err.no Git - linux-2.6/blob - net/mac80211/ieee80211_sta.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 /* TODO:
  15  * BSS table: use <BSSID,SSID> as the key to support multi-SSID APs
  16  * order BSS list by RSSI(?) ("quality of AP")
  17  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  18  *    SSID)
  19  */
  20 #include <linux/delay.h>
  21 #include <linux/if_ether.h>
  22 #include <linux/skbuff.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/wireless.h>
  26 #include <linux/random.h>
  27 #include <linux/etherdevice.h>
  28 #include <net/iw_handler.h>
  29 #include <asm/types.h>
  30
  31 #include <net/mac80211.h>
  32 #include "ieee80211_i.h"
  33 #include "ieee80211_rate.h"
  34 #include "hostapd_ioctl.h"
  35
  36 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  37 #define IEEE80211_AUTH_MAX_TRIES 3
  38 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  39 #define IEEE80211_ASSOC_MAX_TRIES 3
  40 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  41 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  42 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  43 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  44 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  45 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
  46
  47 #define IEEE80211_PROBE_DELAY (HZ / 33)
  48 #define IEEE80211_CHANNEL_TIME (HZ / 33)
  49 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
  50 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
  51 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  52 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  53
  54 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  55
  56
  57 #define IEEE80211_FC(type, stype) cpu_to_le16(type | stype)
  58
  59 #define ERP_INFO_USE_PROTECTION BIT(1)
  60
  61 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
  62                                      u8 *ssid, size_t ssid_len);
  63 static struct ieee80211_sta_bss *
  64 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid);
  65 static void ieee80211_rx_bss_put(struct net_device *dev,
  66                                  struct ieee80211_sta_bss *bss);
  67 static int ieee80211_sta_find_ibss(struct net_device *dev,
  68                                    struct ieee80211_if_sta *ifsta);
  69 static int ieee80211_sta_wep_configured(struct net_device *dev);
  70 static int ieee80211_sta_start_scan(struct net_device *dev,
  71                                     u8 *ssid, size_t ssid_len);
  72 static int ieee80211_sta_config_auth(struct net_device *dev,
  73                                      struct ieee80211_if_sta *ifsta);
  74
  75
  76 /* Parsed Information Elements */
  77 struct ieee802_11_elems {
  78         /* pointers to IEs */
  79         u8 *ssid;
  80         u8 *supp_rates;
  81         u8 *fh_params;
  82         u8 *ds_params;
  83         u8 *cf_params;
  84         u8 *tim;
  85         u8 *ibss_params;
  86         u8 *challenge;
  87         u8 *wpa;
  88         u8 *rsn;
  89         u8 *erp_info;
  90         u8 *ext_supp_rates;
  91         u8 *wmm_info;
  92         u8 *wmm_param;
  93
  94         /* length of them, respectively */
  95         u8 ssid_len;
  96         u8 supp_rates_len;
  97         u8 fh_params_len;
  98         u8 ds_params_len;
  99         u8 cf_params_len;
 100         u8 tim_len;
 101         u8 ibss_params_len;
 102         u8 challenge_len;
 103         u8 wpa_len;
 104         u8 rsn_len;
 105         u8 erp_info_len;
 106         u8 ext_supp_rates_len;
 107         u8 wmm_info_len;
 108         u8 wmm_param_len;
 109 };
 110
 111 typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
 112
 113
 114 static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
 115                                        struct ieee802_11_elems *elems)
 116 {
 117         size_t left = len;
 118         u8 *pos = start;
 119         int unknown = 0;
 120
 121         memset(elems, 0, sizeof(*elems));
 122
 123         while (left >= 2) {
 124                 u8 id, elen;
 125
 126                 id = *pos++;
 127                 elen = *pos++;
 128                 left -= 2;
 129
 130                 if (elen > left) {
 131 #if 0
 132                         if (net_ratelimit())
 133                                 printk(KERN_DEBUG "IEEE 802.11 element parse "
 134                                        "failed (id=%d elen=%d left=%d)\n",
 135                                        id, elen, left);
 136 #endif
 137                         return ParseFailed;
 138                 }
 139
 140                 switch (id) {
 141                 case WLAN_EID_SSID:
 142                         elems->ssid = pos;
 143                         elems->ssid_len = elen;
 144                         break;
 145                 case WLAN_EID_SUPP_RATES:
 146                         elems->supp_rates = pos;
 147                         elems->supp_rates_len = elen;
 148                         break;
 149                 case WLAN_EID_FH_PARAMS:
 150                         elems->fh_params = pos;
 151                         elems->fh_params_len = elen;
 152                         break;
 153                 case WLAN_EID_DS_PARAMS:
 154                         elems->ds_params = pos;
 155                         elems->ds_params_len = elen;
 156                         break;
 157                 case WLAN_EID_CF_PARAMS:
 158                         elems->cf_params = pos;
 159                         elems->cf_params_len = elen;
 160                         break;
 161                 case WLAN_EID_TIM:
 162                         elems->tim = pos;
 163                         elems->tim_len = elen;
 164                         break;
 165                 case WLAN_EID_IBSS_PARAMS:
 166                         elems->ibss_params = pos;
 167                         elems->ibss_params_len = elen;
 168                         break;
 169                 case WLAN_EID_CHALLENGE:
 170                         elems->challenge = pos;
 171                         elems->challenge_len = elen;
 172                         break;
 173                 case WLAN_EID_WPA:
 174                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 175                             pos[2] == 0xf2) {
 176                                 /* Microsoft OUI (00:50:F2) */
 177                                 if (pos[3] == 1) {
 178                                         /* OUI Type 1 - WPA IE */
 179                                         elems->wpa = pos;
 180                                         elems->wpa_len = elen;
 181                                 } else if (elen >= 5 && pos[3] == 2) {
 182                                         if (pos[4] == 0) {
 183                                                 elems->wmm_info = pos;
 184                                                 elems->wmm_info_len = elen;
 185                                         } else if (pos[4] == 1) {
 186                                                 elems->wmm_param = pos;
 187                                                 elems->wmm_param_len = elen;
 188                                         }
 189                                 }
 190                         }
 191                         break;
 192                 case WLAN_EID_RSN:
 193                         elems->rsn = pos;
 194                         elems->rsn_len = elen;
 195                         break;
 196                 case WLAN_EID_ERP_INFO:
 197                         elems->erp_info = pos;
 198                         elems->erp_info_len = elen;
 199                         break;
 200                 case WLAN_EID_EXT_SUPP_RATES:
 201                         elems->ext_supp_rates = pos;
 202                         elems->ext_supp_rates_len = elen;
 203                         break;
 204                 default:
 205 #if 0
 206                         printk(KERN_DEBUG "IEEE 802.11 element parse ignored "
 207                                       "unknown element (id=%d elen=%d)\n",
 208                                       id, elen);
 209 #endif
 210                         unknown++;
 211                         break;
 212                 }
 213
 214                 left -= elen;
 215                 pos += elen;
 216         }
 217
 218         /* Do not trigger error if left == 1 as Apple Airport base stations
 219          * send AssocResps that are one spurious byte too long. */
 220
 221         return unknown ? ParseUnknown : ParseOK;
 222 }
 223
 224
 225
 226
 227 static int ecw2cw(int ecw)
 228 {
 229         int cw = 1;
 230         while (ecw > 0) {
 231                 cw <<= 1;
 232                 ecw--;
 233         }
 234         return cw - 1;
 235 }
 236
 237
 238 static void ieee80211_sta_wmm_params(struct net_device *dev,
 239                                      struct ieee80211_if_sta *ifsta,
 240                                      u8 *wmm_param, size_t wmm_param_len)
 241 {
 242         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 243         struct ieee80211_tx_queue_params params;
 244         size_t left;
 245         int count;
 246         u8 *pos;
 247
 248         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 249                 return;
 250         count = wmm_param[6] & 0x0f;
 251         if (count == ifsta->wmm_last_param_set)
 252                 return;
 253         ifsta->wmm_last_param_set = count;
 254
 255         pos = wmm_param + 8;
 256         left = wmm_param_len - 8;
 257
 258         memset(&params, 0, sizeof(params));
 259
 260         if (!local->ops->conf_tx)
 261                 return;
 262
 263         local->wmm_acm = 0;
 264         for (; left >= 4; left -= 4, pos += 4) {
 265                 int aci = (pos[0] >> 5) & 0x03;
 266                 int acm = (pos[0] >> 4) & 0x01;
 267                 int queue;
 268
 269                 switch (aci) {
 270                 case 1:
 271                         queue = IEEE80211_TX_QUEUE_DATA3;
 272                         if (acm) {
 273                                 local->wmm_acm |= BIT(0) | BIT(3);
 274                         }
 275                         break;
 276                 case 2:
 277                         queue = IEEE80211_TX_QUEUE_DATA1;
 278                         if (acm) {
 279                                 local->wmm_acm |= BIT(4) | BIT(5);
 280                         }
 281                         break;
 282                 case 3:
 283                         queue = IEEE80211_TX_QUEUE_DATA0;
 284                         if (acm) {
 285                                 local->wmm_acm |= BIT(6) | BIT(7);
 286                         }
 287                         break;
 288                 case 0:
 289                 default:
 290                         queue = IEEE80211_TX_QUEUE_DATA2;
 291                         if (acm) {
 292                                 local->wmm_acm |= BIT(1) | BIT(2);
 293                         }
 294                         break;
 295                 }
 296
 297                 params.aifs = pos[0] & 0x0f;
 298                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 299                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 300                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 301                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 302                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 303                        "cWmin=%d cWmax=%d burst=%d\n",
 304                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
 305                        params.cw_max, params.burst_time);
 306                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 307                  * AC for now) */
 308                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 309                         printk(KERN_DEBUG "%s: failed to set TX queue "
 310                                "parameters for queue %d\n", dev->name, queue);
 311                 }
 312         }
 313 }
 314
 315
 316 static void ieee80211_handle_erp_ie(struct net_device *dev, u8 erp_value)
 317 {
 318         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 319         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 320         int use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 321         int preamble_mode = (erp_value & WLAN_ERP_BARKER_PREAMBLE) != 0;
 322         u8 changes = 0;
 323
 324         if (use_protection != sdata->use_protection) {
 325                 if (net_ratelimit()) {
 326                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 327                                MAC_FMT ")\n",
 328                                dev->name,
 329                                use_protection ? "enabled" : "disabled",
 330                                MAC_ARG(ifsta->bssid));
 331                 }
 332                 sdata->use_protection = use_protection;
 333                 changes |= IEEE80211_ERP_CHANGE_PROTECTION;
 334         }
 335
 336         if (!preamble_mode != sdata->short_preamble) {
 337                 if (net_ratelimit()) {
 338                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 339                                " (BSSID=" MAC_FMT ")\n",
 340                                dev->name,
 341                                (preamble_mode == WLAN_ERP_PREAMBLE_SHORT) ?
 342                                         "short" : "long",
 343                                MAC_ARG(ifsta->bssid));
 344                 }
 345                 sdata->short_preamble = !preamble_mode;
 346                 changes |= IEEE80211_ERP_CHANGE_PREAMBLE;
 347         }
 348
 349         if (changes)
 350                 ieee80211_erp_info_change_notify(dev, changes);
 351 }
 352
 353
 354 static void ieee80211_sta_send_associnfo(struct net_device *dev,
 355                                          struct ieee80211_if_sta *ifsta)
 356 {
 357         char *buf;
 358         size_t len;
 359         int i;
 360         union iwreq_data wrqu;
 361
 362         if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
 363                 return;
 364
 365         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
 366                                 ifsta->assocresp_ies_len), GFP_KERNEL);
 367         if (!buf)
 368                 return;
 369
 370         len = sprintf(buf, "ASSOCINFO(");
 371         if (ifsta->assocreq_ies) {
 372                 len += sprintf(buf + len, "ReqIEs=");
 373                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
 374                         len += sprintf(buf + len, "%02x",
 375                                        ifsta->assocreq_ies[i]);
 376                 }
 377         }
 378         if (ifsta->assocresp_ies) {
 379                 if (ifsta->assocreq_ies)
 380                         len += sprintf(buf + len, " ");
 381                 len += sprintf(buf + len, "RespIEs=");
 382                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 383                         len += sprintf(buf + len, "%02x",
 384                                        ifsta->assocresp_ies[i]);
 385                 }
 386         }
 387         len += sprintf(buf + len, ")");
 388
 389         if (len > IW_CUSTOM_MAX) {
 390                 len = sprintf(buf, "ASSOCRESPIE=");
 391                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 392                         len += sprintf(buf + len, "%02x",
 393                                        ifsta->assocresp_ies[i]);
 394                 }
 395         }
 396
 397         memset(&wrqu, 0, sizeof(wrqu));
 398         wrqu.data.length = len;
 399         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 400
 401         kfree(buf);
 402 }
 403
 404
 405 static void ieee80211_set_associated(struct net_device *dev,
 406                                      struct ieee80211_if_sta *ifsta, int assoc)
 407 {
 408         union iwreq_data wrqu;
 409
 410         if (ifsta->associated == assoc)
 411                 return;
 412
 413         ifsta->associated = assoc;
 414
 415         if (assoc) {
 416                 struct ieee80211_sub_if_data *sdata;
 417                 struct ieee80211_sta_bss *bss;
 418                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 419                 if (sdata->type != IEEE80211_IF_TYPE_STA)
 420                         return;
 421
 422                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 423                 if (bss) {
 424                         if (bss->has_erp_value)
 425                                 ieee80211_handle_erp_ie(dev, bss->erp_value);
 426                         ieee80211_rx_bss_put(dev, bss);
 427                 }
 428
 429                 netif_carrier_on(dev);
 430                 ifsta->prev_bssid_set = 1;
 431                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 432                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 433                 ieee80211_sta_send_associnfo(dev, ifsta);
 434         } else {
 435                 netif_carrier_off(dev);
 436                 ieee80211_reset_erp_info(dev);
 437                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 438         }
 439         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 440         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 441         ifsta->last_probe = jiffies;
 442 }
 443
 444 static void ieee80211_set_disassoc(struct net_device *dev,
 445                                    struct ieee80211_if_sta *ifsta, int deauth)
 446 {
 447         if (deauth)
 448                 ifsta->auth_tries = 0;
 449         ifsta->assoc_tries = 0;
 450         ieee80211_set_associated(dev, ifsta, 0);
 451 }
 452
 453 static void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
 454                              int encrypt)
 455 {
 456         struct ieee80211_sub_if_data *sdata;
 457         struct ieee80211_tx_packet_data *pkt_data;
 458
 459         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 460         skb->dev = sdata->local->mdev;
 461         skb_set_mac_header(skb, 0);
 462         skb_set_network_header(skb, 0);
 463         skb_set_transport_header(skb, 0);
 464
 465         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
 466         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
 467         pkt_data->ifindex = sdata->dev->ifindex;
 468         pkt_data->mgmt_iface = (sdata->type == IEEE80211_IF_TYPE_MGMT);
 469         pkt_data->do_not_encrypt = !encrypt;
 470
 471         dev_queue_xmit(skb);
 472 }
 473
 474
 475 static void ieee80211_send_auth(struct net_device *dev,
 476                                 struct ieee80211_if_sta *ifsta,
 477                                 int transaction, u8 *extra, size_t extra_len,
 478                                 int encrypt)
 479 {
 480         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 481         struct sk_buff *skb;
 482         struct ieee80211_mgmt *mgmt;
 483
 484         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 485                             sizeof(*mgmt) + 6 + extra_len);
 486         if (!skb) {
 487                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 488                        "frame\n", dev->name);
 489                 return;
 490         }
 491         skb_reserve(skb, local->hw.extra_tx_headroom);
 492
 493         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 494         memset(mgmt, 0, 24 + 6);
 495         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 496                                            IEEE80211_STYPE_AUTH);
 497         if (encrypt)
 498                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 499         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 500         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 501         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 502         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 503         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 504         ifsta->auth_transaction = transaction + 1;
 505         mgmt->u.auth.status_code = cpu_to_le16(0);
 506         if (extra)
 507                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 508
 509         ieee80211_sta_tx(dev, skb, encrypt);
 510 }
 511
 512
 513 static void ieee80211_authenticate(struct net_device *dev,
 514                                    struct ieee80211_if_sta *ifsta)
 515 {
 516         ifsta->auth_tries++;
 517         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 518                 printk(KERN_DEBUG "%s: authentication with AP " MAC_FMT
 519                        " timed out\n",
 520                        dev->name, MAC_ARG(ifsta->bssid));
 521                 ifsta->state = IEEE80211_DISABLED;
 522                 return;
 523         }
 524
 525         ifsta->state = IEEE80211_AUTHENTICATE;
 526         printk(KERN_DEBUG "%s: authenticate with AP " MAC_FMT "\n",
 527                dev->name, MAC_ARG(ifsta->bssid));
 528
 529         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
 530
 531         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 532 }
 533
 534
 535 static void ieee80211_send_assoc(struct net_device *dev,
 536                                  struct ieee80211_if_sta *ifsta)
 537 {
 538         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 539         struct ieee80211_hw_mode *mode;
 540         struct sk_buff *skb;
 541         struct ieee80211_mgmt *mgmt;
 542         u8 *pos, *ies;
 543         int i, len;
 544         u16 capab;
 545         struct ieee80211_sta_bss *bss;
 546         int wmm = 0;
 547
 548         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 549                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 550                             ifsta->ssid_len);
 551         if (!skb) {
 552                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 553                        "frame\n", dev->name);
 554                 return;
 555         }
 556         skb_reserve(skb, local->hw.extra_tx_headroom);
 557
 558         mode = local->oper_hw_mode;
 559         capab = ifsta->capab;
 560         if (mode->mode == MODE_IEEE80211G) {
 561                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 562                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 563         }
 564         bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 565         if (bss) {
 566                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 567                         capab |= WLAN_CAPABILITY_PRIVACY;
 568                 if (bss->wmm_ie) {
 569                         wmm = 1;
 570                 }
 571                 ieee80211_rx_bss_put(dev, bss);
 572         }
 573
 574         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 575         memset(mgmt, 0, 24);
 576         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 577         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 578         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 579
 580         if (ifsta->prev_bssid_set) {
 581                 skb_put(skb, 10);
 582                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 583                                                    IEEE80211_STYPE_REASSOC_REQ);
 584                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 585                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
 586                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 587                        ETH_ALEN);
 588         } else {
 589                 skb_put(skb, 4);
 590                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 591                                                    IEEE80211_STYPE_ASSOC_REQ);
 592                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 593                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
 594         }
 595
 596         /* SSID */
 597         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 598         *pos++ = WLAN_EID_SSID;
 599         *pos++ = ifsta->ssid_len;
 600         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 601
 602         len = mode->num_rates;
 603         if (len > 8)
 604                 len = 8;
 605         pos = skb_put(skb, len + 2);
 606         *pos++ = WLAN_EID_SUPP_RATES;
 607         *pos++ = len;
 608         for (i = 0; i < len; i++) {
 609                 int rate = mode->rates[i].rate;
 610                 if (mode->mode == MODE_ATHEROS_TURBO)
 611                         rate /= 2;
 612                 *pos++ = (u8) (rate / 5);
 613         }
 614
 615         if (mode->num_rates > len) {
 616                 pos = skb_put(skb, mode->num_rates - len + 2);
 617                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 618                 *pos++ = mode->num_rates - len;
 619                 for (i = len; i < mode->num_rates; i++) {
 620                         int rate = mode->rates[i].rate;
 621                         if (mode->mode == MODE_ATHEROS_TURBO)
 622                                 rate /= 2;
 623                         *pos++ = (u8) (rate / 5);
 624                 }
 625         }
 626
 627         if (ifsta->extra_ie) {
 628                 pos = skb_put(skb, ifsta->extra_ie_len);
 629                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 630         }
 631
 632         if (wmm && ifsta->wmm_enabled) {
 633                 pos = skb_put(skb, 9);
 634                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 635                 *pos++ = 7; /* len */
 636                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 637                 *pos++ = 0x50;
 638                 *pos++ = 0xf2;
 639                 *pos++ = 2; /* WME */
 640                 *pos++ = 0; /* WME info */
 641                 *pos++ = 1; /* WME ver */
 642                 *pos++ = 0;
 643         }
 644
 645         kfree(ifsta->assocreq_ies);
 646         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 647         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 648         if (ifsta->assocreq_ies)
 649                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 650
 651         ieee80211_sta_tx(dev, skb, 0);
 652 }
 653
 654
 655 static void ieee80211_send_deauth(struct net_device *dev,
 656                                   struct ieee80211_if_sta *ifsta, u16 reason)
 657 {
 658         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 659         struct sk_buff *skb;
 660         struct ieee80211_mgmt *mgmt;
 661
 662         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 663         if (!skb) {
 664                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 665                        "frame\n", dev->name);
 666                 return;
 667         }
 668         skb_reserve(skb, local->hw.extra_tx_headroom);
 669
 670         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 671         memset(mgmt, 0, 24);
 672         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 673         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 674         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 675         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 676                                            IEEE80211_STYPE_DEAUTH);
 677         skb_put(skb, 2);
 678         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 679
 680         ieee80211_sta_tx(dev, skb, 0);
 681 }
 682
 683
 684 static void ieee80211_send_disassoc(struct net_device *dev,
 685                                     struct ieee80211_if_sta *ifsta, u16 reason)
 686 {
 687         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 688         struct sk_buff *skb;
 689         struct ieee80211_mgmt *mgmt;
 690
 691         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 692         if (!skb) {
 693                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 694                        "frame\n", dev->name);
 695                 return;
 696         }
 697         skb_reserve(skb, local->hw.extra_tx_headroom);
 698
 699         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 700         memset(mgmt, 0, 24);
 701         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 702         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 703         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 704         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 705                                            IEEE80211_STYPE_DISASSOC);
 706         skb_put(skb, 2);
 707         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 708
 709         ieee80211_sta_tx(dev, skb, 0);
 710 }
 711
 712
 713 static int ieee80211_privacy_mismatch(struct net_device *dev,
 714                                       struct ieee80211_if_sta *ifsta)
 715 {
 716         struct ieee80211_sta_bss *bss;
 717         int res = 0;
 718
 719         if (!ifsta || ifsta->mixed_cell ||
 720             ifsta->key_mgmt != IEEE80211_KEY_MGMT_NONE)
 721                 return 0;
 722
 723         bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 724         if (!bss)
 725                 return 0;
 726
 727         if (ieee80211_sta_wep_configured(dev) !=
 728             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 729                 res = 1;
 730
 731         ieee80211_rx_bss_put(dev, bss);
 732
 733         return res;
 734 }
 735
 736
 737 static void ieee80211_associate(struct net_device *dev,
 738                                 struct ieee80211_if_sta *ifsta)
 739 {
 740         ifsta->assoc_tries++;
 741         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 742                 printk(KERN_DEBUG "%s: association with AP " MAC_FMT
 743                        " timed out\n",
 744                        dev->name, MAC_ARG(ifsta->bssid));
 745                 ifsta->state = IEEE80211_DISABLED;
 746                 return;
 747         }
 748
 749         ifsta->state = IEEE80211_ASSOCIATE;
 750         printk(KERN_DEBUG "%s: associate with AP " MAC_FMT "\n",
 751                dev->name, MAC_ARG(ifsta->bssid));
 752         if (ieee80211_privacy_mismatch(dev, ifsta)) {
 753                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 754                        "mixed-cell disabled - abort association\n", dev->name);
 755                 ifsta->state = IEEE80211_DISABLED;
 756                 return;
 757         }
 758
 759         ieee80211_send_assoc(dev, ifsta);
 760
 761         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 762 }
 763
 764
 765 static void ieee80211_associated(struct net_device *dev,
 766                                  struct ieee80211_if_sta *ifsta)
 767 {
 768         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 769         struct sta_info *sta;
 770         int disassoc;
 771
 772         /* TODO: start monitoring current AP signal quality and number of
 773          * missed beacons. Scan other channels every now and then and search
 774          * for better APs. */
 775         /* TODO: remove expired BSSes */
 776
 777         ifsta->state = IEEE80211_ASSOCIATED;
 778
 779         sta = sta_info_get(local, ifsta->bssid);
 780         if (!sta) {
 781                 printk(KERN_DEBUG "%s: No STA entry for own AP " MAC_FMT "\n",
 782                        dev->name, MAC_ARG(ifsta->bssid));
 783                 disassoc = 1;
 784         } else {
 785                 disassoc = 0;
 786                 if (time_after(jiffies,
 787                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 788                         if (ifsta->probereq_poll) {
 789                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 790                                        "current AP " MAC_FMT " - assume out of "
 791                                        "range\n",
 792                                        dev->name, MAC_ARG(ifsta->bssid));
 793                                 disassoc = 1;
 794                                 sta_info_free(sta);
 795                                 ifsta->probereq_poll = 0;
 796                         } else {
 797                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 798                                                          local->scan_ssid,
 799                                                          local->scan_ssid_len);
 800                                 ifsta->probereq_poll = 1;
 801                         }
 802                 } else {
 803                         ifsta->probereq_poll = 0;
 804                         if (time_after(jiffies, ifsta->last_probe +
 805                                        IEEE80211_PROBE_INTERVAL)) {
 806                                 ifsta->last_probe = jiffies;
 807                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 808                                                          ifsta->ssid,
 809                                                          ifsta->ssid_len);
 810                         }
 811                 }
 812                 sta_info_put(sta);
 813         }
 814         if (disassoc) {
 815                 union iwreq_data wrqu;
 816                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 817                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 818                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 819                 mod_timer(&ifsta->timer, jiffies +
 820                                       IEEE80211_MONITORING_INTERVAL + 30 * HZ);
 821         } else {
 822                 mod_timer(&ifsta->timer, jiffies +
 823                                       IEEE80211_MONITORING_INTERVAL);
 824         }
 825 }
 826
 827
 828 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 829                                      u8 *ssid, size_t ssid_len)
 830 {
 831         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 832         struct ieee80211_hw_mode *mode;
 833         struct sk_buff *skb;
 834         struct ieee80211_mgmt *mgmt;
 835         u8 *pos, *supp_rates, *esupp_rates = NULL;
 836         int i;
 837
 838         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 839         if (!skb) {
 840                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 841                        "request\n", dev->name);
 842                 return;
 843         }
 844         skb_reserve(skb, local->hw.extra_tx_headroom);
 845
 846         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 847         memset(mgmt, 0, 24);
 848         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 849                                            IEEE80211_STYPE_PROBE_REQ);
 850         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 851         if (dst) {
 852                 memcpy(mgmt->da, dst, ETH_ALEN);
 853                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 854         } else {
 855                 memset(mgmt->da, 0xff, ETH_ALEN);
 856                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 857         }
 858         pos = skb_put(skb, 2 + ssid_len);
 859         *pos++ = WLAN_EID_SSID;
 860         *pos++ = ssid_len;
 861         memcpy(pos, ssid, ssid_len);
 862
 863         supp_rates = skb_put(skb, 2);
 864         supp_rates[0] = WLAN_EID_SUPP_RATES;
 865         supp_rates[1] = 0;
 866         mode = local->oper_hw_mode;
 867         for (i = 0; i < mode->num_rates; i++) {
 868                 struct ieee80211_rate *rate = &mode->rates[i];
 869                 if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
 870                         continue;
 871                 if (esupp_rates) {
 872                         pos = skb_put(skb, 1);
 873                         esupp_rates[1]++;
 874                 } else if (supp_rates[1] == 8) {
 875                         esupp_rates = skb_put(skb, 3);
 876                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 877                         esupp_rates[1] = 1;
 878                         pos = &esupp_rates[2];
 879                 } else {
 880                         pos = skb_put(skb, 1);
 881                         supp_rates[1]++;
 882                 }
 883                 if (mode->mode == MODE_ATHEROS_TURBO)
 884                         *pos = rate->rate / 10;
 885                 else
 886                         *pos = rate->rate / 5;
 887         }
 888
 889         ieee80211_sta_tx(dev, skb, 0);
 890 }
 891
 892
 893 static int ieee80211_sta_wep_configured(struct net_device *dev)
 894 {
 895         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 896         if (!sdata || !sdata->default_key ||
 897             sdata->default_key->alg != ALG_WEP)
 898                 return 0;
 899         return 1;
 900 }
 901
 902
 903 static void ieee80211_auth_completed(struct net_device *dev,
 904                                      struct ieee80211_if_sta *ifsta)
 905 {
 906         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
 907         ifsta->authenticated = 1;
 908         ieee80211_associate(dev, ifsta);
 909 }
 910
 911
 912 static void ieee80211_auth_challenge(struct net_device *dev,
 913                                      struct ieee80211_if_sta *ifsta,
 914                                      struct ieee80211_mgmt *mgmt,
 915                                      size_t len)
 916 {
 917         u8 *pos;
 918         struct ieee802_11_elems elems;
 919
 920         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
 921         pos = mgmt->u.auth.variable;
 922         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
 923             == ParseFailed) {
 924                 printk(KERN_DEBUG "%s: failed to parse Auth(challenge)\n",
 925                        dev->name);
 926                 return;
 927         }
 928         if (!elems.challenge) {
 929                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
 930                        "frame\n", dev->name);
 931                 return;
 932         }
 933         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
 934                             elems.challenge_len + 2, 1);
 935 }
 936
 937
 938 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
 939                                    struct ieee80211_if_sta *ifsta,
 940                                    struct ieee80211_mgmt *mgmt,
 941                                    size_t len)
 942 {
 943         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 944         u16 auth_alg, auth_transaction, status_code;
 945
 946         if (ifsta->state != IEEE80211_AUTHENTICATE &&
 947             sdata->type != IEEE80211_IF_TYPE_IBSS) {
 948                 printk(KERN_DEBUG "%s: authentication frame received from "
 949                        MAC_FMT ", but not in authenticate state - ignored\n",
 950                        dev->name, MAC_ARG(mgmt->sa));
 951                 return;
 952         }
 953
 954         if (len < 24 + 6) {
 955                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
 956                        "received from " MAC_FMT " - ignored\n",
 957                        dev->name, len, MAC_ARG(mgmt->sa));
 958                 return;
 959         }
 960
 961         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
 962             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
 963                 printk(KERN_DEBUG "%s: authentication frame received from "
 964                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
 965                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
 966                        MAC_ARG(mgmt->bssid));
 967                 return;
 968         }
 969
 970         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
 971             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 972                 printk(KERN_DEBUG "%s: authentication frame received from "
 973                        "unknown BSSID (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
 974                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
 975                        MAC_ARG(mgmt->bssid));
 976                 return;
 977         }
 978
 979         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
 980         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 981         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 982
 983         printk(KERN_DEBUG "%s: RX authentication from " MAC_FMT " (alg=%d "
 984                "transaction=%d status=%d)\n",
 985                dev->name, MAC_ARG(mgmt->sa), auth_alg,
 986                auth_transaction, status_code);
 987
 988         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
 989                 /* IEEE 802.11 standard does not require authentication in IBSS
 990                  * networks and most implementations do not seem to use it.
 991                  * However, try to reply to authentication attempts if someone
 992                  * has actually implemented this.
 993                  * TODO: Could implement shared key authentication. */
 994                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 995                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
 996                                "frame (alg=%d transaction=%d)\n",
 997                                dev->name, auth_alg, auth_transaction);
 998                         return;
 999                 }
1000                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
1001         }
1002
1003         if (auth_alg != ifsta->auth_alg ||
1004             auth_transaction != ifsta->auth_transaction) {
1005                 printk(KERN_DEBUG "%s: unexpected authentication frame "
1006                        "(alg=%d transaction=%d)\n",
1007                        dev->name, auth_alg, auth_transaction);
1008                 return;
1009         }
1010
1011         if (status_code != WLAN_STATUS_SUCCESS) {
1012                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
1013                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
1014                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1015                         u8 algs[3];
1016                         const int num_algs = ARRAY_SIZE(algs);
1017                         int i, pos;
1018                         algs[0] = algs[1] = algs[2] = 0xff;
1019                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1020                                 algs[0] = WLAN_AUTH_OPEN;
1021                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1022                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1023                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1024                                 algs[2] = WLAN_AUTH_LEAP;
1025                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1026                                 pos = 0;
1027                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1028                                 pos = 1;
1029                         else
1030                                 pos = 2;
1031                         for (i = 0; i < num_algs; i++) {
1032                                 pos++;
1033                                 if (pos >= num_algs)
1034                                         pos = 0;
1035                                 if (algs[pos] == ifsta->auth_alg ||
1036                                     algs[pos] == 0xff)
1037                                         continue;
1038                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1039                                     !ieee80211_sta_wep_configured(dev))
1040                                         continue;
1041                                 ifsta->auth_alg = algs[pos];
1042                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
1043                                        "next try\n",
1044                                        dev->name, ifsta->auth_alg);
1045                                 break;
1046                         }
1047                 }
1048                 return;
1049         }
1050
1051         switch (ifsta->auth_alg) {
1052         case WLAN_AUTH_OPEN:
1053         case WLAN_AUTH_LEAP:
1054                 ieee80211_auth_completed(dev, ifsta);
1055                 break;
1056         case WLAN_AUTH_SHARED_KEY:
1057                 if (ifsta->auth_transaction == 4)
1058                         ieee80211_auth_completed(dev, ifsta);
1059                 else
1060                         ieee80211_auth_challenge(dev, ifsta, mgmt, len);
1061                 break;
1062         }
1063 }
1064
1065
1066 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
1067                                      struct ieee80211_if_sta *ifsta,
1068                                      struct ieee80211_mgmt *mgmt,
1069                                      size_t len)
1070 {
1071         u16 reason_code;
1072
1073         if (len < 24 + 2) {
1074                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
1075                        "received from " MAC_FMT " - ignored\n",
1076                        dev->name, len, MAC_ARG(mgmt->sa));
1077                 return;
1078         }
1079
1080         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1081                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1082                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
1083                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
1084                        MAC_ARG(mgmt->bssid));
1085                 return;
1086         }
1087
1088         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1089
1090         printk(KERN_DEBUG "%s: RX deauthentication from " MAC_FMT
1091                " (reason=%d)\n",
1092                dev->name, MAC_ARG(mgmt->sa), reason_code);
1093
1094         if (ifsta->authenticated) {
1095                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1096         }
1097
1098         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1099             ifsta->state == IEEE80211_ASSOCIATE ||
1100             ifsta->state == IEEE80211_ASSOCIATED) {
1101                 ifsta->state = IEEE80211_AUTHENTICATE;
1102                 mod_timer(&ifsta->timer, jiffies +
1103                                       IEEE80211_RETRY_AUTH_INTERVAL);
1104         }
1105
1106         ieee80211_set_disassoc(dev, ifsta, 1);
1107         ifsta->authenticated = 0;
1108 }
1109
1110
1111 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1112                                        struct ieee80211_if_sta *ifsta,
1113                                        struct ieee80211_mgmt *mgmt,
1114                                        size_t len)
1115 {
1116         u16 reason_code;
1117
1118         if (len < 24 + 2) {
1119                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1120                        "received from " MAC_FMT " - ignored\n",
1121                        dev->name, len, MAC_ARG(mgmt->sa));
1122                 return;
1123         }
1124
1125         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1126                 printk(KERN_DEBUG "%s: disassociation frame received from "
1127                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
1128                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
1129                        MAC_ARG(mgmt->bssid));
1130                 return;
1131         }
1132
1133         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1134
1135         printk(KERN_DEBUG "%s: RX disassociation from " MAC_FMT
1136                " (reason=%d)\n",
1137                dev->name, MAC_ARG(mgmt->sa), reason_code);
1138
1139         if (ifsta->associated)
1140                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1141
1142         if (ifsta->state == IEEE80211_ASSOCIATED) {
1143                 ifsta->state = IEEE80211_ASSOCIATE;
1144                 mod_timer(&ifsta->timer, jiffies +
1145                                       IEEE80211_RETRY_AUTH_INTERVAL);
1146         }
1147
1148         ieee80211_set_disassoc(dev, ifsta, 0);
1149 }
1150
1151
1152 static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
1153                                          struct ieee80211_if_sta *ifsta,
1154                                          struct ieee80211_mgmt *mgmt,
1155                                          size_t len,
1156                                          int reassoc)
1157 {
1158         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1159         struct ieee80211_hw_mode *mode;
1160         struct sta_info *sta;
1161         u32 rates;
1162         u16 capab_info, status_code, aid;
1163         struct ieee802_11_elems elems;
1164         u8 *pos;
1165         int i, j;
1166
1167         /* AssocResp and ReassocResp have identical structure, so process both
1168          * of them in this function. */
1169
1170         if (ifsta->state != IEEE80211_ASSOCIATE) {
1171                 printk(KERN_DEBUG "%s: association frame received from "
1172                        MAC_FMT ", but not in associate state - ignored\n",
1173                        dev->name, MAC_ARG(mgmt->sa));
1174                 return;
1175         }
1176
1177         if (len < 24 + 6) {
1178                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1179                        "received from " MAC_FMT " - ignored\n",
1180                        dev->name, len, MAC_ARG(mgmt->sa));
1181                 return;
1182         }
1183
1184         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1185                 printk(KERN_DEBUG "%s: association frame received from "
1186                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
1187                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
1188                        MAC_ARG(mgmt->bssid));
1189                 return;
1190         }
1191
1192         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1193         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1194         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1195         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1196                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1197                        "set\n", dev->name, aid);
1198         aid &= ~(BIT(15) | BIT(14));
1199
1200         printk(KERN_DEBUG "%s: RX %sssocResp from " MAC_FMT " (capab=0x%x "
1201                "status=%d aid=%d)\n",
1202                dev->name, reassoc ? "Rea" : "A", MAC_ARG(mgmt->sa),
1203                capab_info, status_code, aid);
1204
1205         if (status_code != WLAN_STATUS_SUCCESS) {
1206                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1207                        dev->name, status_code);
1208                 /* if this was a reassociation, ensure we try a "full"
1209                  * association next time. This works around some broken APs
1210                  * which do not correctly reject reassociation requests. */
1211                 ifsta->prev_bssid_set = 0;
1212                 return;
1213         }
1214
1215         pos = mgmt->u.assoc_resp.variable;
1216         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1217             == ParseFailed) {
1218                 printk(KERN_DEBUG "%s: failed to parse AssocResp\n",
1219                        dev->name);
1220                 return;
1221         }
1222
1223         if (!elems.supp_rates) {
1224                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1225                        dev->name);
1226                 return;
1227         }
1228
1229         /* it probably doesn't, but if the frame includes an ERP value then
1230          * update our stored copy */
1231         if (elems.erp_info && elems.erp_info_len >= 1) {
1232                 struct ieee80211_sta_bss *bss
1233                         = ieee80211_rx_bss_get(dev, ifsta->bssid);
1234                 if (bss) {
1235                         bss->erp_value = elems.erp_info[0];
1236                         bss->has_erp_value = 1;
1237                         ieee80211_rx_bss_put(dev, bss);
1238                 }
1239         }
1240
1241         printk(KERN_DEBUG "%s: associated\n", dev->name);
1242         ifsta->aid = aid;
1243         ifsta->ap_capab = capab_info;
1244
1245         kfree(ifsta->assocresp_ies);
1246         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1247         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1248         if (ifsta->assocresp_ies)
1249                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1250
1251         ieee80211_set_associated(dev, ifsta, 1);
1252
1253         /* Add STA entry for the AP */
1254         sta = sta_info_get(local, ifsta->bssid);
1255         if (!sta) {
1256                 struct ieee80211_sta_bss *bss;
1257                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
1258                 if (!sta) {
1259                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
1260                                " AP\n", dev->name);
1261                         return;
1262                 }
1263                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
1264                 if (bss) {
1265                         sta->last_rssi = bss->rssi;
1266                         sta->last_signal = bss->signal;
1267                         sta->last_noise = bss->noise;
1268                         ieee80211_rx_bss_put(dev, bss);
1269                 }
1270         }
1271
1272         sta->dev = dev;
1273         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
1274         sta->assoc_ap = 1;
1275
1276         rates = 0;
1277         mode = local->oper_hw_mode;
1278         for (i = 0; i < elems.supp_rates_len; i++) {
1279                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1280                 if (mode->mode == MODE_ATHEROS_TURBO)
1281                         rate *= 2;
1282                 for (j = 0; j < mode->num_rates; j++)
1283                         if (mode->rates[j].rate == rate)
1284                                 rates |= BIT(j);
1285         }
1286         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1287                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1288                 if (mode->mode == MODE_ATHEROS_TURBO)
1289                         rate *= 2;
1290                 for (j = 0; j < mode->num_rates; j++)
1291                         if (mode->rates[j].rate == rate)
1292                                 rates |= BIT(j);
1293         }
1294         sta->supp_rates = rates;
1295
1296         rate_control_rate_init(sta, local);
1297
1298         if (elems.wmm_param && ifsta->wmm_enabled) {
1299                 sta->flags |= WLAN_STA_WME;
1300                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1301                                          elems.wmm_param_len);
1302         }
1303
1304
1305         sta_info_put(sta);
1306
1307         ieee80211_associated(dev, ifsta);
1308 }
1309
1310
1311 /* Caller must hold local->sta_bss_lock */
1312 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
1313                                         struct ieee80211_sta_bss *bss)
1314 {
1315         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1316         bss->hnext = local->sta_bss_hash[STA_HASH(bss->bssid)];
1317         local->sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1318 }
1319
1320
1321 /* Caller must hold local->sta_bss_lock */
1322 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
1323                                         struct ieee80211_sta_bss *bss)
1324 {
1325         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1326         struct ieee80211_sta_bss *b, *prev = NULL;
1327         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
1328         while (b) {
1329                 if (b == bss) {
1330                         if (!prev)
1331                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
1332                                         bss->hnext;
1333                         else
1334                                 prev->hnext = bss->hnext;
1335                         break;
1336                 }
1337                 prev = b;
1338                 b = b->hnext;
1339         }
1340 }
1341
1342
1343 static struct ieee80211_sta_bss *
1344 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid)
1345 {
1346         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1347         struct ieee80211_sta_bss *bss;
1348
1349         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
1350         if (!bss)
1351                 return NULL;
1352         atomic_inc(&bss->users);
1353         atomic_inc(&bss->users);
1354         memcpy(bss->bssid, bssid, ETH_ALEN);
1355
1356         spin_lock_bh(&local->sta_bss_lock);
1357         /* TODO: order by RSSI? */
1358         list_add_tail(&bss->list, &local->sta_bss_list);
1359         __ieee80211_rx_bss_hash_add(dev, bss);
1360         spin_unlock_bh(&local->sta_bss_lock);
1361         return bss;
1362 }
1363
1364
1365 static struct ieee80211_sta_bss *
1366 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid)
1367 {
1368         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1369         struct ieee80211_sta_bss *bss;
1370
1371         spin_lock_bh(&local->sta_bss_lock);
1372         bss = local->sta_bss_hash[STA_HASH(bssid)];
1373         while (bss) {
1374                 if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0) {
1375                         atomic_inc(&bss->users);
1376                         break;
1377                 }
1378                 bss = bss->hnext;
1379         }
1380         spin_unlock_bh(&local->sta_bss_lock);
1381         return bss;
1382 }
1383
1384
1385 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
1386 {
1387         kfree(bss->wpa_ie);
1388         kfree(bss->rsn_ie);
1389         kfree(bss->wmm_ie);
1390         kfree(bss);
1391 }
1392
1393
1394 static void ieee80211_rx_bss_put(struct net_device *dev,
1395                                  struct ieee80211_sta_bss *bss)
1396 {
1397         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1398         if (!atomic_dec_and_test(&bss->users))
1399                 return;
1400
1401         spin_lock_bh(&local->sta_bss_lock);
1402         __ieee80211_rx_bss_hash_del(dev, bss);
1403         list_del(&bss->list);
1404         spin_unlock_bh(&local->sta_bss_lock);
1405         ieee80211_rx_bss_free(bss);
1406 }
1407
1408
1409 void ieee80211_rx_bss_list_init(struct net_device *dev)
1410 {
1411         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1412         spin_lock_init(&local->sta_bss_lock);
1413         INIT_LIST_HEAD(&local->sta_bss_list);
1414 }
1415
1416
1417 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
1418 {
1419         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1420         struct ieee80211_sta_bss *bss, *tmp;
1421
1422         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
1423                 ieee80211_rx_bss_put(dev, bss);
1424 }
1425
1426
1427 static void ieee80211_rx_bss_info(struct net_device *dev,
1428                                   struct ieee80211_mgmt *mgmt,
1429                                   size_t len,
1430                                   struct ieee80211_rx_status *rx_status,
1431                                   int beacon)
1432 {
1433         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1434         struct ieee802_11_elems elems;
1435         size_t baselen;
1436         int channel, invalid = 0, clen;
1437         struct ieee80211_sta_bss *bss;
1438         struct sta_info *sta;
1439         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1440         u64 timestamp;
1441
1442         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
1443                 return; /* ignore ProbeResp to foreign address */
1444
1445 #if 0
1446         printk(KERN_DEBUG "%s: RX %s from " MAC_FMT " to " MAC_FMT "\n",
1447                dev->name, beacon ? "Beacon" : "Probe Response",
1448                MAC_ARG(mgmt->sa), MAC_ARG(mgmt->da));
1449 #endif
1450
1451         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1452         if (baselen > len)
1453                 return;
1454
1455         timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
1456
1457         if (sdata->type == IEEE80211_IF_TYPE_IBSS && beacon &&
1458             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
1459 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1460                 static unsigned long last_tsf_debug = 0;
1461                 u64 tsf;
1462                 if (local->ops->get_tsf)
1463                         tsf = local->ops->get_tsf(local_to_hw(local));
1464                 else
1465                         tsf = -1LLU;
1466                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1467                         printk(KERN_DEBUG "RX beacon SA=" MAC_FMT " BSSID="
1468                                MAC_FMT " TSF=0x%llx BCN=0x%llx diff=%lld "
1469                                "@%lu\n",
1470                                MAC_ARG(mgmt->sa), MAC_ARG(mgmt->bssid),
1471                                (unsigned long long)tsf,
1472                                (unsigned long long)timestamp,
1473                                (unsigned long long)(tsf - timestamp),
1474                                jiffies);
1475                         last_tsf_debug = jiffies;
1476                 }
1477 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1478         }
1479
1480         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1481                                    &elems) == ParseFailed)
1482                 invalid = 1;
1483
1484         if (sdata->type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
1485             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
1486             (sta = sta_info_get(local, mgmt->sa))) {
1487                 struct ieee80211_hw_mode *mode;
1488                 struct ieee80211_rate *rates;
1489                 size_t num_rates;
1490                 u32 supp_rates, prev_rates;
1491                 int i, j;
1492
1493                 mode = local->sta_scanning ?
1494                        local->scan_hw_mode : local->oper_hw_mode;
1495                 rates = mode->rates;
1496                 num_rates = mode->num_rates;
1497
1498                 supp_rates = 0;
1499                 for (i = 0; i < elems.supp_rates_len +
1500                              elems.ext_supp_rates_len; i++) {
1501                         u8 rate = 0;
1502                         int own_rate;
1503                         if (i < elems.supp_rates_len)
1504                                 rate = elems.supp_rates[i];
1505                         else if (elems.ext_supp_rates)
1506                                 rate = elems.ext_supp_rates
1507                                         [i - elems.supp_rates_len];
1508                         own_rate = 5 * (rate & 0x7f);
1509                         if (mode->mode == MODE_ATHEROS_TURBO)
1510                                 own_rate *= 2;
1511                         for (j = 0; j < num_rates; j++)
1512                                 if (rates[j].rate == own_rate)
1513                                         supp_rates |= BIT(j);
1514                 }
1515
1516                 prev_rates = sta->supp_rates;
1517                 sta->supp_rates &= supp_rates;
1518                 if (sta->supp_rates == 0) {
1519                         /* No matching rates - this should not really happen.
1520                          * Make sure that at least one rate is marked
1521                          * supported to avoid issues with TX rate ctrl. */
1522                         sta->supp_rates = sdata->u.sta.supp_rates_bits;
1523                 }
1524                 if (sta->supp_rates != prev_rates) {
1525                         printk(KERN_DEBUG "%s: updated supp_rates set for "
1526                                MAC_FMT " based on beacon info (0x%x & 0x%x -> "
1527                                "0x%x)\n",
1528                                dev->name, MAC_ARG(sta->addr), prev_rates,
1529                                supp_rates, sta->supp_rates);
1530                 }
1531                 sta_info_put(sta);
1532         }
1533
1534         if (!elems.ssid)
1535                 return;
1536
1537         if (elems.ds_params && elems.ds_params_len == 1)
1538                 channel = elems.ds_params[0];
1539         else
1540                 channel = rx_status->channel;
1541
1542         bss = ieee80211_rx_bss_get(dev, mgmt->bssid);
1543         if (!bss) {
1544                 bss = ieee80211_rx_bss_add(dev, mgmt->bssid);
1545                 if (!bss)
1546                         return;
1547         } else {
1548 #if 0
1549                 /* TODO: order by RSSI? */
1550                 spin_lock_bh(&local->sta_bss_lock);
1551                 list_move_tail(&bss->list, &local->sta_bss_list);
1552                 spin_unlock_bh(&local->sta_bss_lock);
1553 #endif
1554         }
1555
1556         if (bss->probe_resp && beacon) {
1557                 /* Do not allow beacon to override data from Probe Response. */
1558                 ieee80211_rx_bss_put(dev, bss);
1559                 return;
1560         }
1561
1562         /* save the ERP value so that it is available at association time */
1563         if (elems.erp_info && elems.erp_info_len >= 1) {
1564                 bss->erp_value = elems.erp_info[0];
1565                 bss->has_erp_value = 1;
1566         }
1567
1568         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
1569         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
1570         if (elems.ssid && elems.ssid_len <= IEEE80211_MAX_SSID_LEN) {
1571                 memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1572                 bss->ssid_len = elems.ssid_len;
1573         }
1574
1575         bss->supp_rates_len = 0;
1576         if (elems.supp_rates) {
1577                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1578                 if (clen > elems.supp_rates_len)
1579                         clen = elems.supp_rates_len;
1580                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
1581                        clen);
1582                 bss->supp_rates_len += clen;
1583         }
1584         if (elems.ext_supp_rates) {
1585                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1586                 if (clen > elems.ext_supp_rates_len)
1587                         clen = elems.ext_supp_rates_len;
1588                 memcpy(&bss->supp_rates[bss->supp_rates_len],
1589                        elems.ext_supp_rates, clen);
1590                 bss->supp_rates_len += clen;
1591         }
1592
1593         if (elems.wpa &&
1594             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
1595              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1596                 kfree(bss->wpa_ie);
1597                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
1598                 if (bss->wpa_ie) {
1599                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
1600                         bss->wpa_ie_len = elems.wpa_len + 2;
1601                 } else
1602                         bss->wpa_ie_len = 0;
1603         } else if (!elems.wpa && bss->wpa_ie) {
1604                 kfree(bss->wpa_ie);
1605                 bss->wpa_ie = NULL;
1606                 bss->wpa_ie_len = 0;
1607         }
1608
1609         if (elems.rsn &&
1610             (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
1611              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1612                 kfree(bss->rsn_ie);
1613                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
1614                 if (bss->rsn_ie) {
1615                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
1616                         bss->rsn_ie_len = elems.rsn_len + 2;
1617                 } else
1618                         bss->rsn_ie_len = 0;
1619         } else if (!elems.rsn && bss->rsn_ie) {
1620                 kfree(bss->rsn_ie);
1621                 bss->rsn_ie = NULL;
1622                 bss->rsn_ie_len = 0;
1623         }
1624
1625         if (elems.wmm_param &&
1626             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
1627              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1628                 kfree(bss->wmm_ie);
1629                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
1630                 if (bss->wmm_ie) {
1631                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
1632                                elems.wmm_param_len + 2);
1633                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1634                 } else
1635                         bss->wmm_ie_len = 0;
1636         } else if (!elems.wmm_param && bss->wmm_ie) {
1637                 kfree(bss->wmm_ie);
1638                 bss->wmm_ie = NULL;
1639                 bss->wmm_ie_len = 0;
1640         }
1641
1642
1643         bss->hw_mode = rx_status->phymode;
1644         bss->channel = channel;
1645         bss->freq = rx_status->freq;
1646         if (channel != rx_status->channel &&
1647             (bss->hw_mode == MODE_IEEE80211G ||
1648              bss->hw_mode == MODE_IEEE80211B) &&
1649             channel >= 1 && channel <= 14) {
1650                 static const int freq_list[] = {
1651                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1652                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1653                 };
1654                 /* IEEE 802.11g/b mode can receive packets from neighboring
1655                  * channels, so map the channel into frequency. */
1656                 bss->freq = freq_list[channel - 1];
1657         }
1658         bss->timestamp = timestamp;
1659         bss->last_update = jiffies;
1660         bss->rssi = rx_status->ssi;
1661         bss->signal = rx_status->signal;
1662         bss->noise = rx_status->noise;
1663         if (!beacon)
1664                 bss->probe_resp++;
1665         ieee80211_rx_bss_put(dev, bss);
1666 }
1667
1668
1669 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
1670                                          struct ieee80211_mgmt *mgmt,
1671                                          size_t len,
1672                                          struct ieee80211_rx_status *rx_status)
1673 {
1674         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
1675 }
1676
1677
1678 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
1679                                      struct ieee80211_mgmt *mgmt,
1680                                      size_t len,
1681                                      struct ieee80211_rx_status *rx_status)
1682 {
1683         struct ieee80211_sub_if_data *sdata;
1684         struct ieee80211_if_sta *ifsta;
1685         size_t baselen;
1686         struct ieee802_11_elems elems;
1687
1688         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
1689
1690         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1691         if (sdata->type != IEEE80211_IF_TYPE_STA)
1692                 return;
1693         ifsta = &sdata->u.sta;
1694
1695         if (!ifsta->associated ||
1696             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1697                 return;
1698
1699         /* Process beacon from the current BSS */
1700         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1701         if (baselen > len)
1702                 return;
1703
1704         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1705                                    &elems) == ParseFailed)
1706                 return;
1707
1708         if (elems.erp_info && elems.erp_info_len >= 1)
1709                 ieee80211_handle_erp_ie(dev, elems.erp_info[0]);
1710
1711         if (elems.wmm_param && ifsta->wmm_enabled) {
1712                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1713                                          elems.wmm_param_len);
1714         }
1715 }
1716
1717
1718 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
1719                                         struct ieee80211_if_sta *ifsta,
1720                                         struct ieee80211_mgmt *mgmt,
1721                                         size_t len,
1722                                         struct ieee80211_rx_status *rx_status)
1723 {
1724         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1725         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1726         int tx_last_beacon;
1727         struct sk_buff *skb;
1728         struct ieee80211_mgmt *resp;
1729         u8 *pos, *end;
1730
1731         if (sdata->type != IEEE80211_IF_TYPE_IBSS ||
1732             ifsta->state != IEEE80211_IBSS_JOINED ||
1733             len < 24 + 2 || !ifsta->probe_resp)
1734                 return;
1735
1736         if (local->ops->tx_last_beacon)
1737                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
1738         else
1739                 tx_last_beacon = 1;
1740
1741 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1742         printk(KERN_DEBUG "%s: RX ProbeReq SA=" MAC_FMT " DA=" MAC_FMT " BSSID="
1743                MAC_FMT " (tx_last_beacon=%d)\n",
1744                dev->name, MAC_ARG(mgmt->sa), MAC_ARG(mgmt->da),
1745                MAC_ARG(mgmt->bssid), tx_last_beacon);
1746 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1747
1748         if (!tx_last_beacon)
1749                 return;
1750
1751         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
1752             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1753                 return;
1754
1755         end = ((u8 *) mgmt) + len;
1756         pos = mgmt->u.probe_req.variable;
1757         if (pos[0] != WLAN_EID_SSID ||
1758             pos + 2 + pos[1] > end) {
1759                 if (net_ratelimit()) {
1760                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
1761                                "from " MAC_FMT "\n",
1762                                dev->name, MAC_ARG(mgmt->sa));
1763                 }
1764                 return;
1765         }
1766         if (pos[1] != 0 &&
1767             (pos[1] != ifsta->ssid_len ||
1768              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
1769                 /* Ignore ProbeReq for foreign SSID */
1770                 return;
1771         }
1772
1773         /* Reply with ProbeResp */
1774         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
1775         if (!skb)
1776                 return;
1777
1778         resp = (struct ieee80211_mgmt *) skb->data;
1779         memcpy(resp->da, mgmt->sa, ETH_ALEN);
1780 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1781         printk(KERN_DEBUG "%s: Sending ProbeResp to " MAC_FMT "\n",
1782                dev->name, MAC_ARG(resp->da));
1783 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1784         ieee80211_sta_tx(dev, skb, 0);
1785 }
1786
1787
1788 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
1789                            struct ieee80211_rx_status *rx_status)
1790 {
1791         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1792         struct ieee80211_sub_if_data *sdata;
1793         struct ieee80211_if_sta *ifsta;
1794         struct ieee80211_mgmt *mgmt;
1795         u16 fc;
1796
1797         if (skb->len < 24)
1798                 goto fail;
1799
1800         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1801         ifsta = &sdata->u.sta;
1802
1803         mgmt = (struct ieee80211_mgmt *) skb->data;
1804         fc = le16_to_cpu(mgmt->frame_control);
1805
1806         switch (fc & IEEE80211_FCTL_STYPE) {
1807         case IEEE80211_STYPE_PROBE_REQ:
1808         case IEEE80211_STYPE_PROBE_RESP:
1809         case IEEE80211_STYPE_BEACON:
1810                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
1811         case IEEE80211_STYPE_AUTH:
1812         case IEEE80211_STYPE_ASSOC_RESP:
1813         case IEEE80211_STYPE_REASSOC_RESP:
1814         case IEEE80211_STYPE_DEAUTH:
1815         case IEEE80211_STYPE_DISASSOC:
1816                 skb_queue_tail(&ifsta->skb_queue, skb);
1817                 queue_work(local->hw.workqueue, &ifsta->work);
1818                 return;
1819         default:
1820                 printk(KERN_DEBUG "%s: received unknown management frame - "
1821                        "stype=%d\n", dev->name,
1822                        (fc & IEEE80211_FCTL_STYPE) >> 4);
1823                 break;
1824         }
1825
1826  fail:
1827         kfree_skb(skb);
1828 }
1829
1830
1831 static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
1832                                          struct sk_buff *skb)
1833 {
1834         struct ieee80211_rx_status *rx_status;
1835         struct ieee80211_sub_if_data *sdata;
1836         struct ieee80211_if_sta *ifsta;
1837         struct ieee80211_mgmt *mgmt;
1838         u16 fc;
1839
1840         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1841         ifsta = &sdata->u.sta;
1842
1843         rx_status = (struct ieee80211_rx_status *) skb->cb;
1844         mgmt = (struct ieee80211_mgmt *) skb->data;
1845         fc = le16_to_cpu(mgmt->frame_control);
1846
1847         switch (fc & IEEE80211_FCTL_STYPE) {
1848         case IEEE80211_STYPE_PROBE_REQ:
1849                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
1850                                             rx_status);
1851                 break;
1852         case IEEE80211_STYPE_PROBE_RESP:
1853                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
1854                 break;
1855         case IEEE80211_STYPE_BEACON:
1856                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
1857                 break;
1858         case IEEE80211_STYPE_AUTH:
1859                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
1860                 break;
1861         case IEEE80211_STYPE_ASSOC_RESP:
1862                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 0);
1863                 break;
1864         case IEEE80211_STYPE_REASSOC_RESP:
1865                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 1);
1866                 break;
1867         case IEEE80211_STYPE_DEAUTH:
1868                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
1869                 break;
1870         case IEEE80211_STYPE_DISASSOC:
1871                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
1872                 break;
1873         }
1874
1875         kfree_skb(skb);
1876 }
1877
1878
1879 void ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
1880                            struct ieee80211_rx_status *rx_status)
1881 {
1882         struct ieee80211_mgmt *mgmt;
1883         u16 fc;
1884
1885         if (skb->len < 24) {
1886                 dev_kfree_skb(skb);
1887                 return;
1888         }
1889
1890         mgmt = (struct ieee80211_mgmt *) skb->data;
1891         fc = le16_to_cpu(mgmt->frame_control);
1892
1893         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1894                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
1895                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
1896                                                      skb->len, rx_status);
1897                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
1898                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
1899                                                  rx_status);
1900                 }
1901         }
1902
1903         dev_kfree_skb(skb);
1904 }
1905
1906
1907 static int ieee80211_sta_active_ibss(struct net_device *dev)
1908 {
1909         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1910         int active = 0;
1911         struct sta_info *sta;
1912
1913         read_lock_bh(&local->sta_lock);
1914         list_for_each_entry(sta, &local->sta_list, list) {
1915                 if (sta->dev == dev &&
1916                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1917                                jiffies)) {
1918                         active++;
1919                         break;
1920                 }
1921         }
1922         read_unlock_bh(&local->sta_lock);
1923
1924         return active;
1925 }
1926
1927
1928 static void ieee80211_sta_expire(struct net_device *dev)
1929 {
1930         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1931         struct sta_info *sta, *tmp;
1932         LIST_HEAD(tmp_list);
1933
1934         write_lock_bh(&local->sta_lock);
1935         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
1936                 if (time_after(jiffies, sta->last_rx +
1937                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1938                         printk(KERN_DEBUG "%s: expiring inactive STA " MAC_FMT
1939                                "\n", dev->name, MAC_ARG(sta->addr));
1940                         __sta_info_get(sta);
1941                         sta_info_remove(sta);
1942                         list_add(&sta->list, &tmp_list);
1943                 }
1944         write_unlock_bh(&local->sta_lock);
1945
1946         list_for_each_entry_safe(sta, tmp, &tmp_list, list) {
1947                 sta_info_free(sta);
1948                 sta_info_put(sta);
1949         }
1950 }
1951
1952
1953 static void ieee80211_sta_merge_ibss(struct net_device *dev,
1954                                      struct ieee80211_if_sta *ifsta)
1955 {
1956         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
1957
1958         ieee80211_sta_expire(dev);
1959         if (ieee80211_sta_active_ibss(dev))
1960                 return;
1961
1962         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
1963                "IBSS networks with same SSID (merge)\n", dev->name);
1964         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
1965 }
1966
1967
1968 void ieee80211_sta_timer(unsigned long data)
1969 {
1970         struct ieee80211_sub_if_data *sdata =
1971                 (struct ieee80211_sub_if_data *) data;
1972         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1973         struct ieee80211_local *local = wdev_priv(&sdata->wdev);
1974
1975         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
1976         queue_work(local->hw.workqueue, &ifsta->work);
1977 }
1978
1979
1980 void ieee80211_sta_work(struct work_struct *work)
1981 {
1982         struct ieee80211_sub_if_data *sdata =
1983                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
1984         struct net_device *dev = sdata->dev;
1985         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1986         struct ieee80211_if_sta *ifsta;
1987         struct sk_buff *skb;
1988
1989         if (!netif_running(dev))
1990                 return;
1991
1992         if (local->sta_scanning)
1993                 return;
1994
1995         if (sdata->type != IEEE80211_IF_TYPE_STA &&
1996             sdata->type != IEEE80211_IF_TYPE_IBSS) {
1997                 printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
1998                        "(type=%d)\n", dev->name, sdata->type);
1999                 return;
2000         }
2001         ifsta = &sdata->u.sta;
2002
2003         while ((skb = skb_dequeue(&ifsta->skb_queue)))
2004                 ieee80211_sta_rx_queued_mgmt(dev, skb);
2005
2006         if (ifsta->state != IEEE80211_AUTHENTICATE &&
2007             ifsta->state != IEEE80211_ASSOCIATE &&
2008             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
2009                 ieee80211_sta_start_scan(dev, NULL, 0);
2010                 return;
2011         }
2012
2013         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
2014                 if (ieee80211_sta_config_auth(dev, ifsta))
2015                         return;
2016                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2017         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
2018                 return;
2019
2020         switch (ifsta->state) {
2021         case IEEE80211_DISABLED:
2022                 break;
2023         case IEEE80211_AUTHENTICATE:
2024                 ieee80211_authenticate(dev, ifsta);
2025                 break;
2026         case IEEE80211_ASSOCIATE:
2027                 ieee80211_associate(dev, ifsta);
2028                 break;
2029         case IEEE80211_ASSOCIATED:
2030                 ieee80211_associated(dev, ifsta);
2031                 break;
2032         case IEEE80211_IBSS_SEARCH:
2033                 ieee80211_sta_find_ibss(dev, ifsta);
2034                 break;
2035         case IEEE80211_IBSS_JOINED:
2036                 ieee80211_sta_merge_ibss(dev, ifsta);
2037                 break;
2038         default:
2039                 printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
2040                        ifsta->state);
2041                 break;
2042         }
2043
2044         if (ieee80211_privacy_mismatch(dev, ifsta)) {
2045                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
2046                        "mixed-cell disabled - disassociate\n", dev->name);
2047
2048                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
2049                 ieee80211_set_disassoc(dev, ifsta, 0);
2050         }
2051 }
2052
2053
2054 static void ieee80211_sta_reset_auth(struct net_device *dev,
2055                                      struct ieee80211_if_sta *ifsta)
2056 {
2057         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2058
2059         if (local->ops->reset_tsf) {
2060                 /* Reset own TSF to allow time synchronization work. */
2061                 local->ops->reset_tsf(local_to_hw(local));
2062         }
2063
2064         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
2065
2066
2067         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
2068                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2069         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2070                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
2071         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
2072                 ifsta->auth_alg = WLAN_AUTH_LEAP;
2073         else
2074                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2075         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
2076                ifsta->auth_alg);
2077         ifsta->auth_transaction = -1;
2078         ifsta->associated = ifsta->auth_tries = ifsta->assoc_tries = 0;
2079         netif_carrier_off(dev);
2080 }
2081
2082
2083 void ieee80211_sta_req_auth(struct net_device *dev,
2084                             struct ieee80211_if_sta *ifsta)
2085 {
2086         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2087         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2088
2089         if (sdata->type != IEEE80211_IF_TYPE_STA)
2090                 return;
2091
2092         if ((ifsta->bssid_set || ifsta->auto_bssid_sel) &&
2093             (ifsta->ssid_set || ifsta->auto_ssid_sel)) {
2094                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2095                 queue_work(local->hw.workqueue, &ifsta->work);
2096         }
2097 }
2098
2099 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
2100                                     const char *ssid, int ssid_len)
2101 {
2102         int tmp, hidden_ssid;
2103
2104         if (!memcmp(ifsta->ssid, ssid, ssid_len))
2105                 return 1;
2106
2107         if (ifsta->auto_bssid_sel)
2108                 return 0;
2109
2110         hidden_ssid = 1;
2111         tmp = ssid_len;
2112         while (tmp--) {
2113                 if (ssid[tmp] != '\0') {
2114                         hidden_ssid = 0;
2115                         break;
2116                 }
2117         }
2118
2119         if (hidden_ssid && ifsta->ssid_len == ssid_len)
2120                 return 1;
2121
2122         if (ssid_len == 1 && ssid[0] == ' ')
2123                 return 1;
2124
2125         return 0;
2126 }
2127
2128 static int ieee80211_sta_config_auth(struct net_device *dev,
2129                                      struct ieee80211_if_sta *ifsta)
2130 {
2131         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2132         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2133         struct ieee80211_sta_bss *bss, *selected = NULL;
2134         int top_rssi = 0, freq;
2135
2136         if (!ifsta->auto_channel_sel && !ifsta->auto_bssid_sel &&
2137             !ifsta->auto_ssid_sel) {
2138                 ifsta->state = IEEE80211_AUTHENTICATE;
2139                 ieee80211_sta_reset_auth(dev, ifsta);
2140                 return 0;
2141         }
2142
2143         spin_lock_bh(&local->sta_bss_lock);
2144         freq = local->oper_channel->freq;
2145         list_for_each_entry(bss, &local->sta_bss_list, list) {
2146                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
2147                         continue;
2148
2149                 if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
2150                     !!sdata->default_key)
2151                         continue;
2152
2153                 if (!ifsta->auto_channel_sel && bss->freq != freq)
2154                         continue;
2155
2156                 if (!ifsta->auto_bssid_sel &&
2157                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
2158                         continue;
2159
2160                 if (!ifsta->auto_ssid_sel &&
2161                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
2162                         continue;
2163
2164                 if (!selected || top_rssi < bss->rssi) {
2165                         selected = bss;
2166                         top_rssi = bss->rssi;
2167                 }
2168         }
2169         if (selected)
2170                 atomic_inc(&selected->users);
2171         spin_unlock_bh(&local->sta_bss_lock);
2172
2173         if (selected) {
2174                 ieee80211_set_channel(local, -1, selected->freq);
2175                 if (!ifsta->ssid_set)
2176                         ieee80211_sta_set_ssid(dev, selected->ssid,
2177                                                selected->ssid_len);
2178                 ieee80211_sta_set_bssid(dev, selected->bssid);
2179                 ieee80211_rx_bss_put(dev, selected);
2180                 ifsta->state = IEEE80211_AUTHENTICATE;
2181                 ieee80211_sta_reset_auth(dev, ifsta);
2182                 return 0;
2183         } else {
2184                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
2185                         if (ifsta->auto_ssid_sel)
2186                                 ieee80211_sta_start_scan(dev, NULL, 0);
2187                         else
2188                                 ieee80211_sta_start_scan(dev, ifsta->ssid,
2189                                                          ifsta->ssid_len);
2190                         ifsta->state = IEEE80211_AUTHENTICATE;
2191                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2192                 } else
2193                         ifsta->state = IEEE80211_DISABLED;
2194         }
2195         return -1;
2196 }
2197
2198 static int ieee80211_sta_join_ibss(struct net_device *dev,
2199                                    struct ieee80211_if_sta *ifsta,
2200                                    struct ieee80211_sta_bss *bss)
2201 {
2202         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2203         int res, rates, i, j;
2204         struct sk_buff *skb;
2205         struct ieee80211_mgmt *mgmt;
2206         struct ieee80211_tx_control control;
2207         struct ieee80211_rate *rate;
2208         struct ieee80211_hw_mode *mode;
2209         struct rate_control_extra extra;
2210         u8 *pos;
2211         struct ieee80211_sub_if_data *sdata;
2212
2213         /* Remove possible STA entries from other IBSS networks. */
2214         sta_info_flush(local, NULL);
2215
2216         if (local->ops->reset_tsf) {
2217                 /* Reset own TSF to allow time synchronization work. */
2218                 local->ops->reset_tsf(local_to_hw(local));
2219         }
2220         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2221         res = ieee80211_if_config(dev);
2222         if (res)
2223                 return res;
2224
2225         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2226
2227         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2228         sdata->drop_unencrypted = bss->capability &
2229                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2230
2231         res = ieee80211_set_channel(local, -1, bss->freq);
2232
2233         if (!(local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)) {
2234                 printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
2235                        "(%d MHz)\n", dev->name, local->hw.conf.channel,
2236                        local->hw.conf.freq);
2237                 return -1;
2238         }
2239
2240         /* Set beacon template based on scan results */
2241         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2242         do {
2243                 if (!skb)
2244                         break;
2245
2246                 skb_reserve(skb, local->hw.extra_tx_headroom);
2247
2248                 mgmt = (struct ieee80211_mgmt *)
2249                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2250                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2251                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2252                                                    IEEE80211_STYPE_BEACON);
2253                 memset(mgmt->da, 0xff, ETH_ALEN);
2254                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2255                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2256                 mgmt->u.beacon.beacon_int =
2257                         cpu_to_le16(local->hw.conf.beacon_int);
2258                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2259
2260                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2261                 *pos++ = WLAN_EID_SSID;
2262                 *pos++ = ifsta->ssid_len;
2263                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2264
2265                 rates = bss->supp_rates_len;
2266                 if (rates > 8)
2267                         rates = 8;
2268                 pos = skb_put(skb, 2 + rates);
2269                 *pos++ = WLAN_EID_SUPP_RATES;
2270                 *pos++ = rates;
2271                 memcpy(pos, bss->supp_rates, rates);
2272
2273                 pos = skb_put(skb, 2 + 1);
2274                 *pos++ = WLAN_EID_DS_PARAMS;
2275                 *pos++ = 1;
2276                 *pos++ = bss->channel;
2277
2278                 pos = skb_put(skb, 2 + 2);
2279                 *pos++ = WLAN_EID_IBSS_PARAMS;
2280                 *pos++ = 2;
2281                 /* FIX: set ATIM window based on scan results */
2282                 *pos++ = 0;
2283                 *pos++ = 0;
2284
2285                 if (bss->supp_rates_len > 8) {
2286                         rates = bss->supp_rates_len - 8;
2287                         pos = skb_put(skb, 2 + rates);
2288                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2289                         *pos++ = rates;
2290                         memcpy(pos, &bss->supp_rates[8], rates);
2291                 }
2292
2293                 memset(&control, 0, sizeof(control));
2294                 memset(&extra, 0, sizeof(extra));
2295                 extra.mode = local->oper_hw_mode;
2296                 rate = rate_control_get_rate(local, dev, skb, &extra);
2297                 if (!rate) {
2298                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2299                                "for IBSS beacon\n", dev->name);
2300                         break;
2301                 }
2302                 control.tx_rate = (sdata->short_preamble &&
2303                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2304                         rate->val2 : rate->val;
2305                 control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
2306                 control.power_level = local->hw.conf.power_level;
2307                 control.flags |= IEEE80211_TXCTL_NO_ACK;
2308                 control.retry_limit = 1;
2309
2310                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2311                 if (ifsta->probe_resp) {
2312                         mgmt = (struct ieee80211_mgmt *)
2313                                 ifsta->probe_resp->data;
2314                         mgmt->frame_control =
2315                                 IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2316                                              IEEE80211_STYPE_PROBE_RESP);
2317                 } else {
2318                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2319                                "template for IBSS\n", dev->name);
2320                 }
2321
2322                 if (local->ops->beacon_update &&
2323                     local->ops->beacon_update(local_to_hw(local),
2324                                              skb, &control) == 0) {
2325                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2326                                "template based on scan results\n", dev->name);
2327                         skb = NULL;
2328                 }
2329
2330                 rates = 0;
2331                 mode = local->oper_hw_mode;
2332                 for (i = 0; i < bss->supp_rates_len; i++) {
2333                         int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2334                         if (mode->mode == MODE_ATHEROS_TURBO)
2335                                 bitrate *= 2;
2336                         for (j = 0; j < mode->num_rates; j++)
2337                                 if (mode->rates[j].rate == bitrate)
2338                                         rates |= BIT(j);
2339                 }
2340                 ifsta->supp_rates_bits = rates;
2341         } while (0);
2342
2343         if (skb) {
2344                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2345                        "template\n", dev->name);
2346                 dev_kfree_skb(skb);
2347         }
2348
2349         ifsta->state = IEEE80211_IBSS_JOINED;
2350         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2351
2352         ieee80211_rx_bss_put(dev, bss);
2353
2354         return res;
2355 }
2356
2357
2358 static int ieee80211_sta_create_ibss(struct net_device *dev,
2359                                      struct ieee80211_if_sta *ifsta)
2360 {
2361         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2362         struct ieee80211_sta_bss *bss;
2363         struct ieee80211_sub_if_data *sdata;
2364         struct ieee80211_hw_mode *mode;
2365         u8 bssid[ETH_ALEN], *pos;
2366         int i;
2367
2368 #if 0
2369         /* Easier testing, use fixed BSSID. */
2370         memset(bssid, 0xfe, ETH_ALEN);
2371 #else
2372         /* Generate random, not broadcast, locally administered BSSID. Mix in
2373          * own MAC address to make sure that devices that do not have proper
2374          * random number generator get different BSSID. */
2375         get_random_bytes(bssid, ETH_ALEN);
2376         for (i = 0; i < ETH_ALEN; i++)
2377                 bssid[i] ^= dev->dev_addr[i];
2378         bssid[0] &= ~0x01;
2379         bssid[0] |= 0x02;
2380 #endif
2381
2382         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID " MAC_FMT "\n",
2383                dev->name, MAC_ARG(bssid));
2384
2385         bss = ieee80211_rx_bss_add(dev, bssid);
2386         if (!bss)
2387                 return -ENOMEM;
2388
2389         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2390         mode = local->oper_hw_mode;
2391
2392         if (local->hw.conf.beacon_int == 0)
2393                 local->hw.conf.beacon_int = 100;
2394         bss->beacon_int = local->hw.conf.beacon_int;
2395         bss->hw_mode = local->hw.conf.phymode;
2396         bss->channel = local->hw.conf.channel;
2397         bss->freq = local->hw.conf.freq;
2398         bss->last_update = jiffies;
2399         bss->capability = WLAN_CAPABILITY_IBSS;
2400         if (sdata->default_key) {
2401                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
2402         } else
2403                 sdata->drop_unencrypted = 0;
2404         bss->supp_rates_len = mode->num_rates;
2405         pos = bss->supp_rates;
2406         for (i = 0; i < mode->num_rates; i++) {
2407                 int rate = mode->rates[i].rate;
2408                 if (mode->mode == MODE_ATHEROS_TURBO)
2409                         rate /= 2;
2410                 *pos++ = (u8) (rate / 5);
2411         }
2412
2413         return ieee80211_sta_join_ibss(dev, ifsta, bss);
2414 }
2415
2416
2417 static int ieee80211_sta_find_ibss(struct net_device *dev,
2418                                    struct ieee80211_if_sta *ifsta)
2419 {
2420         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2421         struct ieee80211_sta_bss *bss;
2422         int found = 0;
2423         u8 bssid[ETH_ALEN];
2424         int active_ibss;
2425
2426         if (ifsta->ssid_len == 0)
2427                 return -EINVAL;
2428
2429         active_ibss = ieee80211_sta_active_ibss(dev);
2430 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2431         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2432                dev->name, active_ibss);
2433 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2434         spin_lock_bh(&local->sta_bss_lock);
2435         list_for_each_entry(bss, &local->sta_bss_list, list) {
2436                 if (ifsta->ssid_len != bss->ssid_len ||
2437                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2438                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2439                         continue;
2440 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2441                 printk(KERN_DEBUG "   bssid=" MAC_FMT " found\n",
2442                        MAC_ARG(bss->bssid));
2443 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2444                 memcpy(bssid, bss->bssid, ETH_ALEN);
2445                 found = 1;
2446                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2447                         break;
2448         }
2449         spin_unlock_bh(&local->sta_bss_lock);
2450
2451 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2452         printk(KERN_DEBUG "   sta_find_ibss: selected " MAC_FMT " current "
2453                MAC_FMT "\n", MAC_ARG(bssid), MAC_ARG(ifsta->bssid));
2454 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2455         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
2456             (bss = ieee80211_rx_bss_get(dev, bssid))) {
2457                 printk(KERN_DEBUG "%s: Selected IBSS BSSID " MAC_FMT
2458                        " based on configured SSID\n",
2459                        dev->name, MAC_ARG(bssid));
2460                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
2461         }
2462 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2463         printk(KERN_DEBUG "   did not try to join ibss\n");
2464 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2465
2466         /* Selected IBSS not found in current scan results - try to scan */
2467         if (ifsta->state == IEEE80211_IBSS_JOINED &&
2468             !ieee80211_sta_active_ibss(dev)) {
2469                 mod_timer(&ifsta->timer, jiffies +
2470                                       IEEE80211_IBSS_MERGE_INTERVAL);
2471         } else if (time_after(jiffies, local->last_scan_completed +
2472                               IEEE80211_SCAN_INTERVAL)) {
2473                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
2474                        "join\n", dev->name);
2475                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
2476                                               ifsta->ssid_len);
2477         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
2478                 int interval = IEEE80211_SCAN_INTERVAL;
2479
2480                 if (time_after(jiffies, ifsta->ibss_join_req +
2481                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2482                         if (ifsta->create_ibss &&
2483                             local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)
2484                                 return ieee80211_sta_create_ibss(dev, ifsta);
2485                         if (ifsta->create_ibss) {
2486                                 printk(KERN_DEBUG "%s: IBSS not allowed on the"
2487                                        " configured channel %d (%d MHz)\n",
2488                                        dev->name, local->hw.conf.channel,
2489                                        local->hw.conf.freq);
2490                         }
2491
2492                         /* No IBSS found - decrease scan interval and continue
2493                          * scanning. */
2494                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2495                 }
2496
2497                 ifsta->state = IEEE80211_IBSS_SEARCH;
2498                 mod_timer(&ifsta->timer, jiffies + interval);
2499                 return 0;
2500         }
2501
2502         return 0;
2503 }
2504
2505
2506 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
2507 {
2508         struct ieee80211_sub_if_data *sdata;
2509         struct ieee80211_if_sta *ifsta;
2510         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2511
2512         if (len > IEEE80211_MAX_SSID_LEN)
2513                 return -EINVAL;
2514
2515         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2516          * not defined. */
2517         if (local->ops->conf_tx) {
2518                 struct ieee80211_tx_queue_params qparam;
2519                 int i;
2520
2521                 memset(&qparam, 0, sizeof(qparam));
2522                 /* TODO: are these ok defaults for all hw_modes? */
2523                 qparam.aifs = 2;
2524                 qparam.cw_min =
2525                         local->hw.conf.phymode == MODE_IEEE80211B ? 31 : 15;
2526                 qparam.cw_max = 1023;
2527                 qparam.burst_time = 0;
2528                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2529                 {
2530                         local->ops->conf_tx(local_to_hw(local),
2531                                            i + IEEE80211_TX_QUEUE_DATA0,
2532                                            &qparam);
2533                 }
2534                 /* IBSS uses different parameters for Beacon sending */
2535                 qparam.cw_min++;
2536                 qparam.cw_min *= 2;
2537                 qparam.cw_min--;
2538                 local->ops->conf_tx(local_to_hw(local),
2539                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
2540         }
2541
2542         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2543         ifsta = &sdata->u.sta;
2544
2545         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
2546                 ifsta->prev_bssid_set = 0;
2547         memcpy(ifsta->ssid, ssid, len);
2548         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
2549         ifsta->ssid_len = len;
2550
2551         ifsta->ssid_set = len ? 1 : 0;
2552         if (sdata->type == IEEE80211_IF_TYPE_IBSS && !ifsta->bssid_set) {
2553                 ifsta->ibss_join_req = jiffies;
2554                 ifsta->state = IEEE80211_IBSS_SEARCH;
2555                 return ieee80211_sta_find_ibss(dev, ifsta);
2556         }
2557         return 0;
2558 }
2559
2560
2561 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
2562 {
2563         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2564         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2565         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
2566         *len = ifsta->ssid_len;
2567         return 0;
2568 }
2569
2570
2571 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
2572 {
2573         struct ieee80211_sub_if_data *sdata;
2574         struct ieee80211_if_sta *ifsta;
2575         int res;
2576
2577         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2578         ifsta = &sdata->u.sta;
2579
2580         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
2581                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
2582                 res = ieee80211_if_config(dev);
2583                 if (res) {
2584                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
2585                                "the low-level driver\n", dev->name);
2586                         return res;
2587                 }
2588         }
2589
2590         if (!is_valid_ether_addr(bssid))
2591                 ifsta->bssid_set = 0;
2592         else
2593                 ifsta->bssid_set = 1;
2594         return 0;
2595 }
2596
2597
2598 static void ieee80211_send_nullfunc(struct ieee80211_local *local,
2599                                     struct ieee80211_sub_if_data *sdata,
2600                                     int powersave)
2601 {
2602         struct sk_buff *skb;
2603         struct ieee80211_hdr *nullfunc;
2604         u16 fc;
2605
2606         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
2607         if (!skb) {
2608                 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
2609                        "frame\n", sdata->dev->name);
2610                 return;
2611         }
2612         skb_reserve(skb, local->hw.extra_tx_headroom);
2613
2614         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
2615         memset(nullfunc, 0, 24);
2616         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
2617              IEEE80211_FCTL_TODS;
2618         if (powersave)
2619                 fc |= IEEE80211_FCTL_PM;
2620         nullfunc->frame_control = cpu_to_le16(fc);
2621         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
2622         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
2623         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
2624
2625         ieee80211_sta_tx(sdata->dev, skb, 0);
2626 }
2627
2628
2629 void ieee80211_scan_completed(struct ieee80211_hw *hw)
2630 {
2631         struct ieee80211_local *local = hw_to_local(hw);
2632         struct net_device *dev = local->scan_dev;
2633         struct ieee80211_sub_if_data *sdata;
2634         union iwreq_data wrqu;
2635
2636         local->last_scan_completed = jiffies;
2637         wmb();
2638         local->sta_scanning = 0;
2639
2640         if (ieee80211_hw_config(local))
2641                 printk(KERN_DEBUG "%s: failed to restore operational"
2642                        "channel after scan\n", dev->name);
2643
2644         if (!(local->hw.flags & IEEE80211_HW_NO_PROBE_FILTERING) &&
2645             ieee80211_if_config(dev))
2646                 printk(KERN_DEBUG "%s: failed to restore operational"
2647                        "BSSID after scan\n", dev->name);
2648
2649         memset(&wrqu, 0, sizeof(wrqu));
2650         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2651
2652         read_lock(&local->sub_if_lock);
2653         list_for_each_entry(sdata, &local->sub_if_list, list) {
2654
2655                 /* No need to wake the master device. */
2656                 if (sdata->dev == local->mdev)
2657                         continue;
2658
2659                 if (sdata->type == IEEE80211_IF_TYPE_STA) {
2660                         if (sdata->u.sta.associated)
2661                                 ieee80211_send_nullfunc(local, sdata, 0);
2662                         ieee80211_sta_timer((unsigned long)sdata);
2663                 }
2664
2665                 netif_wake_queue(sdata->dev);
2666         }
2667         read_unlock(&local->sub_if_lock);
2668
2669         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2670         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
2671                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2672                 if (!ifsta->bssid_set ||
2673                     (!ifsta->state == IEEE80211_IBSS_JOINED &&
2674                     !ieee80211_sta_active_ibss(dev)))
2675                         ieee80211_sta_find_ibss(dev, ifsta);
2676         }
2677 }
2678 EXPORT_SYMBOL(ieee80211_scan_completed);
2679
2680 void ieee80211_sta_scan_work(struct work_struct *work)
2681 {
2682         struct ieee80211_local *local =
2683                 container_of(work, struct ieee80211_local, scan_work.work);
2684         struct net_device *dev = local->scan_dev;
2685         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2686         struct ieee80211_hw_mode *mode;
2687         struct ieee80211_channel *chan;
2688         int skip;
2689         unsigned long next_delay = 0;
2690
2691         if (!local->sta_scanning)
2692                 return;
2693
2694         switch (local->scan_state) {
2695         case SCAN_SET_CHANNEL:
2696                 mode = local->scan_hw_mode;
2697                 if (local->scan_hw_mode->list.next == &local->modes_list &&
2698                     local->scan_channel_idx >= mode->num_channels) {
2699                         ieee80211_scan_completed(local_to_hw(local));
2700                         return;
2701                 }
2702                 skip = !(local->enabled_modes & (1 << mode->mode));
2703                 chan = &mode->channels[local->scan_channel_idx];
2704                 if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
2705                     (sdata->type == IEEE80211_IF_TYPE_IBSS &&
2706                      !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
2707                     (local->hw_modes & local->enabled_modes &
2708                      (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
2709                         skip = 1;
2710
2711                 if (!skip) {
2712 #if 0
2713                         printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
2714                                dev->name, chan->chan, chan->freq);
2715 #endif
2716
2717                         local->scan_channel = chan;
2718                         if (ieee80211_hw_config(local)) {
2719                                 printk(KERN_DEBUG "%s: failed to set channel "
2720                                        "%d (%d MHz) for scan\n", dev->name,
2721                                        chan->chan, chan->freq);
2722                                 skip = 1;
2723                         }
2724                 }
2725
2726                 local->scan_channel_idx++;
2727                 if (local->scan_channel_idx >= local->scan_hw_mode->num_channels) {
2728                         if (local->scan_hw_mode->list.next != &local->modes_list) {
2729                                 local->scan_hw_mode = list_entry(local->scan_hw_mode->list.next,
2730                                                                  struct ieee80211_hw_mode,
2731                                                                  list);
2732                                 local->scan_channel_idx = 0;
2733                         }
2734                 }
2735
2736                 if (skip)
2737                         break;
2738
2739                 next_delay = IEEE80211_PROBE_DELAY +
2740                              usecs_to_jiffies(local->hw.channel_change_time);
2741                 local->scan_state = SCAN_SEND_PROBE;
2742                 break;
2743         case SCAN_SEND_PROBE:
2744                 if (local->scan_channel->flag & IEEE80211_CHAN_W_ACTIVE_SCAN) {
2745                         ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
2746                                                  local->scan_ssid_len);
2747                         next_delay = IEEE80211_CHANNEL_TIME;
2748                 } else
2749                         next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
2750                 local->scan_state = SCAN_SET_CHANNEL;
2751                 break;
2752         }
2753
2754         if (local->sta_scanning)
2755                 queue_delayed_work(local->hw.workqueue, &local->scan_work,
2756                                    next_delay);
2757 }
2758
2759
2760 static int ieee80211_sta_start_scan(struct net_device *dev,
2761                                     u8 *ssid, size_t ssid_len)
2762 {
2763         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2764         struct ieee80211_sub_if_data *sdata;
2765
2766         if (ssid_len > IEEE80211_MAX_SSID_LEN)
2767                 return -EINVAL;
2768
2769         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2770          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2771          * BSSID: MACAddress
2772          * SSID
2773          * ScanType: ACTIVE, PASSIVE
2774          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2775          *    a Probe frame during active scanning
2776          * ChannelList
2777          * MinChannelTime (>= ProbeDelay), in TU
2778          * MaxChannelTime: (>= MinChannelTime), in TU
2779          */
2780
2781          /* MLME-SCAN.confirm
2782           * BSSDescriptionSet
2783           * ResultCode: SUCCESS, INVALID_PARAMETERS
2784          */
2785
2786         if (local->sta_scanning) {
2787                 if (local->scan_dev == dev)
2788                         return 0;
2789                 return -EBUSY;
2790         }
2791
2792         if (local->ops->hw_scan) {
2793                 int rc = local->ops->hw_scan(local_to_hw(local),
2794                                             ssid, ssid_len);
2795                 if (!rc) {
2796                         local->sta_scanning = 1;
2797                         local->scan_dev = dev;
2798                 }
2799                 return rc;
2800         }
2801
2802         local->sta_scanning = 1;
2803
2804         read_lock(&local->sub_if_lock);
2805         list_for_each_entry(sdata, &local->sub_if_list, list) {
2806
2807                 /* Don't stop the master interface, otherwise we can't transmit
2808                  * probes! */
2809                 if (sdata->dev == local->mdev)
2810                         continue;
2811
2812                 netif_stop_queue(sdata->dev);
2813                 if (sdata->type == IEEE80211_IF_TYPE_STA &&
2814                     sdata->u.sta.associated)
2815                         ieee80211_send_nullfunc(local, sdata, 1);
2816         }
2817         read_unlock(&local->sub_if_lock);
2818
2819         if (ssid) {
2820                 local->scan_ssid_len = ssid_len;
2821                 memcpy(local->scan_ssid, ssid, ssid_len);
2822         } else
2823                 local->scan_ssid_len = 0;
2824         local->scan_state = SCAN_SET_CHANNEL;
2825         local->scan_hw_mode = list_entry(local->modes_list.next,
2826                                          struct ieee80211_hw_mode,
2827                                          list);
2828         local->scan_channel_idx = 0;
2829         local->scan_dev = dev;
2830
2831         if (!(local->hw.flags & IEEE80211_HW_NO_PROBE_FILTERING) &&
2832             ieee80211_if_config(dev))
2833                 printk(KERN_DEBUG "%s: failed to set BSSID for scan\n",
2834                        dev->name);
2835
2836         /* TODO: start scan as soon as all nullfunc frames are ACKed */
2837         queue_delayed_work(local->hw.workqueue, &local->scan_work,
2838                            IEEE80211_CHANNEL_TIME);
2839
2840         return 0;
2841 }
2842
2843
2844 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
2845 {
2846         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2847         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2848         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2849
2850         if (sdata->type != IEEE80211_IF_TYPE_STA)
2851                 return ieee80211_sta_start_scan(dev, ssid, ssid_len);
2852
2853         if (local->sta_scanning) {
2854                 if (local->scan_dev == dev)
2855                         return 0;
2856                 return -EBUSY;
2857         }
2858
2859         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
2860         queue_work(local->hw.workqueue, &ifsta->work);
2861         return 0;
2862 }
2863
2864 static char *
2865 ieee80211_sta_scan_result(struct net_device *dev,
2866                           struct ieee80211_sta_bss *bss,
2867                           char *current_ev, char *end_buf)
2868 {
2869         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2870         struct iw_event iwe;
2871
2872         if (time_after(jiffies,
2873                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
2874                 return current_ev;
2875
2876         if (!(local->enabled_modes & (1 << bss->hw_mode)))
2877                 return current_ev;
2878
2879         if (local->scan_flags & IEEE80211_SCAN_WPA_ONLY &&
2880             !bss->wpa_ie && !bss->rsn_ie)
2881                 return current_ev;
2882
2883         if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID &&
2884             (local->scan_ssid_len != bss->ssid_len ||
2885              memcmp(local->scan_ssid, bss->ssid, bss->ssid_len) != 0))
2886                 return current_ev;
2887
2888         memset(&iwe, 0, sizeof(iwe));
2889         iwe.cmd = SIOCGIWAP;
2890         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2891         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
2892         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2893                                           IW_EV_ADDR_LEN);
2894
2895         memset(&iwe, 0, sizeof(iwe));
2896         iwe.cmd = SIOCGIWESSID;
2897         iwe.u.data.length = bss->ssid_len;
2898         iwe.u.data.flags = 1;
2899         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2900                                           bss->ssid);
2901
2902         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
2903                 memset(&iwe, 0, sizeof(iwe));
2904                 iwe.cmd = SIOCGIWMODE;
2905                 if (bss->capability & WLAN_CAPABILITY_ESS)
2906                         iwe.u.mode = IW_MODE_MASTER;
2907                 else
2908                         iwe.u.mode = IW_MODE_ADHOC;
2909                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2910                                                   IW_EV_UINT_LEN);
2911         }
2912
2913         memset(&iwe, 0, sizeof(iwe));
2914         iwe.cmd = SIOCGIWFREQ;
2915         iwe.u.freq.m = bss->channel;
2916         iwe.u.freq.e = 0;
2917         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2918                                           IW_EV_FREQ_LEN);
2919         iwe.u.freq.m = bss->freq * 100000;
2920         iwe.u.freq.e = 1;
2921         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2922                                           IW_EV_FREQ_LEN);
2923
2924         memset(&iwe, 0, sizeof(iwe));
2925         iwe.cmd = IWEVQUAL;
2926         iwe.u.qual.qual = bss->signal;
2927         iwe.u.qual.level = bss->rssi;
2928         iwe.u.qual.noise = bss->noise;
2929         iwe.u.qual.updated = local->wstats_flags;
2930         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2931                                           IW_EV_QUAL_LEN);
2932
2933         memset(&iwe, 0, sizeof(iwe));
2934         iwe.cmd = SIOCGIWENCODE;
2935         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
2936                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2937         else
2938                 iwe.u.data.flags = IW_ENCODE_DISABLED;
2939         iwe.u.data.length = 0;
2940         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
2941
2942         if (bss && bss->wpa_ie) {
2943                 memset(&iwe, 0, sizeof(iwe));
2944                 iwe.cmd = IWEVGENIE;
2945                 iwe.u.data.length = bss->wpa_ie_len;
2946                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2947                                                   bss->wpa_ie);
2948         }
2949
2950         if (bss && bss->rsn_ie) {
2951                 memset(&iwe, 0, sizeof(iwe));
2952                 iwe.cmd = IWEVGENIE;
2953                 iwe.u.data.length = bss->rsn_ie_len;
2954                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2955                                                   bss->rsn_ie);
2956         }
2957
2958         if (bss && bss->supp_rates_len > 0) {
2959                 /* display all supported rates in readable format */
2960                 char *p = current_ev + IW_EV_LCP_LEN;
2961                 int i;
2962
2963                 memset(&iwe, 0, sizeof(iwe));
2964                 iwe.cmd = SIOCGIWRATE;
2965                 /* Those two flags are ignored... */
2966                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
2967
2968                 for (i = 0; i < bss->supp_rates_len; i++) {
2969                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
2970                                                         0x7f) * 500000);
2971                         p = iwe_stream_add_value(current_ev, p,
2972                                         end_buf, &iwe, IW_EV_PARAM_LEN);
2973                 }
2974                 current_ev = p;
2975         }
2976
2977         if (bss) {
2978                 char *buf;
2979                 buf = kmalloc(30, GFP_ATOMIC);
2980                 if (buf) {
2981                         memset(&iwe, 0, sizeof(iwe));
2982                         iwe.cmd = IWEVCUSTOM;
2983                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
2984                         iwe.u.data.length = strlen(buf);
2985                         current_ev = iwe_stream_add_point(current_ev, end_buf,
2986                                                           &iwe, buf);
2987                         kfree(buf);
2988                 }
2989         }
2990
2991         do {
2992                 char *buf;
2993
2994                 if (!(local->scan_flags & IEEE80211_SCAN_EXTRA_INFO))
2995                         break;
2996
2997                 buf = kmalloc(100, GFP_ATOMIC);
2998                 if (!buf)
2999                         break;
3000
3001                 memset(&iwe, 0, sizeof(iwe));
3002                 iwe.cmd = IWEVCUSTOM;
3003                 sprintf(buf, "bcn_int=%d", bss->beacon_int);
3004                 iwe.u.data.length = strlen(buf);
3005                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3006                                                   buf);
3007
3008                 memset(&iwe, 0, sizeof(iwe));
3009                 iwe.cmd = IWEVCUSTOM;
3010                 sprintf(buf, "capab=0x%04x", bss->capability);
3011                 iwe.u.data.length = strlen(buf);
3012                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3013                                                   buf);
3014
3015                 kfree(buf);
3016                 break;
3017         } while (0);
3018
3019         return current_ev;
3020 }
3021
3022
3023 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
3024 {
3025         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3026         char *current_ev = buf;
3027         char *end_buf = buf + len;
3028         struct ieee80211_sta_bss *bss;
3029
3030         spin_lock_bh(&local->sta_bss_lock);
3031         list_for_each_entry(bss, &local->sta_bss_list, list) {
3032                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3033                         spin_unlock_bh(&local->sta_bss_lock);
3034                         return -E2BIG;
3035                 }
3036                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
3037                                                        end_buf);
3038         }
3039         spin_unlock_bh(&local->sta_bss_lock);
3040         return current_ev - buf;
3041 }
3042
3043
3044 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
3045 {
3046         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3047         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3048         kfree(ifsta->extra_ie);
3049         if (len == 0) {
3050                 ifsta->extra_ie = NULL;
3051                 ifsta->extra_ie_len = 0;
3052                 return 0;
3053         }
3054         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3055         if (!ifsta->extra_ie) {
3056                 ifsta->extra_ie_len = 0;
3057                 return -ENOMEM;
3058         }
3059         memcpy(ifsta->extra_ie, ie, len);
3060         ifsta->extra_ie_len = len;
3061         return 0;
3062 }
3063
3064
3065 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
3066                                          struct sk_buff *skb, u8 *bssid,
3067                                          u8 *addr)
3068 {
3069         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3070         struct sta_info *sta;
3071         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3072
3073         /* TODO: Could consider removing the least recently used entry and
3074          * allow new one to be added. */
3075         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3076                 if (net_ratelimit()) {
3077                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3078                                "entry " MAC_FMT "\n", dev->name, MAC_ARG(addr));
3079                 }
3080                 return NULL;
3081         }
3082
3083         printk(KERN_DEBUG "%s: Adding new IBSS station " MAC_FMT " (dev=%s)\n",
3084                local->mdev->name, MAC_ARG(addr), dev->name);
3085
3086         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
3087         if (!sta)
3088                 return NULL;
3089
3090         sta->supp_rates = sdata->u.sta.supp_rates_bits;
3091
3092         rate_control_rate_init(sta, local);
3093
3094         return sta; /* caller will call sta_info_put() */
3095 }
3096
3097
3098 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
3099 {
3100         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3101         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3102
3103         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
3104                dev->name, reason);
3105
3106         if (sdata->type != IEEE80211_IF_TYPE_STA &&
3107             sdata->type != IEEE80211_IF_TYPE_IBSS)
3108                 return -EINVAL;
3109
3110         ieee80211_send_deauth(dev, ifsta, reason);
3111         ieee80211_set_disassoc(dev, ifsta, 1);
3112         return 0;
3113 }
3114
3115
3116 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
3117 {
3118         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3119         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3120
3121         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
3122                dev->name, reason);
3123
3124         if (sdata->type != IEEE80211_IF_TYPE_STA)
3125                 return -EINVAL;
3126
3127         if (!ifsta->associated)
3128                 return -1;
3129
3130         ieee80211_send_disassoc(dev, ifsta, reason);
3131         ieee80211_set_disassoc(dev, ifsta, 0);
3132         return 0;
3133 }