package/mac80211/src/mac80211/ieee80211_sta.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 /* TODO:
  15  * BSS table: use <BSSID,SSID> as the key to support multi-SSID APs
  16  * order BSS list by RSSI(?) ("quality of AP")
  17  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  18  *    SSID)
  19  */
  20 #include <linux/delay.h>
  21 #include <linux/if_ether.h>
  22 #include <linux/skbuff.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/wireless.h>
  26 #include <linux/random.h>
  27 #include <linux/etherdevice.h>
  28 #include <net/iw_handler.h>
  29 #include <asm/types.h>
  30
  31 #include <net/mac80211.h>
  32 #include "ieee80211_i.h"
  33 #include "ieee80211_rate.h"
  34 #include "ieee80211_led.h"
  35
  36 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  37 #define IEEE80211_AUTH_MAX_TRIES 3
  38 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  39 #define IEEE80211_ASSOC_MAX_TRIES 3
  40 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  41 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  42 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  43 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  44 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  45 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
  46
  47 #define IEEE80211_PROBE_DELAY (HZ / 33)
  48 #define IEEE80211_CHANNEL_TIME (HZ / 33)
  49 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
  50 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
  51 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  52 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  53
  54 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  55
  56
  57 #define IEEE80211_FC(type, stype) cpu_to_le16(type | stype)
  58
  59 #define ERP_INFO_USE_PROTECTION BIT(1)
  60
  61 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
  62                                      u8 *ssid, size_t ssid_len);
  63 static struct ieee80211_sta_bss *
  64 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid);
  65 static void ieee80211_rx_bss_put(struct net_device *dev,
  66                                  struct ieee80211_sta_bss *bss);
  67 static int ieee80211_sta_find_ibss(struct net_device *dev,
  68                                    struct ieee80211_if_sta *ifsta);
  69 static int ieee80211_sta_wep_configured(struct net_device *dev);
  70 static int ieee80211_sta_start_scan(struct net_device *dev,
  71                                     u8 *ssid, size_t ssid_len);
  72 static int ieee80211_sta_config_auth(struct net_device *dev,
  73                                      struct ieee80211_if_sta *ifsta);
  74
  75
  76 /* Parsed Information Elements */
  77 struct ieee802_11_elems {
  78         /* pointers to IEs */
  79         u8 *ssid;
  80         u8 *supp_rates;
  81         u8 *fh_params;
  82         u8 *ds_params;
  83         u8 *cf_params;
  84         u8 *tim;
  85         u8 *ibss_params;
  86         u8 *challenge;
  87         u8 *wpa;
  88         u8 *rsn;
  89         u8 *erp_info;
  90         u8 *ext_supp_rates;
  91         u8 *wmm_info;
  92         u8 *wmm_param;
  93
  94         /* length of them, respectively */
  95         u8 ssid_len;
  96         u8 supp_rates_len;
  97         u8 fh_params_len;
  98         u8 ds_params_len;
  99         u8 cf_params_len;
 100         u8 tim_len;
 101         u8 ibss_params_len;
 102         u8 challenge_len;
 103         u8 wpa_len;
 104         u8 rsn_len;
 105         u8 erp_info_len;
 106         u8 ext_supp_rates_len;
 107         u8 wmm_info_len;
 108         u8 wmm_param_len;
 109 };
 110
 111 enum ParseRes { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 };
 112
 113 static enum ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
 114                                             struct ieee802_11_elems *elems)
 115 {
 116         size_t left = len;
 117         u8 *pos = start;
 118         int unknown = 0;
 119
 120         memset(elems, 0, sizeof(*elems));
 121
 122         while (left >= 2) {
 123                 u8 id, elen;
 124
 125                 id = *pos++;
 126                 elen = *pos++;
 127                 left -= 2;
 128
 129                 if (elen > left) {
 130 #if 0
 131                         if (net_ratelimit())
 132                                 printk(KERN_DEBUG "IEEE 802.11 element parse "
 133                                        "failed (id=%d elen=%d left=%d)\n",
 134                                        id, elen, left);
 135 #endif
 136                         return ParseFailed;
 137                 }
 138
 139                 switch (id) {
 140                 case WLAN_EID_SSID:
 141                         elems->ssid = pos;
 142                         elems->ssid_len = elen;
 143                         break;
 144                 case WLAN_EID_SUPP_RATES:
 145                         elems->supp_rates = pos;
 146                         elems->supp_rates_len = elen;
 147                         break;
 148                 case WLAN_EID_FH_PARAMS:
 149                         elems->fh_params = pos;
 150                         elems->fh_params_len = elen;
 151                         break;
 152                 case WLAN_EID_DS_PARAMS:
 153                         elems->ds_params = pos;
 154                         elems->ds_params_len = elen;
 155                         break;
 156                 case WLAN_EID_CF_PARAMS:
 157                         elems->cf_params = pos;
 158                         elems->cf_params_len = elen;
 159                         break;
 160                 case WLAN_EID_TIM:
 161                         elems->tim = pos;
 162                         elems->tim_len = elen;
 163                         break;
 164                 case WLAN_EID_IBSS_PARAMS:
 165                         elems->ibss_params = pos;
 166                         elems->ibss_params_len = elen;
 167                         break;
 168                 case WLAN_EID_CHALLENGE:
 169                         elems->challenge = pos;
 170                         elems->challenge_len = elen;
 171                         break;
 172                 case WLAN_EID_WPA:
 173                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 174                             pos[2] == 0xf2) {
 175                                 /* Microsoft OUI (00:50:F2) */
 176                                 if (pos[3] == 1) {
 177                                         /* OUI Type 1 - WPA IE */
 178                                         elems->wpa = pos;
 179                                         elems->wpa_len = elen;
 180                                 } else if (elen >= 5 && pos[3] == 2) {
 181                                         if (pos[4] == 0) {
 182                                                 elems->wmm_info = pos;
 183                                                 elems->wmm_info_len = elen;
 184                                         } else if (pos[4] == 1) {
 185                                                 elems->wmm_param = pos;
 186                                                 elems->wmm_param_len = elen;
 187                                         }
 188                                 }
 189                         }
 190                         break;
 191                 case WLAN_EID_RSN:
 192                         elems->rsn = pos;
 193                         elems->rsn_len = elen;
 194                         break;
 195                 case WLAN_EID_ERP_INFO:
 196                         elems->erp_info = pos;
 197                         elems->erp_info_len = elen;
 198                         break;
 199                 case WLAN_EID_EXT_SUPP_RATES:
 200                         elems->ext_supp_rates = pos;
 201                         elems->ext_supp_rates_len = elen;
 202                         break;
 203                 default:
 204 #if 0
 205                         printk(KERN_DEBUG "IEEE 802.11 element parse ignored "
 206                                       "unknown element (id=%d elen=%d)\n",
 207                                       id, elen);
 208 #endif
 209                         unknown++;
 210                         break;
 211                 }
 212
 213                 left -= elen;
 214                 pos += elen;
 215         }
 216
 217         /* Do not trigger error if left == 1 as Apple Airport base stations
 218          * send AssocResps that are one spurious byte too long. */
 219
 220         return unknown ? ParseUnknown : ParseOK;
 221 }
 222
 223
 224
 225
 226 static int ecw2cw(int ecw)
 227 {
 228         int cw = 1;
 229         while (ecw > 0) {
 230                 cw <<= 1;
 231                 ecw--;
 232         }
 233         return cw - 1;
 234 }
 235
 236 static void ieee80211_sta_wmm_params(struct net_device *dev,
 237                                      struct ieee80211_if_sta *ifsta,
 238                                      u8 *wmm_param, size_t wmm_param_len)
 239 {
 240         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 241         struct ieee80211_tx_queue_params params;
 242         size_t left;
 243         int count;
 244         u8 *pos;
 245
 246         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 247                 return;
 248         count = wmm_param[6] & 0x0f;
 249         if (count == ifsta->wmm_last_param_set)
 250                 return;
 251         ifsta->wmm_last_param_set = count;
 252
 253         pos = wmm_param + 8;
 254         left = wmm_param_len - 8;
 255
 256         memset(&params, 0, sizeof(params));
 257
 258         if (!local->ops->conf_tx)
 259                 return;
 260
 261         local->wmm_acm = 0;
 262         for (; left >= 4; left -= 4, pos += 4) {
 263                 int aci = (pos[0] >> 5) & 0x03;
 264                 int acm = (pos[0] >> 4) & 0x01;
 265                 int queue;
 266
 267                 switch (aci) {
 268                 case 1:
 269                         queue = IEEE80211_TX_QUEUE_DATA3;
 270                         if (acm) {
 271                                 local->wmm_acm |= BIT(0) | BIT(3);
 272                         }
 273                         break;
 274                 case 2:
 275                         queue = IEEE80211_TX_QUEUE_DATA1;
 276                         if (acm) {
 277                                 local->wmm_acm |= BIT(4) | BIT(5);
 278                         }
 279                         break;
 280                 case 3:
 281                         queue = IEEE80211_TX_QUEUE_DATA0;
 282                         if (acm) {
 283                                 local->wmm_acm |= BIT(6) | BIT(7);
 284                         }
 285                         break;
 286                 case 0:
 287                 default:
 288                         queue = IEEE80211_TX_QUEUE_DATA2;
 289                         if (acm) {
 290                                 local->wmm_acm |= BIT(1) | BIT(2);
 291                         }
 292                         break;
 293                 }
 294
 295                 params.aifs = pos[0] & 0x0f;
 296                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 297                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 298                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 299                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 300                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 301                        "cWmin=%d cWmax=%d burst=%d\n",
 302                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
 303                        params.cw_max, params.burst_time);
 304                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 305                  * AC for now) */
 306                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 307                         printk(KERN_DEBUG "%s: failed to set TX queue "
 308                                "parameters for queue %d\n", dev->name, queue);
 309                 }
 310         }
 311 }
 312
 313
 314 static void ieee80211_handle_erp_ie(struct net_device *dev, u8 erp_value)
 315 {
 316         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 317         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 318         int use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 319         int preamble_mode = (erp_value & WLAN_ERP_BARKER_PREAMBLE) != 0;
 320         u8 changes = 0;
 321
 322         if (use_protection != !!(sdata->flags & IEEE80211_SDATA_USE_PROTECTION)) {
 323                 if (net_ratelimit()) {
 324                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 325                                MAC_FMT ")\n",
 326                                dev->name,
 327                                use_protection ? "enabled" : "disabled",
 328                                MAC_ARG(ifsta->bssid));
 329                 }
 330                 if (use_protection)
 331                         sdata->flags |= IEEE80211_SDATA_USE_PROTECTION;
 332                 else
 333                         sdata->flags &= ~IEEE80211_SDATA_USE_PROTECTION;
 334                 changes |= IEEE80211_ERP_CHANGE_PROTECTION;
 335         }
 336
 337         if (preamble_mode != !(sdata->flags & IEEE80211_SDATA_SHORT_PREAMBLE)) {
 338                 if (net_ratelimit()) {
 339                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 340                                " (BSSID=" MAC_FMT ")\n",
 341                                dev->name,
 342                                (preamble_mode == WLAN_ERP_PREAMBLE_SHORT) ?
 343                                         "short" : "long",
 344                                MAC_ARG(ifsta->bssid));
 345                 }
 346                 if (preamble_mode)
 347                         sdata->flags &= ~IEEE80211_SDATA_SHORT_PREAMBLE;
 348                 else
 349                         sdata->flags |= IEEE80211_SDATA_SHORT_PREAMBLE;
 350                 changes |= IEEE80211_ERP_CHANGE_PREAMBLE;
 351         }
 352
 353         if (changes)
 354                 ieee80211_erp_info_change_notify(dev, changes);
 355 }
 356
 357
 358 static void ieee80211_sta_send_associnfo(struct net_device *dev,
 359                                          struct ieee80211_if_sta *ifsta)
 360 {
 361         char *buf;
 362         size_t len;
 363         int i;
 364         union iwreq_data wrqu;
 365
 366         if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
 367                 return;
 368
 369         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
 370                                 ifsta->assocresp_ies_len), GFP_KERNEL);
 371         if (!buf)
 372                 return;
 373
 374         len = sprintf(buf, "ASSOCINFO(");
 375         if (ifsta->assocreq_ies) {
 376                 len += sprintf(buf + len, "ReqIEs=");
 377                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
 378                         len += sprintf(buf + len, "%02x",
 379                                        ifsta->assocreq_ies[i]);
 380                 }
 381         }
 382         if (ifsta->assocresp_ies) {
 383                 if (ifsta->assocreq_ies)
 384                         len += sprintf(buf + len, " ");
 385                 len += sprintf(buf + len, "RespIEs=");
 386                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 387                         len += sprintf(buf + len, "%02x",
 388                                        ifsta->assocresp_ies[i]);
 389                 }
 390         }
 391         len += sprintf(buf + len, ")");
 392
 393         if (len > IW_CUSTOM_MAX) {
 394                 len = sprintf(buf, "ASSOCRESPIE=");
 395                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 396                         len += sprintf(buf + len, "%02x",
 397                                        ifsta->assocresp_ies[i]);
 398                 }
 399         }
 400
 401         memset(&wrqu, 0, sizeof(wrqu));
 402         wrqu.data.length = len;
 403         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 404
 405         kfree(buf);
 406 }
 407
 408
 409 static void ieee80211_set_associated(struct net_device *dev,
 410                                      struct ieee80211_if_sta *ifsta,
 411                                      bool assoc)
 412 {
 413         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 414         union iwreq_data wrqu;
 415
 416         if (!!(ifsta->flags & IEEE80211_STA_ASSOCIATED) == assoc)
 417                 return;
 418
 419         if (assoc) {
 420                 struct ieee80211_sub_if_data *sdata;
 421                 struct ieee80211_sta_bss *bss;
 422
 423                 ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 424
 425                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 426                 if (sdata->type != IEEE80211_IF_TYPE_STA)
 427                         return;
 428
 429                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 430                 if (bss) {
 431                         if (bss->has_erp_value)
 432                                 ieee80211_handle_erp_ie(dev, bss->erp_value);
 433                         ieee80211_rx_bss_put(dev, bss);
 434                 }
 435
 436                 netif_carrier_on(dev);
 437                 ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 438                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 439                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 440                 ieee80211_sta_send_associnfo(dev, ifsta);
 441         } else {
 442                 ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
 443
 444                 netif_carrier_off(dev);
 445                 ieee80211_reset_erp_info(dev);
 446                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 447         }
 448         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 449         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 450         ifsta->last_probe = jiffies;
 451         ieee80211_led_assoc(local, assoc);
 452 }
 453
 454 static void ieee80211_set_disassoc(struct net_device *dev,
 455                                    struct ieee80211_if_sta *ifsta, int deauth)
 456 {
 457         if (deauth)
 458                 ifsta->auth_tries = 0;
 459         ifsta->assoc_tries = 0;
 460         ieee80211_set_associated(dev, ifsta, 0);
 461 }
 462
 463 static void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
 464                              int encrypt)
 465 {
 466         struct ieee80211_sub_if_data *sdata;
 467         struct ieee80211_tx_packet_data *pkt_data;
 468
 469         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 470         skb->dev = sdata->local->mdev;
 471         skb_set_mac_header(skb, 0);
 472         skb_set_network_header(skb, 0);
 473         skb_set_transport_header(skb, 0);
 474
 475         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
 476         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
 477         pkt_data->ifindex = sdata->dev->ifindex;
 478         if (!encrypt)
 479                 pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
 480
 481         dev_queue_xmit(skb);
 482 }
 483
 484
 485 static void ieee80211_send_auth(struct net_device *dev,
 486                                 struct ieee80211_if_sta *ifsta,
 487                                 int transaction, u8 *extra, size_t extra_len,
 488                                 int encrypt)
 489 {
 490         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 491         struct sk_buff *skb;
 492         struct ieee80211_mgmt *mgmt;
 493
 494         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 495                             sizeof(*mgmt) + 6 + extra_len);
 496         if (!skb) {
 497                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 498                        "frame\n", dev->name);
 499                 return;
 500         }
 501         skb_reserve(skb, local->hw.extra_tx_headroom);
 502
 503         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 504         memset(mgmt, 0, 24 + 6);
 505         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 506                                            IEEE80211_STYPE_AUTH);
 507         if (encrypt)
 508                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 509         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 510         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 511         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 512         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 513         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 514         ifsta->auth_transaction = transaction + 1;
 515         mgmt->u.auth.status_code = cpu_to_le16(0);
 516         if (extra)
 517                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 518
 519         ieee80211_sta_tx(dev, skb, encrypt);
 520 }
 521
 522
 523 static void ieee80211_authenticate(struct net_device *dev,
 524                                    struct ieee80211_if_sta *ifsta)
 525 {
 526         ifsta->auth_tries++;
 527         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 528                 printk(KERN_DEBUG "%s: authentication with AP " MAC_FMT
 529                        " timed out\n",
 530                        dev->name, MAC_ARG(ifsta->bssid));
 531                 ifsta->state = IEEE80211_DISABLED;
 532                 return;
 533         }
 534
 535         ifsta->state = IEEE80211_AUTHENTICATE;
 536         printk(KERN_DEBUG "%s: authenticate with AP " MAC_FMT "\n",
 537                dev->name, MAC_ARG(ifsta->bssid));
 538
 539         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
 540
 541         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 542 }
 543
 544
 545 static void ieee80211_send_assoc(struct net_device *dev,
 546                                  struct ieee80211_if_sta *ifsta)
 547 {
 548         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 549         struct ieee80211_hw_mode *mode;
 550         struct sk_buff *skb;
 551         struct ieee80211_mgmt *mgmt;
 552         u8 *pos, *ies;
 553         int i, len;
 554         u16 capab;
 555         struct ieee80211_sta_bss *bss;
 556         int wmm = 0;
 557
 558         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 559                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 560                             ifsta->ssid_len);
 561         if (!skb) {
 562                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 563                        "frame\n", dev->name);
 564                 return;
 565         }
 566         skb_reserve(skb, local->hw.extra_tx_headroom);
 567
 568         mode = local->oper_hw_mode;
 569         capab = ifsta->capab;
 570         if (mode->mode == MODE_IEEE80211G) {
 571                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 572                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 573         }
 574         bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 575         if (bss) {
 576                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 577                         capab |= WLAN_CAPABILITY_PRIVACY;
 578                 if (bss->wmm_ie) {
 579                         wmm = 1;
 580                 }
 581                 ieee80211_rx_bss_put(dev, bss);
 582         }
 583
 584         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 585         memset(mgmt, 0, 24);
 586         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 587         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 588         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 589
 590         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 591                 skb_put(skb, 10);
 592                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 593                                                    IEEE80211_STYPE_REASSOC_REQ);
 594                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 595                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
 596                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 597                        ETH_ALEN);
 598         } else {
 599                 skb_put(skb, 4);
 600                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 601                                                    IEEE80211_STYPE_ASSOC_REQ);
 602                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 603                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
 604         }
 605
 606         /* SSID */
 607         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 608         *pos++ = WLAN_EID_SSID;
 609         *pos++ = ifsta->ssid_len;
 610         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 611
 612         len = mode->num_rates;
 613         if (len > 8)
 614                 len = 8;
 615         pos = skb_put(skb, len + 2);
 616         *pos++ = WLAN_EID_SUPP_RATES;
 617         *pos++ = len;
 618         for (i = 0; i < len; i++) {
 619                 int rate = mode->rates[i].rate;
 620                 *pos++ = (u8) (rate / 5);
 621         }
 622
 623         if (mode->num_rates > len) {
 624                 pos = skb_put(skb, mode->num_rates - len + 2);
 625                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 626                 *pos++ = mode->num_rates - len;
 627                 for (i = len; i < mode->num_rates; i++) {
 628                         int rate = mode->rates[i].rate;
 629                         *pos++ = (u8) (rate / 5);
 630                 }
 631         }
 632
 633         if (ifsta->extra_ie) {
 634                 pos = skb_put(skb, ifsta->extra_ie_len);
 635                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 636         }
 637
 638         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 639                 pos = skb_put(skb, 9);
 640                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 641                 *pos++ = 7; /* len */
 642                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 643                 *pos++ = 0x50;
 644                 *pos++ = 0xf2;
 645                 *pos++ = 2; /* WME */
 646                 *pos++ = 0; /* WME info */
 647                 *pos++ = 1; /* WME ver */
 648                 *pos++ = 0;
 649         }
 650
 651         kfree(ifsta->assocreq_ies);
 652         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 653         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 654         if (ifsta->assocreq_ies)
 655                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 656
 657         ieee80211_sta_tx(dev, skb, 0);
 658 }
 659
 660
 661 static void ieee80211_send_deauth(struct net_device *dev,
 662                                   struct ieee80211_if_sta *ifsta, u16 reason)
 663 {
 664         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 665         struct sk_buff *skb;
 666         struct ieee80211_mgmt *mgmt;
 667
 668         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 669         if (!skb) {
 670                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 671                        "frame\n", dev->name);
 672                 return;
 673         }
 674         skb_reserve(skb, local->hw.extra_tx_headroom);
 675
 676         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 677         memset(mgmt, 0, 24);
 678         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 679         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 680         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 681         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 682                                            IEEE80211_STYPE_DEAUTH);
 683         skb_put(skb, 2);
 684         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 685
 686         ieee80211_sta_tx(dev, skb, 0);
 687 }
 688
 689
 690 static void ieee80211_send_disassoc(struct net_device *dev,
 691                                     struct ieee80211_if_sta *ifsta, u16 reason)
 692 {
 693         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 694         struct sk_buff *skb;
 695         struct ieee80211_mgmt *mgmt;
 696
 697         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 698         if (!skb) {
 699                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 700                        "frame\n", dev->name);
 701                 return;
 702         }
 703         skb_reserve(skb, local->hw.extra_tx_headroom);
 704
 705         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 706         memset(mgmt, 0, 24);
 707         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 708         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 709         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 710         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 711                                            IEEE80211_STYPE_DISASSOC);
 712         skb_put(skb, 2);
 713         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 714
 715         ieee80211_sta_tx(dev, skb, 0);
 716 }
 717
 718
 719 static int ieee80211_privacy_mismatch(struct net_device *dev,
 720                                       struct ieee80211_if_sta *ifsta)
 721 {
 722         struct ieee80211_sta_bss *bss;
 723         int res = 0;
 724
 725         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL) ||
 726             ifsta->key_management_enabled)
 727                 return 0;
 728
 729         bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 730         if (!bss)
 731                 return 0;
 732
 733         if (ieee80211_sta_wep_configured(dev) !=
 734             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 735                 res = 1;
 736
 737         ieee80211_rx_bss_put(dev, bss);
 738
 739         return res;
 740 }
 741
 742
 743 static void ieee80211_associate(struct net_device *dev,
 744                                 struct ieee80211_if_sta *ifsta)
 745 {
 746         ifsta->assoc_tries++;
 747         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 748                 printk(KERN_DEBUG "%s: association with AP " MAC_FMT
 749                        " timed out\n",
 750                        dev->name, MAC_ARG(ifsta->bssid));
 751                 ifsta->state = IEEE80211_DISABLED;
 752                 return;
 753         }
 754
 755         ifsta->state = IEEE80211_ASSOCIATE;
 756         printk(KERN_DEBUG "%s: associate with AP " MAC_FMT "\n",
 757                dev->name, MAC_ARG(ifsta->bssid));
 758         if (ieee80211_privacy_mismatch(dev, ifsta)) {
 759                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 760                        "mixed-cell disabled - abort association\n", dev->name);
 761                 ifsta->state = IEEE80211_DISABLED;
 762                 return;
 763         }
 764
 765         ieee80211_send_assoc(dev, ifsta);
 766
 767         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 768 }
 769
 770
 771 static void ieee80211_associated(struct net_device *dev,
 772                                  struct ieee80211_if_sta *ifsta)
 773 {
 774         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 775         struct sta_info *sta;
 776         int disassoc;
 777
 778         /* TODO: start monitoring current AP signal quality and number of
 779          * missed beacons. Scan other channels every now and then and search
 780          * for better APs. */
 781         /* TODO: remove expired BSSes */
 782
 783         ifsta->state = IEEE80211_ASSOCIATED;
 784
 785         sta = sta_info_get(local, ifsta->bssid);
 786         if (!sta) {
 787                 printk(KERN_DEBUG "%s: No STA entry for own AP " MAC_FMT "\n",
 788                        dev->name, MAC_ARG(ifsta->bssid));
 789                 disassoc = 1;
 790         } else {
 791                 disassoc = 0;
 792                 if (time_after(jiffies,
 793                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 794                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
 795                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 796                                        "current AP " MAC_FMT " - assume out of "
 797                                        "range\n",
 798                                        dev->name, MAC_ARG(ifsta->bssid));
 799                                 disassoc = 1;
 800                                 sta_info_free(sta);
 801                         } else
 802                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 803                                                          local->scan_ssid,
 804                                                          local->scan_ssid_len);
 805                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
 806                 } else {
 807                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 808                         if (time_after(jiffies, ifsta->last_probe +
 809                                        IEEE80211_PROBE_INTERVAL)) {
 810                                 ifsta->last_probe = jiffies;
 811                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 812                                                          ifsta->ssid,
 813                                                          ifsta->ssid_len);
 814                         }
 815                 }
 816                 sta_info_put(sta);
 817         }
 818         if (disassoc) {
 819                 union iwreq_data wrqu;
 820                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 821                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 822                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 823                 mod_timer(&ifsta->timer, jiffies +
 824                                       IEEE80211_MONITORING_INTERVAL + 30 * HZ);
 825         } else {
 826                 mod_timer(&ifsta->timer, jiffies +
 827                                       IEEE80211_MONITORING_INTERVAL);
 828         }
 829 }
 830
 831
 832 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 833                                      u8 *ssid, size_t ssid_len)
 834 {
 835         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 836         struct ieee80211_hw_mode *mode;
 837         struct sk_buff *skb;
 838         struct ieee80211_mgmt *mgmt;
 839         u8 *pos, *supp_rates, *esupp_rates = NULL;
 840         int i;
 841
 842         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 843         if (!skb) {
 844                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 845                        "request\n", dev->name);
 846                 return;
 847         }
 848         skb_reserve(skb, local->hw.extra_tx_headroom);
 849
 850         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 851         memset(mgmt, 0, 24);
 852         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 853                                            IEEE80211_STYPE_PROBE_REQ);
 854         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 855         if (dst) {
 856                 memcpy(mgmt->da, dst, ETH_ALEN);
 857                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 858         } else {
 859                 memset(mgmt->da, 0xff, ETH_ALEN);
 860                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 861         }
 862         pos = skb_put(skb, 2 + ssid_len);
 863         *pos++ = WLAN_EID_SSID;
 864         *pos++ = ssid_len;
 865         memcpy(pos, ssid, ssid_len);
 866
 867         supp_rates = skb_put(skb, 2);
 868         supp_rates[0] = WLAN_EID_SUPP_RATES;
 869         supp_rates[1] = 0;
 870         mode = local->oper_hw_mode;
 871         for (i = 0; i < mode->num_rates; i++) {
 872                 struct ieee80211_rate *rate = &mode->rates[i];
 873                 if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
 874                         continue;
 875                 if (esupp_rates) {
 876                         pos = skb_put(skb, 1);
 877                         esupp_rates[1]++;
 878                 } else if (supp_rates[1] == 8) {
 879                         esupp_rates = skb_put(skb, 3);
 880                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 881                         esupp_rates[1] = 1;
 882                         pos = &esupp_rates[2];
 883                 } else {
 884                         pos = skb_put(skb, 1);
 885                         supp_rates[1]++;
 886                 }
 887                 *pos = rate->rate / 5;
 888         }
 889
 890         ieee80211_sta_tx(dev, skb, 0);
 891 }
 892
 893
 894 static int ieee80211_sta_wep_configured(struct net_device *dev)
 895 {
 896         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 897         if (!sdata || !sdata->default_key ||
 898             sdata->default_key->conf.alg != ALG_WEP)
 899                 return 0;
 900         return 1;
 901 }
 902
 903
 904 static void ieee80211_auth_completed(struct net_device *dev,
 905                                      struct ieee80211_if_sta *ifsta)
 906 {
 907         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
 908         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
 909         ieee80211_associate(dev, ifsta);
 910 }
 911
 912
 913 static void ieee80211_auth_challenge(struct net_device *dev,
 914                                      struct ieee80211_if_sta *ifsta,
 915                                      struct ieee80211_mgmt *mgmt,
 916                                      size_t len)
 917 {
 918         u8 *pos;
 919         struct ieee802_11_elems elems;
 920
 921         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
 922         pos = mgmt->u.auth.variable;
 923         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
 924             == ParseFailed) {
 925                 printk(KERN_DEBUG "%s: failed to parse Auth(challenge)\n",
 926                        dev->name);
 927                 return;
 928         }
 929         if (!elems.challenge) {
 930                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
 931                        "frame\n", dev->name);
 932                 return;
 933         }
 934         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
 935                             elems.challenge_len + 2, 1);
 936 }
 937
 938
 939 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
 940                                    struct ieee80211_if_sta *ifsta,
 941                                    struct ieee80211_mgmt *mgmt,
 942                                    size_t len)
 943 {
 944         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 945         u16 auth_alg, auth_transaction, status_code;
 946
 947         if (ifsta->state != IEEE80211_AUTHENTICATE &&
 948             sdata->type != IEEE80211_IF_TYPE_IBSS) {
 949                 printk(KERN_DEBUG "%s: authentication frame received from "
 950                        MAC_FMT ", but not in authenticate state - ignored\n",
 951                        dev->name, MAC_ARG(mgmt->sa));
 952                 return;
 953         }
 954
 955         if (len < 24 + 6) {
 956                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
 957                        "received from " MAC_FMT " - ignored\n",
 958                        dev->name, len, MAC_ARG(mgmt->sa));
 959                 return;
 960         }
 961
 962         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
 963             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
 964                 printk(KERN_DEBUG "%s: authentication frame received from "
 965                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
 966                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
 967                        MAC_ARG(mgmt->bssid));
 968                 return;
 969         }
 970
 971         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
 972             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 973                 printk(KERN_DEBUG "%s: authentication frame received from "
 974                        "unknown BSSID (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
 975                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
 976                        MAC_ARG(mgmt->bssid));
 977                 return;
 978         }
 979
 980         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
 981         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 982         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 983
 984         printk(KERN_DEBUG "%s: RX authentication from " MAC_FMT " (alg=%d "
 985                "transaction=%d status=%d)\n",
 986                dev->name, MAC_ARG(mgmt->sa), auth_alg,
 987                auth_transaction, status_code);
 988
 989         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
 990                 /* IEEE 802.11 standard does not require authentication in IBSS
 991                  * networks and most implementations do not seem to use it.
 992                  * However, try to reply to authentication attempts if someone
 993                  * has actually implemented this.
 994                  * TODO: Could implement shared key authentication. */
 995                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 996                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
 997                                "frame (alg=%d transaction=%d)\n",
 998                                dev->name, auth_alg, auth_transaction);
 999                         return;
1000                 }
1001                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
1002         }
1003
1004         if (auth_alg != ifsta->auth_alg ||
1005             auth_transaction != ifsta->auth_transaction) {
1006                 printk(KERN_DEBUG "%s: unexpected authentication frame "
1007                        "(alg=%d transaction=%d)\n",
1008                        dev->name, auth_alg, auth_transaction);
1009                 return;
1010         }
1011
1012         if (status_code != WLAN_STATUS_SUCCESS) {
1013                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
1014                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
1015                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1016                         u8 algs[3];
1017                         const int num_algs = ARRAY_SIZE(algs);
1018                         int i, pos;
1019                         algs[0] = algs[1] = algs[2] = 0xff;
1020                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1021                                 algs[0] = WLAN_AUTH_OPEN;
1022                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1023                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1024                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1025                                 algs[2] = WLAN_AUTH_LEAP;
1026                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1027                                 pos = 0;
1028                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1029                                 pos = 1;
1030                         else
1031                                 pos = 2;
1032                         for (i = 0; i < num_algs; i++) {
1033                                 pos++;
1034                                 if (pos >= num_algs)
1035                                         pos = 0;
1036                                 if (algs[pos] == ifsta->auth_alg ||
1037                                     algs[pos] == 0xff)
1038                                         continue;
1039                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1040                                     !ieee80211_sta_wep_configured(dev))
1041                                         continue;
1042                                 ifsta->auth_alg = algs[pos];
1043                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
1044                                        "next try\n",
1045                                        dev->name, ifsta->auth_alg);
1046                                 break;
1047                         }
1048                 }
1049                 return;
1050         }
1051
1052         switch (ifsta->auth_alg) {
1053         case WLAN_AUTH_OPEN:
1054         case WLAN_AUTH_LEAP:
1055                 ieee80211_auth_completed(dev, ifsta);
1056                 break;
1057         case WLAN_AUTH_SHARED_KEY:
1058                 if (ifsta->auth_transaction == 4)
1059                         ieee80211_auth_completed(dev, ifsta);
1060                 else
1061                         ieee80211_auth_challenge(dev, ifsta, mgmt, len);
1062                 break;
1063         }
1064 }
1065
1066
1067 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
1068                                      struct ieee80211_if_sta *ifsta,
1069                                      struct ieee80211_mgmt *mgmt,
1070                                      size_t len)
1071 {
1072         u16 reason_code;
1073
1074         if (len < 24 + 2) {
1075                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
1076                        "received from " MAC_FMT " - ignored\n",
1077                        dev->name, len, MAC_ARG(mgmt->sa));
1078                 return;
1079         }
1080
1081         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1082                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1083                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
1084                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
1085                        MAC_ARG(mgmt->bssid));
1086                 return;
1087         }
1088
1089         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1090
1091         printk(KERN_DEBUG "%s: RX deauthentication from " MAC_FMT
1092                " (reason=%d)\n",
1093                dev->name, MAC_ARG(mgmt->sa), reason_code);
1094
1095         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED) {
1096                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1097         }
1098
1099         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1100             ifsta->state == IEEE80211_ASSOCIATE ||
1101             ifsta->state == IEEE80211_ASSOCIATED) {
1102                 ifsta->state = IEEE80211_AUTHENTICATE;
1103                 mod_timer(&ifsta->timer, jiffies +
1104                                       IEEE80211_RETRY_AUTH_INTERVAL);
1105         }
1106
1107         ieee80211_set_disassoc(dev, ifsta, 1);
1108         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1109 }
1110
1111
1112 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1113                                        struct ieee80211_if_sta *ifsta,
1114                                        struct ieee80211_mgmt *mgmt,
1115                                        size_t len)
1116 {
1117         u16 reason_code;
1118
1119         if (len < 24 + 2) {
1120                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1121                        "received from " MAC_FMT " - ignored\n",
1122                        dev->name, len, MAC_ARG(mgmt->sa));
1123                 return;
1124         }
1125
1126         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1127                 printk(KERN_DEBUG "%s: disassociation frame received from "
1128                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
1129                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
1130                        MAC_ARG(mgmt->bssid));
1131                 return;
1132         }
1133
1134         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1135
1136         printk(KERN_DEBUG "%s: RX disassociation from " MAC_FMT
1137                " (reason=%d)\n",
1138                dev->name, MAC_ARG(mgmt->sa), reason_code);
1139
1140         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1141                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1142
1143         if (ifsta->state == IEEE80211_ASSOCIATED) {
1144                 ifsta->state = IEEE80211_ASSOCIATE;
1145                 mod_timer(&ifsta->timer, jiffies +
1146                                       IEEE80211_RETRY_AUTH_INTERVAL);
1147         }
1148
1149         ieee80211_set_disassoc(dev, ifsta, 0);
1150 }
1151
1152
1153 static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
1154                                          struct ieee80211_if_sta *ifsta,
1155                                          struct ieee80211_mgmt *mgmt,
1156                                          size_t len,
1157                                          int reassoc)
1158 {
1159         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1160         struct ieee80211_hw_mode *mode;
1161         struct sta_info *sta;
1162         u32 rates;
1163         u16 capab_info, status_code, aid;
1164         struct ieee802_11_elems elems;
1165         u8 *pos;
1166         int i, j;
1167
1168         /* AssocResp and ReassocResp have identical structure, so process both
1169          * of them in this function. */
1170
1171         if (ifsta->state != IEEE80211_ASSOCIATE) {
1172                 printk(KERN_DEBUG "%s: association frame received from "
1173                        MAC_FMT ", but not in associate state - ignored\n",
1174                        dev->name, MAC_ARG(mgmt->sa));
1175                 return;
1176         }
1177
1178         if (len < 24 + 6) {
1179                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1180                        "received from " MAC_FMT " - ignored\n",
1181                        dev->name, len, MAC_ARG(mgmt->sa));
1182                 return;
1183         }
1184
1185         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1186                 printk(KERN_DEBUG "%s: association frame received from "
1187                        "unknown AP (SA=" MAC_FMT " BSSID=" MAC_FMT ") - "
1188                        "ignored\n", dev->name, MAC_ARG(mgmt->sa),
1189                        MAC_ARG(mgmt->bssid));
1190                 return;
1191         }
1192
1193         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1194         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1195         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1196         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1197                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1198                        "set\n", dev->name, aid);
1199         aid &= ~(BIT(15) | BIT(14));
1200
1201         printk(KERN_DEBUG "%s: RX %sssocResp from " MAC_FMT " (capab=0x%x "
1202                "status=%d aid=%d)\n",
1203                dev->name, reassoc ? "Rea" : "A", MAC_ARG(mgmt->sa),
1204                capab_info, status_code, aid);
1205
1206         if (status_code != WLAN_STATUS_SUCCESS) {
1207                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1208                        dev->name, status_code);
1209                 /* if this was a reassociation, ensure we try a "full"
1210                  * association next time. This works around some broken APs
1211                  * which do not correctly reject reassociation requests. */
1212                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1213                 return;
1214         }
1215
1216         pos = mgmt->u.assoc_resp.variable;
1217         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1218             == ParseFailed) {
1219                 printk(KERN_DEBUG "%s: failed to parse AssocResp\n",
1220                        dev->name);
1221                 return;
1222         }
1223
1224         if (!elems.supp_rates) {
1225                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1226                        dev->name);
1227                 return;
1228         }
1229
1230         /* it probably doesn't, but if the frame includes an ERP value then
1231          * update our stored copy */
1232         if (elems.erp_info && elems.erp_info_len >= 1) {
1233                 struct ieee80211_sta_bss *bss
1234                         = ieee80211_rx_bss_get(dev, ifsta->bssid);
1235                 if (bss) {
1236                         bss->erp_value = elems.erp_info[0];
1237                         bss->has_erp_value = 1;
1238                         ieee80211_rx_bss_put(dev, bss);
1239                 }
1240         }
1241
1242         printk(KERN_DEBUG "%s: associated\n", dev->name);
1243         ifsta->aid = aid;
1244         ifsta->ap_capab = capab_info;
1245
1246         kfree(ifsta->assocresp_ies);
1247         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1248         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1249         if (ifsta->assocresp_ies)
1250                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1251
1252         ieee80211_set_associated(dev, ifsta, 1);
1253
1254         /* Add STA entry for the AP */
1255         sta = sta_info_get(local, ifsta->bssid);
1256         if (!sta) {
1257                 struct ieee80211_sta_bss *bss;
1258                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
1259                 if (!sta) {
1260                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
1261                                " AP\n", dev->name);
1262                         return;
1263                 }
1264                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
1265                 if (bss) {
1266                         sta->last_rssi = bss->rssi;
1267                         sta->last_signal = bss->signal;
1268                         sta->last_noise = bss->noise;
1269                         ieee80211_rx_bss_put(dev, bss);
1270                 }
1271         }
1272
1273         sta->dev = dev;
1274         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP;
1275
1276         rates = 0;
1277         mode = local->oper_hw_mode;
1278         for (i = 0; i < elems.supp_rates_len; i++) {
1279                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1280                 for (j = 0; j < mode->num_rates; j++)
1281                         if (mode->rates[j].rate == rate)
1282                                 rates |= BIT(j);
1283         }
1284         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1285                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1286                 for (j = 0; j < mode->num_rates; j++)
1287                         if (mode->rates[j].rate == rate)
1288                                 rates |= BIT(j);
1289         }
1290         sta->supp_rates = rates;
1291
1292         rate_control_rate_init(sta, local);
1293
1294         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1295                 sta->flags |= WLAN_STA_WME;
1296                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1297                                          elems.wmm_param_len);
1298         }
1299
1300
1301         sta_info_put(sta);
1302
1303         ieee80211_associated(dev, ifsta);
1304 }
1305
1306
1307 /* Caller must hold local->sta_bss_lock */
1308 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
1309                                         struct ieee80211_sta_bss *bss)
1310 {
1311         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1312         bss->hnext = local->sta_bss_hash[STA_HASH(bss->bssid)];
1313         local->sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1314 }
1315
1316
1317 /* Caller must hold local->sta_bss_lock */
1318 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
1319                                         struct ieee80211_sta_bss *bss)
1320 {
1321         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1322         struct ieee80211_sta_bss *b, *prev = NULL;
1323         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
1324         while (b) {
1325                 if (b == bss) {
1326                         if (!prev)
1327                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
1328                                         bss->hnext;
1329                         else
1330                                 prev->hnext = bss->hnext;
1331                         break;
1332                 }
1333                 prev = b;
1334                 b = b->hnext;
1335         }
1336 }
1337
1338
1339 static struct ieee80211_sta_bss *
1340 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid)
1341 {
1342         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1343         struct ieee80211_sta_bss *bss;
1344
1345         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
1346         if (!bss)
1347                 return NULL;
1348         atomic_inc(&bss->users);
1349         atomic_inc(&bss->users);
1350         memcpy(bss->bssid, bssid, ETH_ALEN);
1351
1352         spin_lock_bh(&local->sta_bss_lock);
1353         /* TODO: order by RSSI? */
1354         list_add_tail(&bss->list, &local->sta_bss_list);
1355         __ieee80211_rx_bss_hash_add(dev, bss);
1356         spin_unlock_bh(&local->sta_bss_lock);
1357         return bss;
1358 }
1359
1360
1361 static struct ieee80211_sta_bss *
1362 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid)
1363 {
1364         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1365         struct ieee80211_sta_bss *bss;
1366
1367         spin_lock_bh(&local->sta_bss_lock);
1368         bss = local->sta_bss_hash[STA_HASH(bssid)];
1369         while (bss) {
1370                 if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0) {
1371                         atomic_inc(&bss->users);
1372                         break;
1373                 }
1374                 bss = bss->hnext;
1375         }
1376         spin_unlock_bh(&local->sta_bss_lock);
1377         return bss;
1378 }
1379
1380
1381 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
1382 {
1383         kfree(bss->wpa_ie);
1384         kfree(bss->rsn_ie);
1385         kfree(bss->wmm_ie);
1386         kfree(bss);
1387 }
1388
1389
1390 static void ieee80211_rx_bss_put(struct net_device *dev,
1391                                  struct ieee80211_sta_bss *bss)
1392 {
1393         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1394         if (!atomic_dec_and_test(&bss->users))
1395                 return;
1396
1397         spin_lock_bh(&local->sta_bss_lock);
1398         __ieee80211_rx_bss_hash_del(dev, bss);
1399         list_del(&bss->list);
1400         spin_unlock_bh(&local->sta_bss_lock);
1401         ieee80211_rx_bss_free(bss);
1402 }
1403
1404
1405 void ieee80211_rx_bss_list_init(struct net_device *dev)
1406 {
1407         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1408         spin_lock_init(&local->sta_bss_lock);
1409         INIT_LIST_HEAD(&local->sta_bss_list);
1410 }
1411
1412
1413 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
1414 {
1415         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1416         struct ieee80211_sta_bss *bss, *tmp;
1417
1418         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
1419                 ieee80211_rx_bss_put(dev, bss);
1420 }
1421
1422
1423 static void ieee80211_rx_bss_info(struct net_device *dev,
1424                                   struct ieee80211_mgmt *mgmt,
1425                                   size_t len,
1426                                   struct ieee80211_rx_status *rx_status,
1427                                   int beacon)
1428 {
1429         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1430         struct ieee802_11_elems elems;
1431         size_t baselen;
1432         int channel, invalid = 0, clen;
1433         struct ieee80211_sta_bss *bss;
1434         struct sta_info *sta;
1435         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1436         u64 timestamp;
1437
1438         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
1439                 return; /* ignore ProbeResp to foreign address */
1440
1441 #if 0
1442         printk(KERN_DEBUG "%s: RX %s from " MAC_FMT " to " MAC_FMT "\n",
1443                dev->name, beacon ? "Beacon" : "Probe Response",
1444                MAC_ARG(mgmt->sa), MAC_ARG(mgmt->da));
1445 #endif
1446
1447         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1448         if (baselen > len)
1449                 return;
1450
1451         timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
1452
1453         if (sdata->type == IEEE80211_IF_TYPE_IBSS && beacon &&
1454             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
1455 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1456                 static unsigned long last_tsf_debug = 0;
1457                 u64 tsf;
1458                 if (local->ops->get_tsf)
1459                         tsf = local->ops->get_tsf(local_to_hw(local));
1460                 else
1461                         tsf = -1LLU;
1462                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1463                         printk(KERN_DEBUG "RX beacon SA=" MAC_FMT " BSSID="
1464                                MAC_FMT " TSF=0x%llx BCN=0x%llx diff=%lld "
1465                                "@%lu\n",
1466                                MAC_ARG(mgmt->sa), MAC_ARG(mgmt->bssid),
1467                                (unsigned long long)tsf,
1468                                (unsigned long long)timestamp,
1469                                (unsigned long long)(tsf - timestamp),
1470                                jiffies);
1471                         last_tsf_debug = jiffies;
1472                 }
1473 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1474         }
1475
1476         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1477                                    &elems) == ParseFailed)
1478                 invalid = 1;
1479
1480         if (sdata->type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
1481             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
1482             (sta = sta_info_get(local, mgmt->sa))) {
1483                 struct ieee80211_hw_mode *mode;
1484                 struct ieee80211_rate *rates;
1485                 size_t num_rates;
1486                 u32 supp_rates, prev_rates;
1487                 int i, j;
1488
1489                 mode = local->sta_scanning ?
1490                        local->scan_hw_mode : local->oper_hw_mode;
1491                 rates = mode->rates;
1492                 num_rates = mode->num_rates;
1493
1494                 supp_rates = 0;
1495                 for (i = 0; i < elems.supp_rates_len +
1496                              elems.ext_supp_rates_len; i++) {
1497                         u8 rate = 0;
1498                         int own_rate;
1499                         if (i < elems.supp_rates_len)
1500                                 rate = elems.supp_rates[i];
1501                         else if (elems.ext_supp_rates)
1502                                 rate = elems.ext_supp_rates
1503                                         [i - elems.supp_rates_len];
1504                         own_rate = 5 * (rate & 0x7f);
1505                         for (j = 0; j < num_rates; j++)
1506                                 if (rates[j].rate == own_rate)
1507                                         supp_rates |= BIT(j);
1508                 }
1509
1510                 prev_rates = sta->supp_rates;
1511                 sta->supp_rates &= supp_rates;
1512                 if (sta->supp_rates == 0) {
1513                         /* No matching rates - this should not really happen.
1514                          * Make sure that at least one rate is marked
1515                          * supported to avoid issues with TX rate ctrl. */
1516                         sta->supp_rates = sdata->u.sta.supp_rates_bits;
1517                 }
1518                 if (sta->supp_rates != prev_rates) {
1519                         printk(KERN_DEBUG "%s: updated supp_rates set for "
1520                                MAC_FMT " based on beacon info (0x%x & 0x%x -> "
1521                                "0x%x)\n",
1522                                dev->name, MAC_ARG(sta->addr), prev_rates,
1523                                supp_rates, sta->supp_rates);
1524                 }
1525                 sta_info_put(sta);
1526         }
1527
1528         if (!elems.ssid)
1529                 return;
1530
1531         if (elems.ds_params && elems.ds_params_len == 1)
1532                 channel = elems.ds_params[0];
1533         else
1534                 channel = rx_status->channel;
1535
1536         bss = ieee80211_rx_bss_get(dev, mgmt->bssid);
1537         if (!bss) {
1538                 bss = ieee80211_rx_bss_add(dev, mgmt->bssid);
1539                 if (!bss)
1540                         return;
1541         } else {
1542 #if 0
1543                 /* TODO: order by RSSI? */
1544                 spin_lock_bh(&local->sta_bss_lock);
1545                 list_move_tail(&bss->list, &local->sta_bss_list);
1546                 spin_unlock_bh(&local->sta_bss_lock);
1547 #endif
1548         }
1549
1550         if (bss->probe_resp && beacon) {
1551                 /* Do not allow beacon to override data from Probe Response. */
1552                 ieee80211_rx_bss_put(dev, bss);
1553                 return;
1554         }
1555
1556         /* save the ERP value so that it is available at association time */
1557         if (elems.erp_info && elems.erp_info_len >= 1) {
1558                 bss->erp_value = elems.erp_info[0];
1559                 bss->has_erp_value = 1;
1560         }
1561
1562         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
1563         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
1564         if (elems.ssid && elems.ssid_len <= IEEE80211_MAX_SSID_LEN) {
1565                 memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1566                 bss->ssid_len = elems.ssid_len;
1567         }
1568
1569         bss->supp_rates_len = 0;
1570         if (elems.supp_rates) {
1571                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1572                 if (clen > elems.supp_rates_len)
1573                         clen = elems.supp_rates_len;
1574                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
1575                        clen);
1576                 bss->supp_rates_len += clen;
1577         }
1578         if (elems.ext_supp_rates) {
1579                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1580                 if (clen > elems.ext_supp_rates_len)
1581                         clen = elems.ext_supp_rates_len;
1582                 memcpy(&bss->supp_rates[bss->supp_rates_len],
1583                        elems.ext_supp_rates, clen);
1584                 bss->supp_rates_len += clen;
1585         }
1586
1587         if (elems.wpa &&
1588             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
1589              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1590                 kfree(bss->wpa_ie);
1591                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
1592                 if (bss->wpa_ie) {
1593                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
1594                         bss->wpa_ie_len = elems.wpa_len + 2;
1595                 } else
1596                         bss->wpa_ie_len = 0;
1597         } else if (!elems.wpa && bss->wpa_ie) {
1598                 kfree(bss->wpa_ie);
1599                 bss->wpa_ie = NULL;
1600                 bss->wpa_ie_len = 0;
1601         }
1602
1603         if (elems.rsn &&
1604             (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
1605              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1606                 kfree(bss->rsn_ie);
1607                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
1608                 if (bss->rsn_ie) {
1609                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
1610                         bss->rsn_ie_len = elems.rsn_len + 2;
1611                 } else
1612                         bss->rsn_ie_len = 0;
1613         } else if (!elems.rsn && bss->rsn_ie) {
1614                 kfree(bss->rsn_ie);
1615                 bss->rsn_ie = NULL;
1616                 bss->rsn_ie_len = 0;
1617         }
1618
1619         if (elems.wmm_param &&
1620             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
1621              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1622                 kfree(bss->wmm_ie);
1623                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
1624                 if (bss->wmm_ie) {
1625                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
1626                                elems.wmm_param_len + 2);
1627                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1628                 } else
1629                         bss->wmm_ie_len = 0;
1630         } else if (!elems.wmm_param && bss->wmm_ie) {
1631                 kfree(bss->wmm_ie);
1632                 bss->wmm_ie = NULL;
1633                 bss->wmm_ie_len = 0;
1634         }
1635
1636
1637         bss->hw_mode = rx_status->phymode;
1638         bss->channel = channel;
1639         bss->freq = rx_status->freq;
1640         if (channel != rx_status->channel &&
1641             (bss->hw_mode == MODE_IEEE80211G ||
1642              bss->hw_mode == MODE_IEEE80211B) &&
1643             channel >= 1 && channel <= 14) {
1644                 static const int freq_list[] = {
1645                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1646                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1647                 };
1648                 /* IEEE 802.11g/b mode can receive packets from neighboring
1649                  * channels, so map the channel into frequency. */
1650                 bss->freq = freq_list[channel - 1];
1651         }
1652         bss->timestamp = timestamp;
1653         bss->last_update = jiffies;
1654         bss->rssi = rx_status->ssi;
1655         bss->signal = rx_status->signal;
1656         bss->noise = rx_status->noise;
1657         if (!beacon)
1658                 bss->probe_resp++;
1659         ieee80211_rx_bss_put(dev, bss);
1660 }
1661
1662
1663 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
1664                                          struct ieee80211_mgmt *mgmt,
1665                                          size_t len,
1666                                          struct ieee80211_rx_status *rx_status)
1667 {
1668         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
1669 }
1670
1671
1672 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
1673                                      struct ieee80211_mgmt *mgmt,
1674                                      size_t len,
1675                                      struct ieee80211_rx_status *rx_status)
1676 {
1677         struct ieee80211_sub_if_data *sdata;
1678         struct ieee80211_if_sta *ifsta;
1679         size_t baselen;
1680         struct ieee802_11_elems elems;
1681
1682         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
1683
1684         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1685         if (sdata->type != IEEE80211_IF_TYPE_STA)
1686                 return;
1687         ifsta = &sdata->u.sta;
1688
1689         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
1690             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1691                 return;
1692
1693         /* Process beacon from the current BSS */
1694         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1695         if (baselen > len)
1696                 return;
1697
1698         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1699                                    &elems) == ParseFailed)
1700                 return;
1701
1702         if (elems.erp_info && elems.erp_info_len >= 1)
1703                 ieee80211_handle_erp_ie(dev, elems.erp_info[0]);
1704
1705         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1706                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1707                                          elems.wmm_param_len);
1708         }
1709 }
1710
1711
1712 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
1713                                         struct ieee80211_if_sta *ifsta,
1714                                         struct ieee80211_mgmt *mgmt,
1715                                         size_t len,
1716                                         struct ieee80211_rx_status *rx_status)
1717 {
1718         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1719         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1720         int tx_last_beacon;
1721         struct sk_buff *skb;
1722         struct ieee80211_mgmt *resp;
1723         u8 *pos, *end;
1724
1725         if (sdata->type != IEEE80211_IF_TYPE_IBSS ||
1726             ifsta->state != IEEE80211_IBSS_JOINED ||
1727             len < 24 + 2 || !ifsta->probe_resp)
1728                 return;
1729
1730         if (local->ops->tx_last_beacon)
1731                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
1732         else
1733                 tx_last_beacon = 1;
1734
1735 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1736         printk(KERN_DEBUG "%s: RX ProbeReq SA=" MAC_FMT " DA=" MAC_FMT " BSSID="
1737                MAC_FMT " (tx_last_beacon=%d)\n",
1738                dev->name, MAC_ARG(mgmt->sa), MAC_ARG(mgmt->da),
1739                MAC_ARG(mgmt->bssid), tx_last_beacon);
1740 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1741
1742         if (!tx_last_beacon)
1743                 return;
1744
1745         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
1746             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1747                 return;
1748
1749         end = ((u8 *) mgmt) + len;
1750         pos = mgmt->u.probe_req.variable;
1751         if (pos[0] != WLAN_EID_SSID ||
1752             pos + 2 + pos[1] > end) {
1753                 if (net_ratelimit()) {
1754                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
1755                                "from " MAC_FMT "\n",
1756                                dev->name, MAC_ARG(mgmt->sa));
1757                 }
1758                 return;
1759         }
1760         if (pos[1] != 0 &&
1761             (pos[1] != ifsta->ssid_len ||
1762              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
1763                 /* Ignore ProbeReq for foreign SSID */
1764                 return;
1765         }
1766
1767         /* Reply with ProbeResp */
1768         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
1769         if (!skb)
1770                 return;
1771
1772         resp = (struct ieee80211_mgmt *) skb->data;
1773         memcpy(resp->da, mgmt->sa, ETH_ALEN);
1774 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1775         printk(KERN_DEBUG "%s: Sending ProbeResp to " MAC_FMT "\n",
1776                dev->name, MAC_ARG(resp->da));
1777 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1778         ieee80211_sta_tx(dev, skb, 0);
1779 }
1780
1781
1782 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
1783                            struct ieee80211_rx_status *rx_status)
1784 {
1785         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1786         struct ieee80211_sub_if_data *sdata;
1787         struct ieee80211_if_sta *ifsta;
1788         struct ieee80211_mgmt *mgmt;
1789         u16 fc;
1790
1791         if (skb->len < 24)
1792                 goto fail;
1793
1794         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1795         ifsta = &sdata->u.sta;
1796
1797         mgmt = (struct ieee80211_mgmt *) skb->data;
1798         fc = le16_to_cpu(mgmt->frame_control);
1799
1800         switch (fc & IEEE80211_FCTL_STYPE) {
1801         case IEEE80211_STYPE_PROBE_REQ:
1802         case IEEE80211_STYPE_PROBE_RESP:
1803         case IEEE80211_STYPE_BEACON:
1804                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
1805         case IEEE80211_STYPE_AUTH:
1806         case IEEE80211_STYPE_ASSOC_RESP:
1807         case IEEE80211_STYPE_REASSOC_RESP:
1808         case IEEE80211_STYPE_DEAUTH:
1809         case IEEE80211_STYPE_DISASSOC:
1810                 skb_queue_tail(&ifsta->skb_queue, skb);
1811                 queue_work(local->hw.workqueue, &ifsta->work);
1812                 return;
1813         default:
1814                 printk(KERN_DEBUG "%s: received unknown management frame - "
1815                        "stype=%d\n", dev->name,
1816                        (fc & IEEE80211_FCTL_STYPE) >> 4);
1817                 break;
1818         }
1819
1820  fail:
1821         kfree_skb(skb);
1822 }
1823
1824
1825 static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
1826                                          struct sk_buff *skb)
1827 {
1828         struct ieee80211_rx_status *rx_status;
1829         struct ieee80211_sub_if_data *sdata;
1830         struct ieee80211_if_sta *ifsta;
1831         struct ieee80211_mgmt *mgmt;
1832         u16 fc;
1833
1834         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1835         ifsta = &sdata->u.sta;
1836
1837         rx_status = (struct ieee80211_rx_status *) skb->cb;
1838         mgmt = (struct ieee80211_mgmt *) skb->data;
1839         fc = le16_to_cpu(mgmt->frame_control);
1840
1841         switch (fc & IEEE80211_FCTL_STYPE) {
1842         case IEEE80211_STYPE_PROBE_REQ:
1843                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
1844                                             rx_status);
1845                 break;
1846         case IEEE80211_STYPE_PROBE_RESP:
1847                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
1848                 break;
1849         case IEEE80211_STYPE_BEACON:
1850                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
1851                 break;
1852         case IEEE80211_STYPE_AUTH:
1853                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
1854                 break;
1855         case IEEE80211_STYPE_ASSOC_RESP:
1856                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 0);
1857                 break;
1858         case IEEE80211_STYPE_REASSOC_RESP:
1859                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 1);
1860                 break;
1861         case IEEE80211_STYPE_DEAUTH:
1862                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
1863                 break;
1864         case IEEE80211_STYPE_DISASSOC:
1865                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
1866                 break;
1867         }
1868
1869         kfree_skb(skb);
1870 }
1871
1872
1873 void ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
1874                            struct ieee80211_rx_status *rx_status)
1875 {
1876         struct ieee80211_mgmt *mgmt;
1877         u16 fc;
1878
1879         if (skb->len < 24) {
1880                 dev_kfree_skb(skb);
1881                 return;
1882         }
1883
1884         mgmt = (struct ieee80211_mgmt *) skb->data;
1885         fc = le16_to_cpu(mgmt->frame_control);
1886
1887         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1888                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
1889                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
1890                                                      skb->len, rx_status);
1891                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
1892                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
1893                                                  rx_status);
1894                 }
1895         }
1896
1897         dev_kfree_skb(skb);
1898 }
1899
1900
1901 static int ieee80211_sta_active_ibss(struct net_device *dev)
1902 {
1903         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1904         int active = 0;
1905         struct sta_info *sta;
1906
1907         read_lock_bh(&local->sta_lock);
1908         list_for_each_entry(sta, &local->sta_list, list) {
1909                 if (sta->dev == dev &&
1910                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1911                                jiffies)) {
1912                         active++;
1913                         break;
1914                 }
1915         }
1916         read_unlock_bh(&local->sta_lock);
1917
1918         return active;
1919 }
1920
1921
1922 static void ieee80211_sta_expire(struct net_device *dev)
1923 {
1924         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1925         struct sta_info *sta, *tmp;
1926         LIST_HEAD(tmp_list);
1927
1928         write_lock_bh(&local->sta_lock);
1929         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
1930                 if (time_after(jiffies, sta->last_rx +
1931                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1932                         printk(KERN_DEBUG "%s: expiring inactive STA " MAC_FMT
1933                                "\n", dev->name, MAC_ARG(sta->addr));
1934                         __sta_info_get(sta);
1935                         sta_info_remove(sta);
1936                         list_add(&sta->list, &tmp_list);
1937                 }
1938         write_unlock_bh(&local->sta_lock);
1939
1940         list_for_each_entry_safe(sta, tmp, &tmp_list, list) {
1941                 sta_info_free(sta);
1942                 sta_info_put(sta);
1943         }
1944 }
1945
1946
1947 static void ieee80211_sta_merge_ibss(struct net_device *dev,
1948                                      struct ieee80211_if_sta *ifsta)
1949 {
1950         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
1951
1952         ieee80211_sta_expire(dev);
1953         if (ieee80211_sta_active_ibss(dev))
1954                 return;
1955
1956         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
1957                "IBSS networks with same SSID (merge)\n", dev->name);
1958         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
1959 }
1960
1961
1962 void ieee80211_sta_timer(unsigned long data)
1963 {
1964         struct ieee80211_sub_if_data *sdata =
1965                 (struct ieee80211_sub_if_data *) data;
1966         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1967         struct ieee80211_local *local = wdev_priv(&sdata->wdev);
1968
1969         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
1970         queue_work(local->hw.workqueue, &ifsta->work);
1971 }
1972
1973
1974 void ieee80211_sta_work(struct work_struct *work)
1975 {
1976         struct ieee80211_sub_if_data *sdata =
1977                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
1978         struct net_device *dev = sdata->dev;
1979         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1980         struct ieee80211_if_sta *ifsta;
1981         struct sk_buff *skb;
1982
1983         if (!netif_running(dev))
1984                 return;
1985
1986         if (local->sta_scanning)
1987                 return;
1988
1989         if (sdata->type != IEEE80211_IF_TYPE_STA &&
1990             sdata->type != IEEE80211_IF_TYPE_IBSS) {
1991                 printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
1992                        "(type=%d)\n", dev->name, sdata->type);
1993                 return;
1994         }
1995         ifsta = &sdata->u.sta;
1996
1997         while ((skb = skb_dequeue(&ifsta->skb_queue)))
1998                 ieee80211_sta_rx_queued_mgmt(dev, skb);
1999
2000         if (ifsta->state != IEEE80211_AUTHENTICATE &&
2001             ifsta->state != IEEE80211_ASSOCIATE &&
2002             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
2003                 ieee80211_sta_start_scan(dev, NULL, 0);
2004                 return;
2005         }
2006
2007         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
2008                 if (ieee80211_sta_config_auth(dev, ifsta))
2009                         return;
2010                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2011         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
2012                 return;
2013
2014         switch (ifsta->state) {
2015         case IEEE80211_DISABLED:
2016                 break;
2017         case IEEE80211_AUTHENTICATE:
2018                 ieee80211_authenticate(dev, ifsta);
2019                 break;
2020         case IEEE80211_ASSOCIATE:
2021                 ieee80211_associate(dev, ifsta);
2022                 break;
2023         case IEEE80211_ASSOCIATED:
2024                 ieee80211_associated(dev, ifsta);
2025                 break;
2026         case IEEE80211_IBSS_SEARCH:
2027                 ieee80211_sta_find_ibss(dev, ifsta);
2028                 break;
2029         case IEEE80211_IBSS_JOINED:
2030                 ieee80211_sta_merge_ibss(dev, ifsta);
2031                 break;
2032         default:
2033                 printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
2034                        ifsta->state);
2035                 break;
2036         }
2037
2038         if (ieee80211_privacy_mismatch(dev, ifsta)) {
2039                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
2040                        "mixed-cell disabled - disassociate\n", dev->name);
2041
2042                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
2043                 ieee80211_set_disassoc(dev, ifsta, 0);
2044         }
2045 }
2046
2047
2048 static void ieee80211_sta_reset_auth(struct net_device *dev,
2049                                      struct ieee80211_if_sta *ifsta)
2050 {
2051         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2052
2053         if (local->ops->reset_tsf) {
2054                 /* Reset own TSF to allow time synchronization work. */
2055                 local->ops->reset_tsf(local_to_hw(local));
2056         }
2057
2058         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
2059
2060
2061         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
2062                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2063         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2064                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
2065         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
2066                 ifsta->auth_alg = WLAN_AUTH_LEAP;
2067         else
2068                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2069         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
2070                ifsta->auth_alg);
2071         ifsta->auth_transaction = -1;
2072         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
2073         ifsta->auth_tries = ifsta->assoc_tries = 0;
2074         netif_carrier_off(dev);
2075 }
2076
2077
2078 void ieee80211_sta_req_auth(struct net_device *dev,
2079                             struct ieee80211_if_sta *ifsta)
2080 {
2081         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2082         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2083
2084         if (sdata->type != IEEE80211_IF_TYPE_STA)
2085                 return;
2086
2087         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
2088                                 IEEE80211_STA_AUTO_BSSID_SEL)) &&
2089             (ifsta->flags & (IEEE80211_STA_SSID_SET |
2090                                 IEEE80211_STA_AUTO_SSID_SEL))) {
2091                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2092                 queue_work(local->hw.workqueue, &ifsta->work);
2093         }
2094 }
2095
2096 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
2097                                     const char *ssid, int ssid_len)
2098 {
2099         int tmp, hidden_ssid;
2100
2101         if (!memcmp(ifsta->ssid, ssid, ssid_len))
2102                 return 1;
2103
2104         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
2105                 return 0;
2106
2107         hidden_ssid = 1;
2108         tmp = ssid_len;
2109         while (tmp--) {
2110                 if (ssid[tmp] != '\0') {
2111                         hidden_ssid = 0;
2112                         break;
2113                 }
2114         }
2115
2116         if (hidden_ssid && ifsta->ssid_len == ssid_len)
2117                 return 1;
2118
2119         if (ssid_len == 1 && ssid[0] == ' ')
2120                 return 1;
2121
2122         return 0;
2123 }
2124
2125 static int ieee80211_sta_config_auth(struct net_device *dev,
2126                                      struct ieee80211_if_sta *ifsta)
2127 {
2128         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2129         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2130         struct ieee80211_sta_bss *bss, *selected = NULL;
2131         int top_rssi = 0, freq;
2132
2133         if (!(ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
2134             IEEE80211_STA_AUTO_BSSID_SEL | IEEE80211_STA_AUTO_CHANNEL_SEL))) {
2135                 ifsta->state = IEEE80211_AUTHENTICATE;
2136                 ieee80211_sta_reset_auth(dev, ifsta);
2137                 return 0;
2138         }
2139
2140         spin_lock_bh(&local->sta_bss_lock);
2141         freq = local->oper_channel->freq;
2142         list_for_each_entry(bss, &local->sta_bss_list, list) {
2143                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
2144                         continue;
2145
2146                 if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
2147                     !!sdata->default_key)
2148                         continue;
2149
2150                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
2151                     bss->freq != freq)
2152                         continue;
2153
2154                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
2155                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
2156                         continue;
2157
2158                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
2159                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
2160                         continue;
2161
2162                 if (!selected || top_rssi < bss->rssi) {
2163                         selected = bss;
2164                         top_rssi = bss->rssi;
2165                 }
2166         }
2167         if (selected)
2168                 atomic_inc(&selected->users);
2169         spin_unlock_bh(&local->sta_bss_lock);
2170
2171         if (selected) {
2172                 ieee80211_set_channel(local, -1, selected->freq);
2173                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
2174                         ieee80211_sta_set_ssid(dev, selected->ssid,
2175                                                selected->ssid_len);
2176                 ieee80211_sta_set_bssid(dev, selected->bssid);
2177                 ieee80211_rx_bss_put(dev, selected);
2178                 ifsta->state = IEEE80211_AUTHENTICATE;
2179                 ieee80211_sta_reset_auth(dev, ifsta);
2180                 return 0;
2181         } else {
2182                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
2183                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
2184                                 ieee80211_sta_start_scan(dev, NULL, 0);
2185                         else
2186                                 ieee80211_sta_start_scan(dev, ifsta->ssid,
2187                                                          ifsta->ssid_len);
2188                         ifsta->state = IEEE80211_AUTHENTICATE;
2189                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2190                 } else
2191                         ifsta->state = IEEE80211_DISABLED;
2192         }
2193         return -1;
2194 }
2195
2196 static int ieee80211_sta_join_ibss(struct net_device *dev,
2197                                    struct ieee80211_if_sta *ifsta,
2198                                    struct ieee80211_sta_bss *bss)
2199 {
2200         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2201         int res, rates, i, j;
2202         struct sk_buff *skb;
2203         struct ieee80211_mgmt *mgmt;
2204         struct ieee80211_tx_control control;
2205         struct ieee80211_rate *rate;
2206         struct ieee80211_hw_mode *mode;
2207         struct rate_control_extra extra;
2208         u8 *pos;
2209         struct ieee80211_sub_if_data *sdata;
2210
2211         /* Remove possible STA entries from other IBSS networks. */
2212         sta_info_flush(local, NULL);
2213
2214         if (local->ops->reset_tsf) {
2215                 /* Reset own TSF to allow time synchronization work. */
2216                 local->ops->reset_tsf(local_to_hw(local));
2217         }
2218         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2219         res = ieee80211_if_config(dev);
2220         if (res)
2221                 return res;
2222
2223         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2224
2225         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2226         sdata->drop_unencrypted = bss->capability &
2227                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2228
2229         res = ieee80211_set_channel(local, -1, bss->freq);
2230
2231         if (!(local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)) {
2232                 printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
2233                        "(%d MHz)\n", dev->name, local->hw.conf.channel,
2234                        local->hw.conf.freq);
2235                 return -1;
2236         }
2237
2238         /* Set beacon template based on scan results */
2239         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2240         do {
2241                 if (!skb)
2242                         break;
2243
2244                 skb_reserve(skb, local->hw.extra_tx_headroom);
2245
2246                 mgmt = (struct ieee80211_mgmt *)
2247                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2248                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2249                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2250                                                    IEEE80211_STYPE_BEACON);
2251                 memset(mgmt->da, 0xff, ETH_ALEN);
2252                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2253                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2254                 mgmt->u.beacon.beacon_int =
2255                         cpu_to_le16(local->hw.conf.beacon_int);
2256                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2257
2258                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2259                 *pos++ = WLAN_EID_SSID;
2260                 *pos++ = ifsta->ssid_len;
2261                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2262
2263                 rates = bss->supp_rates_len;
2264                 if (rates > 8)
2265                         rates = 8;
2266                 pos = skb_put(skb, 2 + rates);
2267                 *pos++ = WLAN_EID_SUPP_RATES;
2268                 *pos++ = rates;
2269                 memcpy(pos, bss->supp_rates, rates);
2270
2271                 pos = skb_put(skb, 2 + 1);
2272                 *pos++ = WLAN_EID_DS_PARAMS;
2273                 *pos++ = 1;
2274                 *pos++ = bss->channel;
2275
2276                 pos = skb_put(skb, 2 + 2);
2277                 *pos++ = WLAN_EID_IBSS_PARAMS;
2278                 *pos++ = 2;
2279                 /* FIX: set ATIM window based on scan results */
2280                 *pos++ = 0;
2281                 *pos++ = 0;
2282
2283                 if (bss->supp_rates_len > 8) {
2284                         rates = bss->supp_rates_len - 8;
2285                         pos = skb_put(skb, 2 + rates);
2286                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2287                         *pos++ = rates;
2288                         memcpy(pos, &bss->supp_rates[8], rates);
2289                 }
2290
2291                 memset(&control, 0, sizeof(control));
2292                 memset(&extra, 0, sizeof(extra));
2293                 extra.mode = local->oper_hw_mode;
2294                 rate = rate_control_get_rate(local, dev, skb, &extra);
2295                 if (!rate) {
2296                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2297                                "for IBSS beacon\n", dev->name);
2298                         break;
2299                 }
2300                 control.tx_rate =
2301                         ((sdata->flags & IEEE80211_SDATA_SHORT_PREAMBLE) &&
2302                         (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2303                         rate->val2 : rate->val;
2304                 control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
2305                 control.power_level = local->hw.conf.power_level;
2306                 control.flags |= IEEE80211_TXCTL_NO_ACK;
2307                 control.retry_limit = 1;
2308
2309                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2310                 if (ifsta->probe_resp) {
2311                         mgmt = (struct ieee80211_mgmt *)
2312                                 ifsta->probe_resp->data;
2313                         mgmt->frame_control =
2314                                 IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2315                                              IEEE80211_STYPE_PROBE_RESP);
2316                 } else {
2317                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2318                                "template for IBSS\n", dev->name);
2319                 }
2320
2321                 if (local->ops->beacon_update &&
2322                     local->ops->beacon_update(local_to_hw(local),
2323                                              skb, &control) == 0) {
2324                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2325                                "template based on scan results\n", dev->name);
2326                         skb = NULL;
2327                 }
2328
2329                 rates = 0;
2330                 mode = local->oper_hw_mode;
2331                 for (i = 0; i < bss->supp_rates_len; i++) {
2332                         int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2333                         for (j = 0; j < mode->num_rates; j++)
2334                                 if (mode->rates[j].rate == bitrate)
2335                                         rates |= BIT(j);
2336                 }
2337                 ifsta->supp_rates_bits = rates;
2338         } while (0);
2339
2340         if (skb) {
2341                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2342                        "template\n", dev->name);
2343                 dev_kfree_skb(skb);
2344         }
2345
2346         ifsta->state = IEEE80211_IBSS_JOINED;
2347         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2348
2349         ieee80211_rx_bss_put(dev, bss);
2350
2351         return res;
2352 }
2353
2354
2355 static int ieee80211_sta_create_ibss(struct net_device *dev,
2356                                      struct ieee80211_if_sta *ifsta)
2357 {
2358         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2359         struct ieee80211_sta_bss *bss;
2360         struct ieee80211_sub_if_data *sdata;
2361         struct ieee80211_hw_mode *mode;
2362         u8 bssid[ETH_ALEN], *pos;
2363         int i;
2364
2365 #if 0
2366         /* Easier testing, use fixed BSSID. */
2367         memset(bssid, 0xfe, ETH_ALEN);
2368 #else
2369         /* Generate random, not broadcast, locally administered BSSID. Mix in
2370          * own MAC address to make sure that devices that do not have proper
2371          * random number generator get different BSSID. */
2372         get_random_bytes(bssid, ETH_ALEN);
2373         for (i = 0; i < ETH_ALEN; i++)
2374                 bssid[i] ^= dev->dev_addr[i];
2375         bssid[0] &= ~0x01;
2376         bssid[0] |= 0x02;
2377 #endif
2378
2379         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID " MAC_FMT "\n",
2380                dev->name, MAC_ARG(bssid));
2381
2382         bss = ieee80211_rx_bss_add(dev, bssid);
2383         if (!bss)
2384                 return -ENOMEM;
2385
2386         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2387         mode = local->oper_hw_mode;
2388
2389         if (local->hw.conf.beacon_int == 0)
2390                 local->hw.conf.beacon_int = 100;
2391         bss->beacon_int = local->hw.conf.beacon_int;
2392         bss->hw_mode = local->hw.conf.phymode;
2393         bss->channel = local->hw.conf.channel;
2394         bss->freq = local->hw.conf.freq;
2395         bss->last_update = jiffies;
2396         bss->capability = WLAN_CAPABILITY_IBSS;
2397         if (sdata->default_key) {
2398                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
2399         } else
2400                 sdata->drop_unencrypted = 0;
2401         bss->supp_rates_len = mode->num_rates;
2402         pos = bss->supp_rates;
2403         for (i = 0; i < mode->num_rates; i++) {
2404                 int rate = mode->rates[i].rate;
2405                 *pos++ = (u8) (rate / 5);
2406         }
2407
2408         return ieee80211_sta_join_ibss(dev, ifsta, bss);
2409 }
2410
2411
2412 static int ieee80211_sta_find_ibss(struct net_device *dev,
2413                                    struct ieee80211_if_sta *ifsta)
2414 {
2415         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2416         struct ieee80211_sta_bss *bss;
2417         int found = 0;
2418         u8 bssid[ETH_ALEN];
2419         int active_ibss;
2420
2421         if (ifsta->ssid_len == 0)
2422                 return -EINVAL;
2423
2424         active_ibss = ieee80211_sta_active_ibss(dev);
2425 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2426         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2427                dev->name, active_ibss);
2428 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2429         spin_lock_bh(&local->sta_bss_lock);
2430         list_for_each_entry(bss, &local->sta_bss_list, list) {
2431                 if (ifsta->ssid_len != bss->ssid_len ||
2432                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2433                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2434                         continue;
2435 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2436                 printk(KERN_DEBUG "   bssid=" MAC_FMT " found\n",
2437                        MAC_ARG(bss->bssid));
2438 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2439                 memcpy(bssid, bss->bssid, ETH_ALEN);
2440                 found = 1;
2441                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2442                         break;
2443         }
2444         spin_unlock_bh(&local->sta_bss_lock);
2445
2446 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2447         printk(KERN_DEBUG "   sta_find_ibss: selected " MAC_FMT " current "
2448                MAC_FMT "\n", MAC_ARG(bssid), MAC_ARG(ifsta->bssid));
2449 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2450         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
2451             (bss = ieee80211_rx_bss_get(dev, bssid))) {
2452                 printk(KERN_DEBUG "%s: Selected IBSS BSSID " MAC_FMT
2453                        " based on configured SSID\n",
2454                        dev->name, MAC_ARG(bssid));
2455                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
2456         }
2457 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2458         printk(KERN_DEBUG "   did not try to join ibss\n");
2459 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2460
2461         /* Selected IBSS not found in current scan results - try to scan */
2462         if (ifsta->state == IEEE80211_IBSS_JOINED &&
2463             !ieee80211_sta_active_ibss(dev)) {
2464                 mod_timer(&ifsta->timer, jiffies +
2465                                       IEEE80211_IBSS_MERGE_INTERVAL);
2466         } else if (time_after(jiffies, local->last_scan_completed +
2467                               IEEE80211_SCAN_INTERVAL)) {
2468                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
2469                        "join\n", dev->name);
2470                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
2471                                               ifsta->ssid_len);
2472         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
2473                 int interval = IEEE80211_SCAN_INTERVAL;
2474
2475                 if (time_after(jiffies, ifsta->ibss_join_req +
2476                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2477                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
2478                             local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)
2479                                 return ieee80211_sta_create_ibss(dev, ifsta);
2480                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
2481                                 printk(KERN_DEBUG "%s: IBSS not allowed on the"
2482                                        " configured channel %d (%d MHz)\n",
2483                                        dev->name, local->hw.conf.channel,
2484                                        local->hw.conf.freq);
2485                         }
2486
2487                         /* No IBSS found - decrease scan interval and continue
2488                          * scanning. */
2489                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2490                 }
2491
2492                 ifsta->state = IEEE80211_IBSS_SEARCH;
2493                 mod_timer(&ifsta->timer, jiffies + interval);
2494                 return 0;
2495         }
2496
2497         return 0;
2498 }
2499
2500
2501 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
2502 {
2503         struct ieee80211_sub_if_data *sdata;
2504         struct ieee80211_if_sta *ifsta;
2505         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2506
2507         if (len > IEEE80211_MAX_SSID_LEN)
2508                 return -EINVAL;
2509
2510         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2511          * not defined. */
2512         if (local->ops->conf_tx) {
2513                 struct ieee80211_tx_queue_params qparam;
2514                 int i;
2515
2516                 memset(&qparam, 0, sizeof(qparam));
2517                 /* TODO: are these ok defaults for all hw_modes? */
2518                 qparam.aifs = 2;
2519                 qparam.cw_min =
2520                         local->hw.conf.phymode == MODE_IEEE80211B ? 31 : 15;
2521                 qparam.cw_max = 1023;
2522                 qparam.burst_time = 0;
2523                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2524                 {
2525                         local->ops->conf_tx(local_to_hw(local),
2526                                            i + IEEE80211_TX_QUEUE_DATA0,
2527                                            &qparam);
2528                 }
2529                 /* IBSS uses different parameters for Beacon sending */
2530                 qparam.cw_min++;
2531                 qparam.cw_min *= 2;
2532                 qparam.cw_min--;
2533                 local->ops->conf_tx(local_to_hw(local),
2534                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
2535         }
2536
2537         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2538         ifsta = &sdata->u.sta;
2539
2540         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
2541                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
2542         memcpy(ifsta->ssid, ssid, len);
2543         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
2544         ifsta->ssid_len = len;
2545
2546         if (len)
2547                 ifsta->flags |= IEEE80211_STA_SSID_SET;
2548         else
2549                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
2550         if (sdata->type == IEEE80211_IF_TYPE_IBSS &&
2551             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
2552                 ifsta->ibss_join_req = jiffies;
2553                 ifsta->state = IEEE80211_IBSS_SEARCH;
2554                 return ieee80211_sta_find_ibss(dev, ifsta);
2555         }
2556         return 0;
2557 }
2558
2559
2560 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
2561 {
2562         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2563         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2564         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
2565         *len = ifsta->ssid_len;
2566         return 0;
2567 }
2568
2569
2570 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
2571 {
2572         struct ieee80211_sub_if_data *sdata;
2573         struct ieee80211_if_sta *ifsta;
2574         int res;
2575
2576         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2577         ifsta = &sdata->u.sta;
2578
2579         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
2580                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
2581                 res = ieee80211_if_config(dev);
2582                 if (res) {
2583                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
2584                                "the low-level driver\n", dev->name);
2585                         return res;
2586                 }
2587         }
2588
2589         if (is_valid_ether_addr(bssid))
2590                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
2591         else
2592                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
2593
2594         return 0;
2595 }
2596
2597
2598 static void ieee80211_send_nullfunc(struct ieee80211_local *local,
2599                                     struct ieee80211_sub_if_data *sdata,
2600                                     int powersave)
2601 {
2602         struct sk_buff *skb;
2603         struct ieee80211_hdr *nullfunc;
2604         u16 fc;
2605
2606         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
2607         if (!skb) {
2608                 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
2609                        "frame\n", sdata->dev->name);
2610                 return;
2611         }
2612         skb_reserve(skb, local->hw.extra_tx_headroom);
2613
2614         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
2615         memset(nullfunc, 0, 24);
2616         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
2617              IEEE80211_FCTL_TODS;
2618         if (powersave)
2619                 fc |= IEEE80211_FCTL_PM;
2620         nullfunc->frame_control = cpu_to_le16(fc);
2621         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
2622         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
2623         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
2624
2625         ieee80211_sta_tx(sdata->dev, skb, 0);
2626 }
2627
2628
2629 void ieee80211_scan_completed(struct ieee80211_hw *hw)
2630 {
2631         struct ieee80211_local *local = hw_to_local(hw);
2632         struct net_device *dev = local->scan_dev;
2633         struct ieee80211_sub_if_data *sdata;
2634         union iwreq_data wrqu;
2635
2636         local->last_scan_completed = jiffies;
2637         wmb();
2638         local->sta_scanning = 0;
2639
2640         if (ieee80211_hw_config(local))
2641                 printk(KERN_DEBUG "%s: failed to restore operational"
2642                        "channel after scan\n", dev->name);
2643
2644
2645         netif_tx_lock_bh(local->mdev);
2646         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
2647         local->ops->configure_filter(local_to_hw(local),
2648                                      FIF_BCN_PRBRESP_PROMISC,
2649                                      &local->filter_flags,
2650                                      local->mdev->mc_count,
2651                                      local->mdev->mc_list);
2652
2653         netif_tx_unlock_bh(local->mdev);
2654
2655         memset(&wrqu, 0, sizeof(wrqu));
2656         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2657
2658         rcu_read_lock();
2659         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2660
2661                 /* No need to wake the master device. */
2662                 if (sdata->dev == local->mdev)
2663                         continue;
2664
2665                 if (sdata->type == IEEE80211_IF_TYPE_STA) {
2666                         if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
2667                                 ieee80211_send_nullfunc(local, sdata, 0);
2668                         ieee80211_sta_timer((unsigned long)sdata);
2669                 }
2670
2671                 netif_wake_queue(sdata->dev);
2672         }
2673         rcu_read_unlock();
2674
2675         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2676         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
2677                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2678                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
2679                     (!ifsta->state == IEEE80211_IBSS_JOINED &&
2680                     !ieee80211_sta_active_ibss(dev)))
2681                         ieee80211_sta_find_ibss(dev, ifsta);
2682         }
2683 }
2684 EXPORT_SYMBOL(ieee80211_scan_completed);
2685
2686 void ieee80211_sta_scan_work(struct work_struct *work)
2687 {
2688         struct ieee80211_local *local =
2689                 container_of(work, struct ieee80211_local, scan_work.work);
2690         struct net_device *dev = local->scan_dev;
2691         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2692         struct ieee80211_hw_mode *mode;
2693         struct ieee80211_channel *chan;
2694         int skip;
2695         unsigned long next_delay = 0;
2696
2697         if (!local->sta_scanning)
2698                 return;
2699
2700         switch (local->scan_state) {
2701         case SCAN_SET_CHANNEL:
2702                 mode = local->scan_hw_mode;
2703                 if (local->scan_hw_mode->list.next == &local->modes_list &&
2704                     local->scan_channel_idx >= mode->num_channels) {
2705                         ieee80211_scan_completed(local_to_hw(local));
2706                         return;
2707                 }
2708                 skip = !(local->enabled_modes & (1 << mode->mode));
2709                 chan = &mode->channels[local->scan_channel_idx];
2710                 if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
2711                     (sdata->type == IEEE80211_IF_TYPE_IBSS &&
2712                      !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
2713                     (local->hw_modes & local->enabled_modes &
2714                      (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
2715                         skip = 1;
2716
2717                 if (!skip) {
2718 #if 0
2719                         printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
2720                                dev->name, chan->chan, chan->freq);
2721 #endif
2722
2723                         local->scan_channel = chan;
2724                         if (ieee80211_hw_config(local)) {
2725                                 printk(KERN_DEBUG "%s: failed to set channel "
2726                                        "%d (%d MHz) for scan\n", dev->name,
2727                                        chan->chan, chan->freq);
2728                                 skip = 1;
2729                         }
2730                 }
2731
2732                 local->scan_channel_idx++;
2733                 if (local->scan_channel_idx >= local->scan_hw_mode->num_channels) {
2734                         if (local->scan_hw_mode->list.next != &local->modes_list) {
2735                                 local->scan_hw_mode = list_entry(local->scan_hw_mode->list.next,
2736                                                                  struct ieee80211_hw_mode,
2737                                                                  list);
2738                                 local->scan_channel_idx = 0;
2739                         }
2740                 }
2741
2742                 if (skip)
2743                         break;
2744
2745                 next_delay = IEEE80211_PROBE_DELAY +
2746                              usecs_to_jiffies(local->hw.channel_change_time);
2747                 local->scan_state = SCAN_SEND_PROBE;
2748                 break;
2749         case SCAN_SEND_PROBE:
2750                 if (local->scan_channel->flag & IEEE80211_CHAN_W_ACTIVE_SCAN) {
2751                         ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
2752                                                  local->scan_ssid_len);
2753                         next_delay = IEEE80211_CHANNEL_TIME;
2754                 } else
2755                         next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
2756                 local->scan_state = SCAN_SET_CHANNEL;
2757                 break;
2758         }
2759
2760         if (local->sta_scanning)
2761                 queue_delayed_work(local->hw.workqueue, &local->scan_work,
2762                                    next_delay);
2763 }
2764
2765
2766 static int ieee80211_sta_start_scan(struct net_device *dev,
2767                                     u8 *ssid, size_t ssid_len)
2768 {
2769         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2770         struct ieee80211_sub_if_data *sdata;
2771
2772         if (ssid_len > IEEE80211_MAX_SSID_LEN)
2773                 return -EINVAL;
2774
2775         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2776          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2777          * BSSID: MACAddress
2778          * SSID
2779          * ScanType: ACTIVE, PASSIVE
2780          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2781          *    a Probe frame during active scanning
2782          * ChannelList
2783          * MinChannelTime (>= ProbeDelay), in TU
2784          * MaxChannelTime: (>= MinChannelTime), in TU
2785          */
2786
2787          /* MLME-SCAN.confirm
2788           * BSSDescriptionSet
2789           * ResultCode: SUCCESS, INVALID_PARAMETERS
2790          */
2791
2792         if (local->sta_scanning) {
2793                 if (local->scan_dev == dev)
2794                         return 0;
2795                 return -EBUSY;
2796         }
2797
2798         if (local->ops->hw_scan) {
2799                 int rc = local->ops->hw_scan(local_to_hw(local),
2800                                             ssid, ssid_len);
2801                 if (!rc) {
2802                         local->sta_scanning = 1;
2803                         local->scan_dev = dev;
2804                 }
2805                 return rc;
2806         }
2807
2808         local->sta_scanning = 1;
2809
2810         rcu_read_lock();
2811         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2812
2813                 /* Don't stop the master interface, otherwise we can't transmit
2814                  * probes! */
2815                 if (sdata->dev == local->mdev)
2816                         continue;
2817
2818                 netif_stop_queue(sdata->dev);
2819                 if (sdata->type == IEEE80211_IF_TYPE_STA &&
2820                     (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
2821                         ieee80211_send_nullfunc(local, sdata, 1);
2822         }
2823         rcu_read_unlock();
2824
2825         if (ssid) {
2826                 local->scan_ssid_len = ssid_len;
2827                 memcpy(local->scan_ssid, ssid, ssid_len);
2828         } else
2829                 local->scan_ssid_len = 0;
2830         local->scan_state = SCAN_SET_CHANNEL;
2831         local->scan_hw_mode = list_entry(local->modes_list.next,
2832                                          struct ieee80211_hw_mode,
2833                                          list);
2834         local->scan_channel_idx = 0;
2835         local->scan_dev = dev;
2836
2837         netif_tx_lock_bh(local->mdev);
2838         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
2839         local->ops->configure_filter(local_to_hw(local),
2840                                      FIF_BCN_PRBRESP_PROMISC,
2841                                      &local->filter_flags,
2842                                      local->mdev->mc_count,
2843                                      local->mdev->mc_list);
2844         netif_tx_unlock_bh(local->mdev);
2845
2846         /* TODO: start scan as soon as all nullfunc frames are ACKed */
2847         queue_delayed_work(local->hw.workqueue, &local->scan_work,
2848                            IEEE80211_CHANNEL_TIME);
2849
2850         return 0;
2851 }
2852
2853
2854 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
2855 {
2856         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2857         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2858         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2859
2860         if (sdata->type != IEEE80211_IF_TYPE_STA)
2861                 return ieee80211_sta_start_scan(dev, ssid, ssid_len);
2862
2863         if (local->sta_scanning) {
2864                 if (local->scan_dev == dev)
2865                         return 0;
2866                 return -EBUSY;
2867         }
2868
2869         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
2870         queue_work(local->hw.workqueue, &ifsta->work);
2871         return 0;
2872 }
2873
2874 static char *
2875 ieee80211_sta_scan_result(struct net_device *dev,
2876                           struct ieee80211_sta_bss *bss,
2877                           char *current_ev, char *end_buf)
2878 {
2879         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2880         struct iw_event iwe;
2881
2882         if (time_after(jiffies,
2883                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
2884                 return current_ev;
2885
2886         if (!(local->enabled_modes & (1 << bss->hw_mode)))
2887                 return current_ev;
2888
2889         if (local->scan_flags & IEEE80211_SCAN_WPA_ONLY &&
2890             !bss->wpa_ie && !bss->rsn_ie)
2891                 return current_ev;
2892
2893         if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID &&
2894             (local->scan_ssid_len != bss->ssid_len ||
2895              memcmp(local->scan_ssid, bss->ssid, bss->ssid_len) != 0))
2896                 return current_ev;
2897
2898         memset(&iwe, 0, sizeof(iwe));
2899         iwe.cmd = SIOCGIWAP;
2900         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2901         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
2902         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2903                                           IW_EV_ADDR_LEN);
2904
2905         memset(&iwe, 0, sizeof(iwe));
2906         iwe.cmd = SIOCGIWESSID;
2907         iwe.u.data.length = bss->ssid_len;
2908         iwe.u.data.flags = 1;
2909         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2910                                           bss->ssid);
2911
2912         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
2913                 memset(&iwe, 0, sizeof(iwe));
2914                 iwe.cmd = SIOCGIWMODE;
2915                 if (bss->capability & WLAN_CAPABILITY_ESS)
2916                         iwe.u.mode = IW_MODE_MASTER;
2917                 else
2918                         iwe.u.mode = IW_MODE_ADHOC;
2919                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2920                                                   IW_EV_UINT_LEN);
2921         }
2922
2923         memset(&iwe, 0, sizeof(iwe));
2924         iwe.cmd = SIOCGIWFREQ;
2925         iwe.u.freq.m = bss->channel;
2926         iwe.u.freq.e = 0;
2927         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2928                                           IW_EV_FREQ_LEN);
2929         iwe.u.freq.m = bss->freq * 100000;
2930         iwe.u.freq.e = 1;
2931         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2932                                           IW_EV_FREQ_LEN);
2933
2934         memset(&iwe, 0, sizeof(iwe));
2935         iwe.cmd = IWEVQUAL;
2936         iwe.u.qual.qual = bss->signal;
2937         iwe.u.qual.level = bss->rssi;
2938         iwe.u.qual.noise = bss->noise;
2939         iwe.u.qual.updated = local->wstats_flags;
2940         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2941                                           IW_EV_QUAL_LEN);
2942
2943         memset(&iwe, 0, sizeof(iwe));
2944         iwe.cmd = SIOCGIWENCODE;
2945         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
2946                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2947         else
2948                 iwe.u.data.flags = IW_ENCODE_DISABLED;
2949         iwe.u.data.length = 0;
2950         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
2951
2952         if (bss && bss->wpa_ie) {
2953                 memset(&iwe, 0, sizeof(iwe));
2954                 iwe.cmd = IWEVGENIE;
2955                 iwe.u.data.length = bss->wpa_ie_len;
2956                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2957                                                   bss->wpa_ie);
2958         }
2959
2960         if (bss && bss->rsn_ie) {
2961                 memset(&iwe, 0, sizeof(iwe));
2962                 iwe.cmd = IWEVGENIE;
2963                 iwe.u.data.length = bss->rsn_ie_len;
2964                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2965                                                   bss->rsn_ie);
2966         }
2967
2968         if (bss && bss->supp_rates_len > 0) {
2969                 /* display all supported rates in readable format */
2970                 char *p = current_ev + IW_EV_LCP_LEN;
2971                 int i;
2972
2973                 memset(&iwe, 0, sizeof(iwe));
2974                 iwe.cmd = SIOCGIWRATE;
2975                 /* Those two flags are ignored... */
2976                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
2977
2978                 for (i = 0; i < bss->supp_rates_len; i++) {
2979                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
2980                                                         0x7f) * 500000);
2981                         p = iwe_stream_add_value(current_ev, p,
2982                                         end_buf, &iwe, IW_EV_PARAM_LEN);
2983                 }
2984                 current_ev = p;
2985         }
2986
2987         if (bss) {
2988                 char *buf;
2989                 buf = kmalloc(30, GFP_ATOMIC);
2990                 if (buf) {
2991                         memset(&iwe, 0, sizeof(iwe));
2992                         iwe.cmd = IWEVCUSTOM;
2993                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
2994                         iwe.u.data.length = strlen(buf);
2995                         current_ev = iwe_stream_add_point(current_ev, end_buf,
2996                                                           &iwe, buf);
2997                         kfree(buf);
2998                 }
2999         }
3000
3001         do {
3002                 char *buf;
3003
3004                 if (!(local->scan_flags & IEEE80211_SCAN_EXTRA_INFO))
3005                         break;
3006
3007                 buf = kmalloc(100, GFP_ATOMIC);
3008                 if (!buf)
3009                         break;
3010
3011                 memset(&iwe, 0, sizeof(iwe));
3012                 iwe.cmd = IWEVCUSTOM;
3013                 sprintf(buf, "bcn_int=%d", bss->beacon_int);
3014                 iwe.u.data.length = strlen(buf);
3015                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3016                                                   buf);
3017
3018                 memset(&iwe, 0, sizeof(iwe));
3019                 iwe.cmd = IWEVCUSTOM;
3020                 sprintf(buf, "capab=0x%04x", bss->capability);
3021                 iwe.u.data.length = strlen(buf);
3022                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3023                                                   buf);
3024
3025                 kfree(buf);
3026                 break;
3027         } while (0);
3028
3029         return current_ev;
3030 }
3031
3032
3033 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
3034 {
3035         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3036         char *current_ev = buf;
3037         char *end_buf = buf + len;
3038         struct ieee80211_sta_bss *bss;
3039
3040         spin_lock_bh(&local->sta_bss_lock);
3041         list_for_each_entry(bss, &local->sta_bss_list, list) {
3042                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3043                         spin_unlock_bh(&local->sta_bss_lock);
3044                         return -E2BIG;
3045                 }
3046                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
3047                                                        end_buf);
3048         }
3049         spin_unlock_bh(&local->sta_bss_lock);
3050         return current_ev - buf;
3051 }
3052
3053
3054 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
3055 {
3056         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3057         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3058         kfree(ifsta->extra_ie);
3059         if (len == 0) {
3060                 ifsta->extra_ie = NULL;
3061                 ifsta->extra_ie_len = 0;
3062                 return 0;
3063         }
3064         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3065         if (!ifsta->extra_ie) {
3066                 ifsta->extra_ie_len = 0;
3067                 return -ENOMEM;
3068         }
3069         memcpy(ifsta->extra_ie, ie, len);
3070         ifsta->extra_ie_len = len;
3071         return 0;
3072 }
3073
3074
3075 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
3076                                          struct sk_buff *skb, u8 *bssid,
3077                                          u8 *addr)
3078 {
3079         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3080         struct sta_info *sta;
3081         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3082
3083         /* TODO: Could consider removing the least recently used entry and
3084          * allow new one to be added. */
3085         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3086                 if (net_ratelimit()) {
3087                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3088                                "entry " MAC_FMT "\n", dev->name, MAC_ARG(addr));
3089                 }
3090                 return NULL;
3091         }
3092
3093         printk(KERN_DEBUG "%s: Adding new IBSS station " MAC_FMT " (dev=%s)\n",
3094                wiphy_name(local->hw.wiphy), MAC_ARG(addr), dev->name);
3095
3096         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
3097         if (!sta)
3098                 return NULL;
3099
3100         sta->supp_rates = sdata->u.sta.supp_rates_bits;
3101
3102         rate_control_rate_init(sta, local);
3103
3104         return sta; /* caller will call sta_info_put() */
3105 }
3106
3107
3108 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
3109 {
3110         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3111         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3112
3113         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
3114                dev->name, reason);
3115
3116         if (sdata->type != IEEE80211_IF_TYPE_STA &&
3117             sdata->type != IEEE80211_IF_TYPE_IBSS)
3118                 return -EINVAL;
3119
3120         ieee80211_send_deauth(dev, ifsta, reason);
3121         ieee80211_set_disassoc(dev, ifsta, 1);
3122         return 0;
3123 }
3124
3125
3126 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
3127 {
3128         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3129         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3130
3131         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
3132                dev->name, reason);
3133
3134         if (sdata->type != IEEE80211_IF_TYPE_STA)
3135                 return -EINVAL;
3136
3137         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
3138                 return -1;
3139
3140         ieee80211_send_disassoc(dev, ifsta, reason);
3141         ieee80211_set_disassoc(dev, ifsta, 0);
3142         return 0;
3143 }