net/mac80211/ieee80211_sta.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 /* TODO:
  15  * order BSS list by RSSI(?) ("quality of AP")
  16  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  17  *    SSID)
  18  */
  19 #include <linux/delay.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/if_arp.h>
  24 #include <linux/wireless.h>
  25 #include <linux/random.h>
  26 #include <linux/etherdevice.h>
  27 #include <net/iw_handler.h>
  28 #include <asm/types.h>
  29
  30 #include <net/mac80211.h>
  31 #include "ieee80211_i.h"
  32 #include "ieee80211_rate.h"
  33 #include "ieee80211_led.h"
  34
  35 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  36 #define IEEE80211_AUTH_MAX_TRIES 3
  37 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  38 #define IEEE80211_ASSOC_MAX_TRIES 3
  39 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  40 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  41 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  42 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  43 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  44 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
  45
  46 #define IEEE80211_PROBE_DELAY (HZ / 33)
  47 #define IEEE80211_CHANNEL_TIME (HZ / 33)
  48 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
  49 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
  50 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  51 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  52
  53 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  54
  55
  56 #define IEEE80211_FC(type, stype) cpu_to_le16(type | stype)
  57
  58 #define ERP_INFO_USE_PROTECTION BIT(1)
  59
  60 /* mgmt header + 1 byte action code */
  61 #define IEEE80211_MIN_ACTION_SIZE (24 + 1)
  62
  63 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
  64 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
  65 #define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
  66 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
  67 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
  68
  69 /* next values represent the buffer size for A-MPDU frame.
  70  * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) */
  71 #define IEEE80211_MIN_AMPDU_BUF 0x8
  72 #define IEEE80211_MAX_AMPDU_BUF 0x40
  73
  74 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
  75                                      u8 *ssid, size_t ssid_len);
  76 static struct ieee80211_sta_bss *
  77 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
  78                      u8 *ssid, u8 ssid_len);
  79 static void ieee80211_rx_bss_put(struct net_device *dev,
  80                                  struct ieee80211_sta_bss *bss);
  81 static int ieee80211_sta_find_ibss(struct net_device *dev,
  82                                    struct ieee80211_if_sta *ifsta);
  83 static int ieee80211_sta_wep_configured(struct net_device *dev);
  84 static int ieee80211_sta_start_scan(struct net_device *dev,
  85                                     u8 *ssid, size_t ssid_len);
  86 static int ieee80211_sta_config_auth(struct net_device *dev,
  87                                      struct ieee80211_if_sta *ifsta);
  88
  89
  90 /* Parsed Information Elements */
  91 struct ieee802_11_elems {
  92         /* pointers to IEs */
  93         u8 *ssid;
  94         u8 *supp_rates;
  95         u8 *fh_params;
  96         u8 *ds_params;
  97         u8 *cf_params;
  98         u8 *tim;
  99         u8 *ibss_params;
 100         u8 *challenge;
 101         u8 *wpa;
 102         u8 *rsn;
 103         u8 *erp_info;
 104         u8 *ext_supp_rates;
 105         u8 *wmm_info;
 106         u8 *wmm_param;
 107         u8 *ht_cap_elem;
 108         u8 *ht_info_elem;
 109         /* length of them, respectively */
 110         u8 ssid_len;
 111         u8 supp_rates_len;
 112         u8 fh_params_len;
 113         u8 ds_params_len;
 114         u8 cf_params_len;
 115         u8 tim_len;
 116         u8 ibss_params_len;
 117         u8 challenge_len;
 118         u8 wpa_len;
 119         u8 rsn_len;
 120         u8 erp_info_len;
 121         u8 ext_supp_rates_len;
 122         u8 wmm_info_len;
 123         u8 wmm_param_len;
 124         u8 ht_cap_elem_len;
 125         u8 ht_info_elem_len;
 126 };
 127
 128 static void ieee802_11_parse_elems(u8 *start, size_t len,
 129                                    struct ieee802_11_elems *elems)
 130 {
 131         size_t left = len;
 132         u8 *pos = start;
 133
 134         memset(elems, 0, sizeof(*elems));
 135
 136         while (left >= 2) {
 137                 u8 id, elen;
 138
 139                 id = *pos++;
 140                 elen = *pos++;
 141                 left -= 2;
 142
 143                 if (elen > left)
 144                         return;
 145
 146                 switch (id) {
 147                 case WLAN_EID_SSID:
 148                         elems->ssid = pos;
 149                         elems->ssid_len = elen;
 150                         break;
 151                 case WLAN_EID_SUPP_RATES:
 152                         elems->supp_rates = pos;
 153                         elems->supp_rates_len = elen;
 154                         break;
 155                 case WLAN_EID_FH_PARAMS:
 156                         elems->fh_params = pos;
 157                         elems->fh_params_len = elen;
 158                         break;
 159                 case WLAN_EID_DS_PARAMS:
 160                         elems->ds_params = pos;
 161                         elems->ds_params_len = elen;
 162                         break;
 163                 case WLAN_EID_CF_PARAMS:
 164                         elems->cf_params = pos;
 165                         elems->cf_params_len = elen;
 166                         break;
 167                 case WLAN_EID_TIM:
 168                         elems->tim = pos;
 169                         elems->tim_len = elen;
 170                         break;
 171                 case WLAN_EID_IBSS_PARAMS:
 172                         elems->ibss_params = pos;
 173                         elems->ibss_params_len = elen;
 174                         break;
 175                 case WLAN_EID_CHALLENGE:
 176                         elems->challenge = pos;
 177                         elems->challenge_len = elen;
 178                         break;
 179                 case WLAN_EID_WPA:
 180                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 181                             pos[2] == 0xf2) {
 182                                 /* Microsoft OUI (00:50:F2) */
 183                                 if (pos[3] == 1) {
 184                                         /* OUI Type 1 - WPA IE */
 185                                         elems->wpa = pos;
 186                                         elems->wpa_len = elen;
 187                                 } else if (elen >= 5 && pos[3] == 2) {
 188                                         if (pos[4] == 0) {
 189                                                 elems->wmm_info = pos;
 190                                                 elems->wmm_info_len = elen;
 191                                         } else if (pos[4] == 1) {
 192                                                 elems->wmm_param = pos;
 193                                                 elems->wmm_param_len = elen;
 194                                         }
 195                                 }
 196                         }
 197                         break;
 198                 case WLAN_EID_RSN:
 199                         elems->rsn = pos;
 200                         elems->rsn_len = elen;
 201                         break;
 202                 case WLAN_EID_ERP_INFO:
 203                         elems->erp_info = pos;
 204                         elems->erp_info_len = elen;
 205                         break;
 206                 case WLAN_EID_EXT_SUPP_RATES:
 207                         elems->ext_supp_rates = pos;
 208                         elems->ext_supp_rates_len = elen;
 209                         break;
 210                 case WLAN_EID_HT_CAPABILITY:
 211                         elems->ht_cap_elem = pos;
 212                         elems->ht_cap_elem_len = elen;
 213                         break;
 214                 case WLAN_EID_HT_EXTRA_INFO:
 215                         elems->ht_info_elem = pos;
 216                         elems->ht_info_elem_len = elen;
 217                         break;
 218                 default:
 219                         break;
 220                 }
 221
 222                 left -= elen;
 223                 pos += elen;
 224         }
 225 }
 226
 227
 228 static int ecw2cw(int ecw)
 229 {
 230         int cw = 1;
 231         while (ecw > 0) {
 232                 cw <<= 1;
 233                 ecw--;
 234         }
 235         return cw - 1;
 236 }
 237
 238 static void ieee80211_sta_wmm_params(struct net_device *dev,
 239                                      struct ieee80211_if_sta *ifsta,
 240                                      u8 *wmm_param, size_t wmm_param_len)
 241 {
 242         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 243         struct ieee80211_tx_queue_params params;
 244         size_t left;
 245         int count;
 246         u8 *pos;
 247
 248         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 249                 return;
 250         count = wmm_param[6] & 0x0f;
 251         if (count == ifsta->wmm_last_param_set)
 252                 return;
 253         ifsta->wmm_last_param_set = count;
 254
 255         pos = wmm_param + 8;
 256         left = wmm_param_len - 8;
 257
 258         memset(&params, 0, sizeof(params));
 259
 260         if (!local->ops->conf_tx)
 261                 return;
 262
 263         local->wmm_acm = 0;
 264         for (; left >= 4; left -= 4, pos += 4) {
 265                 int aci = (pos[0] >> 5) & 0x03;
 266                 int acm = (pos[0] >> 4) & 0x01;
 267                 int queue;
 268
 269                 switch (aci) {
 270                 case 1:
 271                         queue = IEEE80211_TX_QUEUE_DATA3;
 272                         if (acm) {
 273                                 local->wmm_acm |= BIT(0) | BIT(3);
 274                         }
 275                         break;
 276                 case 2:
 277                         queue = IEEE80211_TX_QUEUE_DATA1;
 278                         if (acm) {
 279                                 local->wmm_acm |= BIT(4) | BIT(5);
 280                         }
 281                         break;
 282                 case 3:
 283                         queue = IEEE80211_TX_QUEUE_DATA0;
 284                         if (acm) {
 285                                 local->wmm_acm |= BIT(6) | BIT(7);
 286                         }
 287                         break;
 288                 case 0:
 289                 default:
 290                         queue = IEEE80211_TX_QUEUE_DATA2;
 291                         if (acm) {
 292                                 local->wmm_acm |= BIT(1) | BIT(2);
 293                         }
 294                         break;
 295                 }
 296
 297                 params.aifs = pos[0] & 0x0f;
 298                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 299                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 300                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 301                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 302                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 303                        "cWmin=%d cWmax=%d burst=%d\n",
 304                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
 305                        params.cw_max, params.burst_time);
 306                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 307                  * AC for now) */
 308                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 309                         printk(KERN_DEBUG "%s: failed to set TX queue "
 310                                "parameters for queue %d\n", dev->name, queue);
 311                 }
 312         }
 313 }
 314
 315 static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
 316                                            bool use_protection,
 317                                            bool use_short_preamble)
 318 {
 319         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
 320         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 321         DECLARE_MAC_BUF(mac);
 322         u32 changed = 0;
 323
 324         if (use_protection != bss_conf->use_cts_prot) {
 325                 if (net_ratelimit()) {
 326                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 327                                "%s)\n",
 328                                sdata->dev->name,
 329                                use_protection ? "enabled" : "disabled",
 330                                print_mac(mac, ifsta->bssid));
 331                 }
 332                 bss_conf->use_cts_prot = use_protection;
 333                 changed |= BSS_CHANGED_ERP_CTS_PROT;
 334         }
 335
 336         if (use_short_preamble != bss_conf->use_short_preamble) {
 337                 if (net_ratelimit()) {
 338                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 339                                " (BSSID=%s)\n",
 340                                sdata->dev->name,
 341                                use_short_preamble ? "short" : "long",
 342                                print_mac(mac, ifsta->bssid));
 343                 }
 344                 bss_conf->use_short_preamble = use_short_preamble;
 345                 changed |= BSS_CHANGED_ERP_PREAMBLE;
 346         }
 347
 348         return changed;
 349 }
 350
 351 static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
 352                                    u8 erp_value)
 353 {
 354         bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 355         bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
 356
 357         return ieee80211_handle_protect_preamb(sdata,
 358                         use_protection, use_short_preamble);
 359 }
 360
 361 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 362                                            struct ieee80211_sta_bss *bss)
 363 {
 364         u32 changed = 0;
 365
 366         if (bss->has_erp_value)
 367                 changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
 368         else {
 369                 u16 capab = bss->capability;
 370                 changed |= ieee80211_handle_protect_preamb(sdata, false,
 371                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
 372         }
 373
 374         return changed;
 375 }
 376
 377 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
 378                                    struct ieee80211_ht_info *ht_info)
 379 {
 380
 381         if (ht_info == NULL)
 382                 return -EINVAL;
 383
 384         memset(ht_info, 0, sizeof(*ht_info));
 385
 386         if (ht_cap_ie) {
 387                 u8 ampdu_info = ht_cap_ie->ampdu_params_info;
 388
 389                 ht_info->ht_supported = 1;
 390                 ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
 391                 ht_info->ampdu_factor =
 392                         ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
 393                 ht_info->ampdu_density =
 394                         (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
 395                 memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
 396         } else
 397                 ht_info->ht_supported = 0;
 398
 399         return 0;
 400 }
 401
 402 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
 403                         struct ieee80211_ht_addt_info *ht_add_info_ie,
 404                         struct ieee80211_ht_bss_info *bss_info)
 405 {
 406         if (bss_info == NULL)
 407                 return -EINVAL;
 408
 409         memset(bss_info, 0, sizeof(*bss_info));
 410
 411         if (ht_add_info_ie) {
 412                 u16 op_mode;
 413                 op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
 414
 415                 bss_info->primary_channel = ht_add_info_ie->control_chan;
 416                 bss_info->bss_cap = ht_add_info_ie->ht_param;
 417                 bss_info->bss_op_mode = (u8)(op_mode & 0xff);
 418         }
 419
 420         return 0;
 421 }
 422
 423 static void ieee80211_sta_send_associnfo(struct net_device *dev,
 424                                          struct ieee80211_if_sta *ifsta)
 425 {
 426         char *buf;
 427         size_t len;
 428         int i;
 429         union iwreq_data wrqu;
 430
 431         if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
 432                 return;
 433
 434         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
 435                                 ifsta->assocresp_ies_len), GFP_KERNEL);
 436         if (!buf)
 437                 return;
 438
 439         len = sprintf(buf, "ASSOCINFO(");
 440         if (ifsta->assocreq_ies) {
 441                 len += sprintf(buf + len, "ReqIEs=");
 442                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
 443                         len += sprintf(buf + len, "%02x",
 444                                        ifsta->assocreq_ies[i]);
 445                 }
 446         }
 447         if (ifsta->assocresp_ies) {
 448                 if (ifsta->assocreq_ies)
 449                         len += sprintf(buf + len, " ");
 450                 len += sprintf(buf + len, "RespIEs=");
 451                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 452                         len += sprintf(buf + len, "%02x",
 453                                        ifsta->assocresp_ies[i]);
 454                 }
 455         }
 456         len += sprintf(buf + len, ")");
 457
 458         if (len > IW_CUSTOM_MAX) {
 459                 len = sprintf(buf, "ASSOCRESPIE=");
 460                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 461                         len += sprintf(buf + len, "%02x",
 462                                        ifsta->assocresp_ies[i]);
 463                 }
 464         }
 465
 466         memset(&wrqu, 0, sizeof(wrqu));
 467         wrqu.data.length = len;
 468         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 469
 470         kfree(buf);
 471 }
 472
 473
 474 static void ieee80211_set_associated(struct net_device *dev,
 475                                      struct ieee80211_if_sta *ifsta,
 476                                      bool assoc)
 477 {
 478         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 479         struct ieee80211_local *local = sdata->local;
 480         union iwreq_data wrqu;
 481         u32 changed = BSS_CHANGED_ASSOC;
 482
 483         if (assoc) {
 484                 struct ieee80211_sta_bss *bss;
 485
 486                 ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 487
 488                 if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
 489                         return;
 490
 491                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
 492                                            local->hw.conf.channel,
 493                                            ifsta->ssid, ifsta->ssid_len);
 494                 if (bss) {
 495                         changed |= ieee80211_handle_bss_capability(sdata, bss);
 496                         ieee80211_rx_bss_put(dev, bss);
 497                 }
 498
 499                 netif_carrier_on(dev);
 500                 ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 501                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 502                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 503                 ieee80211_sta_send_associnfo(dev, ifsta);
 504         } else {
 505                 ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
 506
 507                 netif_carrier_off(dev);
 508                 ieee80211_reset_erp_info(dev);
 509                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 510         }
 511         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 512         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 513         ifsta->last_probe = jiffies;
 514         ieee80211_led_assoc(local, assoc);
 515
 516         ieee80211_bss_info_change_notify(sdata, changed);
 517 }
 518
 519 static void ieee80211_set_disassoc(struct net_device *dev,
 520                                    struct ieee80211_if_sta *ifsta, int deauth)
 521 {
 522         if (deauth)
 523                 ifsta->auth_tries = 0;
 524         ifsta->assoc_tries = 0;
 525         ieee80211_set_associated(dev, ifsta, 0);
 526 }
 527
 528 static void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
 529                              int encrypt)
 530 {
 531         struct ieee80211_sub_if_data *sdata;
 532         struct ieee80211_tx_packet_data *pkt_data;
 533
 534         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 535         skb->dev = sdata->local->mdev;
 536         skb_set_mac_header(skb, 0);
 537         skb_set_network_header(skb, 0);
 538         skb_set_transport_header(skb, 0);
 539
 540         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
 541         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
 542         pkt_data->ifindex = sdata->dev->ifindex;
 543         if (!encrypt)
 544                 pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
 545
 546         dev_queue_xmit(skb);
 547 }
 548
 549
 550 static void ieee80211_send_auth(struct net_device *dev,
 551                                 struct ieee80211_if_sta *ifsta,
 552                                 int transaction, u8 *extra, size_t extra_len,
 553                                 int encrypt)
 554 {
 555         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 556         struct sk_buff *skb;
 557         struct ieee80211_mgmt *mgmt;
 558
 559         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 560                             sizeof(*mgmt) + 6 + extra_len);
 561         if (!skb) {
 562                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 563                        "frame\n", dev->name);
 564                 return;
 565         }
 566         skb_reserve(skb, local->hw.extra_tx_headroom);
 567
 568         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 569         memset(mgmt, 0, 24 + 6);
 570         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 571                                            IEEE80211_STYPE_AUTH);
 572         if (encrypt)
 573                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 574         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 575         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 576         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 577         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 578         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 579         ifsta->auth_transaction = transaction + 1;
 580         mgmt->u.auth.status_code = cpu_to_le16(0);
 581         if (extra)
 582                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 583
 584         ieee80211_sta_tx(dev, skb, encrypt);
 585 }
 586
 587
 588 static void ieee80211_authenticate(struct net_device *dev,
 589                                    struct ieee80211_if_sta *ifsta)
 590 {
 591         DECLARE_MAC_BUF(mac);
 592
 593         ifsta->auth_tries++;
 594         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 595                 printk(KERN_DEBUG "%s: authentication with AP %s"
 596                        " timed out\n",
 597                        dev->name, print_mac(mac, ifsta->bssid));
 598                 ifsta->state = IEEE80211_DISABLED;
 599                 return;
 600         }
 601
 602         ifsta->state = IEEE80211_AUTHENTICATE;
 603         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
 604                dev->name, print_mac(mac, ifsta->bssid));
 605
 606         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
 607
 608         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 609 }
 610
 611
 612 static void ieee80211_send_assoc(struct net_device *dev,
 613                                  struct ieee80211_if_sta *ifsta)
 614 {
 615         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 616         struct ieee80211_hw_mode *mode;
 617         struct sk_buff *skb;
 618         struct ieee80211_mgmt *mgmt;
 619         u8 *pos, *ies;
 620         int i, len;
 621         u16 capab;
 622         struct ieee80211_sta_bss *bss;
 623         int wmm = 0;
 624
 625         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 626                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 627                             ifsta->ssid_len);
 628         if (!skb) {
 629                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 630                        "frame\n", dev->name);
 631                 return;
 632         }
 633         skb_reserve(skb, local->hw.extra_tx_headroom);
 634
 635         mode = local->oper_hw_mode;
 636         capab = ifsta->capab;
 637         if (mode->mode == MODE_IEEE80211G) {
 638                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 639                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 640         }
 641         bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
 642                                    ifsta->ssid, ifsta->ssid_len);
 643         if (bss) {
 644                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 645                         capab |= WLAN_CAPABILITY_PRIVACY;
 646                 if (bss->wmm_ie) {
 647                         wmm = 1;
 648                 }
 649                 ieee80211_rx_bss_put(dev, bss);
 650         }
 651
 652         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 653         memset(mgmt, 0, 24);
 654         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 655         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 656         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 657
 658         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 659                 skb_put(skb, 10);
 660                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 661                                                    IEEE80211_STYPE_REASSOC_REQ);
 662                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 663                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
 664                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 665                        ETH_ALEN);
 666         } else {
 667                 skb_put(skb, 4);
 668                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 669                                                    IEEE80211_STYPE_ASSOC_REQ);
 670                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 671                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
 672         }
 673
 674         /* SSID */
 675         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 676         *pos++ = WLAN_EID_SSID;
 677         *pos++ = ifsta->ssid_len;
 678         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 679
 680         len = mode->num_rates;
 681         if (len > 8)
 682                 len = 8;
 683         pos = skb_put(skb, len + 2);
 684         *pos++ = WLAN_EID_SUPP_RATES;
 685         *pos++ = len;
 686         for (i = 0; i < len; i++) {
 687                 int rate = mode->rates[i].rate;
 688                 *pos++ = (u8) (rate / 5);
 689         }
 690
 691         if (mode->num_rates > len) {
 692                 pos = skb_put(skb, mode->num_rates - len + 2);
 693                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 694                 *pos++ = mode->num_rates - len;
 695                 for (i = len; i < mode->num_rates; i++) {
 696                         int rate = mode->rates[i].rate;
 697                         *pos++ = (u8) (rate / 5);
 698                 }
 699         }
 700
 701         if (ifsta->extra_ie) {
 702                 pos = skb_put(skb, ifsta->extra_ie_len);
 703                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 704         }
 705
 706         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 707                 pos = skb_put(skb, 9);
 708                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 709                 *pos++ = 7; /* len */
 710                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 711                 *pos++ = 0x50;
 712                 *pos++ = 0xf2;
 713                 *pos++ = 2; /* WME */
 714                 *pos++ = 0; /* WME info */
 715                 *pos++ = 1; /* WME ver */
 716                 *pos++ = 0;
 717         }
 718         /* wmm support is a must to HT */
 719         if (wmm && mode->ht_info.ht_supported) {
 720                 __le16 tmp = cpu_to_le16(mode->ht_info.cap);
 721                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
 722                 *pos++ = WLAN_EID_HT_CAPABILITY;
 723                 *pos++ = sizeof(struct ieee80211_ht_cap);
 724                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
 725                 memcpy(pos, &tmp, sizeof(u16));
 726                 pos += sizeof(u16);
 727                 *pos++ = (mode->ht_info.ampdu_factor |
 728                                 (mode->ht_info.ampdu_density << 2));
 729                 memcpy(pos, mode->ht_info.supp_mcs_set, 16);
 730         }
 731
 732         kfree(ifsta->assocreq_ies);
 733         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 734         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 735         if (ifsta->assocreq_ies)
 736                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 737
 738         ieee80211_sta_tx(dev, skb, 0);
 739 }
 740
 741
 742 static void ieee80211_send_deauth(struct net_device *dev,
 743                                   struct ieee80211_if_sta *ifsta, u16 reason)
 744 {
 745         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 746         struct sk_buff *skb;
 747         struct ieee80211_mgmt *mgmt;
 748
 749         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 750         if (!skb) {
 751                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 752                        "frame\n", dev->name);
 753                 return;
 754         }
 755         skb_reserve(skb, local->hw.extra_tx_headroom);
 756
 757         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 758         memset(mgmt, 0, 24);
 759         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 760         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 761         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 762         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 763                                            IEEE80211_STYPE_DEAUTH);
 764         skb_put(skb, 2);
 765         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 766
 767         ieee80211_sta_tx(dev, skb, 0);
 768 }
 769
 770
 771 static void ieee80211_send_disassoc(struct net_device *dev,
 772                                     struct ieee80211_if_sta *ifsta, u16 reason)
 773 {
 774         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 775         struct sk_buff *skb;
 776         struct ieee80211_mgmt *mgmt;
 777
 778         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 779         if (!skb) {
 780                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 781                        "frame\n", dev->name);
 782                 return;
 783         }
 784         skb_reserve(skb, local->hw.extra_tx_headroom);
 785
 786         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 787         memset(mgmt, 0, 24);
 788         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 789         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 790         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 791         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 792                                            IEEE80211_STYPE_DISASSOC);
 793         skb_put(skb, 2);
 794         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 795
 796         ieee80211_sta_tx(dev, skb, 0);
 797 }
 798
 799
 800 static int ieee80211_privacy_mismatch(struct net_device *dev,
 801                                       struct ieee80211_if_sta *ifsta)
 802 {
 803         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 804         struct ieee80211_sta_bss *bss;
 805         int bss_privacy;
 806         int wep_privacy;
 807         int privacy_invoked;
 808
 809         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
 810                 return 0;
 811
 812         bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
 813                                    ifsta->ssid, ifsta->ssid_len);
 814         if (!bss)
 815                 return 0;
 816
 817         bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
 818         wep_privacy = !!ieee80211_sta_wep_configured(dev);
 819         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 820
 821         ieee80211_rx_bss_put(dev, bss);
 822
 823         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
 824                 return 0;
 825
 826         return 1;
 827 }
 828
 829
 830 static void ieee80211_associate(struct net_device *dev,
 831                                 struct ieee80211_if_sta *ifsta)
 832 {
 833         DECLARE_MAC_BUF(mac);
 834
 835         ifsta->assoc_tries++;
 836         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 837                 printk(KERN_DEBUG "%s: association with AP %s"
 838                        " timed out\n",
 839                        dev->name, print_mac(mac, ifsta->bssid));
 840                 ifsta->state = IEEE80211_DISABLED;
 841                 return;
 842         }
 843
 844         ifsta->state = IEEE80211_ASSOCIATE;
 845         printk(KERN_DEBUG "%s: associate with AP %s\n",
 846                dev->name, print_mac(mac, ifsta->bssid));
 847         if (ieee80211_privacy_mismatch(dev, ifsta)) {
 848                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 849                        "mixed-cell disabled - abort association\n", dev->name);
 850                 ifsta->state = IEEE80211_DISABLED;
 851                 return;
 852         }
 853
 854         ieee80211_send_assoc(dev, ifsta);
 855
 856         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 857 }
 858
 859
 860 static void ieee80211_associated(struct net_device *dev,
 861                                  struct ieee80211_if_sta *ifsta)
 862 {
 863         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 864         struct sta_info *sta;
 865         int disassoc;
 866         DECLARE_MAC_BUF(mac);
 867
 868         /* TODO: start monitoring current AP signal quality and number of
 869          * missed beacons. Scan other channels every now and then and search
 870          * for better APs. */
 871         /* TODO: remove expired BSSes */
 872
 873         ifsta->state = IEEE80211_ASSOCIATED;
 874
 875         sta = sta_info_get(local, ifsta->bssid);
 876         if (!sta) {
 877                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
 878                        dev->name, print_mac(mac, ifsta->bssid));
 879                 disassoc = 1;
 880         } else {
 881                 disassoc = 0;
 882                 if (time_after(jiffies,
 883                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 884                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
 885                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 886                                        "current AP %s - assume out of "
 887                                        "range\n",
 888                                        dev->name, print_mac(mac, ifsta->bssid));
 889                                 disassoc = 1;
 890                                 sta_info_free(sta);
 891                         } else
 892                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 893                                                          local->scan_ssid,
 894                                                          local->scan_ssid_len);
 895                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
 896                 } else {
 897                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 898                         if (time_after(jiffies, ifsta->last_probe +
 899                                        IEEE80211_PROBE_INTERVAL)) {
 900                                 ifsta->last_probe = jiffies;
 901                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 902                                                          ifsta->ssid,
 903                                                          ifsta->ssid_len);
 904                         }
 905                 }
 906                 sta_info_put(sta);
 907         }
 908         if (disassoc) {
 909                 ifsta->state = IEEE80211_DISABLED;
 910                 ieee80211_set_associated(dev, ifsta, 0);
 911         } else {
 912                 mod_timer(&ifsta->timer, jiffies +
 913                                       IEEE80211_MONITORING_INTERVAL);
 914         }
 915 }
 916
 917
 918 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 919                                      u8 *ssid, size_t ssid_len)
 920 {
 921         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 922         struct ieee80211_hw_mode *mode;
 923         struct sk_buff *skb;
 924         struct ieee80211_mgmt *mgmt;
 925         u8 *pos, *supp_rates, *esupp_rates = NULL;
 926         int i;
 927
 928         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 929         if (!skb) {
 930                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 931                        "request\n", dev->name);
 932                 return;
 933         }
 934         skb_reserve(skb, local->hw.extra_tx_headroom);
 935
 936         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 937         memset(mgmt, 0, 24);
 938         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 939                                            IEEE80211_STYPE_PROBE_REQ);
 940         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 941         if (dst) {
 942                 memcpy(mgmt->da, dst, ETH_ALEN);
 943                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 944         } else {
 945                 memset(mgmt->da, 0xff, ETH_ALEN);
 946                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 947         }
 948         pos = skb_put(skb, 2 + ssid_len);
 949         *pos++ = WLAN_EID_SSID;
 950         *pos++ = ssid_len;
 951         memcpy(pos, ssid, ssid_len);
 952
 953         supp_rates = skb_put(skb, 2);
 954         supp_rates[0] = WLAN_EID_SUPP_RATES;
 955         supp_rates[1] = 0;
 956         mode = local->oper_hw_mode;
 957         for (i = 0; i < mode->num_rates; i++) {
 958                 struct ieee80211_rate *rate = &mode->rates[i];
 959                 if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
 960                         continue;
 961                 if (esupp_rates) {
 962                         pos = skb_put(skb, 1);
 963                         esupp_rates[1]++;
 964                 } else if (supp_rates[1] == 8) {
 965                         esupp_rates = skb_put(skb, 3);
 966                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 967                         esupp_rates[1] = 1;
 968                         pos = &esupp_rates[2];
 969                 } else {
 970                         pos = skb_put(skb, 1);
 971                         supp_rates[1]++;
 972                 }
 973                 *pos = rate->rate / 5;
 974         }
 975
 976         ieee80211_sta_tx(dev, skb, 0);
 977 }
 978
 979
 980 static int ieee80211_sta_wep_configured(struct net_device *dev)
 981 {
 982         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 983         if (!sdata || !sdata->default_key ||
 984             sdata->default_key->conf.alg != ALG_WEP)
 985                 return 0;
 986         return 1;
 987 }
 988
 989
 990 static void ieee80211_auth_completed(struct net_device *dev,
 991                                      struct ieee80211_if_sta *ifsta)
 992 {
 993         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
 994         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
 995         ieee80211_associate(dev, ifsta);
 996 }
 997
 998
 999 static void ieee80211_auth_challenge(struct net_device *dev,
1000                                      struct ieee80211_if_sta *ifsta,
1001                                      struct ieee80211_mgmt *mgmt,
1002                                      size_t len)
1003 {
1004         u8 *pos;
1005         struct ieee802_11_elems elems;
1006
1007         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
1008         pos = mgmt->u.auth.variable;
1009         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1010         if (!elems.challenge) {
1011                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
1012                        "frame\n", dev->name);
1013                 return;
1014         }
1015         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
1016                             elems.challenge_len + 2, 1);
1017 }
1018
1019 static void ieee80211_send_addba_resp(struct net_device *dev, u8 *da, u16 tid,
1020                                         u8 dialog_token, u16 status, u16 policy,
1021                                         u16 buf_size, u16 timeout)
1022 {
1023         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1024         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1025         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1026         struct sk_buff *skb;
1027         struct ieee80211_mgmt *mgmt;
1028         u16 capab;
1029
1030         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
1031                                         sizeof(mgmt->u.action.u.addba_resp));
1032         if (!skb) {
1033                 printk(KERN_DEBUG "%s: failed to allocate buffer "
1034                        "for addba resp frame\n", dev->name);
1035                 return;
1036         }
1037
1038         skb_reserve(skb, local->hw.extra_tx_headroom);
1039         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1040         memset(mgmt, 0, 24);
1041         memcpy(mgmt->da, da, ETH_ALEN);
1042         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1043         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1044                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1045         else
1046                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1047         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1048                                            IEEE80211_STYPE_ACTION);
1049
1050         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
1051         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1052         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
1053         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
1054
1055         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
1056         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1057         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
1058
1059         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
1060         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
1061         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
1062
1063         ieee80211_sta_tx(dev, skb, 0);
1064
1065         return;
1066 }
1067
1068 static void ieee80211_sta_process_addba_request(struct net_device *dev,
1069                                                 struct ieee80211_mgmt *mgmt,
1070                                                 size_t len)
1071 {
1072         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1073         struct ieee80211_hw *hw = &local->hw;
1074         struct ieee80211_conf *conf = &hw->conf;
1075         struct sta_info *sta;
1076         struct tid_ampdu_rx *tid_agg_rx;
1077         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
1078         u8 dialog_token;
1079         int ret = -EOPNOTSUPP;
1080         DECLARE_MAC_BUF(mac);
1081
1082         sta = sta_info_get(local, mgmt->sa);
1083         if (!sta)
1084                 return;
1085
1086         /* extract session parameters from addba request frame */
1087         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
1088         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
1089         start_seq_num =
1090                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
1091
1092         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1093         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
1094         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1095         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
1096
1097         status = WLAN_STATUS_REQUEST_DECLINED;
1098
1099         /* sanity check for incoming parameters:
1100          * check if configuration can support the BA policy
1101          * and if buffer size does not exceeds max value */
1102         if (((ba_policy != 1)
1103                 && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
1104                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
1105                 status = WLAN_STATUS_INVALID_QOS_PARAM;
1106 #ifdef CONFIG_MAC80211_HT_DEBUG
1107                 if (net_ratelimit())
1108                         printk(KERN_DEBUG "Block Ack Req with bad params from "
1109                                 "%s on tid %u. policy %d, buffer size %d\n",
1110                                 print_mac(mac, mgmt->sa), tid, ba_policy,
1111                                 buf_size);
1112 #endif /* CONFIG_MAC80211_HT_DEBUG */
1113                 goto end_no_lock;
1114         }
1115         /* determine default buffer size */
1116         if (buf_size == 0) {
1117                 struct ieee80211_hw_mode *mode = conf->mode;
1118                 buf_size = IEEE80211_MIN_AMPDU_BUF;
1119                 buf_size = buf_size << mode->ht_info.ampdu_factor;
1120         }
1121
1122         tid_agg_rx = &sta->ampdu_mlme.tid_rx[tid];
1123
1124         /* examine state machine */
1125         spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
1126
1127         if (tid_agg_rx->state != HT_AGG_STATE_IDLE) {
1128 #ifdef CONFIG_MAC80211_HT_DEBUG
1129                 if (net_ratelimit())
1130                         printk(KERN_DEBUG "unexpected Block Ack Req from "
1131                                 "%s on tid %u\n",
1132                                 print_mac(mac, mgmt->sa), tid);
1133 #endif /* CONFIG_MAC80211_HT_DEBUG */
1134                 goto end;
1135         }
1136
1137         /* prepare reordering buffer */
1138         tid_agg_rx->reorder_buf =
1139                 kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
1140         if (!tid_agg_rx->reorder_buf) {
1141                 if (net_ratelimit())
1142                         printk(KERN_ERR "can not allocate reordering buffer "
1143                                "to tid %d\n", tid);
1144                 goto end;
1145         }
1146         memset(tid_agg_rx->reorder_buf, 0,
1147                 buf_size * sizeof(struct sk_buf *));
1148
1149         if (local->ops->ampdu_action)
1150                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
1151                                                sta->addr, tid, start_seq_num);
1152 #ifdef CONFIG_MAC80211_HT_DEBUG
1153         printk(KERN_DEBUG "Rx A-MPDU on tid %d result %d", tid, ret);
1154 #endif /* CONFIG_MAC80211_HT_DEBUG */
1155
1156         if (ret) {
1157                 kfree(tid_agg_rx->reorder_buf);
1158                 goto end;
1159         }
1160
1161         /* change state and send addba resp */
1162         tid_agg_rx->state = HT_AGG_STATE_OPERATIONAL;
1163         tid_agg_rx->dialog_token = dialog_token;
1164         tid_agg_rx->ssn = start_seq_num;
1165         tid_agg_rx->head_seq_num = start_seq_num;
1166         tid_agg_rx->buf_size = buf_size;
1167         tid_agg_rx->timeout = timeout;
1168         tid_agg_rx->stored_mpdu_num = 0;
1169         status = WLAN_STATUS_SUCCESS;
1170 end:
1171         spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1172
1173 end_no_lock:
1174         ieee80211_send_addba_resp(sta->dev, sta->addr, tid, dialog_token,
1175                                 status, 1, buf_size, timeout);
1176         sta_info_put(sta);
1177 }
1178
1179 static void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
1180                                  u16 initiator, u16 reason_code)
1181 {
1182         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1183         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1184         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1185         struct sk_buff *skb;
1186         struct ieee80211_mgmt *mgmt;
1187         u16 params;
1188
1189         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
1190                                         sizeof(mgmt->u.action.u.delba));
1191
1192         if (!skb) {
1193                 printk(KERN_ERR "%s: failed to allocate buffer "
1194                                         "for delba frame\n", dev->name);
1195                 return;
1196         }
1197
1198         skb_reserve(skb, local->hw.extra_tx_headroom);
1199         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1200         memset(mgmt, 0, 24);
1201         memcpy(mgmt->da, da, ETH_ALEN);
1202         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1203         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1204                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1205         else
1206                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1207         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1208                                         IEEE80211_STYPE_ACTION);
1209
1210         skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
1211
1212         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1213         mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
1214         params = (u16)(initiator << 11);        /* bit 11 initiator */
1215         params |= (u16)(tid << 12);             /* bit 15:12 TID number */
1216
1217         mgmt->u.action.u.delba.params = cpu_to_le16(params);
1218         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
1219
1220         ieee80211_sta_tx(dev, skb, 0);
1221 }
1222
1223 void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
1224                                         u16 initiator, u16 reason)
1225 {
1226         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1227         struct ieee80211_hw *hw = &local->hw;
1228         struct sta_info *sta;
1229         int ret, i;
1230
1231         sta = sta_info_get(local, ra);
1232         if (!sta)
1233                 return;
1234
1235         /* check if TID is in operational state */
1236         spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
1237         if (sta->ampdu_mlme.tid_rx[tid].state
1238                                 != HT_AGG_STATE_OPERATIONAL) {
1239                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1240                 sta_info_put(sta);
1241                 return;
1242         }
1243         sta->ampdu_mlme.tid_rx[tid].state =
1244                 HT_AGG_STATE_REQ_STOP_BA_MSK |
1245                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
1246                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1247
1248         /* stop HW Rx aggregation. ampdu_action existence
1249          * already verified in session init so we add the BUG_ON */
1250         BUG_ON(!local->ops->ampdu_action);
1251
1252         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
1253                                         ra, tid, EINVAL);
1254         if (ret)
1255                 printk(KERN_DEBUG "HW problem - can not stop rx "
1256                                 "aggergation for tid %d\n", tid);
1257
1258         /* shutdown timer has not expired */
1259         if (initiator != WLAN_BACK_TIMER)
1260                 del_timer_sync(&sta->ampdu_mlme.tid_rx[tid].
1261                                         session_timer);
1262
1263         /* check if this is a self generated aggregation halt */
1264         if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
1265                 ieee80211_send_delba(dev, ra, tid, 0, reason);
1266
1267         /* free the reordering buffer */
1268         for (i = 0; i < sta->ampdu_mlme.tid_rx[tid].buf_size; i++) {
1269                 if (sta->ampdu_mlme.tid_rx[tid].reorder_buf[i]) {
1270                         /* release the reordered frames */
1271                         dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid].reorder_buf[i]);
1272                         sta->ampdu_mlme.tid_rx[tid].stored_mpdu_num--;
1273                         sta->ampdu_mlme.tid_rx[tid].reorder_buf[i] = NULL;
1274                 }
1275         }
1276         kfree(sta->ampdu_mlme.tid_rx[tid].reorder_buf);
1277
1278         sta->ampdu_mlme.tid_rx[tid].state = HT_AGG_STATE_IDLE;
1279         sta_info_put(sta);
1280 }
1281
1282 static void ieee80211_sta_process_delba(struct net_device *dev,
1283                         struct ieee80211_mgmt *mgmt, size_t len)
1284 {
1285         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1286         struct sta_info *sta;
1287         u16 tid, params;
1288         u16 initiator;
1289         DECLARE_MAC_BUF(mac);
1290
1291         sta = sta_info_get(local, mgmt->sa);
1292         if (!sta)
1293                 return;
1294
1295         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1296         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1297         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1298
1299 #ifdef CONFIG_MAC80211_HT_DEBUG
1300         if (net_ratelimit())
1301                 printk(KERN_DEBUG "delba from %s on tid %d reason code %d\n",
1302                         print_mac(mac, mgmt->sa), tid,
1303                         mgmt->u.action.u.delba.reason_code);
1304 #endif /* CONFIG_MAC80211_HT_DEBUG */
1305
1306         if (initiator == WLAN_BACK_INITIATOR)
1307                 ieee80211_sta_stop_rx_ba_session(dev, sta->addr, tid,
1308                                                  WLAN_BACK_INITIATOR, 0);
1309         sta_info_put(sta);
1310 }
1311
1312 /*
1313  * After receiving Block Ack Request (BAR) we activated a
1314  * timer after each frame arrives from the originator.
1315  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
1316  */
1317 void sta_rx_agg_session_timer_expired(unsigned long data)
1318 {
1319         /* not an elegant detour, but there is no choice as the timer passes
1320          * only one argument, and verious sta_info are needed here, so init
1321          * flow in sta_info_add gives the TID as data, while the timer_to_id
1322          * array gives the sta through container_of */
1323         u8 *ptid = (u8 *)data;
1324         u8 *timer_to_id = ptid - *ptid;
1325         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
1326                                          timer_to_tid[0]);
1327
1328         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
1329         ieee80211_sta_stop_rx_ba_session(sta->dev, sta->addr, (u16)*ptid,
1330                                          WLAN_BACK_TIMER,
1331                                          WLAN_REASON_QSTA_TIMEOUT);
1332 }
1333
1334
1335 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
1336                                    struct ieee80211_if_sta *ifsta,
1337                                    struct ieee80211_mgmt *mgmt,
1338                                    size_t len)
1339 {
1340         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1341         u16 auth_alg, auth_transaction, status_code;
1342         DECLARE_MAC_BUF(mac);
1343
1344         if (ifsta->state != IEEE80211_AUTHENTICATE &&
1345             sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
1346                 printk(KERN_DEBUG "%s: authentication frame received from "
1347                        "%s, but not in authenticate state - ignored\n",
1348                        dev->name, print_mac(mac, mgmt->sa));
1349                 return;
1350         }
1351
1352         if (len < 24 + 6) {
1353                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
1354                        "received from %s - ignored\n",
1355                        dev->name, len, print_mac(mac, mgmt->sa));
1356                 return;
1357         }
1358
1359         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1360             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1361                 printk(KERN_DEBUG "%s: authentication frame received from "
1362                        "unknown AP (SA=%s BSSID=%s) - "
1363                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1364                        print_mac(mac, mgmt->bssid));
1365                 return;
1366         }
1367
1368         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1369             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
1370                 printk(KERN_DEBUG "%s: authentication frame received from "
1371                        "unknown BSSID (SA=%s BSSID=%s) - "
1372                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1373                        print_mac(mac, mgmt->bssid));
1374                 return;
1375         }
1376
1377         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1378         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1379         status_code = le16_to_cpu(mgmt->u.auth.status_code);
1380
1381         printk(KERN_DEBUG "%s: RX authentication from %s (alg=%d "
1382                "transaction=%d status=%d)\n",
1383                dev->name, print_mac(mac, mgmt->sa), auth_alg,
1384                auth_transaction, status_code);
1385
1386         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
1387                 /* IEEE 802.11 standard does not require authentication in IBSS
1388                  * networks and most implementations do not seem to use it.
1389                  * However, try to reply to authentication attempts if someone
1390                  * has actually implemented this.
1391                  * TODO: Could implement shared key authentication. */
1392                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
1393                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
1394                                "frame (alg=%d transaction=%d)\n",
1395                                dev->name, auth_alg, auth_transaction);
1396                         return;
1397                 }
1398                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
1399         }
1400
1401         if (auth_alg != ifsta->auth_alg ||
1402             auth_transaction != ifsta->auth_transaction) {
1403                 printk(KERN_DEBUG "%s: unexpected authentication frame "
1404                        "(alg=%d transaction=%d)\n",
1405                        dev->name, auth_alg, auth_transaction);
1406                 return;
1407         }
1408
1409         if (status_code != WLAN_STATUS_SUCCESS) {
1410                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
1411                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
1412                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1413                         u8 algs[3];
1414                         const int num_algs = ARRAY_SIZE(algs);
1415                         int i, pos;
1416                         algs[0] = algs[1] = algs[2] = 0xff;
1417                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1418                                 algs[0] = WLAN_AUTH_OPEN;
1419                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1420                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1421                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1422                                 algs[2] = WLAN_AUTH_LEAP;
1423                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1424                                 pos = 0;
1425                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1426                                 pos = 1;
1427                         else
1428                                 pos = 2;
1429                         for (i = 0; i < num_algs; i++) {
1430                                 pos++;
1431                                 if (pos >= num_algs)
1432                                         pos = 0;
1433                                 if (algs[pos] == ifsta->auth_alg ||
1434                                     algs[pos] == 0xff)
1435                                         continue;
1436                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1437                                     !ieee80211_sta_wep_configured(dev))
1438                                         continue;
1439                                 ifsta->auth_alg = algs[pos];
1440                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
1441                                        "next try\n",
1442                                        dev->name, ifsta->auth_alg);
1443                                 break;
1444                         }
1445                 }
1446                 return;
1447         }
1448
1449         switch (ifsta->auth_alg) {
1450         case WLAN_AUTH_OPEN:
1451         case WLAN_AUTH_LEAP:
1452                 ieee80211_auth_completed(dev, ifsta);
1453                 break;
1454         case WLAN_AUTH_SHARED_KEY:
1455                 if (ifsta->auth_transaction == 4)
1456                         ieee80211_auth_completed(dev, ifsta);
1457                 else
1458                         ieee80211_auth_challenge(dev, ifsta, mgmt, len);
1459                 break;
1460         }
1461 }
1462
1463
1464 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
1465                                      struct ieee80211_if_sta *ifsta,
1466                                      struct ieee80211_mgmt *mgmt,
1467                                      size_t len)
1468 {
1469         u16 reason_code;
1470         DECLARE_MAC_BUF(mac);
1471
1472         if (len < 24 + 2) {
1473                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
1474                        "received from %s - ignored\n",
1475                        dev->name, len, print_mac(mac, mgmt->sa));
1476                 return;
1477         }
1478
1479         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1480                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1481                        "unknown AP (SA=%s BSSID=%s) - "
1482                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1483                        print_mac(mac, mgmt->bssid));
1484                 return;
1485         }
1486
1487         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1488
1489         printk(KERN_DEBUG "%s: RX deauthentication from %s"
1490                " (reason=%d)\n",
1491                dev->name, print_mac(mac, mgmt->sa), reason_code);
1492
1493         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED) {
1494                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1495         }
1496
1497         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1498             ifsta->state == IEEE80211_ASSOCIATE ||
1499             ifsta->state == IEEE80211_ASSOCIATED) {
1500                 ifsta->state = IEEE80211_AUTHENTICATE;
1501                 mod_timer(&ifsta->timer, jiffies +
1502                                       IEEE80211_RETRY_AUTH_INTERVAL);
1503         }
1504
1505         ieee80211_set_disassoc(dev, ifsta, 1);
1506         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1507 }
1508
1509
1510 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1511                                        struct ieee80211_if_sta *ifsta,
1512                                        struct ieee80211_mgmt *mgmt,
1513                                        size_t len)
1514 {
1515         u16 reason_code;
1516         DECLARE_MAC_BUF(mac);
1517
1518         if (len < 24 + 2) {
1519                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1520                        "received from %s - ignored\n",
1521                        dev->name, len, print_mac(mac, mgmt->sa));
1522                 return;
1523         }
1524
1525         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1526                 printk(KERN_DEBUG "%s: disassociation frame received from "
1527                        "unknown AP (SA=%s BSSID=%s) - "
1528                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1529                        print_mac(mac, mgmt->bssid));
1530                 return;
1531         }
1532
1533         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1534
1535         printk(KERN_DEBUG "%s: RX disassociation from %s"
1536                " (reason=%d)\n",
1537                dev->name, print_mac(mac, mgmt->sa), reason_code);
1538
1539         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1540                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1541
1542         if (ifsta->state == IEEE80211_ASSOCIATED) {
1543                 ifsta->state = IEEE80211_ASSOCIATE;
1544                 mod_timer(&ifsta->timer, jiffies +
1545                                       IEEE80211_RETRY_AUTH_INTERVAL);
1546         }
1547
1548         ieee80211_set_disassoc(dev, ifsta, 0);
1549 }
1550
1551
1552 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
1553                                          struct ieee80211_if_sta *ifsta,
1554                                          struct ieee80211_mgmt *mgmt,
1555                                          size_t len,
1556                                          int reassoc)
1557 {
1558         struct ieee80211_local *local = sdata->local;
1559         struct net_device *dev = sdata->dev;
1560         struct ieee80211_hw_mode *mode;
1561         struct sta_info *sta;
1562         u32 rates;
1563         u16 capab_info, status_code, aid;
1564         struct ieee802_11_elems elems;
1565         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
1566         u8 *pos;
1567         int i, j;
1568         DECLARE_MAC_BUF(mac);
1569
1570         /* AssocResp and ReassocResp have identical structure, so process both
1571          * of them in this function. */
1572
1573         if (ifsta->state != IEEE80211_ASSOCIATE) {
1574                 printk(KERN_DEBUG "%s: association frame received from "
1575                        "%s, but not in associate state - ignored\n",
1576                        dev->name, print_mac(mac, mgmt->sa));
1577                 return;
1578         }
1579
1580         if (len < 24 + 6) {
1581                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1582                        "received from %s - ignored\n",
1583                        dev->name, len, print_mac(mac, mgmt->sa));
1584                 return;
1585         }
1586
1587         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1588                 printk(KERN_DEBUG "%s: association frame received from "
1589                        "unknown AP (SA=%s BSSID=%s) - "
1590                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1591                        print_mac(mac, mgmt->bssid));
1592                 return;
1593         }
1594
1595         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1596         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1597         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1598
1599         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
1600                "status=%d aid=%d)\n",
1601                dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
1602                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
1603
1604         if (status_code != WLAN_STATUS_SUCCESS) {
1605                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1606                        dev->name, status_code);
1607                 /* if this was a reassociation, ensure we try a "full"
1608                  * association next time. This works around some broken APs
1609                  * which do not correctly reject reassociation requests. */
1610                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1611                 return;
1612         }
1613
1614         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1615                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1616                        "set\n", dev->name, aid);
1617         aid &= ~(BIT(15) | BIT(14));
1618
1619         pos = mgmt->u.assoc_resp.variable;
1620         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1621
1622         if (!elems.supp_rates) {
1623                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1624                        dev->name);
1625                 return;
1626         }
1627
1628         printk(KERN_DEBUG "%s: associated\n", dev->name);
1629         ifsta->aid = aid;
1630         ifsta->ap_capab = capab_info;
1631
1632         kfree(ifsta->assocresp_ies);
1633         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1634         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1635         if (ifsta->assocresp_ies)
1636                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1637
1638         /* set AID, ieee80211_set_associated() will tell the driver */
1639         bss_conf->aid = aid;
1640         ieee80211_set_associated(dev, ifsta, 1);
1641
1642         /* Add STA entry for the AP */
1643         sta = sta_info_get(local, ifsta->bssid);
1644         if (!sta) {
1645                 struct ieee80211_sta_bss *bss;
1646                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
1647                 if (!sta) {
1648                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
1649                                " AP\n", dev->name);
1650                         return;
1651                 }
1652                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
1653                                            local->hw.conf.channel,
1654                                            ifsta->ssid, ifsta->ssid_len);
1655                 if (bss) {
1656                         sta->last_rssi = bss->rssi;
1657                         sta->last_signal = bss->signal;
1658                         sta->last_noise = bss->noise;
1659                         ieee80211_rx_bss_put(dev, bss);
1660                 }
1661         }
1662
1663         sta->dev = dev;
1664         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP;
1665
1666         rates = 0;
1667         mode = local->oper_hw_mode;
1668         for (i = 0; i < elems.supp_rates_len; i++) {
1669                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1670                 for (j = 0; j < mode->num_rates; j++)
1671                         if (mode->rates[j].rate == rate)
1672                                 rates |= BIT(j);
1673         }
1674         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1675                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1676                 for (j = 0; j < mode->num_rates; j++)
1677                         if (mode->rates[j].rate == rate)
1678                                 rates |= BIT(j);
1679         }
1680         sta->supp_rates = rates;
1681
1682         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
1683             local->ops->conf_ht) {
1684                 struct ieee80211_ht_bss_info bss_info;
1685
1686                 ieee80211_ht_cap_ie_to_ht_info(
1687                                 (struct ieee80211_ht_cap *)
1688                                 elems.ht_cap_elem, &sta->ht_info);
1689                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
1690                                 (struct ieee80211_ht_addt_info *)
1691                                 elems.ht_info_elem, &bss_info);
1692                 ieee80211_hw_config_ht(local, 1, &sta->ht_info, &bss_info);
1693         }
1694
1695         rate_control_rate_init(sta, local);
1696
1697         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1698                 sta->flags |= WLAN_STA_WME;
1699                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1700                                          elems.wmm_param_len);
1701         }
1702
1703
1704         sta_info_put(sta);
1705
1706         ieee80211_associated(dev, ifsta);
1707 }
1708
1709
1710 /* Caller must hold local->sta_bss_lock */
1711 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
1712                                         struct ieee80211_sta_bss *bss)
1713 {
1714         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1715         bss->hnext = local->sta_bss_hash[STA_HASH(bss->bssid)];
1716         local->sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1717 }
1718
1719
1720 /* Caller must hold local->sta_bss_lock */
1721 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
1722                                         struct ieee80211_sta_bss *bss)
1723 {
1724         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1725         struct ieee80211_sta_bss *b, *prev = NULL;
1726         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
1727         while (b) {
1728                 if (b == bss) {
1729                         if (!prev)
1730                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
1731                                         bss->hnext;
1732                         else
1733                                 prev->hnext = bss->hnext;
1734                         break;
1735                 }
1736                 prev = b;
1737                 b = b->hnext;
1738         }
1739 }
1740
1741
1742 static struct ieee80211_sta_bss *
1743 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
1744                      u8 *ssid, u8 ssid_len)
1745 {
1746         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1747         struct ieee80211_sta_bss *bss;
1748
1749         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
1750         if (!bss)
1751                 return NULL;
1752         atomic_inc(&bss->users);
1753         atomic_inc(&bss->users);
1754         memcpy(bss->bssid, bssid, ETH_ALEN);
1755         bss->channel = channel;
1756         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
1757                 memcpy(bss->ssid, ssid, ssid_len);
1758                 bss->ssid_len = ssid_len;
1759         }
1760
1761         spin_lock_bh(&local->sta_bss_lock);
1762         /* TODO: order by RSSI? */
1763         list_add_tail(&bss->list, &local->sta_bss_list);
1764         __ieee80211_rx_bss_hash_add(dev, bss);
1765         spin_unlock_bh(&local->sta_bss_lock);
1766         return bss;
1767 }
1768
1769
1770 static struct ieee80211_sta_bss *
1771 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
1772                      u8 *ssid, u8 ssid_len)
1773 {
1774         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1775         struct ieee80211_sta_bss *bss;
1776
1777         spin_lock_bh(&local->sta_bss_lock);
1778         bss = local->sta_bss_hash[STA_HASH(bssid)];
1779         while (bss) {
1780                 if (!memcmp(bss->bssid, bssid, ETH_ALEN) &&
1781                     bss->channel == channel &&
1782                     bss->ssid_len == ssid_len &&
1783                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
1784                         atomic_inc(&bss->users);
1785                         break;
1786                 }
1787                 bss = bss->hnext;
1788         }
1789         spin_unlock_bh(&local->sta_bss_lock);
1790         return bss;
1791 }
1792
1793
1794 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
1795 {
1796         kfree(bss->wpa_ie);
1797         kfree(bss->rsn_ie);
1798         kfree(bss->wmm_ie);
1799         kfree(bss->ht_ie);
1800         kfree(bss);
1801 }
1802
1803
1804 static void ieee80211_rx_bss_put(struct net_device *dev,
1805                                  struct ieee80211_sta_bss *bss)
1806 {
1807         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1808         if (!atomic_dec_and_test(&bss->users))
1809                 return;
1810
1811         spin_lock_bh(&local->sta_bss_lock);
1812         __ieee80211_rx_bss_hash_del(dev, bss);
1813         list_del(&bss->list);
1814         spin_unlock_bh(&local->sta_bss_lock);
1815         ieee80211_rx_bss_free(bss);
1816 }
1817
1818
1819 void ieee80211_rx_bss_list_init(struct net_device *dev)
1820 {
1821         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1822         spin_lock_init(&local->sta_bss_lock);
1823         INIT_LIST_HEAD(&local->sta_bss_list);
1824 }
1825
1826
1827 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
1828 {
1829         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1830         struct ieee80211_sta_bss *bss, *tmp;
1831
1832         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
1833                 ieee80211_rx_bss_put(dev, bss);
1834 }
1835
1836
1837 static void ieee80211_rx_bss_info(struct net_device *dev,
1838                                   struct ieee80211_mgmt *mgmt,
1839                                   size_t len,
1840                                   struct ieee80211_rx_status *rx_status,
1841                                   int beacon)
1842 {
1843         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1844         struct ieee802_11_elems elems;
1845         size_t baselen;
1846         int channel, clen;
1847         struct ieee80211_sta_bss *bss;
1848         struct sta_info *sta;
1849         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1850         u64 timestamp;
1851         DECLARE_MAC_BUF(mac);
1852         DECLARE_MAC_BUF(mac2);
1853
1854         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
1855                 return; /* ignore ProbeResp to foreign address */
1856
1857 #if 0
1858         printk(KERN_DEBUG "%s: RX %s from %s to %s\n",
1859                dev->name, beacon ? "Beacon" : "Probe Response",
1860                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da));
1861 #endif
1862
1863         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1864         if (baselen > len)
1865                 return;
1866
1867         timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
1868
1869         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
1870             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
1871 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1872                 static unsigned long last_tsf_debug = 0;
1873                 u64 tsf;
1874                 if (local->ops->get_tsf)
1875                         tsf = local->ops->get_tsf(local_to_hw(local));
1876                 else
1877                         tsf = -1LLU;
1878                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1879                         printk(KERN_DEBUG "RX beacon SA=%s BSSID="
1880                                "%s TSF=0x%llx BCN=0x%llx diff=%lld "
1881                                "@%lu\n",
1882                                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->bssid),
1883                                (unsigned long long)tsf,
1884                                (unsigned long long)timestamp,
1885                                (unsigned long long)(tsf - timestamp),
1886                                jiffies);
1887                         last_tsf_debug = jiffies;
1888                 }
1889 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1890         }
1891
1892         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
1893
1894         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
1895             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
1896             (sta = sta_info_get(local, mgmt->sa))) {
1897                 struct ieee80211_hw_mode *mode;
1898                 struct ieee80211_rate *rates;
1899                 size_t num_rates;
1900                 u32 supp_rates, prev_rates;
1901                 int i, j;
1902
1903                 mode = local->sta_sw_scanning ?
1904                        local->scan_hw_mode : local->oper_hw_mode;
1905
1906                 if (local->sta_hw_scanning) {
1907                         /* search for the correct mode matches the beacon */
1908                         list_for_each_entry(mode, &local->modes_list, list)
1909                                 if (mode->mode == rx_status->phymode)
1910                                         break;
1911
1912                         if (mode == NULL)
1913                                 mode = local->oper_hw_mode;
1914                 }
1915                 rates = mode->rates;
1916                 num_rates = mode->num_rates;
1917
1918                 supp_rates = 0;
1919                 for (i = 0; i < elems.supp_rates_len +
1920                              elems.ext_supp_rates_len; i++) {
1921                         u8 rate = 0;
1922                         int own_rate;
1923                         if (i < elems.supp_rates_len)
1924                                 rate = elems.supp_rates[i];
1925                         else if (elems.ext_supp_rates)
1926                                 rate = elems.ext_supp_rates
1927                                         [i - elems.supp_rates_len];
1928                         own_rate = 5 * (rate & 0x7f);
1929                         for (j = 0; j < num_rates; j++)
1930                                 if (rates[j].rate == own_rate)
1931                                         supp_rates |= BIT(j);
1932                 }
1933
1934                 prev_rates = sta->supp_rates;
1935                 sta->supp_rates &= supp_rates;
1936                 if (sta->supp_rates == 0) {
1937                         /* No matching rates - this should not really happen.
1938                          * Make sure that at least one rate is marked
1939                          * supported to avoid issues with TX rate ctrl. */
1940                         sta->supp_rates = sdata->u.sta.supp_rates_bits;
1941                 }
1942                 if (sta->supp_rates != prev_rates) {
1943                         printk(KERN_DEBUG "%s: updated supp_rates set for "
1944                                "%s based on beacon info (0x%x & 0x%x -> "
1945                                "0x%x)\n",
1946                                dev->name, print_mac(mac, sta->addr), prev_rates,
1947                                supp_rates, sta->supp_rates);
1948                 }
1949                 sta_info_put(sta);
1950         }
1951
1952         if (!elems.ssid)
1953                 return;
1954
1955         if (elems.ds_params && elems.ds_params_len == 1)
1956                 channel = elems.ds_params[0];
1957         else
1958                 channel = rx_status->channel;
1959
1960         bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel,
1961                                    elems.ssid, elems.ssid_len);
1962         if (!bss) {
1963                 bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel,
1964                                            elems.ssid, elems.ssid_len);
1965                 if (!bss)
1966                         return;
1967         } else {
1968 #if 0
1969                 /* TODO: order by RSSI? */
1970                 spin_lock_bh(&local->sta_bss_lock);
1971                 list_move_tail(&bss->list, &local->sta_bss_list);
1972                 spin_unlock_bh(&local->sta_bss_lock);
1973 #endif
1974         }
1975
1976         if (bss->probe_resp && beacon) {
1977                 /* Do not allow beacon to override data from Probe Response. */
1978                 ieee80211_rx_bss_put(dev, bss);
1979                 return;
1980         }
1981
1982         /* save the ERP value so that it is available at association time */
1983         if (elems.erp_info && elems.erp_info_len >= 1) {
1984                 bss->erp_value = elems.erp_info[0];
1985                 bss->has_erp_value = 1;
1986         }
1987
1988         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
1989         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
1990
1991         bss->supp_rates_len = 0;
1992         if (elems.supp_rates) {
1993                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1994                 if (clen > elems.supp_rates_len)
1995                         clen = elems.supp_rates_len;
1996                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
1997                        clen);
1998                 bss->supp_rates_len += clen;
1999         }
2000         if (elems.ext_supp_rates) {
2001                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
2002                 if (clen > elems.ext_supp_rates_len)
2003                         clen = elems.ext_supp_rates_len;
2004                 memcpy(&bss->supp_rates[bss->supp_rates_len],
2005                        elems.ext_supp_rates, clen);
2006                 bss->supp_rates_len += clen;
2007         }
2008
2009         if (elems.wpa &&
2010             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
2011              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
2012                 kfree(bss->wpa_ie);
2013                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
2014                 if (bss->wpa_ie) {
2015                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
2016                         bss->wpa_ie_len = elems.wpa_len + 2;
2017                 } else
2018                         bss->wpa_ie_len = 0;
2019         } else if (!elems.wpa && bss->wpa_ie) {
2020                 kfree(bss->wpa_ie);
2021                 bss->wpa_ie = NULL;
2022                 bss->wpa_ie_len = 0;
2023         }
2024
2025         if (elems.rsn &&
2026             (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
2027              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
2028                 kfree(bss->rsn_ie);
2029                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
2030                 if (bss->rsn_ie) {
2031                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
2032                         bss->rsn_ie_len = elems.rsn_len + 2;
2033                 } else
2034                         bss->rsn_ie_len = 0;
2035         } else if (!elems.rsn && bss->rsn_ie) {
2036                 kfree(bss->rsn_ie);
2037                 bss->rsn_ie = NULL;
2038                 bss->rsn_ie_len = 0;
2039         }
2040
2041         if (elems.wmm_param &&
2042             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
2043              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
2044                 kfree(bss->wmm_ie);
2045                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
2046                 if (bss->wmm_ie) {
2047                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
2048                                elems.wmm_param_len + 2);
2049                         bss->wmm_ie_len = elems.wmm_param_len + 2;
2050                 } else
2051                         bss->wmm_ie_len = 0;
2052         } else if (!elems.wmm_param && bss->wmm_ie) {
2053                 kfree(bss->wmm_ie);
2054                 bss->wmm_ie = NULL;
2055                 bss->wmm_ie_len = 0;
2056         }
2057         if (elems.ht_cap_elem &&
2058             (!bss->ht_ie || bss->ht_ie_len != elems.ht_cap_elem_len ||
2059              memcmp(bss->ht_ie, elems.ht_cap_elem, elems.ht_cap_elem_len))) {
2060                 kfree(bss->ht_ie);
2061                 bss->ht_ie = kmalloc(elems.ht_cap_elem_len + 2, GFP_ATOMIC);
2062                 if (bss->ht_ie) {
2063                         memcpy(bss->ht_ie, elems.ht_cap_elem - 2,
2064                                elems.ht_cap_elem_len + 2);
2065                         bss->ht_ie_len = elems.ht_cap_elem_len + 2;
2066                 } else
2067                         bss->ht_ie_len = 0;
2068         } else if (!elems.ht_cap_elem && bss->ht_ie) {
2069                 kfree(bss->ht_ie);
2070                 bss->ht_ie = NULL;
2071                 bss->ht_ie_len = 0;
2072         }
2073
2074         bss->hw_mode = rx_status->phymode;
2075         bss->freq = rx_status->freq;
2076         if (channel != rx_status->channel &&
2077             (bss->hw_mode == MODE_IEEE80211G ||
2078              bss->hw_mode == MODE_IEEE80211B) &&
2079             channel >= 1 && channel <= 14) {
2080                 static const int freq_list[] = {
2081                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
2082                         2447, 2452, 2457, 2462, 2467, 2472, 2484
2083                 };
2084                 /* IEEE 802.11g/b mode can receive packets from neighboring
2085                  * channels, so map the channel into frequency. */
2086                 bss->freq = freq_list[channel - 1];
2087         }
2088         bss->timestamp = timestamp;
2089         bss->last_update = jiffies;
2090         bss->rssi = rx_status->ssi;
2091         bss->signal = rx_status->signal;
2092         bss->noise = rx_status->noise;
2093         if (!beacon)
2094                 bss->probe_resp++;
2095         ieee80211_rx_bss_put(dev, bss);
2096 }
2097
2098
2099 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
2100                                          struct ieee80211_mgmt *mgmt,
2101                                          size_t len,
2102                                          struct ieee80211_rx_status *rx_status)
2103 {
2104         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
2105 }
2106
2107
2108 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
2109                                      struct ieee80211_mgmt *mgmt,
2110                                      size_t len,
2111                                      struct ieee80211_rx_status *rx_status)
2112 {
2113         struct ieee80211_sub_if_data *sdata;
2114         struct ieee80211_if_sta *ifsta;
2115         size_t baselen;
2116         struct ieee802_11_elems elems;
2117         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2118         struct ieee80211_conf *conf = &local->hw.conf;
2119         u32 changed = 0;
2120
2121         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
2122
2123         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2124         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2125                 return;
2126         ifsta = &sdata->u.sta;
2127
2128         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
2129             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
2130                 return;
2131
2132         /* Process beacon from the current BSS */
2133         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2134         if (baselen > len)
2135                 return;
2136
2137         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2138
2139         if (elems.erp_info && elems.erp_info_len >= 1)
2140                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
2141         else {
2142                 u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
2143                 changed |= ieee80211_handle_protect_preamb(sdata, false,
2144                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
2145         }
2146
2147         if (elems.ht_cap_elem && elems.ht_info_elem &&
2148             elems.wmm_param && local->ops->conf_ht &&
2149             conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
2150                 struct ieee80211_ht_bss_info bss_info;
2151
2152                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2153                                 (struct ieee80211_ht_addt_info *)
2154                                 elems.ht_info_elem, &bss_info);
2155                 /* check if AP changed bss inforamation */
2156                 if ((conf->ht_bss_conf.primary_channel !=
2157                      bss_info.primary_channel) ||
2158                     (conf->ht_bss_conf.bss_cap != bss_info.bss_cap) ||
2159                     (conf->ht_bss_conf.bss_op_mode != bss_info.bss_op_mode))
2160                         ieee80211_hw_config_ht(local, 1, &conf->ht_conf,
2161                                                 &bss_info);
2162         }
2163
2164         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
2165                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
2166                                          elems.wmm_param_len);
2167         }
2168
2169         ieee80211_bss_info_change_notify(sdata, changed);
2170 }
2171
2172
2173 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
2174                                         struct ieee80211_if_sta *ifsta,
2175                                         struct ieee80211_mgmt *mgmt,
2176                                         size_t len,
2177                                         struct ieee80211_rx_status *rx_status)
2178 {
2179         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2180         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2181         int tx_last_beacon;
2182         struct sk_buff *skb;
2183         struct ieee80211_mgmt *resp;
2184         u8 *pos, *end;
2185         DECLARE_MAC_BUF(mac);
2186 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2187         DECLARE_MAC_BUF(mac2);
2188         DECLARE_MAC_BUF(mac3);
2189 #endif
2190
2191         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS ||
2192             ifsta->state != IEEE80211_IBSS_JOINED ||
2193             len < 24 + 2 || !ifsta->probe_resp)
2194                 return;
2195
2196         if (local->ops->tx_last_beacon)
2197                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
2198         else
2199                 tx_last_beacon = 1;
2200
2201 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2202         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
2203                "%s (tx_last_beacon=%d)\n",
2204                dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
2205                print_mac(mac3, mgmt->bssid), tx_last_beacon);
2206 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2207
2208         if (!tx_last_beacon)
2209                 return;
2210
2211         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
2212             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2213                 return;
2214
2215         end = ((u8 *) mgmt) + len;
2216         pos = mgmt->u.probe_req.variable;
2217         if (pos[0] != WLAN_EID_SSID ||
2218             pos + 2 + pos[1] > end) {
2219                 if (net_ratelimit()) {
2220                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
2221                                "from %s\n",
2222                                dev->name, print_mac(mac, mgmt->sa));
2223                 }
2224                 return;
2225         }
2226         if (pos[1] != 0 &&
2227             (pos[1] != ifsta->ssid_len ||
2228              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
2229                 /* Ignore ProbeReq for foreign SSID */
2230                 return;
2231         }
2232
2233         /* Reply with ProbeResp */
2234         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
2235         if (!skb)
2236                 return;
2237
2238         resp = (struct ieee80211_mgmt *) skb->data;
2239         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2240 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2241         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
2242                dev->name, print_mac(mac, resp->da));
2243 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2244         ieee80211_sta_tx(dev, skb, 0);
2245 }
2246
2247 static void ieee80211_rx_mgmt_action(struct net_device *dev,
2248                                      struct ieee80211_if_sta *ifsta,
2249                                      struct ieee80211_mgmt *mgmt,
2250                                      size_t len)
2251 {
2252         if (len < IEEE80211_MIN_ACTION_SIZE)
2253                 return;
2254
2255         switch (mgmt->u.action.category) {
2256         case WLAN_CATEGORY_BACK:
2257                 switch (mgmt->u.action.u.addba_req.action_code) {
2258                 case WLAN_ACTION_ADDBA_REQ:
2259                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2260                                    sizeof(mgmt->u.action.u.addba_req)))
2261                                 break;
2262                         ieee80211_sta_process_addba_request(dev, mgmt, len);
2263                         break;
2264                 case WLAN_ACTION_DELBA:
2265                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2266                                    sizeof(mgmt->u.action.u.delba)))
2267                                 break;
2268                         ieee80211_sta_process_delba(dev, mgmt, len);
2269                         break;
2270                 default:
2271                         if (net_ratelimit())
2272                            printk(KERN_DEBUG "%s: Rx unknown A-MPDU action\n",
2273                                         dev->name);
2274                         break;
2275                 }
2276                 break;
2277         default:
2278                 break;
2279         }
2280 }
2281
2282 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
2283                            struct ieee80211_rx_status *rx_status)
2284 {
2285         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2286         struct ieee80211_sub_if_data *sdata;
2287         struct ieee80211_if_sta *ifsta;
2288         struct ieee80211_mgmt *mgmt;
2289         u16 fc;
2290
2291         if (skb->len < 24)
2292                 goto fail;
2293
2294         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2295         ifsta = &sdata->u.sta;
2296
2297         mgmt = (struct ieee80211_mgmt *) skb->data;
2298         fc = le16_to_cpu(mgmt->frame_control);
2299
2300         switch (fc & IEEE80211_FCTL_STYPE) {
2301         case IEEE80211_STYPE_PROBE_REQ:
2302         case IEEE80211_STYPE_PROBE_RESP:
2303         case IEEE80211_STYPE_BEACON:
2304                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
2305         case IEEE80211_STYPE_AUTH:
2306         case IEEE80211_STYPE_ASSOC_RESP:
2307         case IEEE80211_STYPE_REASSOC_RESP:
2308         case IEEE80211_STYPE_DEAUTH:
2309         case IEEE80211_STYPE_DISASSOC:
2310         case IEEE80211_STYPE_ACTION:
2311                 skb_queue_tail(&ifsta->skb_queue, skb);
2312                 queue_work(local->hw.workqueue, &ifsta->work);
2313                 return;
2314         default:
2315                 printk(KERN_DEBUG "%s: received unknown management frame - "
2316                        "stype=%d\n", dev->name,
2317                        (fc & IEEE80211_FCTL_STYPE) >> 4);
2318                 break;
2319         }
2320
2321  fail:
2322         kfree_skb(skb);
2323 }
2324
2325
2326 static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
2327                                          struct sk_buff *skb)
2328 {
2329         struct ieee80211_rx_status *rx_status;
2330         struct ieee80211_sub_if_data *sdata;
2331         struct ieee80211_if_sta *ifsta;
2332         struct ieee80211_mgmt *mgmt;
2333         u16 fc;
2334
2335         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2336         ifsta = &sdata->u.sta;
2337
2338         rx_status = (struct ieee80211_rx_status *) skb->cb;
2339         mgmt = (struct ieee80211_mgmt *) skb->data;
2340         fc = le16_to_cpu(mgmt->frame_control);
2341
2342         switch (fc & IEEE80211_FCTL_STYPE) {
2343         case IEEE80211_STYPE_PROBE_REQ:
2344                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
2345                                             rx_status);
2346                 break;
2347         case IEEE80211_STYPE_PROBE_RESP:
2348                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
2349                 break;
2350         case IEEE80211_STYPE_BEACON:
2351                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
2352                 break;
2353         case IEEE80211_STYPE_AUTH:
2354                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
2355                 break;
2356         case IEEE80211_STYPE_ASSOC_RESP:
2357                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
2358                 break;
2359         case IEEE80211_STYPE_REASSOC_RESP:
2360                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
2361                 break;
2362         case IEEE80211_STYPE_DEAUTH:
2363                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
2364                 break;
2365         case IEEE80211_STYPE_DISASSOC:
2366                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
2367                 break;
2368         case IEEE80211_STYPE_ACTION:
2369                 ieee80211_rx_mgmt_action(dev, ifsta, mgmt, skb->len);
2370                 break;
2371         }
2372
2373         kfree_skb(skb);
2374 }
2375
2376
2377 ieee80211_txrx_result
2378 ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
2379                       struct ieee80211_rx_status *rx_status)
2380 {
2381         struct ieee80211_mgmt *mgmt;
2382         u16 fc;
2383
2384         if (skb->len < 2)
2385                 return TXRX_DROP;
2386
2387         mgmt = (struct ieee80211_mgmt *) skb->data;
2388         fc = le16_to_cpu(mgmt->frame_control);
2389
2390         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
2391                 return TXRX_CONTINUE;
2392
2393         if (skb->len < 24)
2394                 return TXRX_DROP;
2395
2396         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
2397                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
2398                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
2399                                                      skb->len, rx_status);
2400                         dev_kfree_skb(skb);
2401                         return TXRX_QUEUED;
2402                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
2403                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
2404                                                  rx_status);
2405                         dev_kfree_skb(skb);
2406                         return TXRX_QUEUED;
2407                 }
2408         }
2409         return TXRX_CONTINUE;
2410 }
2411
2412
2413 static int ieee80211_sta_active_ibss(struct net_device *dev)
2414 {
2415         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2416         int active = 0;
2417         struct sta_info *sta;
2418
2419         read_lock_bh(&local->sta_lock);
2420         list_for_each_entry(sta, &local->sta_list, list) {
2421                 if (sta->dev == dev &&
2422                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2423                                jiffies)) {
2424                         active++;
2425                         break;
2426                 }
2427         }
2428         read_unlock_bh(&local->sta_lock);
2429
2430         return active;
2431 }
2432
2433
2434 static void ieee80211_sta_expire(struct net_device *dev)
2435 {
2436         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2437         struct sta_info *sta, *tmp;
2438         LIST_HEAD(tmp_list);
2439         DECLARE_MAC_BUF(mac);
2440
2441         write_lock_bh(&local->sta_lock);
2442         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
2443                 if (time_after(jiffies, sta->last_rx +
2444                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2445                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
2446                                dev->name, print_mac(mac, sta->addr));
2447                         __sta_info_get(sta);
2448                         sta_info_remove(sta);
2449                         list_add(&sta->list, &tmp_list);
2450                 }
2451         write_unlock_bh(&local->sta_lock);
2452
2453         list_for_each_entry_safe(sta, tmp, &tmp_list, list) {
2454                 sta_info_free(sta);
2455                 sta_info_put(sta);
2456         }
2457 }
2458
2459
2460 static void ieee80211_sta_merge_ibss(struct net_device *dev,
2461                                      struct ieee80211_if_sta *ifsta)
2462 {
2463         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2464
2465         ieee80211_sta_expire(dev);
2466         if (ieee80211_sta_active_ibss(dev))
2467                 return;
2468
2469         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
2470                "IBSS networks with same SSID (merge)\n", dev->name);
2471         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
2472 }
2473
2474
2475 void ieee80211_sta_timer(unsigned long data)
2476 {
2477         struct ieee80211_sub_if_data *sdata =
2478                 (struct ieee80211_sub_if_data *) data;
2479         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2480         struct ieee80211_local *local = wdev_priv(&sdata->wdev);
2481
2482         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2483         queue_work(local->hw.workqueue, &ifsta->work);
2484 }
2485
2486
2487 void ieee80211_sta_work(struct work_struct *work)
2488 {
2489         struct ieee80211_sub_if_data *sdata =
2490                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
2491         struct net_device *dev = sdata->dev;
2492         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2493         struct ieee80211_if_sta *ifsta;
2494         struct sk_buff *skb;
2495
2496         if (!netif_running(dev))
2497                 return;
2498
2499         if (local->sta_sw_scanning || local->sta_hw_scanning)
2500                 return;
2501
2502         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
2503             sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
2504                 printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
2505                        "(type=%d)\n", dev->name, sdata->vif.type);
2506                 return;
2507         }
2508         ifsta = &sdata->u.sta;
2509
2510         while ((skb = skb_dequeue(&ifsta->skb_queue)))
2511                 ieee80211_sta_rx_queued_mgmt(dev, skb);
2512
2513         if (ifsta->state != IEEE80211_AUTHENTICATE &&
2514             ifsta->state != IEEE80211_ASSOCIATE &&
2515             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
2516                 if (ifsta->scan_ssid_len)
2517                         ieee80211_sta_start_scan(dev, ifsta->scan_ssid, ifsta->scan_ssid_len);
2518                 else
2519                         ieee80211_sta_start_scan(dev, NULL, 0);
2520                 return;
2521         }
2522
2523         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
2524                 if (ieee80211_sta_config_auth(dev, ifsta))
2525                         return;
2526                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2527         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
2528                 return;
2529
2530         switch (ifsta->state) {
2531         case IEEE80211_DISABLED:
2532                 break;
2533         case IEEE80211_AUTHENTICATE:
2534                 ieee80211_authenticate(dev, ifsta);
2535                 break;
2536         case IEEE80211_ASSOCIATE:
2537                 ieee80211_associate(dev, ifsta);
2538                 break;
2539         case IEEE80211_ASSOCIATED:
2540                 ieee80211_associated(dev, ifsta);
2541                 break;
2542         case IEEE80211_IBSS_SEARCH:
2543                 ieee80211_sta_find_ibss(dev, ifsta);
2544                 break;
2545         case IEEE80211_IBSS_JOINED:
2546                 ieee80211_sta_merge_ibss(dev, ifsta);
2547                 break;
2548         default:
2549                 printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
2550                        ifsta->state);
2551                 break;
2552         }
2553
2554         if (ieee80211_privacy_mismatch(dev, ifsta)) {
2555                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
2556                        "mixed-cell disabled - disassociate\n", dev->name);
2557
2558                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
2559                 ieee80211_set_disassoc(dev, ifsta, 0);
2560         }
2561 }
2562
2563
2564 static void ieee80211_sta_reset_auth(struct net_device *dev,
2565                                      struct ieee80211_if_sta *ifsta)
2566 {
2567         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2568
2569         if (local->ops->reset_tsf) {
2570                 /* Reset own TSF to allow time synchronization work. */
2571                 local->ops->reset_tsf(local_to_hw(local));
2572         }
2573
2574         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
2575
2576
2577         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
2578                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2579         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2580                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
2581         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
2582                 ifsta->auth_alg = WLAN_AUTH_LEAP;
2583         else
2584                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2585         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
2586                ifsta->auth_alg);
2587         ifsta->auth_transaction = -1;
2588         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
2589         ifsta->auth_tries = ifsta->assoc_tries = 0;
2590         netif_carrier_off(dev);
2591 }
2592
2593
2594 void ieee80211_sta_req_auth(struct net_device *dev,
2595                             struct ieee80211_if_sta *ifsta)
2596 {
2597         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2598         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2599
2600         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2601                 return;
2602
2603         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
2604                                 IEEE80211_STA_AUTO_BSSID_SEL)) &&
2605             (ifsta->flags & (IEEE80211_STA_SSID_SET |
2606                                 IEEE80211_STA_AUTO_SSID_SEL))) {
2607                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2608                 queue_work(local->hw.workqueue, &ifsta->work);
2609         }
2610 }
2611
2612 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
2613                                     const char *ssid, int ssid_len)
2614 {
2615         int tmp, hidden_ssid;
2616
2617         if (ssid_len == ifsta->ssid_len &&
2618             !memcmp(ifsta->ssid, ssid, ssid_len))
2619                 return 1;
2620
2621         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
2622                 return 0;
2623
2624         hidden_ssid = 1;
2625         tmp = ssid_len;
2626         while (tmp--) {
2627                 if (ssid[tmp] != '\0') {
2628                         hidden_ssid = 0;
2629                         break;
2630                 }
2631         }
2632
2633         if (hidden_ssid && ifsta->ssid_len == ssid_len)
2634                 return 1;
2635
2636         if (ssid_len == 1 && ssid[0] == ' ')
2637                 return 1;
2638
2639         return 0;
2640 }
2641
2642 static int ieee80211_sta_config_auth(struct net_device *dev,
2643                                      struct ieee80211_if_sta *ifsta)
2644 {
2645         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2646         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2647         struct ieee80211_sta_bss *bss, *selected = NULL;
2648         int top_rssi = 0, freq;
2649
2650         if (!(ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
2651             IEEE80211_STA_AUTO_BSSID_SEL | IEEE80211_STA_AUTO_CHANNEL_SEL))) {
2652                 ifsta->state = IEEE80211_AUTHENTICATE;
2653                 ieee80211_sta_reset_auth(dev, ifsta);
2654                 return 0;
2655         }
2656
2657         spin_lock_bh(&local->sta_bss_lock);
2658         freq = local->oper_channel->freq;
2659         list_for_each_entry(bss, &local->sta_bss_list, list) {
2660                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
2661                         continue;
2662
2663                 if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
2664                     !!sdata->default_key)
2665                         continue;
2666
2667                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
2668                     bss->freq != freq)
2669                         continue;
2670
2671                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
2672                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
2673                         continue;
2674
2675                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
2676                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
2677                         continue;
2678
2679                 if (!selected || top_rssi < bss->rssi) {
2680                         selected = bss;
2681                         top_rssi = bss->rssi;
2682                 }
2683         }
2684         if (selected)
2685                 atomic_inc(&selected->users);
2686         spin_unlock_bh(&local->sta_bss_lock);
2687
2688         if (selected) {
2689                 ieee80211_set_channel(local, -1, selected->freq);
2690                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
2691                         ieee80211_sta_set_ssid(dev, selected->ssid,
2692                                                selected->ssid_len);
2693                 ieee80211_sta_set_bssid(dev, selected->bssid);
2694                 ieee80211_rx_bss_put(dev, selected);
2695                 ifsta->state = IEEE80211_AUTHENTICATE;
2696                 ieee80211_sta_reset_auth(dev, ifsta);
2697                 return 0;
2698         } else {
2699                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
2700                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
2701                                 ieee80211_sta_start_scan(dev, NULL, 0);
2702                         else
2703                                 ieee80211_sta_start_scan(dev, ifsta->ssid,
2704                                                          ifsta->ssid_len);
2705                         ifsta->state = IEEE80211_AUTHENTICATE;
2706                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2707                 } else
2708                         ifsta->state = IEEE80211_DISABLED;
2709         }
2710         return -1;
2711 }
2712
2713 static int ieee80211_sta_join_ibss(struct net_device *dev,
2714                                    struct ieee80211_if_sta *ifsta,
2715                                    struct ieee80211_sta_bss *bss)
2716 {
2717         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2718         int res, rates, i, j;
2719         struct sk_buff *skb;
2720         struct ieee80211_mgmt *mgmt;
2721         struct ieee80211_tx_control control;
2722         struct ieee80211_hw_mode *mode;
2723         struct rate_selection ratesel;
2724         u8 *pos;
2725         struct ieee80211_sub_if_data *sdata;
2726
2727         /* Remove possible STA entries from other IBSS networks. */
2728         sta_info_flush(local, NULL);
2729
2730         if (local->ops->reset_tsf) {
2731                 /* Reset own TSF to allow time synchronization work. */
2732                 local->ops->reset_tsf(local_to_hw(local));
2733         }
2734         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2735         res = ieee80211_if_config(dev);
2736         if (res)
2737                 return res;
2738
2739         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2740
2741         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2742         sdata->drop_unencrypted = bss->capability &
2743                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2744
2745         res = ieee80211_set_channel(local, -1, bss->freq);
2746
2747         if (!(local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)) {
2748                 printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
2749                        "(%d MHz)\n", dev->name, local->hw.conf.channel,
2750                        local->hw.conf.freq);
2751                 return -1;
2752         }
2753
2754         /* Set beacon template based on scan results */
2755         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2756         do {
2757                 if (!skb)
2758                         break;
2759
2760                 skb_reserve(skb, local->hw.extra_tx_headroom);
2761
2762                 mgmt = (struct ieee80211_mgmt *)
2763                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2764                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2765                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2766                                                    IEEE80211_STYPE_BEACON);
2767                 memset(mgmt->da, 0xff, ETH_ALEN);
2768                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2769                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2770                 mgmt->u.beacon.beacon_int =
2771                         cpu_to_le16(local->hw.conf.beacon_int);
2772                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2773
2774                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2775                 *pos++ = WLAN_EID_SSID;
2776                 *pos++ = ifsta->ssid_len;
2777                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2778
2779                 rates = bss->supp_rates_len;
2780                 if (rates > 8)
2781                         rates = 8;
2782                 pos = skb_put(skb, 2 + rates);
2783                 *pos++ = WLAN_EID_SUPP_RATES;
2784                 *pos++ = rates;
2785                 memcpy(pos, bss->supp_rates, rates);
2786
2787                 pos = skb_put(skb, 2 + 1);
2788                 *pos++ = WLAN_EID_DS_PARAMS;
2789                 *pos++ = 1;
2790                 *pos++ = bss->channel;
2791
2792                 pos = skb_put(skb, 2 + 2);
2793                 *pos++ = WLAN_EID_IBSS_PARAMS;
2794                 *pos++ = 2;
2795                 /* FIX: set ATIM window based on scan results */
2796                 *pos++ = 0;
2797                 *pos++ = 0;
2798
2799                 if (bss->supp_rates_len > 8) {
2800                         rates = bss->supp_rates_len - 8;
2801                         pos = skb_put(skb, 2 + rates);
2802                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2803                         *pos++ = rates;
2804                         memcpy(pos, &bss->supp_rates[8], rates);
2805                 }
2806
2807                 memset(&control, 0, sizeof(control));
2808                 rate_control_get_rate(dev, local->oper_hw_mode, skb, &ratesel);
2809                 if (!ratesel.rate) {
2810                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2811                                "for IBSS beacon\n", dev->name);
2812                         break;
2813                 }
2814                 control.vif = &sdata->vif;
2815                 control.tx_rate =
2816                         (sdata->bss_conf.use_short_preamble &&
2817                         (ratesel.rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2818                         ratesel.rate->val2 : ratesel.rate->val;
2819                 control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
2820                 control.power_level = local->hw.conf.power_level;
2821                 control.flags |= IEEE80211_TXCTL_NO_ACK;
2822                 control.retry_limit = 1;
2823
2824                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2825                 if (ifsta->probe_resp) {
2826                         mgmt = (struct ieee80211_mgmt *)
2827                                 ifsta->probe_resp->data;
2828                         mgmt->frame_control =
2829                                 IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2830                                              IEEE80211_STYPE_PROBE_RESP);
2831                 } else {
2832                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2833                                "template for IBSS\n", dev->name);
2834                 }
2835
2836                 if (local->ops->beacon_update &&
2837                     local->ops->beacon_update(local_to_hw(local),
2838                                              skb, &control) == 0) {
2839                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2840                                "template based on scan results\n", dev->name);
2841                         skb = NULL;
2842                 }
2843
2844                 rates = 0;
2845                 mode = local->oper_hw_mode;
2846                 for (i = 0; i < bss->supp_rates_len; i++) {
2847                         int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2848                         for (j = 0; j < mode->num_rates; j++)
2849                                 if (mode->rates[j].rate == bitrate)
2850                                         rates |= BIT(j);
2851                 }
2852                 ifsta->supp_rates_bits = rates;
2853         } while (0);
2854
2855         if (skb) {
2856                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2857                        "template\n", dev->name);
2858                 dev_kfree_skb(skb);
2859         }
2860
2861         ifsta->state = IEEE80211_IBSS_JOINED;
2862         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2863
2864         ieee80211_rx_bss_put(dev, bss);
2865
2866         return res;
2867 }
2868
2869
2870 static int ieee80211_sta_create_ibss(struct net_device *dev,
2871                                      struct ieee80211_if_sta *ifsta)
2872 {
2873         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2874         struct ieee80211_sta_bss *bss;
2875         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2876         struct ieee80211_hw_mode *mode;
2877         u8 bssid[ETH_ALEN], *pos;
2878         int i;
2879         DECLARE_MAC_BUF(mac);
2880
2881 #if 0
2882         /* Easier testing, use fixed BSSID. */
2883         memset(bssid, 0xfe, ETH_ALEN);
2884 #else
2885         /* Generate random, not broadcast, locally administered BSSID. Mix in
2886          * own MAC address to make sure that devices that do not have proper
2887          * random number generator get different BSSID. */
2888         get_random_bytes(bssid, ETH_ALEN);
2889         for (i = 0; i < ETH_ALEN; i++)
2890                 bssid[i] ^= dev->dev_addr[i];
2891         bssid[0] &= ~0x01;
2892         bssid[0] |= 0x02;
2893 #endif
2894
2895         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
2896                dev->name, print_mac(mac, bssid));
2897
2898         bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel,
2899                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
2900         if (!bss)
2901                 return -ENOMEM;
2902
2903         mode = local->oper_hw_mode;
2904
2905         if (local->hw.conf.beacon_int == 0)
2906                 local->hw.conf.beacon_int = 100;
2907         bss->beacon_int = local->hw.conf.beacon_int;
2908         bss->hw_mode = local->hw.conf.phymode;
2909         bss->freq = local->hw.conf.freq;
2910         bss->last_update = jiffies;
2911         bss->capability = WLAN_CAPABILITY_IBSS;
2912         if (sdata->default_key) {
2913                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
2914         } else
2915                 sdata->drop_unencrypted = 0;
2916         bss->supp_rates_len = mode->num_rates;
2917         pos = bss->supp_rates;
2918         for (i = 0; i < mode->num_rates; i++) {
2919                 int rate = mode->rates[i].rate;
2920                 *pos++ = (u8) (rate / 5);
2921         }
2922
2923         return ieee80211_sta_join_ibss(dev, ifsta, bss);
2924 }
2925
2926
2927 static int ieee80211_sta_find_ibss(struct net_device *dev,
2928                                    struct ieee80211_if_sta *ifsta)
2929 {
2930         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2931         struct ieee80211_sta_bss *bss;
2932         int found = 0;
2933         u8 bssid[ETH_ALEN];
2934         int active_ibss;
2935         DECLARE_MAC_BUF(mac);
2936         DECLARE_MAC_BUF(mac2);
2937
2938         if (ifsta->ssid_len == 0)
2939                 return -EINVAL;
2940
2941         active_ibss = ieee80211_sta_active_ibss(dev);
2942 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2943         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2944                dev->name, active_ibss);
2945 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2946         spin_lock_bh(&local->sta_bss_lock);
2947         list_for_each_entry(bss, &local->sta_bss_list, list) {
2948                 if (ifsta->ssid_len != bss->ssid_len ||
2949                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2950                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2951                         continue;
2952 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2953                 printk(KERN_DEBUG "   bssid=%s found\n",
2954                        print_mac(mac, bss->bssid));
2955 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2956                 memcpy(bssid, bss->bssid, ETH_ALEN);
2957                 found = 1;
2958                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2959                         break;
2960         }
2961         spin_unlock_bh(&local->sta_bss_lock);
2962
2963 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2964         printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
2965                "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
2966 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2967         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
2968             (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel,
2969                                         ifsta->ssid, ifsta->ssid_len))) {
2970                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
2971                        " based on configured SSID\n",
2972                        dev->name, print_mac(mac, bssid));
2973                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
2974         }
2975 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2976         printk(KERN_DEBUG "   did not try to join ibss\n");
2977 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2978
2979         /* Selected IBSS not found in current scan results - try to scan */
2980         if (ifsta->state == IEEE80211_IBSS_JOINED &&
2981             !ieee80211_sta_active_ibss(dev)) {
2982                 mod_timer(&ifsta->timer, jiffies +
2983                                       IEEE80211_IBSS_MERGE_INTERVAL);
2984         } else if (time_after(jiffies, local->last_scan_completed +
2985                               IEEE80211_SCAN_INTERVAL)) {
2986                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
2987                        "join\n", dev->name);
2988                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
2989                                               ifsta->ssid_len);
2990         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
2991                 int interval = IEEE80211_SCAN_INTERVAL;
2992
2993                 if (time_after(jiffies, ifsta->ibss_join_req +
2994                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2995                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
2996                             local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)
2997                                 return ieee80211_sta_create_ibss(dev, ifsta);
2998                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
2999                                 printk(KERN_DEBUG "%s: IBSS not allowed on the"
3000                                        " configured channel %d (%d MHz)\n",
3001                                        dev->name, local->hw.conf.channel,
3002                                        local->hw.conf.freq);
3003                         }
3004
3005                         /* No IBSS found - decrease scan interval and continue
3006                          * scanning. */
3007                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
3008                 }
3009
3010                 ifsta->state = IEEE80211_IBSS_SEARCH;
3011                 mod_timer(&ifsta->timer, jiffies + interval);
3012                 return 0;
3013         }
3014
3015         return 0;
3016 }
3017
3018
3019 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
3020 {
3021         struct ieee80211_sub_if_data *sdata;
3022         struct ieee80211_if_sta *ifsta;
3023         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3024
3025         if (len > IEEE80211_MAX_SSID_LEN)
3026                 return -EINVAL;
3027
3028         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
3029          * not defined. */
3030         if (local->ops->conf_tx) {
3031                 struct ieee80211_tx_queue_params qparam;
3032                 int i;
3033
3034                 memset(&qparam, 0, sizeof(qparam));
3035                 /* TODO: are these ok defaults for all hw_modes? */
3036                 qparam.aifs = 2;
3037                 qparam.cw_min =
3038                         local->hw.conf.phymode == MODE_IEEE80211B ? 31 : 15;
3039                 qparam.cw_max = 1023;
3040                 qparam.burst_time = 0;
3041                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
3042                 {
3043                         local->ops->conf_tx(local_to_hw(local),
3044                                            i + IEEE80211_TX_QUEUE_DATA0,
3045                                            &qparam);
3046                 }
3047                 /* IBSS uses different parameters for Beacon sending */
3048                 qparam.cw_min++;
3049                 qparam.cw_min *= 2;
3050                 qparam.cw_min--;
3051                 local->ops->conf_tx(local_to_hw(local),
3052                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
3053         }
3054
3055         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3056         ifsta = &sdata->u.sta;
3057
3058         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
3059                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
3060         memcpy(ifsta->ssid, ssid, len);
3061         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
3062         ifsta->ssid_len = len;
3063
3064         if (len)
3065                 ifsta->flags |= IEEE80211_STA_SSID_SET;
3066         else
3067                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
3068         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3069             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
3070                 ifsta->ibss_join_req = jiffies;
3071                 ifsta->state = IEEE80211_IBSS_SEARCH;
3072                 return ieee80211_sta_find_ibss(dev, ifsta);
3073         }
3074         return 0;
3075 }
3076
3077
3078 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
3079 {
3080         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3081         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3082         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
3083         *len = ifsta->ssid_len;
3084         return 0;
3085 }
3086
3087
3088 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
3089 {
3090         struct ieee80211_sub_if_data *sdata;
3091         struct ieee80211_if_sta *ifsta;
3092         int res;
3093
3094         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3095         ifsta = &sdata->u.sta;
3096
3097         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
3098                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
3099                 res = ieee80211_if_config(dev);
3100                 if (res) {
3101                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
3102                                "the low-level driver\n", dev->name);
3103                         return res;
3104                 }
3105         }
3106
3107         if (is_valid_ether_addr(bssid))
3108                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
3109         else
3110                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
3111
3112         return 0;
3113 }
3114
3115
3116 static void ieee80211_send_nullfunc(struct ieee80211_local *local,
3117                                     struct ieee80211_sub_if_data *sdata,
3118                                     int powersave)
3119 {
3120         struct sk_buff *skb;
3121         struct ieee80211_hdr *nullfunc;
3122         u16 fc;
3123
3124         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
3125         if (!skb) {
3126                 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
3127                        "frame\n", sdata->dev->name);
3128                 return;
3129         }
3130         skb_reserve(skb, local->hw.extra_tx_headroom);
3131
3132         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
3133         memset(nullfunc, 0, 24);
3134         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
3135              IEEE80211_FCTL_TODS;
3136         if (powersave)
3137                 fc |= IEEE80211_FCTL_PM;
3138         nullfunc->frame_control = cpu_to_le16(fc);
3139         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
3140         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
3141         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
3142
3143         ieee80211_sta_tx(sdata->dev, skb, 0);
3144 }
3145
3146
3147 void ieee80211_scan_completed(struct ieee80211_hw *hw)
3148 {
3149         struct ieee80211_local *local = hw_to_local(hw);
3150         struct net_device *dev = local->scan_dev;
3151         struct ieee80211_sub_if_data *sdata;
3152         union iwreq_data wrqu;
3153
3154         local->last_scan_completed = jiffies;
3155         memset(&wrqu, 0, sizeof(wrqu));
3156         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
3157
3158         if (local->sta_hw_scanning) {
3159                 local->sta_hw_scanning = 0;
3160                 goto done;
3161         }
3162
3163         local->sta_sw_scanning = 0;
3164         if (ieee80211_hw_config(local))
3165                 printk(KERN_DEBUG "%s: failed to restore operational "
3166                        "channel after scan\n", dev->name);
3167
3168
3169         netif_tx_lock_bh(local->mdev);
3170         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
3171         local->ops->configure_filter(local_to_hw(local),
3172                                      FIF_BCN_PRBRESP_PROMISC,
3173                                      &local->filter_flags,
3174                                      local->mdev->mc_count,
3175                                      local->mdev->mc_list);
3176
3177         netif_tx_unlock_bh(local->mdev);
3178
3179         rcu_read_lock();
3180         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3181
3182                 /* No need to wake the master device. */
3183                 if (sdata->dev == local->mdev)
3184                         continue;
3185
3186                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
3187                         if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
3188                                 ieee80211_send_nullfunc(local, sdata, 0);
3189                         ieee80211_sta_timer((unsigned long)sdata);
3190                 }
3191
3192                 netif_wake_queue(sdata->dev);
3193         }
3194         rcu_read_unlock();
3195
3196 done:
3197         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3198         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
3199                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3200                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
3201                     (!ifsta->state == IEEE80211_IBSS_JOINED &&
3202                     !ieee80211_sta_active_ibss(dev)))
3203                         ieee80211_sta_find_ibss(dev, ifsta);
3204         }
3205 }
3206 EXPORT_SYMBOL(ieee80211_scan_completed);
3207
3208 void ieee80211_sta_scan_work(struct work_struct *work)
3209 {
3210         struct ieee80211_local *local =
3211                 container_of(work, struct ieee80211_local, scan_work.work);
3212         struct net_device *dev = local->scan_dev;
3213         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3214         struct ieee80211_hw_mode *mode;
3215         struct ieee80211_channel *chan;
3216         int skip;
3217         unsigned long next_delay = 0;
3218
3219         if (!local->sta_sw_scanning)
3220                 return;
3221
3222         switch (local->scan_state) {
3223         case SCAN_SET_CHANNEL:
3224                 mode = local->scan_hw_mode;
3225                 if (local->scan_hw_mode->list.next == &local->modes_list &&
3226                     local->scan_channel_idx >= mode->num_channels) {
3227                         ieee80211_scan_completed(local_to_hw(local));
3228                         return;
3229                 }
3230                 skip = !(local->enabled_modes & (1 << mode->mode));
3231                 chan = &mode->channels[local->scan_channel_idx];
3232                 if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
3233                     (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3234                      !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
3235                     (local->hw_modes & local->enabled_modes &
3236                      (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
3237                         skip = 1;
3238
3239                 if (!skip) {
3240 #if 0
3241                         printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
3242                                dev->name, chan->chan, chan->freq);
3243 #endif
3244
3245                         local->scan_channel = chan;
3246                         if (ieee80211_hw_config(local)) {
3247                                 printk(KERN_DEBUG "%s: failed to set channel "
3248                                        "%d (%d MHz) for scan\n", dev->name,
3249                                        chan->chan, chan->freq);
3250                                 skip = 1;
3251                         }
3252                 }
3253
3254                 local->scan_channel_idx++;
3255                 if (local->scan_channel_idx >= local->scan_hw_mode->num_channels) {
3256                         if (local->scan_hw_mode->list.next != &local->modes_list) {
3257                                 local->scan_hw_mode = list_entry(local->scan_hw_mode->list.next,
3258                                                                  struct ieee80211_hw_mode,
3259                                                                  list);
3260                                 local->scan_channel_idx = 0;
3261                         }
3262                 }
3263
3264                 if (skip)
3265                         break;
3266
3267                 next_delay = IEEE80211_PROBE_DELAY +
3268                              usecs_to_jiffies(local->hw.channel_change_time);
3269                 local->scan_state = SCAN_SEND_PROBE;
3270                 break;
3271         case SCAN_SEND_PROBE:
3272                 if (local->scan_channel->flag & IEEE80211_CHAN_W_ACTIVE_SCAN) {
3273                         ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
3274                                                  local->scan_ssid_len);
3275                         next_delay = IEEE80211_CHANNEL_TIME;
3276                 } else
3277                         next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
3278                 local->scan_state = SCAN_SET_CHANNEL;
3279                 break;
3280         }
3281
3282         if (local->sta_sw_scanning)
3283                 queue_delayed_work(local->hw.workqueue, &local->scan_work,
3284                                    next_delay);
3285 }
3286
3287
3288 static int ieee80211_sta_start_scan(struct net_device *dev,
3289                                     u8 *ssid, size_t ssid_len)
3290 {
3291         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3292         struct ieee80211_sub_if_data *sdata;
3293
3294         if (ssid_len > IEEE80211_MAX_SSID_LEN)
3295                 return -EINVAL;
3296
3297         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
3298          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
3299          * BSSID: MACAddress
3300          * SSID
3301          * ScanType: ACTIVE, PASSIVE
3302          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
3303          *    a Probe frame during active scanning
3304          * ChannelList
3305          * MinChannelTime (>= ProbeDelay), in TU
3306          * MaxChannelTime: (>= MinChannelTime), in TU
3307          */
3308
3309          /* MLME-SCAN.confirm
3310           * BSSDescriptionSet
3311           * ResultCode: SUCCESS, INVALID_PARAMETERS
3312          */
3313
3314         if (local->sta_sw_scanning || local->sta_hw_scanning) {
3315                 if (local->scan_dev == dev)
3316                         return 0;
3317                 return -EBUSY;
3318         }
3319
3320         if (local->ops->hw_scan) {
3321                 int rc = local->ops->hw_scan(local_to_hw(local),
3322                                              ssid, ssid_len);
3323                 if (!rc) {
3324                         local->sta_hw_scanning = 1;
3325                         local->scan_dev = dev;
3326                 }
3327                 return rc;
3328         }
3329
3330         local->sta_sw_scanning = 1;
3331
3332         rcu_read_lock();
3333         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3334
3335                 /* Don't stop the master interface, otherwise we can't transmit
3336                  * probes! */
3337                 if (sdata->dev == local->mdev)
3338                         continue;
3339
3340                 netif_stop_queue(sdata->dev);
3341                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
3342                     (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
3343                         ieee80211_send_nullfunc(local, sdata, 1);
3344         }
3345         rcu_read_unlock();
3346
3347         if (ssid) {
3348                 local->scan_ssid_len = ssid_len;
3349                 memcpy(local->scan_ssid, ssid, ssid_len);
3350         } else
3351                 local->scan_ssid_len = 0;
3352         local->scan_state = SCAN_SET_CHANNEL;
3353         local->scan_hw_mode = list_entry(local->modes_list.next,
3354                                          struct ieee80211_hw_mode,
3355                                          list);
3356         local->scan_channel_idx = 0;
3357         local->scan_dev = dev;
3358
3359         netif_tx_lock_bh(local->mdev);
3360         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
3361         local->ops->configure_filter(local_to_hw(local),
3362                                      FIF_BCN_PRBRESP_PROMISC,
3363                                      &local->filter_flags,
3364                                      local->mdev->mc_count,
3365                                      local->mdev->mc_list);
3366         netif_tx_unlock_bh(local->mdev);
3367
3368         /* TODO: start scan as soon as all nullfunc frames are ACKed */
3369         queue_delayed_work(local->hw.workqueue, &local->scan_work,
3370                            IEEE80211_CHANNEL_TIME);
3371
3372         return 0;
3373 }
3374
3375
3376 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
3377 {
3378         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3379         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3380         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3381
3382         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3383                 return ieee80211_sta_start_scan(dev, ssid, ssid_len);
3384
3385         if (local->sta_sw_scanning || local->sta_hw_scanning) {
3386                 if (local->scan_dev == dev)
3387                         return 0;
3388                 return -EBUSY;
3389         }
3390
3391         ifsta->scan_ssid_len = ssid_len;
3392         if (ssid_len)
3393                 memcpy(ifsta->scan_ssid, ssid, ssid_len);
3394         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
3395         queue_work(local->hw.workqueue, &ifsta->work);
3396         return 0;
3397 }
3398
3399 static char *
3400 ieee80211_sta_scan_result(struct net_device *dev,
3401                           struct ieee80211_sta_bss *bss,
3402                           char *current_ev, char *end_buf)
3403 {
3404         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3405         struct iw_event iwe;
3406
3407         if (time_after(jiffies,
3408                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
3409                 return current_ev;
3410
3411         if (!(local->enabled_modes & (1 << bss->hw_mode)))
3412                 return current_ev;
3413
3414         memset(&iwe, 0, sizeof(iwe));
3415         iwe.cmd = SIOCGIWAP;
3416         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
3417         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
3418         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3419                                           IW_EV_ADDR_LEN);
3420
3421         memset(&iwe, 0, sizeof(iwe));
3422         iwe.cmd = SIOCGIWESSID;
3423         iwe.u.data.length = bss->ssid_len;
3424         iwe.u.data.flags = 1;
3425         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3426                                           bss->ssid);
3427
3428         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
3429                 memset(&iwe, 0, sizeof(iwe));
3430                 iwe.cmd = SIOCGIWMODE;
3431                 if (bss->capability & WLAN_CAPABILITY_ESS)
3432                         iwe.u.mode = IW_MODE_MASTER;
3433                 else
3434                         iwe.u.mode = IW_MODE_ADHOC;
3435                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3436                                                   IW_EV_UINT_LEN);
3437         }
3438
3439         memset(&iwe, 0, sizeof(iwe));
3440         iwe.cmd = SIOCGIWFREQ;
3441         iwe.u.freq.m = bss->channel;
3442         iwe.u.freq.e = 0;
3443         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3444                                           IW_EV_FREQ_LEN);
3445         iwe.u.freq.m = bss->freq * 100000;
3446         iwe.u.freq.e = 1;
3447         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3448                                           IW_EV_FREQ_LEN);
3449
3450         memset(&iwe, 0, sizeof(iwe));
3451         iwe.cmd = IWEVQUAL;
3452         iwe.u.qual.qual = bss->signal;
3453         iwe.u.qual.level = bss->rssi;
3454         iwe.u.qual.noise = bss->noise;
3455         iwe.u.qual.updated = local->wstats_flags;
3456         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3457                                           IW_EV_QUAL_LEN);
3458
3459         memset(&iwe, 0, sizeof(iwe));
3460         iwe.cmd = SIOCGIWENCODE;
3461         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
3462                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
3463         else
3464                 iwe.u.data.flags = IW_ENCODE_DISABLED;
3465         iwe.u.data.length = 0;
3466         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
3467
3468         if (bss && bss->wpa_ie) {
3469                 memset(&iwe, 0, sizeof(iwe));
3470                 iwe.cmd = IWEVGENIE;
3471                 iwe.u.data.length = bss->wpa_ie_len;
3472                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3473                                                   bss->wpa_ie);
3474         }
3475
3476         if (bss && bss->rsn_ie) {
3477                 memset(&iwe, 0, sizeof(iwe));
3478                 iwe.cmd = IWEVGENIE;
3479                 iwe.u.data.length = bss->rsn_ie_len;
3480                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3481                                                   bss->rsn_ie);
3482         }
3483
3484         if (bss && bss->supp_rates_len > 0) {
3485                 /* display all supported rates in readable format */
3486                 char *p = current_ev + IW_EV_LCP_LEN;
3487                 int i;
3488
3489                 memset(&iwe, 0, sizeof(iwe));
3490                 iwe.cmd = SIOCGIWRATE;
3491                 /* Those two flags are ignored... */
3492                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3493
3494                 for (i = 0; i < bss->supp_rates_len; i++) {
3495                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
3496                                                         0x7f) * 500000);
3497                         p = iwe_stream_add_value(current_ev, p,
3498                                         end_buf, &iwe, IW_EV_PARAM_LEN);
3499                 }
3500                 current_ev = p;
3501         }
3502
3503         if (bss) {
3504                 char *buf;
3505                 buf = kmalloc(30, GFP_ATOMIC);
3506                 if (buf) {
3507                         memset(&iwe, 0, sizeof(iwe));
3508                         iwe.cmd = IWEVCUSTOM;
3509                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
3510                         iwe.u.data.length = strlen(buf);
3511                         current_ev = iwe_stream_add_point(current_ev, end_buf,
3512                                                           &iwe, buf);
3513                         kfree(buf);
3514                 }
3515         }
3516
3517         return current_ev;
3518 }
3519
3520
3521 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
3522 {
3523         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3524         char *current_ev = buf;
3525         char *end_buf = buf + len;
3526         struct ieee80211_sta_bss *bss;
3527
3528         spin_lock_bh(&local->sta_bss_lock);
3529         list_for_each_entry(bss, &local->sta_bss_list, list) {
3530                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3531                         spin_unlock_bh(&local->sta_bss_lock);
3532                         return -E2BIG;
3533                 }
3534                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
3535                                                        end_buf);
3536         }
3537         spin_unlock_bh(&local->sta_bss_lock);
3538         return current_ev - buf;
3539 }
3540
3541
3542 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
3543 {
3544         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3545         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3546         kfree(ifsta->extra_ie);
3547         if (len == 0) {
3548                 ifsta->extra_ie = NULL;
3549                 ifsta->extra_ie_len = 0;
3550                 return 0;
3551         }
3552         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3553         if (!ifsta->extra_ie) {
3554                 ifsta->extra_ie_len = 0;
3555                 return -ENOMEM;
3556         }
3557         memcpy(ifsta->extra_ie, ie, len);
3558         ifsta->extra_ie_len = len;
3559         return 0;
3560 }
3561
3562
3563 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
3564                                          struct sk_buff *skb, u8 *bssid,
3565                                          u8 *addr)
3566 {
3567         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3568         struct sta_info *sta;
3569         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3570         DECLARE_MAC_BUF(mac);
3571
3572         /* TODO: Could consider removing the least recently used entry and
3573          * allow new one to be added. */
3574         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3575                 if (net_ratelimit()) {
3576                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3577                                "entry %s\n", dev->name, print_mac(mac, addr));
3578                 }
3579                 return NULL;
3580         }
3581
3582         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
3583                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
3584
3585         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
3586         if (!sta)
3587                 return NULL;
3588
3589         sta->supp_rates = sdata->u.sta.supp_rates_bits;
3590
3591         rate_control_rate_init(sta, local);
3592
3593         return sta; /* caller will call sta_info_put() */
3594 }
3595
3596
3597 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
3598 {
3599         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3600         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3601
3602         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
3603                dev->name, reason);
3604
3605         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3606             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
3607                 return -EINVAL;
3608
3609         ieee80211_send_deauth(dev, ifsta, reason);
3610         ieee80211_set_disassoc(dev, ifsta, 1);
3611         return 0;
3612 }
3613
3614
3615 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
3616 {
3617         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3618         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3619
3620         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
3621                dev->name, reason);
3622
3623         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3624                 return -EINVAL;
3625
3626         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
3627                 return -1;
3628
3629         ieee80211_send_disassoc(dev, ifsta, reason);
3630         ieee80211_set_disassoc(dev, ifsta, 0);
3631         return 0;
3632 }