err.no Git - linux-2.6/blob - net/mac80211/ieee80211_sta.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 /* TODO:
  15  * order BSS list by RSSI(?) ("quality of AP")
  16  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  17  *    SSID)
  18  */
  19 #include <linux/delay.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/if_arp.h>
  24 #include <linux/wireless.h>
  25 #include <linux/random.h>
  26 #include <linux/etherdevice.h>
  27 #include <net/iw_handler.h>
  28 #include <asm/types.h>
  29
  30 #include <net/mac80211.h>
  31 #include "ieee80211_i.h"
  32 #include "ieee80211_rate.h"
  33 #include "ieee80211_led.h"
  34
  35 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  36 #define IEEE80211_AUTH_MAX_TRIES 3
  37 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  38 #define IEEE80211_ASSOC_MAX_TRIES 3
  39 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  40 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  41 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  42 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  43 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  44 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
  45
  46 #define IEEE80211_PROBE_DELAY (HZ / 33)
  47 #define IEEE80211_CHANNEL_TIME (HZ / 33)
  48 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
  49 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
  50 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  51 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  52
  53 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  54
  55
  56 #define IEEE80211_FC(type, stype) cpu_to_le16(type | stype)
  57
  58 #define ERP_INFO_USE_PROTECTION BIT(1)
  59
  60 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
  61                                      u8 *ssid, size_t ssid_len);
  62 static struct ieee80211_sta_bss *
  63 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
  64                      u8 *ssid, u8 ssid_len);
  65 static void ieee80211_rx_bss_put(struct net_device *dev,
  66                                  struct ieee80211_sta_bss *bss);
  67 static int ieee80211_sta_find_ibss(struct net_device *dev,
  68                                    struct ieee80211_if_sta *ifsta);
  69 static int ieee80211_sta_wep_configured(struct net_device *dev);
  70 static int ieee80211_sta_start_scan(struct net_device *dev,
  71                                     u8 *ssid, size_t ssid_len);
  72 static int ieee80211_sta_config_auth(struct net_device *dev,
  73                                      struct ieee80211_if_sta *ifsta);
  74
  75
  76 /* Parsed Information Elements */
  77 struct ieee802_11_elems {
  78         /* pointers to IEs */
  79         u8 *ssid;
  80         u8 *supp_rates;
  81         u8 *fh_params;
  82         u8 *ds_params;
  83         u8 *cf_params;
  84         u8 *tim;
  85         u8 *ibss_params;
  86         u8 *challenge;
  87         u8 *wpa;
  88         u8 *rsn;
  89         u8 *erp_info;
  90         u8 *ext_supp_rates;
  91         u8 *wmm_info;
  92         u8 *wmm_param;
  93         u8 *ht_cap_elem;
  94         u8 *ht_info_elem;
  95         /* length of them, respectively */
  96         u8 ssid_len;
  97         u8 supp_rates_len;
  98         u8 fh_params_len;
  99         u8 ds_params_len;
 100         u8 cf_params_len;
 101         u8 tim_len;
 102         u8 ibss_params_len;
 103         u8 challenge_len;
 104         u8 wpa_len;
 105         u8 rsn_len;
 106         u8 erp_info_len;
 107         u8 ext_supp_rates_len;
 108         u8 wmm_info_len;
 109         u8 wmm_param_len;
 110         u8 ht_cap_elem_len;
 111         u8 ht_info_elem_len;
 112 };
 113
 114 static void ieee802_11_parse_elems(u8 *start, size_t len,
 115                                    struct ieee802_11_elems *elems)
 116 {
 117         size_t left = len;
 118         u8 *pos = start;
 119
 120         memset(elems, 0, sizeof(*elems));
 121
 122         while (left >= 2) {
 123                 u8 id, elen;
 124
 125                 id = *pos++;
 126                 elen = *pos++;
 127                 left -= 2;
 128
 129                 if (elen > left)
 130                         return;
 131
 132                 switch (id) {
 133                 case WLAN_EID_SSID:
 134                         elems->ssid = pos;
 135                         elems->ssid_len = elen;
 136                         break;
 137                 case WLAN_EID_SUPP_RATES:
 138                         elems->supp_rates = pos;
 139                         elems->supp_rates_len = elen;
 140                         break;
 141                 case WLAN_EID_FH_PARAMS:
 142                         elems->fh_params = pos;
 143                         elems->fh_params_len = elen;
 144                         break;
 145                 case WLAN_EID_DS_PARAMS:
 146                         elems->ds_params = pos;
 147                         elems->ds_params_len = elen;
 148                         break;
 149                 case WLAN_EID_CF_PARAMS:
 150                         elems->cf_params = pos;
 151                         elems->cf_params_len = elen;
 152                         break;
 153                 case WLAN_EID_TIM:
 154                         elems->tim = pos;
 155                         elems->tim_len = elen;
 156                         break;
 157                 case WLAN_EID_IBSS_PARAMS:
 158                         elems->ibss_params = pos;
 159                         elems->ibss_params_len = elen;
 160                         break;
 161                 case WLAN_EID_CHALLENGE:
 162                         elems->challenge = pos;
 163                         elems->challenge_len = elen;
 164                         break;
 165                 case WLAN_EID_WPA:
 166                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 167                             pos[2] == 0xf2) {
 168                                 /* Microsoft OUI (00:50:F2) */
 169                                 if (pos[3] == 1) {
 170                                         /* OUI Type 1 - WPA IE */
 171                                         elems->wpa = pos;
 172                                         elems->wpa_len = elen;
 173                                 } else if (elen >= 5 && pos[3] == 2) {
 174                                         if (pos[4] == 0) {
 175                                                 elems->wmm_info = pos;
 176                                                 elems->wmm_info_len = elen;
 177                                         } else if (pos[4] == 1) {
 178                                                 elems->wmm_param = pos;
 179                                                 elems->wmm_param_len = elen;
 180                                         }
 181                                 }
 182                         }
 183                         break;
 184                 case WLAN_EID_RSN:
 185                         elems->rsn = pos;
 186                         elems->rsn_len = elen;
 187                         break;
 188                 case WLAN_EID_ERP_INFO:
 189                         elems->erp_info = pos;
 190                         elems->erp_info_len = elen;
 191                         break;
 192                 case WLAN_EID_EXT_SUPP_RATES:
 193                         elems->ext_supp_rates = pos;
 194                         elems->ext_supp_rates_len = elen;
 195                         break;
 196                 case WLAN_EID_HT_CAPABILITY:
 197                         elems->ht_cap_elem = pos;
 198                         elems->ht_cap_elem_len = elen;
 199                         break;
 200                 case WLAN_EID_HT_EXTRA_INFO:
 201                         elems->ht_info_elem = pos;
 202                         elems->ht_info_elem_len = elen;
 203                         break;
 204                 default:
 205                         break;
 206                 }
 207
 208                 left -= elen;
 209                 pos += elen;
 210         }
 211 }
 212
 213
 214 static int ecw2cw(int ecw)
 215 {
 216         int cw = 1;
 217         while (ecw > 0) {
 218                 cw <<= 1;
 219                 ecw--;
 220         }
 221         return cw - 1;
 222 }
 223
 224 static void ieee80211_sta_wmm_params(struct net_device *dev,
 225                                      struct ieee80211_if_sta *ifsta,
 226                                      u8 *wmm_param, size_t wmm_param_len)
 227 {
 228         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 229         struct ieee80211_tx_queue_params params;
 230         size_t left;
 231         int count;
 232         u8 *pos;
 233
 234         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 235                 return;
 236         count = wmm_param[6] & 0x0f;
 237         if (count == ifsta->wmm_last_param_set)
 238                 return;
 239         ifsta->wmm_last_param_set = count;
 240
 241         pos = wmm_param + 8;
 242         left = wmm_param_len - 8;
 243
 244         memset(&params, 0, sizeof(params));
 245
 246         if (!local->ops->conf_tx)
 247                 return;
 248
 249         local->wmm_acm = 0;
 250         for (; left >= 4; left -= 4, pos += 4) {
 251                 int aci = (pos[0] >> 5) & 0x03;
 252                 int acm = (pos[0] >> 4) & 0x01;
 253                 int queue;
 254
 255                 switch (aci) {
 256                 case 1:
 257                         queue = IEEE80211_TX_QUEUE_DATA3;
 258                         if (acm) {
 259                                 local->wmm_acm |= BIT(0) | BIT(3);
 260                         }
 261                         break;
 262                 case 2:
 263                         queue = IEEE80211_TX_QUEUE_DATA1;
 264                         if (acm) {
 265                                 local->wmm_acm |= BIT(4) | BIT(5);
 266                         }
 267                         break;
 268                 case 3:
 269                         queue = IEEE80211_TX_QUEUE_DATA0;
 270                         if (acm) {
 271                                 local->wmm_acm |= BIT(6) | BIT(7);
 272                         }
 273                         break;
 274                 case 0:
 275                 default:
 276                         queue = IEEE80211_TX_QUEUE_DATA2;
 277                         if (acm) {
 278                                 local->wmm_acm |= BIT(1) | BIT(2);
 279                         }
 280                         break;
 281                 }
 282
 283                 params.aifs = pos[0] & 0x0f;
 284                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 285                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 286                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 287                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 288                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 289                        "cWmin=%d cWmax=%d burst=%d\n",
 290                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
 291                        params.cw_max, params.burst_time);
 292                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 293                  * AC for now) */
 294                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 295                         printk(KERN_DEBUG "%s: failed to set TX queue "
 296                                "parameters for queue %d\n", dev->name, queue);
 297                 }
 298         }
 299 }
 300
 301
 302 static void ieee80211_handle_erp_ie(struct net_device *dev, u8 erp_value)
 303 {
 304         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 305         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 306         int use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 307         int preamble_mode = (erp_value & WLAN_ERP_BARKER_PREAMBLE) != 0;
 308         u8 changes = 0;
 309         DECLARE_MAC_BUF(mac);
 310
 311         if (use_protection != !!(sdata->flags & IEEE80211_SDATA_USE_PROTECTION)) {
 312                 if (net_ratelimit()) {
 313                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 314                                "%s)\n",
 315                                dev->name,
 316                                use_protection ? "enabled" : "disabled",
 317                                print_mac(mac, ifsta->bssid));
 318                 }
 319                 if (use_protection)
 320                         sdata->flags |= IEEE80211_SDATA_USE_PROTECTION;
 321                 else
 322                         sdata->flags &= ~IEEE80211_SDATA_USE_PROTECTION;
 323                 changes |= IEEE80211_ERP_CHANGE_PROTECTION;
 324         }
 325
 326         if (preamble_mode != !(sdata->flags & IEEE80211_SDATA_SHORT_PREAMBLE)) {
 327                 if (net_ratelimit()) {
 328                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 329                                " (BSSID=%s)\n",
 330                                dev->name,
 331                                (preamble_mode == WLAN_ERP_PREAMBLE_SHORT) ?
 332                                         "short" : "long",
 333                                print_mac(mac, ifsta->bssid));
 334                 }
 335                 if (preamble_mode)
 336                         sdata->flags &= ~IEEE80211_SDATA_SHORT_PREAMBLE;
 337                 else
 338                         sdata->flags |= IEEE80211_SDATA_SHORT_PREAMBLE;
 339                 changes |= IEEE80211_ERP_CHANGE_PREAMBLE;
 340         }
 341
 342         if (changes)
 343                 ieee80211_erp_info_change_notify(dev, changes);
 344 }
 345
 346 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
 347                                    struct ieee80211_ht_info *ht_info)
 348 {
 349
 350         if (ht_info == NULL)
 351                 return -EINVAL;
 352
 353         memset(ht_info, 0, sizeof(*ht_info));
 354
 355         if (ht_cap_ie) {
 356                 u8 ampdu_info = ht_cap_ie->ampdu_params_info;
 357
 358                 ht_info->ht_supported = 1;
 359                 ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
 360                 ht_info->ampdu_factor =
 361                         ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
 362                 ht_info->ampdu_density =
 363                         (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
 364                 memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
 365         } else
 366                 ht_info->ht_supported = 0;
 367
 368         return 0;
 369 }
 370
 371 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
 372                         struct ieee80211_ht_addt_info *ht_add_info_ie,
 373                         struct ieee80211_ht_bss_info *bss_info)
 374 {
 375         if (bss_info == NULL)
 376                 return -EINVAL;
 377
 378         memset(bss_info, 0, sizeof(*bss_info));
 379
 380         if (ht_add_info_ie) {
 381                 u16 op_mode;
 382                 op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
 383
 384                 bss_info->primary_channel = ht_add_info_ie->control_chan;
 385                 bss_info->bss_cap = ht_add_info_ie->ht_param;
 386                 bss_info->bss_op_mode = (u8)(op_mode & 0xff);
 387         }
 388
 389         return 0;
 390 }
 391
 392 static void ieee80211_sta_send_associnfo(struct net_device *dev,
 393                                          struct ieee80211_if_sta *ifsta)
 394 {
 395         char *buf;
 396         size_t len;
 397         int i;
 398         union iwreq_data wrqu;
 399
 400         if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
 401                 return;
 402
 403         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
 404                                 ifsta->assocresp_ies_len), GFP_KERNEL);
 405         if (!buf)
 406                 return;
 407
 408         len = sprintf(buf, "ASSOCINFO(");
 409         if (ifsta->assocreq_ies) {
 410                 len += sprintf(buf + len, "ReqIEs=");
 411                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
 412                         len += sprintf(buf + len, "%02x",
 413                                        ifsta->assocreq_ies[i]);
 414                 }
 415         }
 416         if (ifsta->assocresp_ies) {
 417                 if (ifsta->assocreq_ies)
 418                         len += sprintf(buf + len, " ");
 419                 len += sprintf(buf + len, "RespIEs=");
 420                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 421                         len += sprintf(buf + len, "%02x",
 422                                        ifsta->assocresp_ies[i]);
 423                 }
 424         }
 425         len += sprintf(buf + len, ")");
 426
 427         if (len > IW_CUSTOM_MAX) {
 428                 len = sprintf(buf, "ASSOCRESPIE=");
 429                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 430                         len += sprintf(buf + len, "%02x",
 431                                        ifsta->assocresp_ies[i]);
 432                 }
 433         }
 434
 435         memset(&wrqu, 0, sizeof(wrqu));
 436         wrqu.data.length = len;
 437         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 438
 439         kfree(buf);
 440 }
 441
 442
 443 static void ieee80211_set_associated(struct net_device *dev,
 444                                      struct ieee80211_if_sta *ifsta,
 445                                      bool assoc)
 446 {
 447         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 448         union iwreq_data wrqu;
 449
 450         if (!!(ifsta->flags & IEEE80211_STA_ASSOCIATED) == assoc)
 451                 return;
 452
 453         if (assoc) {
 454                 struct ieee80211_sub_if_data *sdata;
 455                 struct ieee80211_sta_bss *bss;
 456
 457                 ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 458
 459                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 460                 if (sdata->type != IEEE80211_IF_TYPE_STA)
 461                         return;
 462
 463                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
 464                                            local->hw.conf.channel,
 465                                            ifsta->ssid, ifsta->ssid_len);
 466                 if (bss) {
 467                         if (bss->has_erp_value)
 468                                 ieee80211_handle_erp_ie(dev, bss->erp_value);
 469                         ieee80211_rx_bss_put(dev, bss);
 470                 }
 471
 472                 netif_carrier_on(dev);
 473                 ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 474                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 475                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 476                 ieee80211_sta_send_associnfo(dev, ifsta);
 477         } else {
 478                 ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
 479
 480                 netif_carrier_off(dev);
 481                 ieee80211_reset_erp_info(dev);
 482                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 483         }
 484         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 485         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 486         ifsta->last_probe = jiffies;
 487         ieee80211_led_assoc(local, assoc);
 488 }
 489
 490 static void ieee80211_set_disassoc(struct net_device *dev,
 491                                    struct ieee80211_if_sta *ifsta, int deauth)
 492 {
 493         if (deauth)
 494                 ifsta->auth_tries = 0;
 495         ifsta->assoc_tries = 0;
 496         ieee80211_set_associated(dev, ifsta, 0);
 497 }
 498
 499 static void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
 500                              int encrypt)
 501 {
 502         struct ieee80211_sub_if_data *sdata;
 503         struct ieee80211_tx_packet_data *pkt_data;
 504
 505         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 506         skb->dev = sdata->local->mdev;
 507         skb_set_mac_header(skb, 0);
 508         skb_set_network_header(skb, 0);
 509         skb_set_transport_header(skb, 0);
 510
 511         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
 512         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
 513         pkt_data->ifindex = sdata->dev->ifindex;
 514         if (!encrypt)
 515                 pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
 516
 517         dev_queue_xmit(skb);
 518 }
 519
 520
 521 static void ieee80211_send_auth(struct net_device *dev,
 522                                 struct ieee80211_if_sta *ifsta,
 523                                 int transaction, u8 *extra, size_t extra_len,
 524                                 int encrypt)
 525 {
 526         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 527         struct sk_buff *skb;
 528         struct ieee80211_mgmt *mgmt;
 529
 530         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 531                             sizeof(*mgmt) + 6 + extra_len);
 532         if (!skb) {
 533                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 534                        "frame\n", dev->name);
 535                 return;
 536         }
 537         skb_reserve(skb, local->hw.extra_tx_headroom);
 538
 539         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 540         memset(mgmt, 0, 24 + 6);
 541         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 542                                            IEEE80211_STYPE_AUTH);
 543         if (encrypt)
 544                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 545         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 546         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 547         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 548         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 549         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 550         ifsta->auth_transaction = transaction + 1;
 551         mgmt->u.auth.status_code = cpu_to_le16(0);
 552         if (extra)
 553                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 554
 555         ieee80211_sta_tx(dev, skb, encrypt);
 556 }
 557
 558
 559 static void ieee80211_authenticate(struct net_device *dev,
 560                                    struct ieee80211_if_sta *ifsta)
 561 {
 562         DECLARE_MAC_BUF(mac);
 563
 564         ifsta->auth_tries++;
 565         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 566                 printk(KERN_DEBUG "%s: authentication with AP %s"
 567                        " timed out\n",
 568                        dev->name, print_mac(mac, ifsta->bssid));
 569                 ifsta->state = IEEE80211_DISABLED;
 570                 return;
 571         }
 572
 573         ifsta->state = IEEE80211_AUTHENTICATE;
 574         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
 575                dev->name, print_mac(mac, ifsta->bssid));
 576
 577         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
 578
 579         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 580 }
 581
 582
 583 static void ieee80211_send_assoc(struct net_device *dev,
 584                                  struct ieee80211_if_sta *ifsta)
 585 {
 586         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 587         struct ieee80211_hw_mode *mode;
 588         struct sk_buff *skb;
 589         struct ieee80211_mgmt *mgmt;
 590         u8 *pos, *ies;
 591         int i, len;
 592         u16 capab;
 593         struct ieee80211_sta_bss *bss;
 594         int wmm = 0;
 595
 596         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 597                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 598                             ifsta->ssid_len);
 599         if (!skb) {
 600                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 601                        "frame\n", dev->name);
 602                 return;
 603         }
 604         skb_reserve(skb, local->hw.extra_tx_headroom);
 605
 606         mode = local->oper_hw_mode;
 607         capab = ifsta->capab;
 608         if (mode->mode == MODE_IEEE80211G) {
 609                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 610                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 611         }
 612         bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
 613                                    ifsta->ssid, ifsta->ssid_len);
 614         if (bss) {
 615                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 616                         capab |= WLAN_CAPABILITY_PRIVACY;
 617                 if (bss->wmm_ie) {
 618                         wmm = 1;
 619                 }
 620                 ieee80211_rx_bss_put(dev, bss);
 621         }
 622
 623         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 624         memset(mgmt, 0, 24);
 625         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 626         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 627         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 628
 629         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 630                 skb_put(skb, 10);
 631                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 632                                                    IEEE80211_STYPE_REASSOC_REQ);
 633                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 634                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
 635                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 636                        ETH_ALEN);
 637         } else {
 638                 skb_put(skb, 4);
 639                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 640                                                    IEEE80211_STYPE_ASSOC_REQ);
 641                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 642                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
 643         }
 644
 645         /* SSID */
 646         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 647         *pos++ = WLAN_EID_SSID;
 648         *pos++ = ifsta->ssid_len;
 649         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 650
 651         len = mode->num_rates;
 652         if (len > 8)
 653                 len = 8;
 654         pos = skb_put(skb, len + 2);
 655         *pos++ = WLAN_EID_SUPP_RATES;
 656         *pos++ = len;
 657         for (i = 0; i < len; i++) {
 658                 int rate = mode->rates[i].rate;
 659                 *pos++ = (u8) (rate / 5);
 660         }
 661
 662         if (mode->num_rates > len) {
 663                 pos = skb_put(skb, mode->num_rates - len + 2);
 664                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 665                 *pos++ = mode->num_rates - len;
 666                 for (i = len; i < mode->num_rates; i++) {
 667                         int rate = mode->rates[i].rate;
 668                         *pos++ = (u8) (rate / 5);
 669                 }
 670         }
 671
 672         if (ifsta->extra_ie) {
 673                 pos = skb_put(skb, ifsta->extra_ie_len);
 674                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 675         }
 676
 677         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 678                 pos = skb_put(skb, 9);
 679                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 680                 *pos++ = 7; /* len */
 681                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 682                 *pos++ = 0x50;
 683                 *pos++ = 0xf2;
 684                 *pos++ = 2; /* WME */
 685                 *pos++ = 0; /* WME info */
 686                 *pos++ = 1; /* WME ver */
 687                 *pos++ = 0;
 688         }
 689         /* wmm support is a must to HT */
 690         if (wmm && mode->ht_info.ht_supported) {
 691                 __le16 tmp = cpu_to_le16(mode->ht_info.cap);
 692                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
 693                 *pos++ = WLAN_EID_HT_CAPABILITY;
 694                 *pos++ = sizeof(struct ieee80211_ht_cap);
 695                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
 696                 memcpy(pos, &tmp, sizeof(u16));
 697                 pos += sizeof(u16);
 698                 *pos++ = (mode->ht_info.ampdu_factor |
 699                                 (mode->ht_info.ampdu_density << 2));
 700                 memcpy(pos, mode->ht_info.supp_mcs_set, 16);
 701         }
 702
 703         kfree(ifsta->assocreq_ies);
 704         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 705         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 706         if (ifsta->assocreq_ies)
 707                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 708
 709         ieee80211_sta_tx(dev, skb, 0);
 710 }
 711
 712
 713 static void ieee80211_send_deauth(struct net_device *dev,
 714                                   struct ieee80211_if_sta *ifsta, u16 reason)
 715 {
 716         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 717         struct sk_buff *skb;
 718         struct ieee80211_mgmt *mgmt;
 719
 720         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 721         if (!skb) {
 722                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 723                        "frame\n", dev->name);
 724                 return;
 725         }
 726         skb_reserve(skb, local->hw.extra_tx_headroom);
 727
 728         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 729         memset(mgmt, 0, 24);
 730         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 731         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 732         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 733         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 734                                            IEEE80211_STYPE_DEAUTH);
 735         skb_put(skb, 2);
 736         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 737
 738         ieee80211_sta_tx(dev, skb, 0);
 739 }
 740
 741
 742 static void ieee80211_send_disassoc(struct net_device *dev,
 743                                     struct ieee80211_if_sta *ifsta, u16 reason)
 744 {
 745         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 746         struct sk_buff *skb;
 747         struct ieee80211_mgmt *mgmt;
 748
 749         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 750         if (!skb) {
 751                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 752                        "frame\n", dev->name);
 753                 return;
 754         }
 755         skb_reserve(skb, local->hw.extra_tx_headroom);
 756
 757         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 758         memset(mgmt, 0, 24);
 759         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 760         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 761         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 762         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 763                                            IEEE80211_STYPE_DISASSOC);
 764         skb_put(skb, 2);
 765         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 766
 767         ieee80211_sta_tx(dev, skb, 0);
 768 }
 769
 770
 771 static int ieee80211_privacy_mismatch(struct net_device *dev,
 772                                       struct ieee80211_if_sta *ifsta)
 773 {
 774         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 775         struct ieee80211_sta_bss *bss;
 776         int bss_privacy;
 777         int wep_privacy;
 778         int privacy_invoked;
 779
 780         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
 781                 return 0;
 782
 783         bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
 784                                    ifsta->ssid, ifsta->ssid_len);
 785         if (!bss)
 786                 return 0;
 787
 788         bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
 789         wep_privacy = !!ieee80211_sta_wep_configured(dev);
 790         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 791
 792         ieee80211_rx_bss_put(dev, bss);
 793
 794         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
 795                 return 0;
 796
 797         return 1;
 798 }
 799
 800
 801 static void ieee80211_associate(struct net_device *dev,
 802                                 struct ieee80211_if_sta *ifsta)
 803 {
 804         DECLARE_MAC_BUF(mac);
 805
 806         ifsta->assoc_tries++;
 807         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 808                 printk(KERN_DEBUG "%s: association with AP %s"
 809                        " timed out\n",
 810                        dev->name, print_mac(mac, ifsta->bssid));
 811                 ifsta->state = IEEE80211_DISABLED;
 812                 return;
 813         }
 814
 815         ifsta->state = IEEE80211_ASSOCIATE;
 816         printk(KERN_DEBUG "%s: associate with AP %s\n",
 817                dev->name, print_mac(mac, ifsta->bssid));
 818         if (ieee80211_privacy_mismatch(dev, ifsta)) {
 819                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 820                        "mixed-cell disabled - abort association\n", dev->name);
 821                 ifsta->state = IEEE80211_DISABLED;
 822                 return;
 823         }
 824
 825         ieee80211_send_assoc(dev, ifsta);
 826
 827         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 828 }
 829
 830
 831 static void ieee80211_associated(struct net_device *dev,
 832                                  struct ieee80211_if_sta *ifsta)
 833 {
 834         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 835         struct sta_info *sta;
 836         int disassoc;
 837         DECLARE_MAC_BUF(mac);
 838
 839         /* TODO: start monitoring current AP signal quality and number of
 840          * missed beacons. Scan other channels every now and then and search
 841          * for better APs. */
 842         /* TODO: remove expired BSSes */
 843
 844         ifsta->state = IEEE80211_ASSOCIATED;
 845
 846         sta = sta_info_get(local, ifsta->bssid);
 847         if (!sta) {
 848                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
 849                        dev->name, print_mac(mac, ifsta->bssid));
 850                 disassoc = 1;
 851         } else {
 852                 disassoc = 0;
 853                 if (time_after(jiffies,
 854                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 855                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
 856                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 857                                        "current AP %s - assume out of "
 858                                        "range\n",
 859                                        dev->name, print_mac(mac, ifsta->bssid));
 860                                 disassoc = 1;
 861                                 sta_info_free(sta);
 862                         } else
 863                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 864                                                          local->scan_ssid,
 865                                                          local->scan_ssid_len);
 866                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
 867                 } else {
 868                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 869                         if (time_after(jiffies, ifsta->last_probe +
 870                                        IEEE80211_PROBE_INTERVAL)) {
 871                                 ifsta->last_probe = jiffies;
 872                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 873                                                          ifsta->ssid,
 874                                                          ifsta->ssid_len);
 875                         }
 876                 }
 877                 sta_info_put(sta);
 878         }
 879         if (disassoc) {
 880                 ifsta->state = IEEE80211_DISABLED;
 881                 ieee80211_set_associated(dev, ifsta, 0);
 882         } else {
 883                 mod_timer(&ifsta->timer, jiffies +
 884                                       IEEE80211_MONITORING_INTERVAL);
 885         }
 886 }
 887
 888
 889 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 890                                      u8 *ssid, size_t ssid_len)
 891 {
 892         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 893         struct ieee80211_hw_mode *mode;
 894         struct sk_buff *skb;
 895         struct ieee80211_mgmt *mgmt;
 896         u8 *pos, *supp_rates, *esupp_rates = NULL;
 897         int i;
 898
 899         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 900         if (!skb) {
 901                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 902                        "request\n", dev->name);
 903                 return;
 904         }
 905         skb_reserve(skb, local->hw.extra_tx_headroom);
 906
 907         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 908         memset(mgmt, 0, 24);
 909         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 910                                            IEEE80211_STYPE_PROBE_REQ);
 911         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 912         if (dst) {
 913                 memcpy(mgmt->da, dst, ETH_ALEN);
 914                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 915         } else {
 916                 memset(mgmt->da, 0xff, ETH_ALEN);
 917                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 918         }
 919         pos = skb_put(skb, 2 + ssid_len);
 920         *pos++ = WLAN_EID_SSID;
 921         *pos++ = ssid_len;
 922         memcpy(pos, ssid, ssid_len);
 923
 924         supp_rates = skb_put(skb, 2);
 925         supp_rates[0] = WLAN_EID_SUPP_RATES;
 926         supp_rates[1] = 0;
 927         mode = local->oper_hw_mode;
 928         for (i = 0; i < mode->num_rates; i++) {
 929                 struct ieee80211_rate *rate = &mode->rates[i];
 930                 if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
 931                         continue;
 932                 if (esupp_rates) {
 933                         pos = skb_put(skb, 1);
 934                         esupp_rates[1]++;
 935                 } else if (supp_rates[1] == 8) {
 936                         esupp_rates = skb_put(skb, 3);
 937                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 938                         esupp_rates[1] = 1;
 939                         pos = &esupp_rates[2];
 940                 } else {
 941                         pos = skb_put(skb, 1);
 942                         supp_rates[1]++;
 943                 }
 944                 *pos = rate->rate / 5;
 945         }
 946
 947         ieee80211_sta_tx(dev, skb, 0);
 948 }
 949
 950
 951 static int ieee80211_sta_wep_configured(struct net_device *dev)
 952 {
 953         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 954         if (!sdata || !sdata->default_key ||
 955             sdata->default_key->conf.alg != ALG_WEP)
 956                 return 0;
 957         return 1;
 958 }
 959
 960
 961 static void ieee80211_auth_completed(struct net_device *dev,
 962                                      struct ieee80211_if_sta *ifsta)
 963 {
 964         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
 965         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
 966         ieee80211_associate(dev, ifsta);
 967 }
 968
 969
 970 static void ieee80211_auth_challenge(struct net_device *dev,
 971                                      struct ieee80211_if_sta *ifsta,
 972                                      struct ieee80211_mgmt *mgmt,
 973                                      size_t len)
 974 {
 975         u8 *pos;
 976         struct ieee802_11_elems elems;
 977
 978         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
 979         pos = mgmt->u.auth.variable;
 980         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 981         if (!elems.challenge) {
 982                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
 983                        "frame\n", dev->name);
 984                 return;
 985         }
 986         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
 987                             elems.challenge_len + 2, 1);
 988 }
 989
 990
 991 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
 992                                    struct ieee80211_if_sta *ifsta,
 993                                    struct ieee80211_mgmt *mgmt,
 994                                    size_t len)
 995 {
 996         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 997         u16 auth_alg, auth_transaction, status_code;
 998         DECLARE_MAC_BUF(mac);
 999
1000         if (ifsta->state != IEEE80211_AUTHENTICATE &&
1001             sdata->type != IEEE80211_IF_TYPE_IBSS) {
1002                 printk(KERN_DEBUG "%s: authentication frame received from "
1003                        "%s, but not in authenticate state - ignored\n",
1004                        dev->name, print_mac(mac, mgmt->sa));
1005                 return;
1006         }
1007
1008         if (len < 24 + 6) {
1009                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
1010                        "received from %s - ignored\n",
1011                        dev->name, len, print_mac(mac, mgmt->sa));
1012                 return;
1013         }
1014
1015         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
1016             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1017                 printk(KERN_DEBUG "%s: authentication frame received from "
1018                        "unknown AP (SA=%s BSSID=%s) - "
1019                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1020                        print_mac(mac, mgmt->bssid));
1021                 return;
1022         }
1023
1024         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
1025             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
1026                 printk(KERN_DEBUG "%s: authentication frame received from "
1027                        "unknown BSSID (SA=%s BSSID=%s) - "
1028                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1029                        print_mac(mac, mgmt->bssid));
1030                 return;
1031         }
1032
1033         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1034         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1035         status_code = le16_to_cpu(mgmt->u.auth.status_code);
1036
1037         printk(KERN_DEBUG "%s: RX authentication from %s (alg=%d "
1038                "transaction=%d status=%d)\n",
1039                dev->name, print_mac(mac, mgmt->sa), auth_alg,
1040                auth_transaction, status_code);
1041
1042         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
1043                 /* IEEE 802.11 standard does not require authentication in IBSS
1044                  * networks and most implementations do not seem to use it.
1045                  * However, try to reply to authentication attempts if someone
1046                  * has actually implemented this.
1047                  * TODO: Could implement shared key authentication. */
1048                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
1049                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
1050                                "frame (alg=%d transaction=%d)\n",
1051                                dev->name, auth_alg, auth_transaction);
1052                         return;
1053                 }
1054                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
1055         }
1056
1057         if (auth_alg != ifsta->auth_alg ||
1058             auth_transaction != ifsta->auth_transaction) {
1059                 printk(KERN_DEBUG "%s: unexpected authentication frame "
1060                        "(alg=%d transaction=%d)\n",
1061                        dev->name, auth_alg, auth_transaction);
1062                 return;
1063         }
1064
1065         if (status_code != WLAN_STATUS_SUCCESS) {
1066                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
1067                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
1068                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1069                         u8 algs[3];
1070                         const int num_algs = ARRAY_SIZE(algs);
1071                         int i, pos;
1072                         algs[0] = algs[1] = algs[2] = 0xff;
1073                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1074                                 algs[0] = WLAN_AUTH_OPEN;
1075                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1076                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1077                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1078                                 algs[2] = WLAN_AUTH_LEAP;
1079                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1080                                 pos = 0;
1081                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1082                                 pos = 1;
1083                         else
1084                                 pos = 2;
1085                         for (i = 0; i < num_algs; i++) {
1086                                 pos++;
1087                                 if (pos >= num_algs)
1088                                         pos = 0;
1089                                 if (algs[pos] == ifsta->auth_alg ||
1090                                     algs[pos] == 0xff)
1091                                         continue;
1092                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1093                                     !ieee80211_sta_wep_configured(dev))
1094                                         continue;
1095                                 ifsta->auth_alg = algs[pos];
1096                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
1097                                        "next try\n",
1098                                        dev->name, ifsta->auth_alg);
1099                                 break;
1100                         }
1101                 }
1102                 return;
1103         }
1104
1105         switch (ifsta->auth_alg) {
1106         case WLAN_AUTH_OPEN:
1107         case WLAN_AUTH_LEAP:
1108                 ieee80211_auth_completed(dev, ifsta);
1109                 break;
1110         case WLAN_AUTH_SHARED_KEY:
1111                 if (ifsta->auth_transaction == 4)
1112                         ieee80211_auth_completed(dev, ifsta);
1113                 else
1114                         ieee80211_auth_challenge(dev, ifsta, mgmt, len);
1115                 break;
1116         }
1117 }
1118
1119
1120 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
1121                                      struct ieee80211_if_sta *ifsta,
1122                                      struct ieee80211_mgmt *mgmt,
1123                                      size_t len)
1124 {
1125         u16 reason_code;
1126         DECLARE_MAC_BUF(mac);
1127
1128         if (len < 24 + 2) {
1129                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
1130                        "received from %s - ignored\n",
1131                        dev->name, len, print_mac(mac, mgmt->sa));
1132                 return;
1133         }
1134
1135         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1136                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1137                        "unknown AP (SA=%s BSSID=%s) - "
1138                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1139                        print_mac(mac, mgmt->bssid));
1140                 return;
1141         }
1142
1143         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1144
1145         printk(KERN_DEBUG "%s: RX deauthentication from %s"
1146                " (reason=%d)\n",
1147                dev->name, print_mac(mac, mgmt->sa), reason_code);
1148
1149         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED) {
1150                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1151         }
1152
1153         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1154             ifsta->state == IEEE80211_ASSOCIATE ||
1155             ifsta->state == IEEE80211_ASSOCIATED) {
1156                 ifsta->state = IEEE80211_AUTHENTICATE;
1157                 mod_timer(&ifsta->timer, jiffies +
1158                                       IEEE80211_RETRY_AUTH_INTERVAL);
1159         }
1160
1161         ieee80211_set_disassoc(dev, ifsta, 1);
1162         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1163 }
1164
1165
1166 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1167                                        struct ieee80211_if_sta *ifsta,
1168                                        struct ieee80211_mgmt *mgmt,
1169                                        size_t len)
1170 {
1171         u16 reason_code;
1172         DECLARE_MAC_BUF(mac);
1173
1174         if (len < 24 + 2) {
1175                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1176                        "received from %s - ignored\n",
1177                        dev->name, len, print_mac(mac, mgmt->sa));
1178                 return;
1179         }
1180
1181         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1182                 printk(KERN_DEBUG "%s: disassociation frame received from "
1183                        "unknown AP (SA=%s BSSID=%s) - "
1184                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1185                        print_mac(mac, mgmt->bssid));
1186                 return;
1187         }
1188
1189         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1190
1191         printk(KERN_DEBUG "%s: RX disassociation from %s"
1192                " (reason=%d)\n",
1193                dev->name, print_mac(mac, mgmt->sa), reason_code);
1194
1195         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1196                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1197
1198         if (ifsta->state == IEEE80211_ASSOCIATED) {
1199                 ifsta->state = IEEE80211_ASSOCIATE;
1200                 mod_timer(&ifsta->timer, jiffies +
1201                                       IEEE80211_RETRY_AUTH_INTERVAL);
1202         }
1203
1204         ieee80211_set_disassoc(dev, ifsta, 0);
1205 }
1206
1207
1208 static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
1209                                          struct ieee80211_if_sta *ifsta,
1210                                          struct ieee80211_mgmt *mgmt,
1211                                          size_t len,
1212                                          int reassoc)
1213 {
1214         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1215         struct ieee80211_hw_mode *mode;
1216         struct sta_info *sta;
1217         u32 rates;
1218         u16 capab_info, status_code, aid;
1219         struct ieee802_11_elems elems;
1220         u8 *pos;
1221         int i, j;
1222         DECLARE_MAC_BUF(mac);
1223
1224         /* AssocResp and ReassocResp have identical structure, so process both
1225          * of them in this function. */
1226
1227         if (ifsta->state != IEEE80211_ASSOCIATE) {
1228                 printk(KERN_DEBUG "%s: association frame received from "
1229                        "%s, but not in associate state - ignored\n",
1230                        dev->name, print_mac(mac, mgmt->sa));
1231                 return;
1232         }
1233
1234         if (len < 24 + 6) {
1235                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1236                        "received from %s - ignored\n",
1237                        dev->name, len, print_mac(mac, mgmt->sa));
1238                 return;
1239         }
1240
1241         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1242                 printk(KERN_DEBUG "%s: association frame received from "
1243                        "unknown AP (SA=%s BSSID=%s) - "
1244                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1245                        print_mac(mac, mgmt->bssid));
1246                 return;
1247         }
1248
1249         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1250         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1251         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1252
1253         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
1254                "status=%d aid=%d)\n",
1255                dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
1256                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
1257
1258         if (status_code != WLAN_STATUS_SUCCESS) {
1259                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1260                        dev->name, status_code);
1261                 /* if this was a reassociation, ensure we try a "full"
1262                  * association next time. This works around some broken APs
1263                  * which do not correctly reject reassociation requests. */
1264                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1265                 return;
1266         }
1267
1268         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1269                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1270                        "set\n", dev->name, aid);
1271         aid &= ~(BIT(15) | BIT(14));
1272
1273         pos = mgmt->u.assoc_resp.variable;
1274         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1275
1276         if (!elems.supp_rates) {
1277                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1278                        dev->name);
1279                 return;
1280         }
1281
1282         /* it probably doesn't, but if the frame includes an ERP value then
1283          * update our stored copy */
1284         if (elems.erp_info && elems.erp_info_len >= 1) {
1285                 struct ieee80211_sta_bss *bss
1286                         = ieee80211_rx_bss_get(dev, ifsta->bssid,
1287                                                local->hw.conf.channel,
1288                                                ifsta->ssid, ifsta->ssid_len);
1289                 if (bss) {
1290                         bss->erp_value = elems.erp_info[0];
1291                         bss->has_erp_value = 1;
1292                         ieee80211_rx_bss_put(dev, bss);
1293                 }
1294         }
1295
1296         printk(KERN_DEBUG "%s: associated\n", dev->name);
1297         ifsta->aid = aid;
1298         ifsta->ap_capab = capab_info;
1299
1300         kfree(ifsta->assocresp_ies);
1301         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1302         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1303         if (ifsta->assocresp_ies)
1304                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1305
1306         ieee80211_set_associated(dev, ifsta, 1);
1307
1308         /* Add STA entry for the AP */
1309         sta = sta_info_get(local, ifsta->bssid);
1310         if (!sta) {
1311                 struct ieee80211_sta_bss *bss;
1312                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
1313                 if (!sta) {
1314                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
1315                                " AP\n", dev->name);
1316                         return;
1317                 }
1318                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
1319                                            local->hw.conf.channel,
1320                                            ifsta->ssid, ifsta->ssid_len);
1321                 if (bss) {
1322                         sta->last_rssi = bss->rssi;
1323                         sta->last_signal = bss->signal;
1324                         sta->last_noise = bss->noise;
1325                         ieee80211_rx_bss_put(dev, bss);
1326                 }
1327         }
1328
1329         sta->dev = dev;
1330         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP;
1331
1332         rates = 0;
1333         mode = local->oper_hw_mode;
1334         for (i = 0; i < elems.supp_rates_len; i++) {
1335                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1336                 for (j = 0; j < mode->num_rates; j++)
1337                         if (mode->rates[j].rate == rate)
1338                                 rates |= BIT(j);
1339         }
1340         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1341                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1342                 for (j = 0; j < mode->num_rates; j++)
1343                         if (mode->rates[j].rate == rate)
1344                                 rates |= BIT(j);
1345         }
1346         sta->supp_rates = rates;
1347
1348         rate_control_rate_init(sta, local);
1349
1350         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1351                 sta->flags |= WLAN_STA_WME;
1352                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1353                                          elems.wmm_param_len);
1354         }
1355
1356
1357         sta_info_put(sta);
1358
1359         ieee80211_associated(dev, ifsta);
1360 }
1361
1362
1363 /* Caller must hold local->sta_bss_lock */
1364 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
1365                                         struct ieee80211_sta_bss *bss)
1366 {
1367         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1368         bss->hnext = local->sta_bss_hash[STA_HASH(bss->bssid)];
1369         local->sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1370 }
1371
1372
1373 /* Caller must hold local->sta_bss_lock */
1374 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
1375                                         struct ieee80211_sta_bss *bss)
1376 {
1377         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1378         struct ieee80211_sta_bss *b, *prev = NULL;
1379         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
1380         while (b) {
1381                 if (b == bss) {
1382                         if (!prev)
1383                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
1384                                         bss->hnext;
1385                         else
1386                                 prev->hnext = bss->hnext;
1387                         break;
1388                 }
1389                 prev = b;
1390                 b = b->hnext;
1391         }
1392 }
1393
1394
1395 static struct ieee80211_sta_bss *
1396 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
1397                      u8 *ssid, u8 ssid_len)
1398 {
1399         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1400         struct ieee80211_sta_bss *bss;
1401
1402         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
1403         if (!bss)
1404                 return NULL;
1405         atomic_inc(&bss->users);
1406         atomic_inc(&bss->users);
1407         memcpy(bss->bssid, bssid, ETH_ALEN);
1408         bss->channel = channel;
1409         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
1410                 memcpy(bss->ssid, ssid, ssid_len);
1411                 bss->ssid_len = ssid_len;
1412         }
1413
1414         spin_lock_bh(&local->sta_bss_lock);
1415         /* TODO: order by RSSI? */
1416         list_add_tail(&bss->list, &local->sta_bss_list);
1417         __ieee80211_rx_bss_hash_add(dev, bss);
1418         spin_unlock_bh(&local->sta_bss_lock);
1419         return bss;
1420 }
1421
1422
1423 static struct ieee80211_sta_bss *
1424 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
1425                      u8 *ssid, u8 ssid_len)
1426 {
1427         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1428         struct ieee80211_sta_bss *bss;
1429
1430         spin_lock_bh(&local->sta_bss_lock);
1431         bss = local->sta_bss_hash[STA_HASH(bssid)];
1432         while (bss) {
1433                 if (!memcmp(bss->bssid, bssid, ETH_ALEN) &&
1434                     bss->channel == channel &&
1435                     bss->ssid_len == ssid_len &&
1436                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
1437                         atomic_inc(&bss->users);
1438                         break;
1439                 }
1440                 bss = bss->hnext;
1441         }
1442         spin_unlock_bh(&local->sta_bss_lock);
1443         return bss;
1444 }
1445
1446
1447 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
1448 {
1449         kfree(bss->wpa_ie);
1450         kfree(bss->rsn_ie);
1451         kfree(bss->wmm_ie);
1452         kfree(bss->ht_ie);
1453         kfree(bss);
1454 }
1455
1456
1457 static void ieee80211_rx_bss_put(struct net_device *dev,
1458                                  struct ieee80211_sta_bss *bss)
1459 {
1460         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1461         if (!atomic_dec_and_test(&bss->users))
1462                 return;
1463
1464         spin_lock_bh(&local->sta_bss_lock);
1465         __ieee80211_rx_bss_hash_del(dev, bss);
1466         list_del(&bss->list);
1467         spin_unlock_bh(&local->sta_bss_lock);
1468         ieee80211_rx_bss_free(bss);
1469 }
1470
1471
1472 void ieee80211_rx_bss_list_init(struct net_device *dev)
1473 {
1474         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1475         spin_lock_init(&local->sta_bss_lock);
1476         INIT_LIST_HEAD(&local->sta_bss_list);
1477 }
1478
1479
1480 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
1481 {
1482         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1483         struct ieee80211_sta_bss *bss, *tmp;
1484
1485         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
1486                 ieee80211_rx_bss_put(dev, bss);
1487 }
1488
1489
1490 static void ieee80211_rx_bss_info(struct net_device *dev,
1491                                   struct ieee80211_mgmt *mgmt,
1492                                   size_t len,
1493                                   struct ieee80211_rx_status *rx_status,
1494                                   int beacon)
1495 {
1496         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1497         struct ieee802_11_elems elems;
1498         size_t baselen;
1499         int channel, clen;
1500         struct ieee80211_sta_bss *bss;
1501         struct sta_info *sta;
1502         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1503         u64 timestamp;
1504         DECLARE_MAC_BUF(mac);
1505         DECLARE_MAC_BUF(mac2);
1506
1507         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
1508                 return; /* ignore ProbeResp to foreign address */
1509
1510 #if 0
1511         printk(KERN_DEBUG "%s: RX %s from %s to %s\n",
1512                dev->name, beacon ? "Beacon" : "Probe Response",
1513                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da));
1514 #endif
1515
1516         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1517         if (baselen > len)
1518                 return;
1519
1520         timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
1521
1522         if (sdata->type == IEEE80211_IF_TYPE_IBSS && beacon &&
1523             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
1524 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1525                 static unsigned long last_tsf_debug = 0;
1526                 u64 tsf;
1527                 if (local->ops->get_tsf)
1528                         tsf = local->ops->get_tsf(local_to_hw(local));
1529                 else
1530                         tsf = -1LLU;
1531                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1532                         printk(KERN_DEBUG "RX beacon SA=%s BSSID="
1533                                "%s TSF=0x%llx BCN=0x%llx diff=%lld "
1534                                "@%lu\n",
1535                                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->bssid),
1536                                (unsigned long long)tsf,
1537                                (unsigned long long)timestamp,
1538                                (unsigned long long)(tsf - timestamp),
1539                                jiffies);
1540                         last_tsf_debug = jiffies;
1541                 }
1542 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1543         }
1544
1545         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
1546
1547         if (sdata->type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
1548             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
1549             (sta = sta_info_get(local, mgmt->sa))) {
1550                 struct ieee80211_hw_mode *mode;
1551                 struct ieee80211_rate *rates;
1552                 size_t num_rates;
1553                 u32 supp_rates, prev_rates;
1554                 int i, j;
1555
1556                 mode = local->sta_sw_scanning ?
1557                        local->scan_hw_mode : local->oper_hw_mode;
1558
1559                 if (local->sta_hw_scanning) {
1560                         /* search for the correct mode matches the beacon */
1561                         list_for_each_entry(mode, &local->modes_list, list)
1562                                 if (mode->mode == rx_status->phymode)
1563                                         break;
1564
1565                         if (mode == NULL)
1566                                 mode = local->oper_hw_mode;
1567                 }
1568                 rates = mode->rates;
1569                 num_rates = mode->num_rates;
1570
1571                 supp_rates = 0;
1572                 for (i = 0; i < elems.supp_rates_len +
1573                              elems.ext_supp_rates_len; i++) {
1574                         u8 rate = 0;
1575                         int own_rate;
1576                         if (i < elems.supp_rates_len)
1577                                 rate = elems.supp_rates[i];
1578                         else if (elems.ext_supp_rates)
1579                                 rate = elems.ext_supp_rates
1580                                         [i - elems.supp_rates_len];
1581                         own_rate = 5 * (rate & 0x7f);
1582                         for (j = 0; j < num_rates; j++)
1583                                 if (rates[j].rate == own_rate)
1584                                         supp_rates |= BIT(j);
1585                 }
1586
1587                 prev_rates = sta->supp_rates;
1588                 sta->supp_rates &= supp_rates;
1589                 if (sta->supp_rates == 0) {
1590                         /* No matching rates - this should not really happen.
1591                          * Make sure that at least one rate is marked
1592                          * supported to avoid issues with TX rate ctrl. */
1593                         sta->supp_rates = sdata->u.sta.supp_rates_bits;
1594                 }
1595                 if (sta->supp_rates != prev_rates) {
1596                         printk(KERN_DEBUG "%s: updated supp_rates set for "
1597                                "%s based on beacon info (0x%x & 0x%x -> "
1598                                "0x%x)\n",
1599                                dev->name, print_mac(mac, sta->addr), prev_rates,
1600                                supp_rates, sta->supp_rates);
1601                 }
1602                 sta_info_put(sta);
1603         }
1604
1605         if (!elems.ssid)
1606                 return;
1607
1608         if (elems.ds_params && elems.ds_params_len == 1)
1609                 channel = elems.ds_params[0];
1610         else
1611                 channel = rx_status->channel;
1612
1613         bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel,
1614                                    elems.ssid, elems.ssid_len);
1615         if (!bss) {
1616                 bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel,
1617                                            elems.ssid, elems.ssid_len);
1618                 if (!bss)
1619                         return;
1620         } else {
1621 #if 0
1622                 /* TODO: order by RSSI? */
1623                 spin_lock_bh(&local->sta_bss_lock);
1624                 list_move_tail(&bss->list, &local->sta_bss_list);
1625                 spin_unlock_bh(&local->sta_bss_lock);
1626 #endif
1627         }
1628
1629         if (bss->probe_resp && beacon) {
1630                 /* Do not allow beacon to override data from Probe Response. */
1631                 ieee80211_rx_bss_put(dev, bss);
1632                 return;
1633         }
1634
1635         /* save the ERP value so that it is available at association time */
1636         if (elems.erp_info && elems.erp_info_len >= 1) {
1637                 bss->erp_value = elems.erp_info[0];
1638                 bss->has_erp_value = 1;
1639         }
1640
1641         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
1642         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
1643
1644         bss->supp_rates_len = 0;
1645         if (elems.supp_rates) {
1646                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1647                 if (clen > elems.supp_rates_len)
1648                         clen = elems.supp_rates_len;
1649                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
1650                        clen);
1651                 bss->supp_rates_len += clen;
1652         }
1653         if (elems.ext_supp_rates) {
1654                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1655                 if (clen > elems.ext_supp_rates_len)
1656                         clen = elems.ext_supp_rates_len;
1657                 memcpy(&bss->supp_rates[bss->supp_rates_len],
1658                        elems.ext_supp_rates, clen);
1659                 bss->supp_rates_len += clen;
1660         }
1661
1662         if (elems.wpa &&
1663             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
1664              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1665                 kfree(bss->wpa_ie);
1666                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
1667                 if (bss->wpa_ie) {
1668                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
1669                         bss->wpa_ie_len = elems.wpa_len + 2;
1670                 } else
1671                         bss->wpa_ie_len = 0;
1672         } else if (!elems.wpa && bss->wpa_ie) {
1673                 kfree(bss->wpa_ie);
1674                 bss->wpa_ie = NULL;
1675                 bss->wpa_ie_len = 0;
1676         }
1677
1678         if (elems.rsn &&
1679             (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
1680              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1681                 kfree(bss->rsn_ie);
1682                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
1683                 if (bss->rsn_ie) {
1684                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
1685                         bss->rsn_ie_len = elems.rsn_len + 2;
1686                 } else
1687                         bss->rsn_ie_len = 0;
1688         } else if (!elems.rsn && bss->rsn_ie) {
1689                 kfree(bss->rsn_ie);
1690                 bss->rsn_ie = NULL;
1691                 bss->rsn_ie_len = 0;
1692         }
1693
1694         if (elems.wmm_param &&
1695             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
1696              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1697                 kfree(bss->wmm_ie);
1698                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
1699                 if (bss->wmm_ie) {
1700                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
1701                                elems.wmm_param_len + 2);
1702                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1703                 } else
1704                         bss->wmm_ie_len = 0;
1705         } else if (!elems.wmm_param && bss->wmm_ie) {
1706                 kfree(bss->wmm_ie);
1707                 bss->wmm_ie = NULL;
1708                 bss->wmm_ie_len = 0;
1709         }
1710         if (elems.ht_cap_elem &&
1711             (!bss->ht_ie || bss->ht_ie_len != elems.ht_cap_elem_len ||
1712              memcmp(bss->ht_ie, elems.ht_cap_elem, elems.ht_cap_elem_len))) {
1713                 kfree(bss->ht_ie);
1714                 bss->ht_ie = kmalloc(elems.ht_cap_elem_len + 2, GFP_ATOMIC);
1715                 if (bss->ht_ie) {
1716                         memcpy(bss->ht_ie, elems.ht_cap_elem - 2,
1717                                elems.ht_cap_elem_len + 2);
1718                         bss->ht_ie_len = elems.ht_cap_elem_len + 2;
1719                 } else
1720                         bss->ht_ie_len = 0;
1721         } else if (!elems.ht_cap_elem && bss->ht_ie) {
1722                 kfree(bss->ht_ie);
1723                 bss->ht_ie = NULL;
1724                 bss->ht_ie_len = 0;
1725         }
1726
1727         bss->hw_mode = rx_status->phymode;
1728         bss->freq = rx_status->freq;
1729         if (channel != rx_status->channel &&
1730             (bss->hw_mode == MODE_IEEE80211G ||
1731              bss->hw_mode == MODE_IEEE80211B) &&
1732             channel >= 1 && channel <= 14) {
1733                 static const int freq_list[] = {
1734                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1735                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1736                 };
1737                 /* IEEE 802.11g/b mode can receive packets from neighboring
1738                  * channels, so map the channel into frequency. */
1739                 bss->freq = freq_list[channel - 1];
1740         }
1741         bss->timestamp = timestamp;
1742         bss->last_update = jiffies;
1743         bss->rssi = rx_status->ssi;
1744         bss->signal = rx_status->signal;
1745         bss->noise = rx_status->noise;
1746         if (!beacon)
1747                 bss->probe_resp++;
1748         ieee80211_rx_bss_put(dev, bss);
1749 }
1750
1751
1752 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
1753                                          struct ieee80211_mgmt *mgmt,
1754                                          size_t len,
1755                                          struct ieee80211_rx_status *rx_status)
1756 {
1757         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
1758 }
1759
1760
1761 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
1762                                      struct ieee80211_mgmt *mgmt,
1763                                      size_t len,
1764                                      struct ieee80211_rx_status *rx_status)
1765 {
1766         struct ieee80211_sub_if_data *sdata;
1767         struct ieee80211_if_sta *ifsta;
1768         size_t baselen;
1769         struct ieee802_11_elems elems;
1770
1771         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
1772
1773         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1774         if (sdata->type != IEEE80211_IF_TYPE_STA)
1775                 return;
1776         ifsta = &sdata->u.sta;
1777
1778         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
1779             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1780                 return;
1781
1782         /* Process beacon from the current BSS */
1783         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1784         if (baselen > len)
1785                 return;
1786
1787         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
1788
1789         if (elems.erp_info && elems.erp_info_len >= 1)
1790                 ieee80211_handle_erp_ie(dev, elems.erp_info[0]);
1791
1792         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1793                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1794                                          elems.wmm_param_len);
1795         }
1796 }
1797
1798
1799 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
1800                                         struct ieee80211_if_sta *ifsta,
1801                                         struct ieee80211_mgmt *mgmt,
1802                                         size_t len,
1803                                         struct ieee80211_rx_status *rx_status)
1804 {
1805         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1806         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1807         int tx_last_beacon;
1808         struct sk_buff *skb;
1809         struct ieee80211_mgmt *resp;
1810         u8 *pos, *end;
1811         DECLARE_MAC_BUF(mac);
1812 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1813         DECLARE_MAC_BUF(mac2);
1814         DECLARE_MAC_BUF(mac3);
1815 #endif
1816
1817         if (sdata->type != IEEE80211_IF_TYPE_IBSS ||
1818             ifsta->state != IEEE80211_IBSS_JOINED ||
1819             len < 24 + 2 || !ifsta->probe_resp)
1820                 return;
1821
1822         if (local->ops->tx_last_beacon)
1823                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
1824         else
1825                 tx_last_beacon = 1;
1826
1827 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1828         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
1829                "%s (tx_last_beacon=%d)\n",
1830                dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
1831                print_mac(mac3, mgmt->bssid), tx_last_beacon);
1832 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1833
1834         if (!tx_last_beacon)
1835                 return;
1836
1837         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
1838             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1839                 return;
1840
1841         end = ((u8 *) mgmt) + len;
1842         pos = mgmt->u.probe_req.variable;
1843         if (pos[0] != WLAN_EID_SSID ||
1844             pos + 2 + pos[1] > end) {
1845                 if (net_ratelimit()) {
1846                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
1847                                "from %s\n",
1848                                dev->name, print_mac(mac, mgmt->sa));
1849                 }
1850                 return;
1851         }
1852         if (pos[1] != 0 &&
1853             (pos[1] != ifsta->ssid_len ||
1854              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
1855                 /* Ignore ProbeReq for foreign SSID */
1856                 return;
1857         }
1858
1859         /* Reply with ProbeResp */
1860         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
1861         if (!skb)
1862                 return;
1863
1864         resp = (struct ieee80211_mgmt *) skb->data;
1865         memcpy(resp->da, mgmt->sa, ETH_ALEN);
1866 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1867         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
1868                dev->name, print_mac(mac, resp->da));
1869 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1870         ieee80211_sta_tx(dev, skb, 0);
1871 }
1872
1873
1874 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
1875                            struct ieee80211_rx_status *rx_status)
1876 {
1877         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1878         struct ieee80211_sub_if_data *sdata;
1879         struct ieee80211_if_sta *ifsta;
1880         struct ieee80211_mgmt *mgmt;
1881         u16 fc;
1882
1883         if (skb->len < 24)
1884                 goto fail;
1885
1886         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1887         ifsta = &sdata->u.sta;
1888
1889         mgmt = (struct ieee80211_mgmt *) skb->data;
1890         fc = le16_to_cpu(mgmt->frame_control);
1891
1892         switch (fc & IEEE80211_FCTL_STYPE) {
1893         case IEEE80211_STYPE_PROBE_REQ:
1894         case IEEE80211_STYPE_PROBE_RESP:
1895         case IEEE80211_STYPE_BEACON:
1896                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
1897         case IEEE80211_STYPE_AUTH:
1898         case IEEE80211_STYPE_ASSOC_RESP:
1899         case IEEE80211_STYPE_REASSOC_RESP:
1900         case IEEE80211_STYPE_DEAUTH:
1901         case IEEE80211_STYPE_DISASSOC:
1902                 skb_queue_tail(&ifsta->skb_queue, skb);
1903                 queue_work(local->hw.workqueue, &ifsta->work);
1904                 return;
1905         default:
1906                 printk(KERN_DEBUG "%s: received unknown management frame - "
1907                        "stype=%d\n", dev->name,
1908                        (fc & IEEE80211_FCTL_STYPE) >> 4);
1909                 break;
1910         }
1911
1912  fail:
1913         kfree_skb(skb);
1914 }
1915
1916
1917 static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
1918                                          struct sk_buff *skb)
1919 {
1920         struct ieee80211_rx_status *rx_status;
1921         struct ieee80211_sub_if_data *sdata;
1922         struct ieee80211_if_sta *ifsta;
1923         struct ieee80211_mgmt *mgmt;
1924         u16 fc;
1925
1926         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1927         ifsta = &sdata->u.sta;
1928
1929         rx_status = (struct ieee80211_rx_status *) skb->cb;
1930         mgmt = (struct ieee80211_mgmt *) skb->data;
1931         fc = le16_to_cpu(mgmt->frame_control);
1932
1933         switch (fc & IEEE80211_FCTL_STYPE) {
1934         case IEEE80211_STYPE_PROBE_REQ:
1935                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
1936                                             rx_status);
1937                 break;
1938         case IEEE80211_STYPE_PROBE_RESP:
1939                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
1940                 break;
1941         case IEEE80211_STYPE_BEACON:
1942                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
1943                 break;
1944         case IEEE80211_STYPE_AUTH:
1945                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
1946                 break;
1947         case IEEE80211_STYPE_ASSOC_RESP:
1948                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 0);
1949                 break;
1950         case IEEE80211_STYPE_REASSOC_RESP:
1951                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 1);
1952                 break;
1953         case IEEE80211_STYPE_DEAUTH:
1954                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
1955                 break;
1956         case IEEE80211_STYPE_DISASSOC:
1957                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
1958                 break;
1959         }
1960
1961         kfree_skb(skb);
1962 }
1963
1964
1965 ieee80211_txrx_result
1966 ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
1967                       struct ieee80211_rx_status *rx_status)
1968 {
1969         struct ieee80211_mgmt *mgmt;
1970         u16 fc;
1971
1972         if (skb->len < 2)
1973                 return TXRX_DROP;
1974
1975         mgmt = (struct ieee80211_mgmt *) skb->data;
1976         fc = le16_to_cpu(mgmt->frame_control);
1977
1978         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
1979                 return TXRX_CONTINUE;
1980
1981         if (skb->len < 24)
1982                 return TXRX_DROP;
1983
1984         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1985                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
1986                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
1987                                                      skb->len, rx_status);
1988                         dev_kfree_skb(skb);
1989                         return TXRX_QUEUED;
1990                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
1991                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
1992                                                  rx_status);
1993                         dev_kfree_skb(skb);
1994                         return TXRX_QUEUED;
1995                 }
1996         }
1997         return TXRX_CONTINUE;
1998 }
1999
2000
2001 static int ieee80211_sta_active_ibss(struct net_device *dev)
2002 {
2003         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2004         int active = 0;
2005         struct sta_info *sta;
2006
2007         read_lock_bh(&local->sta_lock);
2008         list_for_each_entry(sta, &local->sta_list, list) {
2009                 if (sta->dev == dev &&
2010                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2011                                jiffies)) {
2012                         active++;
2013                         break;
2014                 }
2015         }
2016         read_unlock_bh(&local->sta_lock);
2017
2018         return active;
2019 }
2020
2021
2022 static void ieee80211_sta_expire(struct net_device *dev)
2023 {
2024         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2025         struct sta_info *sta, *tmp;
2026         LIST_HEAD(tmp_list);
2027         DECLARE_MAC_BUF(mac);
2028
2029         write_lock_bh(&local->sta_lock);
2030         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
2031                 if (time_after(jiffies, sta->last_rx +
2032                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2033                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
2034                                dev->name, print_mac(mac, sta->addr));
2035                         __sta_info_get(sta);
2036                         sta_info_remove(sta);
2037                         list_add(&sta->list, &tmp_list);
2038                 }
2039         write_unlock_bh(&local->sta_lock);
2040
2041         list_for_each_entry_safe(sta, tmp, &tmp_list, list) {
2042                 sta_info_free(sta);
2043                 sta_info_put(sta);
2044         }
2045 }
2046
2047
2048 static void ieee80211_sta_merge_ibss(struct net_device *dev,
2049                                      struct ieee80211_if_sta *ifsta)
2050 {
2051         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2052
2053         ieee80211_sta_expire(dev);
2054         if (ieee80211_sta_active_ibss(dev))
2055                 return;
2056
2057         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
2058                "IBSS networks with same SSID (merge)\n", dev->name);
2059         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
2060 }
2061
2062
2063 void ieee80211_sta_timer(unsigned long data)
2064 {
2065         struct ieee80211_sub_if_data *sdata =
2066                 (struct ieee80211_sub_if_data *) data;
2067         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2068         struct ieee80211_local *local = wdev_priv(&sdata->wdev);
2069
2070         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2071         queue_work(local->hw.workqueue, &ifsta->work);
2072 }
2073
2074
2075 void ieee80211_sta_work(struct work_struct *work)
2076 {
2077         struct ieee80211_sub_if_data *sdata =
2078                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
2079         struct net_device *dev = sdata->dev;
2080         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2081         struct ieee80211_if_sta *ifsta;
2082         struct sk_buff *skb;
2083
2084         if (!netif_running(dev))
2085                 return;
2086
2087         if (local->sta_sw_scanning || local->sta_hw_scanning)
2088                 return;
2089
2090         if (sdata->type != IEEE80211_IF_TYPE_STA &&
2091             sdata->type != IEEE80211_IF_TYPE_IBSS) {
2092                 printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
2093                        "(type=%d)\n", dev->name, sdata->type);
2094                 return;
2095         }
2096         ifsta = &sdata->u.sta;
2097
2098         while ((skb = skb_dequeue(&ifsta->skb_queue)))
2099                 ieee80211_sta_rx_queued_mgmt(dev, skb);
2100
2101         if (ifsta->state != IEEE80211_AUTHENTICATE &&
2102             ifsta->state != IEEE80211_ASSOCIATE &&
2103             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
2104                 if (ifsta->scan_ssid_len)
2105                         ieee80211_sta_start_scan(dev, ifsta->scan_ssid, ifsta->scan_ssid_len);
2106                 else
2107                         ieee80211_sta_start_scan(dev, NULL, 0);
2108                 return;
2109         }
2110
2111         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
2112                 if (ieee80211_sta_config_auth(dev, ifsta))
2113                         return;
2114                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2115         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
2116                 return;
2117
2118         switch (ifsta->state) {
2119         case IEEE80211_DISABLED:
2120                 break;
2121         case IEEE80211_AUTHENTICATE:
2122                 ieee80211_authenticate(dev, ifsta);
2123                 break;
2124         case IEEE80211_ASSOCIATE:
2125                 ieee80211_associate(dev, ifsta);
2126                 break;
2127         case IEEE80211_ASSOCIATED:
2128                 ieee80211_associated(dev, ifsta);
2129                 break;
2130         case IEEE80211_IBSS_SEARCH:
2131                 ieee80211_sta_find_ibss(dev, ifsta);
2132                 break;
2133         case IEEE80211_IBSS_JOINED:
2134                 ieee80211_sta_merge_ibss(dev, ifsta);
2135                 break;
2136         default:
2137                 printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
2138                        ifsta->state);
2139                 break;
2140         }
2141
2142         if (ieee80211_privacy_mismatch(dev, ifsta)) {
2143                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
2144                        "mixed-cell disabled - disassociate\n", dev->name);
2145
2146                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
2147                 ieee80211_set_disassoc(dev, ifsta, 0);
2148         }
2149 }
2150
2151
2152 static void ieee80211_sta_reset_auth(struct net_device *dev,
2153                                      struct ieee80211_if_sta *ifsta)
2154 {
2155         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2156
2157         if (local->ops->reset_tsf) {
2158                 /* Reset own TSF to allow time synchronization work. */
2159                 local->ops->reset_tsf(local_to_hw(local));
2160         }
2161
2162         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
2163
2164
2165         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
2166                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2167         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2168                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
2169         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
2170                 ifsta->auth_alg = WLAN_AUTH_LEAP;
2171         else
2172                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2173         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
2174                ifsta->auth_alg);
2175         ifsta->auth_transaction = -1;
2176         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
2177         ifsta->auth_tries = ifsta->assoc_tries = 0;
2178         netif_carrier_off(dev);
2179 }
2180
2181
2182 void ieee80211_sta_req_auth(struct net_device *dev,
2183                             struct ieee80211_if_sta *ifsta)
2184 {
2185         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2186         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2187
2188         if (sdata->type != IEEE80211_IF_TYPE_STA)
2189                 return;
2190
2191         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
2192                                 IEEE80211_STA_AUTO_BSSID_SEL)) &&
2193             (ifsta->flags & (IEEE80211_STA_SSID_SET |
2194                                 IEEE80211_STA_AUTO_SSID_SEL))) {
2195                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2196                 queue_work(local->hw.workqueue, &ifsta->work);
2197         }
2198 }
2199
2200 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
2201                                     const char *ssid, int ssid_len)
2202 {
2203         int tmp, hidden_ssid;
2204
2205         if (ssid_len == ifsta->ssid_len &&
2206             !memcmp(ifsta->ssid, ssid, ssid_len))
2207                 return 1;
2208
2209         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
2210                 return 0;
2211
2212         hidden_ssid = 1;
2213         tmp = ssid_len;
2214         while (tmp--) {
2215                 if (ssid[tmp] != '\0') {
2216                         hidden_ssid = 0;
2217                         break;
2218                 }
2219         }
2220
2221         if (hidden_ssid && ifsta->ssid_len == ssid_len)
2222                 return 1;
2223
2224         if (ssid_len == 1 && ssid[0] == ' ')
2225                 return 1;
2226
2227         return 0;
2228 }
2229
2230 static int ieee80211_sta_config_auth(struct net_device *dev,
2231                                      struct ieee80211_if_sta *ifsta)
2232 {
2233         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2234         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2235         struct ieee80211_sta_bss *bss, *selected = NULL;
2236         int top_rssi = 0, freq;
2237
2238         if (!(ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
2239             IEEE80211_STA_AUTO_BSSID_SEL | IEEE80211_STA_AUTO_CHANNEL_SEL))) {
2240                 ifsta->state = IEEE80211_AUTHENTICATE;
2241                 ieee80211_sta_reset_auth(dev, ifsta);
2242                 return 0;
2243         }
2244
2245         spin_lock_bh(&local->sta_bss_lock);
2246         freq = local->oper_channel->freq;
2247         list_for_each_entry(bss, &local->sta_bss_list, list) {
2248                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
2249                         continue;
2250
2251                 if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
2252                     !!sdata->default_key)
2253                         continue;
2254
2255                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
2256                     bss->freq != freq)
2257                         continue;
2258
2259                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
2260                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
2261                         continue;
2262
2263                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
2264                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
2265                         continue;
2266
2267                 if (!selected || top_rssi < bss->rssi) {
2268                         selected = bss;
2269                         top_rssi = bss->rssi;
2270                 }
2271         }
2272         if (selected)
2273                 atomic_inc(&selected->users);
2274         spin_unlock_bh(&local->sta_bss_lock);
2275
2276         if (selected) {
2277                 ieee80211_set_channel(local, -1, selected->freq);
2278                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
2279                         ieee80211_sta_set_ssid(dev, selected->ssid,
2280                                                selected->ssid_len);
2281                 ieee80211_sta_set_bssid(dev, selected->bssid);
2282                 ieee80211_rx_bss_put(dev, selected);
2283                 ifsta->state = IEEE80211_AUTHENTICATE;
2284                 ieee80211_sta_reset_auth(dev, ifsta);
2285                 return 0;
2286         } else {
2287                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
2288                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
2289                                 ieee80211_sta_start_scan(dev, NULL, 0);
2290                         else
2291                                 ieee80211_sta_start_scan(dev, ifsta->ssid,
2292                                                          ifsta->ssid_len);
2293                         ifsta->state = IEEE80211_AUTHENTICATE;
2294                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2295                 } else
2296                         ifsta->state = IEEE80211_DISABLED;
2297         }
2298         return -1;
2299 }
2300
2301 static int ieee80211_sta_join_ibss(struct net_device *dev,
2302                                    struct ieee80211_if_sta *ifsta,
2303                                    struct ieee80211_sta_bss *bss)
2304 {
2305         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2306         int res, rates, i, j;
2307         struct sk_buff *skb;
2308         struct ieee80211_mgmt *mgmt;
2309         struct ieee80211_tx_control control;
2310         struct ieee80211_rate *rate;
2311         struct ieee80211_hw_mode *mode;
2312         struct rate_control_extra extra;
2313         u8 *pos;
2314         struct ieee80211_sub_if_data *sdata;
2315
2316         /* Remove possible STA entries from other IBSS networks. */
2317         sta_info_flush(local, NULL);
2318
2319         if (local->ops->reset_tsf) {
2320                 /* Reset own TSF to allow time synchronization work. */
2321                 local->ops->reset_tsf(local_to_hw(local));
2322         }
2323         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2324         res = ieee80211_if_config(dev);
2325         if (res)
2326                 return res;
2327
2328         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2329
2330         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2331         sdata->drop_unencrypted = bss->capability &
2332                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2333
2334         res = ieee80211_set_channel(local, -1, bss->freq);
2335
2336         if (!(local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)) {
2337                 printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
2338                        "(%d MHz)\n", dev->name, local->hw.conf.channel,
2339                        local->hw.conf.freq);
2340                 return -1;
2341         }
2342
2343         /* Set beacon template based on scan results */
2344         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2345         do {
2346                 if (!skb)
2347                         break;
2348
2349                 skb_reserve(skb, local->hw.extra_tx_headroom);
2350
2351                 mgmt = (struct ieee80211_mgmt *)
2352                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2353                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2354                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2355                                                    IEEE80211_STYPE_BEACON);
2356                 memset(mgmt->da, 0xff, ETH_ALEN);
2357                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2358                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2359                 mgmt->u.beacon.beacon_int =
2360                         cpu_to_le16(local->hw.conf.beacon_int);
2361                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2362
2363                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2364                 *pos++ = WLAN_EID_SSID;
2365                 *pos++ = ifsta->ssid_len;
2366                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2367
2368                 rates = bss->supp_rates_len;
2369                 if (rates > 8)
2370                         rates = 8;
2371                 pos = skb_put(skb, 2 + rates);
2372                 *pos++ = WLAN_EID_SUPP_RATES;
2373                 *pos++ = rates;
2374                 memcpy(pos, bss->supp_rates, rates);
2375
2376                 pos = skb_put(skb, 2 + 1);
2377                 *pos++ = WLAN_EID_DS_PARAMS;
2378                 *pos++ = 1;
2379                 *pos++ = bss->channel;
2380
2381                 pos = skb_put(skb, 2 + 2);
2382                 *pos++ = WLAN_EID_IBSS_PARAMS;
2383                 *pos++ = 2;
2384                 /* FIX: set ATIM window based on scan results */
2385                 *pos++ = 0;
2386                 *pos++ = 0;
2387
2388                 if (bss->supp_rates_len > 8) {
2389                         rates = bss->supp_rates_len - 8;
2390                         pos = skb_put(skb, 2 + rates);
2391                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2392                         *pos++ = rates;
2393                         memcpy(pos, &bss->supp_rates[8], rates);
2394                 }
2395
2396                 memset(&control, 0, sizeof(control));
2397                 memset(&extra, 0, sizeof(extra));
2398                 extra.mode = local->oper_hw_mode;
2399                 rate = rate_control_get_rate(local, dev, skb, &extra);
2400                 if (!rate) {
2401                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2402                                "for IBSS beacon\n", dev->name);
2403                         break;
2404                 }
2405                 control.tx_rate =
2406                         ((sdata->flags & IEEE80211_SDATA_SHORT_PREAMBLE) &&
2407                         (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2408                         rate->val2 : rate->val;
2409                 control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
2410                 control.power_level = local->hw.conf.power_level;
2411                 control.flags |= IEEE80211_TXCTL_NO_ACK;
2412                 control.retry_limit = 1;
2413
2414                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2415                 if (ifsta->probe_resp) {
2416                         mgmt = (struct ieee80211_mgmt *)
2417                                 ifsta->probe_resp->data;
2418                         mgmt->frame_control =
2419                                 IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2420                                              IEEE80211_STYPE_PROBE_RESP);
2421                 } else {
2422                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2423                                "template for IBSS\n", dev->name);
2424                 }
2425
2426                 if (local->ops->beacon_update &&
2427                     local->ops->beacon_update(local_to_hw(local),
2428                                              skb, &control) == 0) {
2429                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2430                                "template based on scan results\n", dev->name);
2431                         skb = NULL;
2432                 }
2433
2434                 rates = 0;
2435                 mode = local->oper_hw_mode;
2436                 for (i = 0; i < bss->supp_rates_len; i++) {
2437                         int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2438                         for (j = 0; j < mode->num_rates; j++)
2439                                 if (mode->rates[j].rate == bitrate)
2440                                         rates |= BIT(j);
2441                 }
2442                 ifsta->supp_rates_bits = rates;
2443         } while (0);
2444
2445         if (skb) {
2446                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2447                        "template\n", dev->name);
2448                 dev_kfree_skb(skb);
2449         }
2450
2451         ifsta->state = IEEE80211_IBSS_JOINED;
2452         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2453
2454         ieee80211_rx_bss_put(dev, bss);
2455
2456         return res;
2457 }
2458
2459
2460 static int ieee80211_sta_create_ibss(struct net_device *dev,
2461                                      struct ieee80211_if_sta *ifsta)
2462 {
2463         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2464         struct ieee80211_sta_bss *bss;
2465         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2466         struct ieee80211_hw_mode *mode;
2467         u8 bssid[ETH_ALEN], *pos;
2468         int i;
2469         DECLARE_MAC_BUF(mac);
2470
2471 #if 0
2472         /* Easier testing, use fixed BSSID. */
2473         memset(bssid, 0xfe, ETH_ALEN);
2474 #else
2475         /* Generate random, not broadcast, locally administered BSSID. Mix in
2476          * own MAC address to make sure that devices that do not have proper
2477          * random number generator get different BSSID. */
2478         get_random_bytes(bssid, ETH_ALEN);
2479         for (i = 0; i < ETH_ALEN; i++)
2480                 bssid[i] ^= dev->dev_addr[i];
2481         bssid[0] &= ~0x01;
2482         bssid[0] |= 0x02;
2483 #endif
2484
2485         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
2486                dev->name, print_mac(mac, bssid));
2487
2488         bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel,
2489                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
2490         if (!bss)
2491                 return -ENOMEM;
2492
2493         mode = local->oper_hw_mode;
2494
2495         if (local->hw.conf.beacon_int == 0)
2496                 local->hw.conf.beacon_int = 100;
2497         bss->beacon_int = local->hw.conf.beacon_int;
2498         bss->hw_mode = local->hw.conf.phymode;
2499         bss->freq = local->hw.conf.freq;
2500         bss->last_update = jiffies;
2501         bss->capability = WLAN_CAPABILITY_IBSS;
2502         if (sdata->default_key) {
2503                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
2504         } else
2505                 sdata->drop_unencrypted = 0;
2506         bss->supp_rates_len = mode->num_rates;
2507         pos = bss->supp_rates;
2508         for (i = 0; i < mode->num_rates; i++) {
2509                 int rate = mode->rates[i].rate;
2510                 *pos++ = (u8) (rate / 5);
2511         }
2512
2513         return ieee80211_sta_join_ibss(dev, ifsta, bss);
2514 }
2515
2516
2517 static int ieee80211_sta_find_ibss(struct net_device *dev,
2518                                    struct ieee80211_if_sta *ifsta)
2519 {
2520         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2521         struct ieee80211_sta_bss *bss;
2522         int found = 0;
2523         u8 bssid[ETH_ALEN];
2524         int active_ibss;
2525         DECLARE_MAC_BUF(mac);
2526         DECLARE_MAC_BUF(mac2);
2527
2528         if (ifsta->ssid_len == 0)
2529                 return -EINVAL;
2530
2531         active_ibss = ieee80211_sta_active_ibss(dev);
2532 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2533         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2534                dev->name, active_ibss);
2535 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2536         spin_lock_bh(&local->sta_bss_lock);
2537         list_for_each_entry(bss, &local->sta_bss_list, list) {
2538                 if (ifsta->ssid_len != bss->ssid_len ||
2539                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2540                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2541                         continue;
2542 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2543                 printk(KERN_DEBUG "   bssid=%s found\n",
2544                        print_mac(mac, bss->bssid));
2545 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2546                 memcpy(bssid, bss->bssid, ETH_ALEN);
2547                 found = 1;
2548                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2549                         break;
2550         }
2551         spin_unlock_bh(&local->sta_bss_lock);
2552
2553 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2554         printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
2555                "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
2556 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2557         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
2558             (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel,
2559                                         ifsta->ssid, ifsta->ssid_len))) {
2560                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
2561                        " based on configured SSID\n",
2562                        dev->name, print_mac(mac, bssid));
2563                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
2564         }
2565 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2566         printk(KERN_DEBUG "   did not try to join ibss\n");
2567 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2568
2569         /* Selected IBSS not found in current scan results - try to scan */
2570         if (ifsta->state == IEEE80211_IBSS_JOINED &&
2571             !ieee80211_sta_active_ibss(dev)) {
2572                 mod_timer(&ifsta->timer, jiffies +
2573                                       IEEE80211_IBSS_MERGE_INTERVAL);
2574         } else if (time_after(jiffies, local->last_scan_completed +
2575                               IEEE80211_SCAN_INTERVAL)) {
2576                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
2577                        "join\n", dev->name);
2578                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
2579                                               ifsta->ssid_len);
2580         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
2581                 int interval = IEEE80211_SCAN_INTERVAL;
2582
2583                 if (time_after(jiffies, ifsta->ibss_join_req +
2584                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2585                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
2586                             local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)
2587                                 return ieee80211_sta_create_ibss(dev, ifsta);
2588                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
2589                                 printk(KERN_DEBUG "%s: IBSS not allowed on the"
2590                                        " configured channel %d (%d MHz)\n",
2591                                        dev->name, local->hw.conf.channel,
2592                                        local->hw.conf.freq);
2593                         }
2594
2595                         /* No IBSS found - decrease scan interval and continue
2596                          * scanning. */
2597                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2598                 }
2599
2600                 ifsta->state = IEEE80211_IBSS_SEARCH;
2601                 mod_timer(&ifsta->timer, jiffies + interval);
2602                 return 0;
2603         }
2604
2605         return 0;
2606 }
2607
2608
2609 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
2610 {
2611         struct ieee80211_sub_if_data *sdata;
2612         struct ieee80211_if_sta *ifsta;
2613         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2614
2615         if (len > IEEE80211_MAX_SSID_LEN)
2616                 return -EINVAL;
2617
2618         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2619          * not defined. */
2620         if (local->ops->conf_tx) {
2621                 struct ieee80211_tx_queue_params qparam;
2622                 int i;
2623
2624                 memset(&qparam, 0, sizeof(qparam));
2625                 /* TODO: are these ok defaults for all hw_modes? */
2626                 qparam.aifs = 2;
2627                 qparam.cw_min =
2628                         local->hw.conf.phymode == MODE_IEEE80211B ? 31 : 15;
2629                 qparam.cw_max = 1023;
2630                 qparam.burst_time = 0;
2631                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2632                 {
2633                         local->ops->conf_tx(local_to_hw(local),
2634                                            i + IEEE80211_TX_QUEUE_DATA0,
2635                                            &qparam);
2636                 }
2637                 /* IBSS uses different parameters for Beacon sending */
2638                 qparam.cw_min++;
2639                 qparam.cw_min *= 2;
2640                 qparam.cw_min--;
2641                 local->ops->conf_tx(local_to_hw(local),
2642                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
2643         }
2644
2645         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2646         ifsta = &sdata->u.sta;
2647
2648         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
2649                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
2650         memcpy(ifsta->ssid, ssid, len);
2651         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
2652         ifsta->ssid_len = len;
2653
2654         if (len)
2655                 ifsta->flags |= IEEE80211_STA_SSID_SET;
2656         else
2657                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
2658         if (sdata->type == IEEE80211_IF_TYPE_IBSS &&
2659             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
2660                 ifsta->ibss_join_req = jiffies;
2661                 ifsta->state = IEEE80211_IBSS_SEARCH;
2662                 return ieee80211_sta_find_ibss(dev, ifsta);
2663         }
2664         return 0;
2665 }
2666
2667
2668 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
2669 {
2670         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2671         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2672         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
2673         *len = ifsta->ssid_len;
2674         return 0;
2675 }
2676
2677
2678 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
2679 {
2680         struct ieee80211_sub_if_data *sdata;
2681         struct ieee80211_if_sta *ifsta;
2682         int res;
2683
2684         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2685         ifsta = &sdata->u.sta;
2686
2687         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
2688                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
2689                 res = ieee80211_if_config(dev);
2690                 if (res) {
2691                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
2692                                "the low-level driver\n", dev->name);
2693                         return res;
2694                 }
2695         }
2696
2697         if (is_valid_ether_addr(bssid))
2698                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
2699         else
2700                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
2701
2702         return 0;
2703 }
2704
2705
2706 static void ieee80211_send_nullfunc(struct ieee80211_local *local,
2707                                     struct ieee80211_sub_if_data *sdata,
2708                                     int powersave)
2709 {
2710         struct sk_buff *skb;
2711         struct ieee80211_hdr *nullfunc;
2712         u16 fc;
2713
2714         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
2715         if (!skb) {
2716                 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
2717                        "frame\n", sdata->dev->name);
2718                 return;
2719         }
2720         skb_reserve(skb, local->hw.extra_tx_headroom);
2721
2722         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
2723         memset(nullfunc, 0, 24);
2724         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
2725              IEEE80211_FCTL_TODS;
2726         if (powersave)
2727                 fc |= IEEE80211_FCTL_PM;
2728         nullfunc->frame_control = cpu_to_le16(fc);
2729         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
2730         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
2731         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
2732
2733         ieee80211_sta_tx(sdata->dev, skb, 0);
2734 }
2735
2736
2737 void ieee80211_scan_completed(struct ieee80211_hw *hw)
2738 {
2739         struct ieee80211_local *local = hw_to_local(hw);
2740         struct net_device *dev = local->scan_dev;
2741         struct ieee80211_sub_if_data *sdata;
2742         union iwreq_data wrqu;
2743
2744         local->last_scan_completed = jiffies;
2745         memset(&wrqu, 0, sizeof(wrqu));
2746         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2747
2748         if (local->sta_hw_scanning) {
2749                 local->sta_hw_scanning = 0;
2750                 goto done;
2751         }
2752
2753         local->sta_sw_scanning = 0;
2754         if (ieee80211_hw_config(local))
2755                 printk(KERN_DEBUG "%s: failed to restore operational "
2756                        "channel after scan\n", dev->name);
2757
2758
2759         netif_tx_lock_bh(local->mdev);
2760         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
2761         local->ops->configure_filter(local_to_hw(local),
2762                                      FIF_BCN_PRBRESP_PROMISC,
2763                                      &local->filter_flags,
2764                                      local->mdev->mc_count,
2765                                      local->mdev->mc_list);
2766
2767         netif_tx_unlock_bh(local->mdev);
2768
2769         rcu_read_lock();
2770         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2771
2772                 /* No need to wake the master device. */
2773                 if (sdata->dev == local->mdev)
2774                         continue;
2775
2776                 if (sdata->type == IEEE80211_IF_TYPE_STA) {
2777                         if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
2778                                 ieee80211_send_nullfunc(local, sdata, 0);
2779                         ieee80211_sta_timer((unsigned long)sdata);
2780                 }
2781
2782                 netif_wake_queue(sdata->dev);
2783         }
2784         rcu_read_unlock();
2785
2786 done:
2787         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2788         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
2789                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2790                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
2791                     (!ifsta->state == IEEE80211_IBSS_JOINED &&
2792                     !ieee80211_sta_active_ibss(dev)))
2793                         ieee80211_sta_find_ibss(dev, ifsta);
2794         }
2795 }
2796 EXPORT_SYMBOL(ieee80211_scan_completed);
2797
2798 void ieee80211_sta_scan_work(struct work_struct *work)
2799 {
2800         struct ieee80211_local *local =
2801                 container_of(work, struct ieee80211_local, scan_work.work);
2802         struct net_device *dev = local->scan_dev;
2803         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2804         struct ieee80211_hw_mode *mode;
2805         struct ieee80211_channel *chan;
2806         int skip;
2807         unsigned long next_delay = 0;
2808
2809         if (!local->sta_sw_scanning)
2810                 return;
2811
2812         switch (local->scan_state) {
2813         case SCAN_SET_CHANNEL:
2814                 mode = local->scan_hw_mode;
2815                 if (local->scan_hw_mode->list.next == &local->modes_list &&
2816                     local->scan_channel_idx >= mode->num_channels) {
2817                         ieee80211_scan_completed(local_to_hw(local));
2818                         return;
2819                 }
2820                 skip = !(local->enabled_modes & (1 << mode->mode));
2821                 chan = &mode->channels[local->scan_channel_idx];
2822                 if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
2823                     (sdata->type == IEEE80211_IF_TYPE_IBSS &&
2824                      !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
2825                     (local->hw_modes & local->enabled_modes &
2826                      (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
2827                         skip = 1;
2828
2829                 if (!skip) {
2830 #if 0
2831                         printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
2832                                dev->name, chan->chan, chan->freq);
2833 #endif
2834
2835                         local->scan_channel = chan;
2836                         if (ieee80211_hw_config(local)) {
2837                                 printk(KERN_DEBUG "%s: failed to set channel "
2838                                        "%d (%d MHz) for scan\n", dev->name,
2839                                        chan->chan, chan->freq);
2840                                 skip = 1;
2841                         }
2842                 }
2843
2844                 local->scan_channel_idx++;
2845                 if (local->scan_channel_idx >= local->scan_hw_mode->num_channels) {
2846                         if (local->scan_hw_mode->list.next != &local->modes_list) {
2847                                 local->scan_hw_mode = list_entry(local->scan_hw_mode->list.next,
2848                                                                  struct ieee80211_hw_mode,
2849                                                                  list);
2850                                 local->scan_channel_idx = 0;
2851                         }
2852                 }
2853
2854                 if (skip)
2855                         break;
2856
2857                 next_delay = IEEE80211_PROBE_DELAY +
2858                              usecs_to_jiffies(local->hw.channel_change_time);
2859                 local->scan_state = SCAN_SEND_PROBE;
2860                 break;
2861         case SCAN_SEND_PROBE:
2862                 if (local->scan_channel->flag & IEEE80211_CHAN_W_ACTIVE_SCAN) {
2863                         ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
2864                                                  local->scan_ssid_len);
2865                         next_delay = IEEE80211_CHANNEL_TIME;
2866                 } else
2867                         next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
2868                 local->scan_state = SCAN_SET_CHANNEL;
2869                 break;
2870         }
2871
2872         if (local->sta_sw_scanning)
2873                 queue_delayed_work(local->hw.workqueue, &local->scan_work,
2874                                    next_delay);
2875 }
2876
2877
2878 static int ieee80211_sta_start_scan(struct net_device *dev,
2879                                     u8 *ssid, size_t ssid_len)
2880 {
2881         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2882         struct ieee80211_sub_if_data *sdata;
2883
2884         if (ssid_len > IEEE80211_MAX_SSID_LEN)
2885                 return -EINVAL;
2886
2887         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2888          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2889          * BSSID: MACAddress
2890          * SSID
2891          * ScanType: ACTIVE, PASSIVE
2892          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2893          *    a Probe frame during active scanning
2894          * ChannelList
2895          * MinChannelTime (>= ProbeDelay), in TU
2896          * MaxChannelTime: (>= MinChannelTime), in TU
2897          */
2898
2899          /* MLME-SCAN.confirm
2900           * BSSDescriptionSet
2901           * ResultCode: SUCCESS, INVALID_PARAMETERS
2902          */
2903
2904         if (local->sta_sw_scanning || local->sta_hw_scanning) {
2905                 if (local->scan_dev == dev)
2906                         return 0;
2907                 return -EBUSY;
2908         }
2909
2910         if (local->ops->hw_scan) {
2911                 int rc = local->ops->hw_scan(local_to_hw(local),
2912                                              ssid, ssid_len);
2913                 if (!rc) {
2914                         local->sta_hw_scanning = 1;
2915                         local->scan_dev = dev;
2916                 }
2917                 return rc;
2918         }
2919
2920         local->sta_sw_scanning = 1;
2921
2922         rcu_read_lock();
2923         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2924
2925                 /* Don't stop the master interface, otherwise we can't transmit
2926                  * probes! */
2927                 if (sdata->dev == local->mdev)
2928                         continue;
2929
2930                 netif_stop_queue(sdata->dev);
2931                 if (sdata->type == IEEE80211_IF_TYPE_STA &&
2932                     (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
2933                         ieee80211_send_nullfunc(local, sdata, 1);
2934         }
2935         rcu_read_unlock();
2936
2937         if (ssid) {
2938                 local->scan_ssid_len = ssid_len;
2939                 memcpy(local->scan_ssid, ssid, ssid_len);
2940         } else
2941                 local->scan_ssid_len = 0;
2942         local->scan_state = SCAN_SET_CHANNEL;
2943         local->scan_hw_mode = list_entry(local->modes_list.next,
2944                                          struct ieee80211_hw_mode,
2945                                          list);
2946         local->scan_channel_idx = 0;
2947         local->scan_dev = dev;
2948
2949         netif_tx_lock_bh(local->mdev);
2950         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
2951         local->ops->configure_filter(local_to_hw(local),
2952                                      FIF_BCN_PRBRESP_PROMISC,
2953                                      &local->filter_flags,
2954                                      local->mdev->mc_count,
2955                                      local->mdev->mc_list);
2956         netif_tx_unlock_bh(local->mdev);
2957
2958         /* TODO: start scan as soon as all nullfunc frames are ACKed */
2959         queue_delayed_work(local->hw.workqueue, &local->scan_work,
2960                            IEEE80211_CHANNEL_TIME);
2961
2962         return 0;
2963 }
2964
2965
2966 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
2967 {
2968         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2969         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2970         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2971
2972         if (sdata->type != IEEE80211_IF_TYPE_STA)
2973                 return ieee80211_sta_start_scan(dev, ssid, ssid_len);
2974
2975         if (local->sta_sw_scanning || local->sta_hw_scanning) {
2976                 if (local->scan_dev == dev)
2977                         return 0;
2978                 return -EBUSY;
2979         }
2980
2981         ifsta->scan_ssid_len = ssid_len;
2982         if (ssid_len)
2983                 memcpy(ifsta->scan_ssid, ssid, ssid_len);
2984         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
2985         queue_work(local->hw.workqueue, &ifsta->work);
2986         return 0;
2987 }
2988
2989 static char *
2990 ieee80211_sta_scan_result(struct net_device *dev,
2991                           struct ieee80211_sta_bss *bss,
2992                           char *current_ev, char *end_buf)
2993 {
2994         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2995         struct iw_event iwe;
2996
2997         if (time_after(jiffies,
2998                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
2999                 return current_ev;
3000
3001         if (!(local->enabled_modes & (1 << bss->hw_mode)))
3002                 return current_ev;
3003
3004         memset(&iwe, 0, sizeof(iwe));
3005         iwe.cmd = SIOCGIWAP;
3006         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
3007         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
3008         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3009                                           IW_EV_ADDR_LEN);
3010
3011         memset(&iwe, 0, sizeof(iwe));
3012         iwe.cmd = SIOCGIWESSID;
3013         iwe.u.data.length = bss->ssid_len;
3014         iwe.u.data.flags = 1;
3015         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3016                                           bss->ssid);
3017
3018         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
3019                 memset(&iwe, 0, sizeof(iwe));
3020                 iwe.cmd = SIOCGIWMODE;
3021                 if (bss->capability & WLAN_CAPABILITY_ESS)
3022                         iwe.u.mode = IW_MODE_MASTER;
3023                 else
3024                         iwe.u.mode = IW_MODE_ADHOC;
3025                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3026                                                   IW_EV_UINT_LEN);
3027         }
3028
3029         memset(&iwe, 0, sizeof(iwe));
3030         iwe.cmd = SIOCGIWFREQ;
3031         iwe.u.freq.m = bss->channel;
3032         iwe.u.freq.e = 0;
3033         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3034                                           IW_EV_FREQ_LEN);
3035         iwe.u.freq.m = bss->freq * 100000;
3036         iwe.u.freq.e = 1;
3037         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3038                                           IW_EV_FREQ_LEN);
3039
3040         memset(&iwe, 0, sizeof(iwe));
3041         iwe.cmd = IWEVQUAL;
3042         iwe.u.qual.qual = bss->signal;
3043         iwe.u.qual.level = bss->rssi;
3044         iwe.u.qual.noise = bss->noise;
3045         iwe.u.qual.updated = local->wstats_flags;
3046         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3047                                           IW_EV_QUAL_LEN);
3048
3049         memset(&iwe, 0, sizeof(iwe));
3050         iwe.cmd = SIOCGIWENCODE;
3051         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
3052                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
3053         else
3054                 iwe.u.data.flags = IW_ENCODE_DISABLED;
3055         iwe.u.data.length = 0;
3056         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
3057
3058         if (bss && bss->wpa_ie) {
3059                 memset(&iwe, 0, sizeof(iwe));
3060                 iwe.cmd = IWEVGENIE;
3061                 iwe.u.data.length = bss->wpa_ie_len;
3062                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3063                                                   bss->wpa_ie);
3064         }
3065
3066         if (bss && bss->rsn_ie) {
3067                 memset(&iwe, 0, sizeof(iwe));
3068                 iwe.cmd = IWEVGENIE;
3069                 iwe.u.data.length = bss->rsn_ie_len;
3070                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3071                                                   bss->rsn_ie);
3072         }
3073
3074         if (bss && bss->supp_rates_len > 0) {
3075                 /* display all supported rates in readable format */
3076                 char *p = current_ev + IW_EV_LCP_LEN;
3077                 int i;
3078
3079                 memset(&iwe, 0, sizeof(iwe));
3080                 iwe.cmd = SIOCGIWRATE;
3081                 /* Those two flags are ignored... */
3082                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3083
3084                 for (i = 0; i < bss->supp_rates_len; i++) {
3085                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
3086                                                         0x7f) * 500000);
3087                         p = iwe_stream_add_value(current_ev, p,
3088                                         end_buf, &iwe, IW_EV_PARAM_LEN);
3089                 }
3090                 current_ev = p;
3091         }
3092
3093         if (bss) {
3094                 char *buf;
3095                 buf = kmalloc(30, GFP_ATOMIC);
3096                 if (buf) {
3097                         memset(&iwe, 0, sizeof(iwe));
3098                         iwe.cmd = IWEVCUSTOM;
3099                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
3100                         iwe.u.data.length = strlen(buf);
3101                         current_ev = iwe_stream_add_point(current_ev, end_buf,
3102                                                           &iwe, buf);
3103                         kfree(buf);
3104                 }
3105         }
3106
3107         do {
3108                 char *buf;
3109
3110                 buf = kmalloc(100, GFP_ATOMIC);
3111                 if (!buf)
3112                         break;
3113
3114                 memset(&iwe, 0, sizeof(iwe));
3115                 iwe.cmd = IWEVCUSTOM;
3116                 sprintf(buf, "bcn_int=%d", bss->beacon_int);
3117                 iwe.u.data.length = strlen(buf);
3118                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3119                                                   buf);
3120
3121                 memset(&iwe, 0, sizeof(iwe));
3122                 iwe.cmd = IWEVCUSTOM;
3123                 sprintf(buf, "capab=0x%04x", bss->capability);
3124                 iwe.u.data.length = strlen(buf);
3125                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3126                                                   buf);
3127
3128                 kfree(buf);
3129                 break;
3130         } while (0);
3131
3132         return current_ev;
3133 }
3134
3135
3136 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
3137 {
3138         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3139         char *current_ev = buf;
3140         char *end_buf = buf + len;
3141         struct ieee80211_sta_bss *bss;
3142
3143         spin_lock_bh(&local->sta_bss_lock);
3144         list_for_each_entry(bss, &local->sta_bss_list, list) {
3145                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3146                         spin_unlock_bh(&local->sta_bss_lock);
3147                         return -E2BIG;
3148                 }
3149                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
3150                                                        end_buf);
3151         }
3152         spin_unlock_bh(&local->sta_bss_lock);
3153         return current_ev - buf;
3154 }
3155
3156
3157 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
3158 {
3159         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3160         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3161         kfree(ifsta->extra_ie);
3162         if (len == 0) {
3163                 ifsta->extra_ie = NULL;
3164                 ifsta->extra_ie_len = 0;
3165                 return 0;
3166         }
3167         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3168         if (!ifsta->extra_ie) {
3169                 ifsta->extra_ie_len = 0;
3170                 return -ENOMEM;
3171         }
3172         memcpy(ifsta->extra_ie, ie, len);
3173         ifsta->extra_ie_len = len;
3174         return 0;
3175 }
3176
3177
3178 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
3179                                          struct sk_buff *skb, u8 *bssid,
3180                                          u8 *addr)
3181 {
3182         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3183         struct sta_info *sta;
3184         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3185         DECLARE_MAC_BUF(mac);
3186
3187         /* TODO: Could consider removing the least recently used entry and
3188          * allow new one to be added. */
3189         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3190                 if (net_ratelimit()) {
3191                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3192                                "entry %s\n", dev->name, print_mac(mac, addr));
3193                 }
3194                 return NULL;
3195         }
3196
3197         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
3198                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
3199
3200         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
3201         if (!sta)
3202                 return NULL;
3203
3204         sta->supp_rates = sdata->u.sta.supp_rates_bits;
3205
3206         rate_control_rate_init(sta, local);
3207
3208         return sta; /* caller will call sta_info_put() */
3209 }
3210
3211
3212 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
3213 {
3214         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3215         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3216
3217         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
3218                dev->name, reason);
3219
3220         if (sdata->type != IEEE80211_IF_TYPE_STA &&
3221             sdata->type != IEEE80211_IF_TYPE_IBSS)
3222                 return -EINVAL;
3223
3224         ieee80211_send_deauth(dev, ifsta, reason);
3225         ieee80211_set_disassoc(dev, ifsta, 1);
3226         return 0;
3227 }
3228
3229
3230 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
3231 {
3232         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3233         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3234
3235         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
3236                dev->name, reason);
3237
3238         if (sdata->type != IEEE80211_IF_TYPE_STA)
3239                 return -EINVAL;
3240
3241         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
3242                 return -1;
3243
3244         ieee80211_send_disassoc(dev, ifsta, reason);
3245         ieee80211_set_disassoc(dev, ifsta, 0);
3246         return 0;
3247 }