net/mac80211/mlme.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 /* TODO:
  15  * order BSS list by RSSI(?) ("quality of AP")
  16  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  17  *    SSID)
  18  */
  19 #include <linux/delay.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/if_arp.h>
  24 #include <linux/wireless.h>
  25 #include <linux/random.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/rtnetlink.h>
  28 #include <net/iw_handler.h>
  29 #include <net/mac80211.h>
  30
  31 #include "ieee80211_i.h"
  32 #include "rate.h"
  33 #include "led.h"
  34 #include "mesh.h"
  35
  36 #define IEEE80211_ASSOC_SCANS_MAX_TRIES 2
  37 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  38 #define IEEE80211_AUTH_MAX_TRIES 3
  39 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  40 #define IEEE80211_ASSOC_MAX_TRIES 3
  41 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  42 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
  43 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  44 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  45 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  46 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  47 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
  48
  49 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  50 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  51 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
  52
  53 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  54
  55
  56 /* mgmt header + 1 byte category code */
  57 #define IEEE80211_MIN_ACTION_SIZE (24 + 1)
  58
  59 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
  60 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
  61 #define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
  62 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
  63 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
  64
  65 /* next values represent the buffer size for A-MPDU frame.
  66  * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) */
  67 #define IEEE80211_MIN_AMPDU_BUF 0x8
  68 #define IEEE80211_MAX_AMPDU_BUF 0x40
  69
  70 /* BSS handling */
  71 static struct ieee80211_sta_bss *
  72 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
  73                      u8 *ssid, u8 ssid_len)
  74 {
  75         struct ieee80211_sta_bss *bss;
  76
  77         spin_lock_bh(&local->sta_bss_lock);
  78         bss = local->sta_bss_hash[STA_HASH(bssid)];
  79         while (bss) {
  80                 if (!bss_mesh_cfg(bss) &&
  81                     !memcmp(bss->bssid, bssid, ETH_ALEN) &&
  82                     bss->freq == freq &&
  83                     bss->ssid_len == ssid_len &&
  84                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
  85                         atomic_inc(&bss->users);
  86                         break;
  87                 }
  88                 bss = bss->hnext;
  89         }
  90         spin_unlock_bh(&local->sta_bss_lock);
  91         return bss;
  92 }
  93
  94 /* Caller must hold local->sta_bss_lock */
  95 static void __ieee80211_rx_bss_hash_add(struct ieee80211_local *local,
  96                                         struct ieee80211_sta_bss *bss)
  97 {
  98         u8 hash_idx;
  99
 100         if (bss_mesh_cfg(bss))
 101                 hash_idx = mesh_id_hash(bss_mesh_id(bss),
 102                                         bss_mesh_id_len(bss));
 103         else
 104                 hash_idx = STA_HASH(bss->bssid);
 105
 106         bss->hnext = local->sta_bss_hash[hash_idx];
 107         local->sta_bss_hash[hash_idx] = bss;
 108 }
 109
 110 /* Caller must hold local->sta_bss_lock */
 111 static void __ieee80211_rx_bss_hash_del(struct ieee80211_local *local,
 112                                         struct ieee80211_sta_bss *bss)
 113 {
 114         struct ieee80211_sta_bss *b, *prev = NULL;
 115         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
 116         while (b) {
 117                 if (b == bss) {
 118                         if (!prev)
 119                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
 120                                         bss->hnext;
 121                         else
 122                                 prev->hnext = bss->hnext;
 123                         break;
 124                 }
 125                 prev = b;
 126                 b = b->hnext;
 127         }
 128 }
 129
 130 static struct ieee80211_sta_bss *
 131 ieee80211_rx_bss_add(struct ieee80211_sub_if_data *sdata, u8 *bssid, int freq,
 132                      u8 *ssid, u8 ssid_len)
 133 {
 134         struct ieee80211_local *local = sdata->local;
 135         struct ieee80211_sta_bss *bss;
 136
 137         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
 138         if (!bss)
 139                 return NULL;
 140         atomic_inc(&bss->users);
 141         atomic_inc(&bss->users);
 142         memcpy(bss->bssid, bssid, ETH_ALEN);
 143         bss->freq = freq;
 144         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
 145                 memcpy(bss->ssid, ssid, ssid_len);
 146                 bss->ssid_len = ssid_len;
 147         }
 148
 149         spin_lock_bh(&local->sta_bss_lock);
 150         /* TODO: order by RSSI? */
 151         list_add_tail(&bss->list, &local->sta_bss_list);
 152         __ieee80211_rx_bss_hash_add(local, bss);
 153         spin_unlock_bh(&local->sta_bss_lock);
 154         return bss;
 155 }
 156
 157 #ifdef CONFIG_MAC80211_MESH
 158 static struct ieee80211_sta_bss *
 159 ieee80211_rx_mesh_bss_get(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
 160                           u8 *mesh_cfg, int freq)
 161 {
 162         struct ieee80211_sta_bss *bss;
 163
 164         spin_lock_bh(&local->sta_bss_lock);
 165         bss = local->sta_bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
 166         while (bss) {
 167                 if (bss_mesh_cfg(bss) &&
 168                     !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
 169                     bss->freq == freq &&
 170                     mesh_id_len == bss->mesh_id_len &&
 171                     (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
 172                                                  mesh_id_len))) {
 173                         atomic_inc(&bss->users);
 174                         break;
 175                 }
 176                 bss = bss->hnext;
 177         }
 178         spin_unlock_bh(&local->sta_bss_lock);
 179         return bss;
 180 }
 181
 182 static struct ieee80211_sta_bss *
 183 ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
 184                           u8 *mesh_cfg, int mesh_config_len, int freq)
 185 {
 186         struct ieee80211_sta_bss *bss;
 187
 188         if (mesh_config_len != MESH_CFG_LEN)
 189                 return NULL;
 190
 191         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
 192         if (!bss)
 193                 return NULL;
 194
 195         bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
 196         if (!bss->mesh_cfg) {
 197                 kfree(bss);
 198                 return NULL;
 199         }
 200
 201         if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
 202                 bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
 203                 if (!bss->mesh_id) {
 204                         kfree(bss->mesh_cfg);
 205                         kfree(bss);
 206                         return NULL;
 207                 }
 208                 memcpy(bss->mesh_id, mesh_id, mesh_id_len);
 209         }
 210
 211         atomic_inc(&bss->users);
 212         atomic_inc(&bss->users);
 213         memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
 214         bss->mesh_id_len = mesh_id_len;
 215         bss->freq = freq;
 216         spin_lock_bh(&local->sta_bss_lock);
 217         /* TODO: order by RSSI? */
 218         list_add_tail(&bss->list, &local->sta_bss_list);
 219         __ieee80211_rx_bss_hash_add(local, bss);
 220         spin_unlock_bh(&local->sta_bss_lock);
 221         return bss;
 222 }
 223 #endif
 224
 225 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
 226 {
 227         kfree(bss->ies);
 228         kfree(bss_mesh_id(bss));
 229         kfree(bss_mesh_cfg(bss));
 230         kfree(bss);
 231 }
 232
 233 static void ieee80211_rx_bss_put(struct ieee80211_local *local,
 234                                  struct ieee80211_sta_bss *bss)
 235 {
 236         local_bh_disable();
 237         if (!atomic_dec_and_lock(&bss->users, &local->sta_bss_lock)) {
 238                 local_bh_enable();
 239                 return;
 240         }
 241
 242         __ieee80211_rx_bss_hash_del(local, bss);
 243         list_del(&bss->list);
 244         spin_unlock_bh(&local->sta_bss_lock);
 245         ieee80211_rx_bss_free(bss);
 246 }
 247
 248 void ieee80211_rx_bss_list_init(struct ieee80211_local *local)
 249 {
 250         spin_lock_init(&local->sta_bss_lock);
 251         INIT_LIST_HEAD(&local->sta_bss_list);
 252 }
 253
 254 void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local)
 255 {
 256         struct ieee80211_sta_bss *bss, *tmp;
 257
 258         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
 259                 ieee80211_rx_bss_put(local, bss);
 260 }
 261
 262 static u8 *ieee80211_bss_get_ie(struct ieee80211_sta_bss *bss, u8 ie)
 263 {
 264         u8 *end, *pos;
 265
 266         pos = bss->ies;
 267         if (pos == NULL)
 268                 return NULL;
 269         end = pos + bss->ies_len;
 270
 271         while (pos + 1 < end) {
 272                 if (pos + 2 + pos[1] > end)
 273                         break;
 274                 if (pos[0] == ie)
 275                         return pos;
 276                 pos += 2 + pos[1];
 277         }
 278
 279         return NULL;
 280 }
 281
 282 /* utils */
 283 static int ecw2cw(int ecw)
 284 {
 285         return (1 << ecw) - 1;
 286 }
 287
 288 /* frame sending functions */
 289 void ieee80211_sta_tx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 290                       int encrypt)
 291 {
 292         skb->dev = sdata->local->mdev;
 293         skb_set_mac_header(skb, 0);
 294         skb_set_network_header(skb, 0);
 295         skb_set_transport_header(skb, 0);
 296
 297         skb->iif = sdata->dev->ifindex;
 298         skb->do_not_encrypt = !encrypt;
 299
 300         dev_queue_xmit(skb);
 301 }
 302
 303 static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
 304                                 struct ieee80211_if_sta *ifsta,
 305                                 int transaction, u8 *extra, size_t extra_len,
 306                                 int encrypt)
 307 {
 308         struct ieee80211_local *local = sdata->local;
 309         struct sk_buff *skb;
 310         struct ieee80211_mgmt *mgmt;
 311
 312         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 313                             sizeof(*mgmt) + 6 + extra_len);
 314         if (!skb) {
 315                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 316                        "frame\n", sdata->dev->name);
 317                 return;
 318         }
 319         skb_reserve(skb, local->hw.extra_tx_headroom);
 320
 321         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 322         memset(mgmt, 0, 24 + 6);
 323         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 324                                           IEEE80211_STYPE_AUTH);
 325         if (encrypt)
 326                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 327         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 328         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 329         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 330         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 331         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 332         ifsta->auth_transaction = transaction + 1;
 333         mgmt->u.auth.status_code = cpu_to_le16(0);
 334         if (extra)
 335                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 336
 337         ieee80211_sta_tx(sdata, skb, encrypt);
 338 }
 339
 340 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
 341                               u8 *ssid, size_t ssid_len)
 342 {
 343         struct ieee80211_local *local = sdata->local;
 344         struct ieee80211_supported_band *sband;
 345         struct sk_buff *skb;
 346         struct ieee80211_mgmt *mgmt;
 347         u8 *pos, *supp_rates, *esupp_rates = NULL;
 348         int i;
 349
 350         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 351         if (!skb) {
 352                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 353                        "request\n", sdata->dev->name);
 354                 return;
 355         }
 356         skb_reserve(skb, local->hw.extra_tx_headroom);
 357
 358         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 359         memset(mgmt, 0, 24);
 360         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 361                                           IEEE80211_STYPE_PROBE_REQ);
 362         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 363         if (dst) {
 364                 memcpy(mgmt->da, dst, ETH_ALEN);
 365                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 366         } else {
 367                 memset(mgmt->da, 0xff, ETH_ALEN);
 368                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 369         }
 370         pos = skb_put(skb, 2 + ssid_len);
 371         *pos++ = WLAN_EID_SSID;
 372         *pos++ = ssid_len;
 373         memcpy(pos, ssid, ssid_len);
 374
 375         supp_rates = skb_put(skb, 2);
 376         supp_rates[0] = WLAN_EID_SUPP_RATES;
 377         supp_rates[1] = 0;
 378         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 379
 380         for (i = 0; i < sband->n_bitrates; i++) {
 381                 struct ieee80211_rate *rate = &sband->bitrates[i];
 382                 if (esupp_rates) {
 383                         pos = skb_put(skb, 1);
 384                         esupp_rates[1]++;
 385                 } else if (supp_rates[1] == 8) {
 386                         esupp_rates = skb_put(skb, 3);
 387                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 388                         esupp_rates[1] = 1;
 389                         pos = &esupp_rates[2];
 390                 } else {
 391                         pos = skb_put(skb, 1);
 392                         supp_rates[1]++;
 393                 }
 394                 *pos = rate->bitrate / 5;
 395         }
 396
 397         ieee80211_sta_tx(sdata, skb, 0);
 398 }
 399
 400 /* MLME */
 401 static void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
 402                                          struct ieee80211_sta_bss *bss,
 403                                          int ibss)
 404 {
 405         struct ieee80211_local *local = sdata->local;
 406         int i, have_higher_than_11mbit = 0;
 407
 408
 409         /* cf. IEEE 802.11 9.2.12 */
 410         for (i = 0; i < bss->supp_rates_len; i++)
 411                 if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
 412                         have_higher_than_11mbit = 1;
 413
 414         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
 415             have_higher_than_11mbit)
 416                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
 417         else
 418                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 419
 420
 421         if (local->ops->conf_tx) {
 422                 struct ieee80211_tx_queue_params qparam;
 423
 424                 memset(&qparam, 0, sizeof(qparam));
 425
 426                 qparam.aifs = 2;
 427
 428                 if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
 429                     !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
 430                         qparam.cw_min = 31;
 431                 else
 432                         qparam.cw_min = 15;
 433
 434                 qparam.cw_max = 1023;
 435                 qparam.txop = 0;
 436
 437                 for (i = 0; i < local_to_hw(local)->queues; i++)
 438                         local->ops->conf_tx(local_to_hw(local), i, &qparam);
 439         }
 440 }
 441
 442 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 443                                      struct ieee80211_if_sta *ifsta,
 444                                      u8 *wmm_param, size_t wmm_param_len)
 445 {
 446         struct ieee80211_tx_queue_params params;
 447         size_t left;
 448         int count;
 449         u8 *pos;
 450
 451         if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
 452                 return;
 453
 454         if (!wmm_param)
 455                 return;
 456
 457         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 458                 return;
 459         count = wmm_param[6] & 0x0f;
 460         if (count == ifsta->wmm_last_param_set)
 461                 return;
 462         ifsta->wmm_last_param_set = count;
 463
 464         pos = wmm_param + 8;
 465         left = wmm_param_len - 8;
 466
 467         memset(&params, 0, sizeof(params));
 468
 469         if (!local->ops->conf_tx)
 470                 return;
 471
 472         local->wmm_acm = 0;
 473         for (; left >= 4; left -= 4, pos += 4) {
 474                 int aci = (pos[0] >> 5) & 0x03;
 475                 int acm = (pos[0] >> 4) & 0x01;
 476                 int queue;
 477
 478                 switch (aci) {
 479                 case 1:
 480                         queue = 3;
 481                         if (acm)
 482                                 local->wmm_acm |= BIT(0) | BIT(3);
 483                         break;
 484                 case 2:
 485                         queue = 1;
 486                         if (acm)
 487                                 local->wmm_acm |= BIT(4) | BIT(5);
 488                         break;
 489                 case 3:
 490                         queue = 0;
 491                         if (acm)
 492                                 local->wmm_acm |= BIT(6) | BIT(7);
 493                         break;
 494                 case 0:
 495                 default:
 496                         queue = 2;
 497                         if (acm)
 498                                 local->wmm_acm |= BIT(1) | BIT(2);
 499                         break;
 500                 }
 501
 502                 params.aifs = pos[0] & 0x0f;
 503                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 504                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 505                 params.txop = get_unaligned_le16(pos + 2);
 506 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 507                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 508                        "cWmin=%d cWmax=%d txop=%d\n",
 509                        local->mdev->name, queue, aci, acm, params.aifs, params.cw_min,
 510                        params.cw_max, params.txop);
 511 #endif
 512                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 513                  * AC for now) */
 514                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 515                         printk(KERN_DEBUG "%s: failed to set TX queue "
 516                                "parameters for queue %d\n", local->mdev->name, queue);
 517                 }
 518         }
 519 }
 520
 521 static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
 522                                            bool use_protection,
 523                                            bool use_short_preamble)
 524 {
 525         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
 526 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 527         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 528         DECLARE_MAC_BUF(mac);
 529 #endif
 530         u32 changed = 0;
 531
 532         if (use_protection != bss_conf->use_cts_prot) {
 533 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 534                 if (net_ratelimit()) {
 535                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 536                                "%s)\n",
 537                                sdata->dev->name,
 538                                use_protection ? "enabled" : "disabled",
 539                                print_mac(mac, ifsta->bssid));
 540                 }
 541 #endif
 542                 bss_conf->use_cts_prot = use_protection;
 543                 changed |= BSS_CHANGED_ERP_CTS_PROT;
 544         }
 545
 546         if (use_short_preamble != bss_conf->use_short_preamble) {
 547 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 548                 if (net_ratelimit()) {
 549                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 550                                " (BSSID=%s)\n",
 551                                sdata->dev->name,
 552                                use_short_preamble ? "short" : "long",
 553                                print_mac(mac, ifsta->bssid));
 554                 }
 555 #endif
 556                 bss_conf->use_short_preamble = use_short_preamble;
 557                 changed |= BSS_CHANGED_ERP_PREAMBLE;
 558         }
 559
 560         return changed;
 561 }
 562
 563 static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
 564                                    u8 erp_value)
 565 {
 566         bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 567         bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
 568
 569         return ieee80211_handle_protect_preamb(sdata,
 570                         use_protection, use_short_preamble);
 571 }
 572
 573 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 574                                            struct ieee80211_sta_bss *bss)
 575 {
 576         u32 changed = 0;
 577
 578         if (bss->has_erp_value)
 579                 changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
 580         else {
 581                 u16 capab = bss->capability;
 582                 changed |= ieee80211_handle_protect_preamb(sdata, false,
 583                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
 584         }
 585
 586         return changed;
 587 }
 588
 589 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
 590                                    struct ieee80211_ht_info *ht_info)
 591 {
 592
 593         if (ht_info == NULL)
 594                 return -EINVAL;
 595
 596         memset(ht_info, 0, sizeof(*ht_info));
 597
 598         if (ht_cap_ie) {
 599                 u8 ampdu_info = ht_cap_ie->ampdu_params_info;
 600
 601                 ht_info->ht_supported = 1;
 602                 ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
 603                 ht_info->ampdu_factor =
 604                         ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
 605                 ht_info->ampdu_density =
 606                         (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
 607                 memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
 608         } else
 609                 ht_info->ht_supported = 0;
 610
 611         return 0;
 612 }
 613
 614 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
 615                         struct ieee80211_ht_addt_info *ht_add_info_ie,
 616                         struct ieee80211_ht_bss_info *bss_info)
 617 {
 618         if (bss_info == NULL)
 619                 return -EINVAL;
 620
 621         memset(bss_info, 0, sizeof(*bss_info));
 622
 623         if (ht_add_info_ie) {
 624                 u16 op_mode;
 625                 op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
 626
 627                 bss_info->primary_channel = ht_add_info_ie->control_chan;
 628                 bss_info->bss_cap = ht_add_info_ie->ht_param;
 629                 bss_info->bss_op_mode = (u8)(op_mode & 0xff);
 630         }
 631
 632         return 0;
 633 }
 634
 635 static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata,
 636                                         struct ieee80211_if_sta *ifsta)
 637 {
 638         union iwreq_data wrqu;
 639         memset(&wrqu, 0, sizeof(wrqu));
 640         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
 641                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 642         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 643         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
 644 }
 645
 646 static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
 647                                          struct ieee80211_if_sta *ifsta)
 648 {
 649         union iwreq_data wrqu;
 650
 651         if (ifsta->assocreq_ies) {
 652                 memset(&wrqu, 0, sizeof(wrqu));
 653                 wrqu.data.length = ifsta->assocreq_ies_len;
 654                 wireless_send_event(sdata->dev, IWEVASSOCREQIE, &wrqu,
 655                                     ifsta->assocreq_ies);
 656         }
 657         if (ifsta->assocresp_ies) {
 658                 memset(&wrqu, 0, sizeof(wrqu));
 659                 wrqu.data.length = ifsta->assocresp_ies_len;
 660                 wireless_send_event(sdata->dev, IWEVASSOCRESPIE, &wrqu,
 661                                     ifsta->assocresp_ies);
 662         }
 663 }
 664
 665
 666 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 667                                      struct ieee80211_if_sta *ifsta)
 668 {
 669         struct ieee80211_local *local = sdata->local;
 670         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
 671         u32 changed = BSS_CHANGED_ASSOC;
 672
 673         struct ieee80211_sta_bss *bss;
 674
 675         ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 676
 677         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
 678                 return;
 679
 680         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 681                                    conf->channel->center_freq,
 682                                    ifsta->ssid, ifsta->ssid_len);
 683         if (bss) {
 684                 /* set timing information */
 685                 sdata->bss_conf.beacon_int = bss->beacon_int;
 686                 sdata->bss_conf.timestamp = bss->timestamp;
 687                 sdata->bss_conf.dtim_period = bss->dtim_period;
 688
 689                 changed |= ieee80211_handle_bss_capability(sdata, bss);
 690
 691                 ieee80211_rx_bss_put(local, bss);
 692         }
 693
 694         if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
 695                 changed |= BSS_CHANGED_HT;
 696                 sdata->bss_conf.assoc_ht = 1;
 697                 sdata->bss_conf.ht_conf = &conf->ht_conf;
 698                 sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
 699         }
 700
 701         ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 702         memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 703         ieee80211_sta_send_associnfo(sdata, ifsta);
 704
 705         ifsta->last_probe = jiffies;
 706         ieee80211_led_assoc(local, 1);
 707
 708         sdata->bss_conf.assoc = 1;
 709         ieee80211_bss_info_change_notify(sdata, changed);
 710
 711         netif_tx_start_all_queues(sdata->dev);
 712         netif_carrier_on(sdata->dev);
 713
 714         ieee80211_sta_send_apinfo(sdata, ifsta);
 715 }
 716
 717 static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
 718                                    struct ieee80211_if_sta *ifsta)
 719 {
 720         DECLARE_MAC_BUF(mac);
 721
 722         ifsta->direct_probe_tries++;
 723         if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
 724                 printk(KERN_DEBUG "%s: direct probe to AP %s timed out\n",
 725                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 726                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 727                 return;
 728         }
 729
 730         printk(KERN_DEBUG "%s: direct probe to AP %s try %d\n",
 731                         sdata->dev->name, print_mac(mac, ifsta->bssid),
 732                         ifsta->direct_probe_tries);
 733
 734         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 735
 736         set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifsta->request);
 737
 738         /* Direct probe is sent to broadcast address as some APs
 739          * will not answer to direct packet in unassociated state.
 740          */
 741         ieee80211_send_probe_req(sdata, NULL,
 742                                  ifsta->ssid, ifsta->ssid_len);
 743
 744         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 745 }
 746
 747
 748 static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
 749                                    struct ieee80211_if_sta *ifsta)
 750 {
 751         DECLARE_MAC_BUF(mac);
 752
 753         ifsta->auth_tries++;
 754         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 755                 printk(KERN_DEBUG "%s: authentication with AP %s"
 756                        " timed out\n",
 757                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 758                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 759                 return;
 760         }
 761
 762         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
 763         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
 764                sdata->dev->name, print_mac(mac, ifsta->bssid));
 765
 766         ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
 767
 768         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 769 }
 770
 771 static int ieee80211_compatible_rates(struct ieee80211_sta_bss *bss,
 772                                       struct ieee80211_supported_band *sband,
 773                                       u64 *rates)
 774 {
 775         int i, j, count;
 776         *rates = 0;
 777         count = 0;
 778         for (i = 0; i < bss->supp_rates_len; i++) {
 779                 int rate = (bss->supp_rates[i] & 0x7F) * 5;
 780
 781                 for (j = 0; j < sband->n_bitrates; j++)
 782                         if (sband->bitrates[j].bitrate == rate) {
 783                                 *rates |= BIT(j);
 784                                 count++;
 785                                 break;
 786                         }
 787         }
 788
 789         return count;
 790 }
 791
 792 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 793                                  struct ieee80211_if_sta *ifsta)
 794 {
 795         struct ieee80211_local *local = sdata->local;
 796         struct sk_buff *skb;
 797         struct ieee80211_mgmt *mgmt;
 798         u8 *pos, *ies, *ht_add_ie;
 799         int i, len, count, rates_len, supp_rates_len;
 800         u16 capab;
 801         struct ieee80211_sta_bss *bss;
 802         int wmm = 0;
 803         struct ieee80211_supported_band *sband;
 804         u64 rates = 0;
 805
 806         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 807                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 808                             ifsta->ssid_len);
 809         if (!skb) {
 810                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 811                        "frame\n", sdata->dev->name);
 812                 return;
 813         }
 814         skb_reserve(skb, local->hw.extra_tx_headroom);
 815
 816         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 817
 818         capab = ifsta->capab;
 819
 820         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
 821                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
 822                         capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 823                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
 824                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 825         }
 826
 827         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 828                                    local->hw.conf.channel->center_freq,
 829                                    ifsta->ssid, ifsta->ssid_len);
 830         if (bss) {
 831                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 832                         capab |= WLAN_CAPABILITY_PRIVACY;
 833                 if (bss->wmm_used)
 834                         wmm = 1;
 835
 836                 /* get all rates supported by the device and the AP as
 837                  * some APs don't like getting a superset of their rates
 838                  * in the association request (e.g. D-Link DAP 1353 in
 839                  * b-only mode) */
 840                 rates_len = ieee80211_compatible_rates(bss, sband, &rates);
 841
 842                 if ((bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
 843                     (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
 844                         capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 845
 846                 ieee80211_rx_bss_put(local, bss);
 847         } else {
 848                 rates = ~0;
 849                 rates_len = sband->n_bitrates;
 850         }
 851
 852         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 853         memset(mgmt, 0, 24);
 854         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 855         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 856         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 857
 858         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 859                 skb_put(skb, 10);
 860                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 861                                                   IEEE80211_STYPE_REASSOC_REQ);
 862                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 863                 mgmt->u.reassoc_req.listen_interval =
 864                                 cpu_to_le16(local->hw.conf.listen_interval);
 865                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 866                        ETH_ALEN);
 867         } else {
 868                 skb_put(skb, 4);
 869                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 870                                                   IEEE80211_STYPE_ASSOC_REQ);
 871                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 872                 mgmt->u.reassoc_req.listen_interval =
 873                                 cpu_to_le16(local->hw.conf.listen_interval);
 874         }
 875
 876         /* SSID */
 877         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 878         *pos++ = WLAN_EID_SSID;
 879         *pos++ = ifsta->ssid_len;
 880         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 881
 882         /* add all rates which were marked to be used above */
 883         supp_rates_len = rates_len;
 884         if (supp_rates_len > 8)
 885                 supp_rates_len = 8;
 886
 887         len = sband->n_bitrates;
 888         pos = skb_put(skb, supp_rates_len + 2);
 889         *pos++ = WLAN_EID_SUPP_RATES;
 890         *pos++ = supp_rates_len;
 891
 892         count = 0;
 893         for (i = 0; i < sband->n_bitrates; i++) {
 894                 if (BIT(i) & rates) {
 895                         int rate = sband->bitrates[i].bitrate;
 896                         *pos++ = (u8) (rate / 5);
 897                         if (++count == 8)
 898                                 break;
 899                 }
 900         }
 901
 902         if (rates_len > count) {
 903                 pos = skb_put(skb, rates_len - count + 2);
 904                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 905                 *pos++ = rates_len - count;
 906
 907                 for (i++; i < sband->n_bitrates; i++) {
 908                         if (BIT(i) & rates) {
 909                                 int rate = sband->bitrates[i].bitrate;
 910                                 *pos++ = (u8) (rate / 5);
 911                         }
 912                 }
 913         }
 914
 915         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
 916                 /* 1. power capabilities */
 917                 pos = skb_put(skb, 4);
 918                 *pos++ = WLAN_EID_PWR_CAPABILITY;
 919                 *pos++ = 2;
 920                 *pos++ = 0; /* min tx power */
 921                 *pos++ = local->hw.conf.channel->max_power; /* max tx power */
 922
 923                 /* 2. supported channels */
 924                 /* TODO: get this in reg domain format */
 925                 pos = skb_put(skb, 2 * sband->n_channels + 2);
 926                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
 927                 *pos++ = 2 * sband->n_channels;
 928                 for (i = 0; i < sband->n_channels; i++) {
 929                         *pos++ = ieee80211_frequency_to_channel(
 930                                         sband->channels[i].center_freq);
 931                         *pos++ = 1; /* one channel in the subband*/
 932                 }
 933         }
 934
 935         if (ifsta->extra_ie) {
 936                 pos = skb_put(skb, ifsta->extra_ie_len);
 937                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 938         }
 939
 940         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 941                 pos = skb_put(skb, 9);
 942                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 943                 *pos++ = 7; /* len */
 944                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 945                 *pos++ = 0x50;
 946                 *pos++ = 0xf2;
 947                 *pos++ = 2; /* WME */
 948                 *pos++ = 0; /* WME info */
 949                 *pos++ = 1; /* WME ver */
 950                 *pos++ = 0;
 951         }
 952
 953         /* wmm support is a must to HT */
 954         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
 955             sband->ht_info.ht_supported &&
 956             (ht_add_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_EXTRA_INFO))) {
 957                 struct ieee80211_ht_addt_info *ht_add_info =
 958                         (struct ieee80211_ht_addt_info *)ht_add_ie;
 959                 u16 cap = sband->ht_info.cap;
 960                 __le16 tmp;
 961                 u32 flags = local->hw.conf.channel->flags;
 962
 963                 switch (ht_add_info->ht_param & IEEE80211_HT_IE_CHA_SEC_OFFSET) {
 964                 case IEEE80211_HT_IE_CHA_SEC_ABOVE:
 965                         if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
 966                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
 967                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 968                         }
 969                         break;
 970                 case IEEE80211_HT_IE_CHA_SEC_BELOW:
 971                         if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
 972                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
 973                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 974                         }
 975                         break;
 976                 }
 977
 978                 tmp = cpu_to_le16(cap);
 979                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
 980                 *pos++ = WLAN_EID_HT_CAPABILITY;
 981                 *pos++ = sizeof(struct ieee80211_ht_cap);
 982                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
 983                 memcpy(pos, &tmp, sizeof(u16));
 984                 pos += sizeof(u16);
 985                 /* TODO: needs a define here for << 2 */
 986                 *pos++ = sband->ht_info.ampdu_factor |
 987                          (sband->ht_info.ampdu_density << 2);
 988                 memcpy(pos, sband->ht_info.supp_mcs_set, 16);
 989         }
 990
 991         kfree(ifsta->assocreq_ies);
 992         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 993         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 994         if (ifsta->assocreq_ies)
 995                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 996
 997         ieee80211_sta_tx(sdata, skb, 0);
 998 }
 999
1000
1001 static void ieee80211_send_deauth(struct ieee80211_sub_if_data *sdata,
1002                                   struct ieee80211_if_sta *ifsta, u16 reason)
1003 {
1004         struct ieee80211_local *local = sdata->local;
1005         struct sk_buff *skb;
1006         struct ieee80211_mgmt *mgmt;
1007
1008         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
1009         if (!skb) {
1010                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
1011                        "frame\n", sdata->dev->name);
1012                 return;
1013         }
1014         skb_reserve(skb, local->hw.extra_tx_headroom);
1015
1016         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1017         memset(mgmt, 0, 24);
1018         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
1019         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1020         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1021         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1022                                           IEEE80211_STYPE_DEAUTH);
1023         skb_put(skb, 2);
1024         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
1025
1026         ieee80211_sta_tx(sdata, skb, 0);
1027 }
1028
1029 static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
1030 {
1031         if (!sdata || !sdata->default_key ||
1032             sdata->default_key->conf.alg != ALG_WEP)
1033                 return 0;
1034         return 1;
1035 }
1036
1037 static void ieee80211_send_disassoc(struct ieee80211_sub_if_data *sdata,
1038                                     struct ieee80211_if_sta *ifsta, u16 reason)
1039 {
1040         struct ieee80211_local *local = sdata->local;
1041         struct sk_buff *skb;
1042         struct ieee80211_mgmt *mgmt;
1043
1044         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
1045         if (!skb) {
1046                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
1047                        "frame\n", sdata->dev->name);
1048                 return;
1049         }
1050         skb_reserve(skb, local->hw.extra_tx_headroom);
1051
1052         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1053         memset(mgmt, 0, 24);
1054         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
1055         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1056         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1057         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1058                                           IEEE80211_STYPE_DISASSOC);
1059         skb_put(skb, 2);
1060         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
1061
1062         ieee80211_sta_tx(sdata, skb, 0);
1063 }
1064
1065 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1066                                    struct ieee80211_if_sta *ifsta, bool deauth,
1067                                    bool self_disconnected, u16 reason)
1068 {
1069         struct ieee80211_local *local = sdata->local;
1070         struct sta_info *sta;
1071         u32 changed = BSS_CHANGED_ASSOC;
1072
1073         rcu_read_lock();
1074
1075         sta = sta_info_get(local, ifsta->bssid);
1076         if (!sta) {
1077                 rcu_read_unlock();
1078                 return;
1079         }
1080
1081         if (deauth) {
1082                 ifsta->direct_probe_tries = 0;
1083                 ifsta->auth_tries = 0;
1084         }
1085         ifsta->assoc_scan_tries = 0;
1086         ifsta->assoc_tries = 0;
1087
1088         netif_tx_stop_all_queues(sdata->dev);
1089         netif_carrier_off(sdata->dev);
1090
1091         ieee80211_sta_tear_down_BA_sessions(sdata, sta->addr);
1092
1093         if (self_disconnected) {
1094                 if (deauth)
1095                         ieee80211_send_deauth(sdata, ifsta, reason);
1096                 else
1097                         ieee80211_send_disassoc(sdata, ifsta, reason);
1098         }
1099
1100         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
1101         changed |= ieee80211_reset_erp_info(sdata);
1102
1103         if (sdata->bss_conf.assoc_ht)
1104                 changed |= BSS_CHANGED_HT;
1105
1106         sdata->bss_conf.assoc_ht = 0;
1107         sdata->bss_conf.ht_conf = NULL;
1108         sdata->bss_conf.ht_bss_conf = NULL;
1109
1110         ieee80211_led_assoc(local, 0);
1111         sdata->bss_conf.assoc = 0;
1112
1113         ieee80211_sta_send_apinfo(sdata, ifsta);
1114
1115         if (self_disconnected)
1116                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
1117
1118         sta_info_unlink(&sta);
1119
1120         rcu_read_unlock();
1121
1122         sta_info_destroy(sta);
1123 }
1124
1125 static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
1126                                       struct ieee80211_if_sta *ifsta)
1127 {
1128         struct ieee80211_local *local = sdata->local;
1129         struct ieee80211_sta_bss *bss;
1130         int bss_privacy;
1131         int wep_privacy;
1132         int privacy_invoked;
1133
1134         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
1135                 return 0;
1136
1137         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
1138                                    local->hw.conf.channel->center_freq,
1139                                    ifsta->ssid, ifsta->ssid_len);
1140         if (!bss)
1141                 return 0;
1142
1143         bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
1144         wep_privacy = !!ieee80211_sta_wep_configured(sdata);
1145         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
1146
1147         ieee80211_rx_bss_put(local, bss);
1148
1149         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
1150                 return 0;
1151
1152         return 1;
1153 }
1154
1155 static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
1156                                 struct ieee80211_if_sta *ifsta)
1157 {
1158         DECLARE_MAC_BUF(mac);
1159
1160         ifsta->assoc_tries++;
1161         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
1162                 printk(KERN_DEBUG "%s: association with AP %s"
1163                        " timed out\n",
1164                        sdata->dev->name, print_mac(mac, ifsta->bssid));
1165                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
1166                 return;
1167         }
1168
1169         ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
1170         printk(KERN_DEBUG "%s: associate with AP %s\n",
1171                sdata->dev->name, print_mac(mac, ifsta->bssid));
1172         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
1173                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
1174                        "mixed-cell disabled - abort association\n", sdata->dev->name);
1175                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
1176                 return;
1177         }
1178
1179         ieee80211_send_assoc(sdata, ifsta);
1180
1181         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
1182 }
1183
1184
1185 static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
1186                                  struct ieee80211_if_sta *ifsta)
1187 {
1188         struct ieee80211_local *local = sdata->local;
1189         struct sta_info *sta;
1190         int disassoc;
1191         DECLARE_MAC_BUF(mac);
1192
1193         /* TODO: start monitoring current AP signal quality and number of
1194          * missed beacons. Scan other channels every now and then and search
1195          * for better APs. */
1196         /* TODO: remove expired BSSes */
1197
1198         ifsta->state = IEEE80211_STA_MLME_ASSOCIATED;
1199
1200         rcu_read_lock();
1201
1202         sta = sta_info_get(local, ifsta->bssid);
1203         if (!sta) {
1204                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
1205                        sdata->dev->name, print_mac(mac, ifsta->bssid));
1206                 disassoc = 1;
1207         } else {
1208                 disassoc = 0;
1209                 if (time_after(jiffies,
1210                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
1211                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
1212                                 printk(KERN_DEBUG "%s: No ProbeResp from "
1213                                        "current AP %s - assume out of "
1214                                        "range\n",
1215                                        sdata->dev->name, print_mac(mac, ifsta->bssid));
1216                                 disassoc = 1;
1217                         } else
1218                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
1219                                                          local->scan_ssid,
1220                                                          local->scan_ssid_len);
1221                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
1222                 } else {
1223                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
1224                         if (time_after(jiffies, ifsta->last_probe +
1225                                        IEEE80211_PROBE_INTERVAL)) {
1226                                 ifsta->last_probe = jiffies;
1227                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
1228                                                          ifsta->ssid,
1229                                                          ifsta->ssid_len);
1230                         }
1231                 }
1232         }
1233
1234         rcu_read_unlock();
1235
1236         if (disassoc)
1237                 ieee80211_set_disassoc(sdata, ifsta, true, true,
1238                                         WLAN_REASON_PREV_AUTH_NOT_VALID);
1239         else
1240                 mod_timer(&ifsta->timer, jiffies +
1241                                       IEEE80211_MONITORING_INTERVAL);
1242 }
1243
1244
1245 static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
1246                                      struct ieee80211_if_sta *ifsta)
1247 {
1248         printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
1249         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
1250         ieee80211_associate(sdata, ifsta);
1251 }
1252
1253
1254 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
1255                                      struct ieee80211_if_sta *ifsta,
1256                                      struct ieee80211_mgmt *mgmt,
1257                                      size_t len)
1258 {
1259         u8 *pos;
1260         struct ieee802_11_elems elems;
1261
1262         pos = mgmt->u.auth.variable;
1263         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1264         if (!elems.challenge)
1265                 return;
1266         ieee80211_send_auth(sdata, ifsta, 3, elems.challenge - 2,
1267                             elems.challenge_len + 2, 1);
1268 }
1269
1270 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
1271                                         u8 dialog_token, u16 status, u16 policy,
1272                                         u16 buf_size, u16 timeout)
1273 {
1274         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1275         struct ieee80211_local *local = sdata->local;
1276         struct sk_buff *skb;
1277         struct ieee80211_mgmt *mgmt;
1278         u16 capab;
1279
1280         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1281
1282         if (!skb) {
1283                 printk(KERN_DEBUG "%s: failed to allocate buffer "
1284                        "for addba resp frame\n", sdata->dev->name);
1285                 return;
1286         }
1287
1288         skb_reserve(skb, local->hw.extra_tx_headroom);
1289         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1290         memset(mgmt, 0, 24);
1291         memcpy(mgmt->da, da, ETH_ALEN);
1292         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1293         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1294                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
1295         else
1296                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1297         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1298                                           IEEE80211_STYPE_ACTION);
1299
1300         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
1301         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1302         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
1303         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
1304
1305         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
1306         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1307         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
1308
1309         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
1310         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
1311         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
1312
1313         ieee80211_sta_tx(sdata, skb, 0);
1314
1315         return;
1316 }
1317
1318 void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata, const u8 *da,
1319                                 u16 tid, u8 dialog_token, u16 start_seq_num,
1320                                 u16 agg_size, u16 timeout)
1321 {
1322         struct ieee80211_local *local = sdata->local;
1323         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1324         struct sk_buff *skb;
1325         struct ieee80211_mgmt *mgmt;
1326         u16 capab;
1327
1328         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1329
1330         if (!skb) {
1331                 printk(KERN_ERR "%s: failed to allocate buffer "
1332                                 "for addba request frame\n", sdata->dev->name);
1333                 return;
1334         }
1335         skb_reserve(skb, local->hw.extra_tx_headroom);
1336         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1337         memset(mgmt, 0, 24);
1338         memcpy(mgmt->da, da, ETH_ALEN);
1339         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1340         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1341                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
1342         else
1343                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1344
1345         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1346                                           IEEE80211_STYPE_ACTION);
1347
1348         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
1349
1350         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1351         mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
1352
1353         mgmt->u.action.u.addba_req.dialog_token = dialog_token;
1354         capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
1355         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1356         capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
1357
1358         mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
1359
1360         mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
1361         mgmt->u.action.u.addba_req.start_seq_num =
1362                                         cpu_to_le16(start_seq_num << 4);
1363
1364         ieee80211_sta_tx(sdata, skb, 0);
1365 }
1366
1367 /*
1368  * After accepting the AddBA Request we activated a timer,
1369  * resetting it after each frame that arrives from the originator.
1370  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
1371  */
1372 static void sta_rx_agg_session_timer_expired(unsigned long data)
1373 {
1374         /* not an elegant detour, but there is no choice as the timer passes
1375          * only one argument, and various sta_info are needed here, so init
1376          * flow in sta_info_create gives the TID as data, while the timer_to_id
1377          * array gives the sta through container_of */
1378         u8 *ptid = (u8 *)data;
1379         u8 *timer_to_id = ptid - *ptid;
1380         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
1381                                          timer_to_tid[0]);
1382
1383 #ifdef CONFIG_MAC80211_HT_DEBUG
1384         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
1385 #endif
1386         ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->addr,
1387                                          (u16)*ptid, WLAN_BACK_TIMER,
1388                                          WLAN_REASON_QSTA_TIMEOUT);
1389 }
1390
1391 static void ieee80211_sta_process_addba_request(struct ieee80211_local *local,
1392                                                 struct ieee80211_mgmt *mgmt,
1393                                                 size_t len)
1394 {
1395         struct ieee80211_hw *hw = &local->hw;
1396         struct ieee80211_conf *conf = &hw->conf;
1397         struct sta_info *sta;
1398         struct tid_ampdu_rx *tid_agg_rx;
1399         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
1400         u8 dialog_token;
1401         int ret = -EOPNOTSUPP;
1402         DECLARE_MAC_BUF(mac);
1403
1404         rcu_read_lock();
1405
1406         sta = sta_info_get(local, mgmt->sa);
1407         if (!sta) {
1408                 rcu_read_unlock();
1409                 return;
1410         }
1411
1412         /* extract session parameters from addba request frame */
1413         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
1414         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
1415         start_seq_num =
1416                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
1417
1418         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1419         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
1420         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1421         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
1422
1423         status = WLAN_STATUS_REQUEST_DECLINED;
1424
1425         /* sanity check for incoming parameters:
1426          * check if configuration can support the BA policy
1427          * and if buffer size does not exceeds max value */
1428         if (((ba_policy != 1)
1429                 && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
1430                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
1431                 status = WLAN_STATUS_INVALID_QOS_PARAM;
1432 #ifdef CONFIG_MAC80211_HT_DEBUG
1433                 if (net_ratelimit())
1434                         printk(KERN_DEBUG "AddBA Req with bad params from "
1435                                 "%s on tid %u. policy %d, buffer size %d\n",
1436                                 print_mac(mac, mgmt->sa), tid, ba_policy,
1437                                 buf_size);
1438 #endif /* CONFIG_MAC80211_HT_DEBUG */
1439                 goto end_no_lock;
1440         }
1441         /* determine default buffer size */
1442         if (buf_size == 0) {
1443                 struct ieee80211_supported_band *sband;
1444
1445                 sband = local->hw.wiphy->bands[conf->channel->band];
1446                 buf_size = IEEE80211_MIN_AMPDU_BUF;
1447                 buf_size = buf_size << sband->ht_info.ampdu_factor;
1448         }
1449
1450
1451         /* examine state machine */
1452         spin_lock_bh(&sta->lock);
1453
1454         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
1455 #ifdef CONFIG_MAC80211_HT_DEBUG
1456                 if (net_ratelimit())
1457                         printk(KERN_DEBUG "unexpected AddBA Req from "
1458                                 "%s on tid %u\n",
1459                                 print_mac(mac, mgmt->sa), tid);
1460 #endif /* CONFIG_MAC80211_HT_DEBUG */
1461                 goto end;
1462         }
1463
1464         /* prepare A-MPDU MLME for Rx aggregation */
1465         sta->ampdu_mlme.tid_rx[tid] =
1466                         kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
1467         if (!sta->ampdu_mlme.tid_rx[tid]) {
1468 #ifdef CONFIG_MAC80211_HT_DEBUG
1469                 if (net_ratelimit())
1470                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
1471                                         tid);
1472 #endif
1473                 goto end;
1474         }
1475         /* rx timer */
1476         sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
1477                                 sta_rx_agg_session_timer_expired;
1478         sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
1479                                 (unsigned long)&sta->timer_to_tid[tid];
1480         init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
1481
1482         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
1483
1484         /* prepare reordering buffer */
1485         tid_agg_rx->reorder_buf =
1486                 kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
1487         if (!tid_agg_rx->reorder_buf) {
1488 #ifdef CONFIG_MAC80211_HT_DEBUG
1489                 if (net_ratelimit())
1490                         printk(KERN_ERR "can not allocate reordering buffer "
1491                                "to tid %d\n", tid);
1492 #endif
1493                 kfree(sta->ampdu_mlme.tid_rx[tid]);
1494                 goto end;
1495         }
1496         memset(tid_agg_rx->reorder_buf, 0,
1497                 buf_size * sizeof(struct sk_buff *));
1498
1499         if (local->ops->ampdu_action)
1500                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
1501                                                sta->addr, tid, &start_seq_num);
1502 #ifdef CONFIG_MAC80211_HT_DEBUG
1503         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
1504 #endif /* CONFIG_MAC80211_HT_DEBUG */
1505
1506         if (ret) {
1507                 kfree(tid_agg_rx->reorder_buf);
1508                 kfree(tid_agg_rx);
1509                 sta->ampdu_mlme.tid_rx[tid] = NULL;
1510                 goto end;
1511         }
1512
1513         /* change state and send addba resp */
1514         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
1515         tid_agg_rx->dialog_token = dialog_token;
1516         tid_agg_rx->ssn = start_seq_num;
1517         tid_agg_rx->head_seq_num = start_seq_num;
1518         tid_agg_rx->buf_size = buf_size;
1519         tid_agg_rx->timeout = timeout;
1520         tid_agg_rx->stored_mpdu_num = 0;
1521         status = WLAN_STATUS_SUCCESS;
1522 end:
1523         spin_unlock_bh(&sta->lock);
1524
1525 end_no_lock:
1526         ieee80211_send_addba_resp(sta->sdata, sta->addr, tid,
1527                                   dialog_token, status, 1, buf_size, timeout);
1528         rcu_read_unlock();
1529 }
1530
1531 static void ieee80211_sta_process_addba_resp(struct ieee80211_local *local,
1532                                              struct ieee80211_mgmt *mgmt,
1533                                              size_t len)
1534 {
1535         struct ieee80211_hw *hw = &local->hw;
1536         struct sta_info *sta;
1537         u16 capab;
1538         u16 tid;
1539         u8 *state;
1540
1541         rcu_read_lock();
1542
1543         sta = sta_info_get(local, mgmt->sa);
1544         if (!sta) {
1545                 rcu_read_unlock();
1546                 return;
1547         }
1548
1549         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
1550         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1551
1552         state = &sta->ampdu_mlme.tid_state_tx[tid];
1553
1554         spin_lock_bh(&sta->lock);
1555
1556         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1557                 spin_unlock_bh(&sta->lock);
1558                 goto addba_resp_exit;
1559         }
1560
1561         if (mgmt->u.action.u.addba_resp.dialog_token !=
1562                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
1563                 spin_unlock_bh(&sta->lock);
1564 #ifdef CONFIG_MAC80211_HT_DEBUG
1565                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
1566 #endif /* CONFIG_MAC80211_HT_DEBUG */
1567                 goto addba_resp_exit;
1568         }
1569
1570         del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
1571 #ifdef CONFIG_MAC80211_HT_DEBUG
1572         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
1573 #endif /* CONFIG_MAC80211_HT_DEBUG */
1574         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
1575                         == WLAN_STATUS_SUCCESS) {
1576                 *state |= HT_ADDBA_RECEIVED_MSK;
1577                 sta->ampdu_mlme.addba_req_num[tid] = 0;
1578
1579                 if (*state == HT_AGG_STATE_OPERATIONAL)
1580                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
1581
1582                 spin_unlock_bh(&sta->lock);
1583         } else {
1584                 sta->ampdu_mlme.addba_req_num[tid]++;
1585                 /* this will allow the state check in stop_BA_session */
1586                 *state = HT_AGG_STATE_OPERATIONAL;
1587                 spin_unlock_bh(&sta->lock);
1588                 ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
1589                                              WLAN_BACK_INITIATOR);
1590         }
1591
1592 addba_resp_exit:
1593         rcu_read_unlock();
1594 }
1595
1596 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata, const u8 *da, u16 tid,
1597                           u16 initiator, u16 reason_code)
1598 {
1599         struct ieee80211_local *local = sdata->local;
1600         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1601         struct sk_buff *skb;
1602         struct ieee80211_mgmt *mgmt;
1603         u16 params;
1604
1605         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1606
1607         if (!skb) {
1608                 printk(KERN_ERR "%s: failed to allocate buffer "
1609                                         "for delba frame\n", sdata->dev->name);
1610                 return;
1611         }
1612
1613         skb_reserve(skb, local->hw.extra_tx_headroom);
1614         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1615         memset(mgmt, 0, 24);
1616         memcpy(mgmt->da, da, ETH_ALEN);
1617         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1618         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1619                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
1620         else
1621                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1622         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1623                                           IEEE80211_STYPE_ACTION);
1624
1625         skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
1626
1627         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1628         mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
1629         params = (u16)(initiator << 11);        /* bit 11 initiator */
1630         params |= (u16)(tid << 12);             /* bit 15:12 TID number */
1631
1632         mgmt->u.action.u.delba.params = cpu_to_le16(params);
1633         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
1634
1635         ieee80211_sta_tx(sdata, skb, 0);
1636 }
1637
1638 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
1639 {
1640         struct ieee80211_local *local = sdata->local;
1641         struct sk_buff *skb;
1642         struct ieee80211_bar *bar;
1643         u16 bar_control = 0;
1644
1645         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
1646         if (!skb) {
1647                 printk(KERN_ERR "%s: failed to allocate buffer for "
1648                         "bar frame\n", sdata->dev->name);
1649                 return;
1650         }
1651         skb_reserve(skb, local->hw.extra_tx_headroom);
1652         bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
1653         memset(bar, 0, sizeof(*bar));
1654         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1655                                          IEEE80211_STYPE_BACK_REQ);
1656         memcpy(bar->ra, ra, ETH_ALEN);
1657         memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
1658         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
1659         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
1660         bar_control |= (u16)(tid << 12);
1661         bar->control = cpu_to_le16(bar_control);
1662         bar->start_seq_num = cpu_to_le16(ssn);
1663
1664         ieee80211_sta_tx(sdata, skb, 0);
1665 }
1666
1667 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
1668                                         u16 initiator, u16 reason)
1669 {
1670         struct ieee80211_local *local = sdata->local;
1671         struct ieee80211_hw *hw = &local->hw;
1672         struct sta_info *sta;
1673         int ret, i;
1674         DECLARE_MAC_BUF(mac);
1675
1676         rcu_read_lock();
1677
1678         sta = sta_info_get(local, ra);
1679         if (!sta) {
1680                 rcu_read_unlock();
1681                 return;
1682         }
1683
1684         /* check if TID is in operational state */
1685         spin_lock_bh(&sta->lock);
1686         if (sta->ampdu_mlme.tid_state_rx[tid]
1687                                 != HT_AGG_STATE_OPERATIONAL) {
1688                 spin_unlock_bh(&sta->lock);
1689                 rcu_read_unlock();
1690                 return;
1691         }
1692         sta->ampdu_mlme.tid_state_rx[tid] =
1693                 HT_AGG_STATE_REQ_STOP_BA_MSK |
1694                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
1695         spin_unlock_bh(&sta->lock);
1696
1697         /* stop HW Rx aggregation. ampdu_action existence
1698          * already verified in session init so we add the BUG_ON */
1699         BUG_ON(!local->ops->ampdu_action);
1700
1701 #ifdef CONFIG_MAC80211_HT_DEBUG
1702         printk(KERN_DEBUG "Rx BA session stop requested for %s tid %u\n",
1703                                 print_mac(mac, ra), tid);
1704 #endif /* CONFIG_MAC80211_HT_DEBUG */
1705
1706         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
1707                                         ra, tid, NULL);
1708         if (ret)
1709                 printk(KERN_DEBUG "HW problem - can not stop rx "
1710                                 "aggregation for tid %d\n", tid);
1711
1712         /* shutdown timer has not expired */
1713         if (initiator != WLAN_BACK_TIMER)
1714                 del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
1715
1716         /* check if this is a self generated aggregation halt */
1717         if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
1718                 ieee80211_send_delba(sdata, ra, tid, 0, reason);
1719
1720         /* free the reordering buffer */
1721         for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
1722                 if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
1723                         /* release the reordered frames */
1724                         dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
1725                         sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
1726                         sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
1727                 }
1728         }
1729         /* free resources */
1730         kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
1731         kfree(sta->ampdu_mlme.tid_rx[tid]);
1732         sta->ampdu_mlme.tid_rx[tid] = NULL;
1733         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
1734
1735         rcu_read_unlock();
1736 }
1737
1738
1739 static void ieee80211_sta_process_delba(struct ieee80211_sub_if_data *sdata,
1740                         struct ieee80211_mgmt *mgmt, size_t len)
1741 {
1742         struct ieee80211_local *local = sdata->local;
1743         struct sta_info *sta;
1744         u16 tid, params;
1745         u16 initiator;
1746         DECLARE_MAC_BUF(mac);
1747
1748         rcu_read_lock();
1749
1750         sta = sta_info_get(local, mgmt->sa);
1751         if (!sta) {
1752                 rcu_read_unlock();
1753                 return;
1754         }
1755
1756         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1757         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1758         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1759
1760 #ifdef CONFIG_MAC80211_HT_DEBUG
1761         if (net_ratelimit())
1762                 printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
1763                         print_mac(mac, mgmt->sa),
1764                         initiator ? "initiator" : "recipient", tid,
1765                         mgmt->u.action.u.delba.reason_code);
1766 #endif /* CONFIG_MAC80211_HT_DEBUG */
1767
1768         if (initiator == WLAN_BACK_INITIATOR)
1769                 ieee80211_sta_stop_rx_ba_session(sdata, sta->addr, tid,
1770                                                  WLAN_BACK_INITIATOR, 0);
1771         else { /* WLAN_BACK_RECIPIENT */
1772                 spin_lock_bh(&sta->lock);
1773                 sta->ampdu_mlme.tid_state_tx[tid] =
1774                                 HT_AGG_STATE_OPERATIONAL;
1775                 spin_unlock_bh(&sta->lock);
1776                 ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
1777                                              WLAN_BACK_RECIPIENT);
1778         }
1779         rcu_read_unlock();
1780 }
1781
1782 /*
1783  * After sending add Block Ack request we activated a timer until
1784  * add Block Ack response will arrive from the recipient.
1785  * If this timer expires sta_addba_resp_timer_expired will be executed.
1786  */
1787 void sta_addba_resp_timer_expired(unsigned long data)
1788 {
1789         /* not an elegant detour, but there is no choice as the timer passes
1790          * only one argument, and both sta_info and TID are needed, so init
1791          * flow in sta_info_create gives the TID as data, while the timer_to_id
1792          * array gives the sta through container_of */
1793         u16 tid = *(u8 *)data;
1794         struct sta_info *temp_sta = container_of((void *)data,
1795                 struct sta_info, timer_to_tid[tid]);
1796
1797         struct ieee80211_local *local = temp_sta->local;
1798         struct ieee80211_hw *hw = &local->hw;
1799         struct sta_info *sta;
1800         u8 *state;
1801
1802         rcu_read_lock();
1803
1804         sta = sta_info_get(local, temp_sta->addr);
1805         if (!sta) {
1806                 rcu_read_unlock();
1807                 return;
1808         }
1809
1810         state = &sta->ampdu_mlme.tid_state_tx[tid];
1811         /* check if the TID waits for addBA response */
1812         spin_lock_bh(&sta->lock);
1813         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1814                 spin_unlock_bh(&sta->lock);
1815                 *state = HT_AGG_STATE_IDLE;
1816 #ifdef CONFIG_MAC80211_HT_DEBUG
1817                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
1818                                 "expecting addBA response there", tid);
1819 #endif
1820                 goto timer_expired_exit;
1821         }
1822
1823 #ifdef CONFIG_MAC80211_HT_DEBUG
1824         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
1825 #endif
1826
1827         /* go through the state check in stop_BA_session */
1828         *state = HT_AGG_STATE_OPERATIONAL;
1829         spin_unlock_bh(&sta->lock);
1830         ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
1831                                      WLAN_BACK_INITIATOR);
1832
1833 timer_expired_exit:
1834         rcu_read_unlock();
1835 }
1836
1837 void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr)
1838 {
1839         struct ieee80211_local *local = sdata->local;
1840         int i;
1841
1842         for (i = 0; i <  STA_TID_NUM; i++) {
1843                 ieee80211_stop_tx_ba_session(&local->hw, addr, i,
1844                                              WLAN_BACK_INITIATOR);
1845                 ieee80211_sta_stop_rx_ba_session(sdata, addr, i,
1846                                                  WLAN_BACK_RECIPIENT,
1847                                                  WLAN_REASON_QSTA_LEAVE_QBSS);
1848         }
1849 }
1850
1851 static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_data *sdata,
1852                                         struct ieee80211_msrment_ie *request_ie,
1853                                         const u8 *da, const u8 *bssid,
1854                                         u8 dialog_token)
1855 {
1856         struct ieee80211_local *local = sdata->local;
1857         struct sk_buff *skb;
1858         struct ieee80211_mgmt *msr_report;
1859
1860         skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
1861                                 sizeof(struct ieee80211_msrment_ie));
1862
1863         if (!skb) {
1864                 printk(KERN_ERR "%s: failed to allocate buffer for "
1865                                 "measurement report frame\n", sdata->dev->name);
1866                 return;
1867         }
1868
1869         skb_reserve(skb, local->hw.extra_tx_headroom);
1870         msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
1871         memset(msr_report, 0, 24);
1872         memcpy(msr_report->da, da, ETH_ALEN);
1873         memcpy(msr_report->sa, sdata->dev->dev_addr, ETH_ALEN);
1874         memcpy(msr_report->bssid, bssid, ETH_ALEN);
1875         msr_report->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1876                                                 IEEE80211_STYPE_ACTION);
1877
1878         skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
1879         msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
1880         msr_report->u.action.u.measurement.action_code =
1881                                 WLAN_ACTION_SPCT_MSR_RPRT;
1882         msr_report->u.action.u.measurement.dialog_token = dialog_token;
1883
1884         msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
1885         msr_report->u.action.u.measurement.length =
1886                         sizeof(struct ieee80211_msrment_ie);
1887
1888         memset(&msr_report->u.action.u.measurement.msr_elem, 0,
1889                 sizeof(struct ieee80211_msrment_ie));
1890         msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
1891         msr_report->u.action.u.measurement.msr_elem.mode |=
1892                         IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
1893         msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
1894
1895         ieee80211_sta_tx(sdata, skb, 0);
1896 }
1897
1898 static void ieee80211_sta_process_measurement_req(struct ieee80211_sub_if_data *sdata,
1899                                                 struct ieee80211_mgmt *mgmt,
1900                                                 size_t len)
1901 {
1902         /*
1903          * Ignoring measurement request is spec violation.
1904          * Mandatory measurements must be reported optional
1905          * measurements might be refused or reported incapable
1906          * For now just refuse
1907          * TODO: Answer basic measurement as unmeasured
1908          */
1909         ieee80211_send_refuse_measurement_request(sdata,
1910                         &mgmt->u.action.u.measurement.msr_elem,
1911                         mgmt->sa, mgmt->bssid,
1912                         mgmt->u.action.u.measurement.dialog_token);
1913 }
1914
1915
1916 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
1917                                    struct ieee80211_if_sta *ifsta,
1918                                    struct ieee80211_mgmt *mgmt,
1919                                    size_t len)
1920 {
1921         u16 auth_alg, auth_transaction, status_code;
1922         DECLARE_MAC_BUF(mac);
1923
1924         if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
1925             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
1926                 return;
1927
1928         if (len < 24 + 6)
1929                 return;
1930
1931         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1932             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
1933                 return;
1934
1935         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1936             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1937                 return;
1938
1939         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1940         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1941         status_code = le16_to_cpu(mgmt->u.auth.status_code);
1942
1943         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
1944                 /*
1945                  * IEEE 802.11 standard does not require authentication in IBSS
1946                  * networks and most implementations do not seem to use it.
1947                  * However, try to reply to authentication attempts if someone
1948                  * has actually implemented this.
1949                  */
1950                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
1951                         return;
1952                 ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
1953         }
1954
1955         if (auth_alg != ifsta->auth_alg ||
1956             auth_transaction != ifsta->auth_transaction)
1957                 return;
1958
1959         if (status_code != WLAN_STATUS_SUCCESS) {
1960                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1961                         u8 algs[3];
1962                         const int num_algs = ARRAY_SIZE(algs);
1963                         int i, pos;
1964                         algs[0] = algs[1] = algs[2] = 0xff;
1965                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1966                                 algs[0] = WLAN_AUTH_OPEN;
1967                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1968                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1969                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1970                                 algs[2] = WLAN_AUTH_LEAP;
1971                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1972                                 pos = 0;
1973                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1974                                 pos = 1;
1975                         else
1976                                 pos = 2;
1977                         for (i = 0; i < num_algs; i++) {
1978                                 pos++;
1979                                 if (pos >= num_algs)
1980                                         pos = 0;
1981                                 if (algs[pos] == ifsta->auth_alg ||
1982                                     algs[pos] == 0xff)
1983                                         continue;
1984                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1985                                     !ieee80211_sta_wep_configured(sdata))
1986                                         continue;
1987                                 ifsta->auth_alg = algs[pos];
1988                                 break;
1989                         }
1990                 }
1991                 return;
1992         }
1993
1994         switch (ifsta->auth_alg) {
1995         case WLAN_AUTH_OPEN:
1996         case WLAN_AUTH_LEAP:
1997                 ieee80211_auth_completed(sdata, ifsta);
1998                 break;
1999         case WLAN_AUTH_SHARED_KEY:
2000                 if (ifsta->auth_transaction == 4)
2001                         ieee80211_auth_completed(sdata, ifsta);
2002                 else
2003                         ieee80211_auth_challenge(sdata, ifsta, mgmt, len);
2004                 break;
2005         }
2006 }
2007
2008
2009 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2010                                      struct ieee80211_if_sta *ifsta,
2011                                      struct ieee80211_mgmt *mgmt,
2012                                      size_t len)
2013 {
2014         u16 reason_code;
2015         DECLARE_MAC_BUF(mac);
2016
2017         if (len < 24 + 2)
2018                 return;
2019
2020         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
2021                 return;
2022
2023         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2024
2025         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
2026                 printk(KERN_DEBUG "%s: deauthenticated\n", sdata->dev->name);
2027
2028         if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
2029             ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
2030             ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
2031                 ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
2032                 mod_timer(&ifsta->timer, jiffies +
2033                                       IEEE80211_RETRY_AUTH_INTERVAL);
2034         }
2035
2036         ieee80211_set_disassoc(sdata, ifsta, true, false, 0);
2037         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
2038 }
2039
2040
2041 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2042                                        struct ieee80211_if_sta *ifsta,
2043                                        struct ieee80211_mgmt *mgmt,
2044                                        size_t len)
2045 {
2046         u16 reason_code;
2047         DECLARE_MAC_BUF(mac);
2048
2049         if (len < 24 + 2)
2050                 return;
2051
2052         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
2053                 return;
2054
2055         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2056
2057         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
2058                 printk(KERN_DEBUG "%s: disassociated\n", sdata->dev->name);
2059
2060         if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
2061                 ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
2062                 mod_timer(&ifsta->timer, jiffies +
2063                                       IEEE80211_RETRY_AUTH_INTERVAL);
2064         }
2065
2066         ieee80211_set_disassoc(sdata, ifsta, false, false, 0);
2067 }
2068
2069
2070 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2071                                          struct ieee80211_if_sta *ifsta,
2072                                          struct ieee80211_mgmt *mgmt,
2073                                          size_t len,
2074                                          int reassoc)
2075 {
2076         struct ieee80211_local *local = sdata->local;
2077         struct ieee80211_supported_band *sband;
2078         struct sta_info *sta;
2079         u64 rates, basic_rates;
2080         u16 capab_info, status_code, aid;
2081         struct ieee802_11_elems elems;
2082         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
2083         u8 *pos;
2084         int i, j;
2085         DECLARE_MAC_BUF(mac);
2086         bool have_higher_than_11mbit = false;
2087
2088         /* AssocResp and ReassocResp have identical structure, so process both
2089          * of them in this function. */
2090
2091         if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATE)
2092                 return;
2093
2094         if (len < 24 + 6)
2095                 return;
2096
2097         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
2098                 return;
2099
2100         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2101         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2102         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2103
2104         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
2105                "status=%d aid=%d)\n",
2106                sdata->dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
2107                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
2108
2109         if (status_code != WLAN_STATUS_SUCCESS) {
2110                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
2111                        sdata->dev->name, status_code);
2112                 /* if this was a reassociation, ensure we try a "full"
2113                  * association next time. This works around some broken APs
2114                  * which do not correctly reject reassociation requests. */
2115                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
2116                 return;
2117         }
2118
2119         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2120                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
2121                        "set\n", sdata->dev->name, aid);
2122         aid &= ~(BIT(15) | BIT(14));
2123
2124         pos = mgmt->u.assoc_resp.variable;
2125         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
2126
2127         if (!elems.supp_rates) {
2128                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
2129                        sdata->dev->name);
2130                 return;
2131         }
2132
2133         printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
2134         ifsta->aid = aid;
2135         ifsta->ap_capab = capab_info;
2136
2137         kfree(ifsta->assocresp_ies);
2138         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
2139         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
2140         if (ifsta->assocresp_ies)
2141                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
2142
2143         rcu_read_lock();
2144
2145         /* Add STA entry for the AP */
2146         sta = sta_info_get(local, ifsta->bssid);
2147         if (!sta) {
2148                 struct ieee80211_sta_bss *bss;
2149                 int err;
2150
2151                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
2152                 if (!sta) {
2153                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
2154                                " the AP\n", sdata->dev->name);
2155                         rcu_read_unlock();
2156                         return;
2157                 }
2158                 bss = ieee80211_rx_bss_get(local, ifsta->bssid,
2159                                            local->hw.conf.channel->center_freq,
2160                                            ifsta->ssid, ifsta->ssid_len);
2161                 if (bss) {
2162                         sta->last_signal = bss->signal;
2163                         sta->last_qual = bss->qual;
2164                         sta->last_noise = bss->noise;
2165                         ieee80211_rx_bss_put(local, bss);
2166                 }
2167
2168                 err = sta_info_insert(sta);
2169                 if (err) {
2170                         printk(KERN_DEBUG "%s: failed to insert STA entry for"
2171                                " the AP (error %d)\n", sdata->dev->name, err);
2172                         rcu_read_unlock();
2173                         return;
2174                 }
2175                 /* update new sta with its last rx activity */
2176                 sta->last_rx = jiffies;
2177         }
2178
2179         /*
2180          * FIXME: Do we really need to update the sta_info's information here?
2181          *        We already know about the AP (we found it in our list) so it
2182          *        should already be filled with the right info, no?
2183          *        As is stands, all this is racy because typically we assume
2184          *        the information that is filled in here (except flags) doesn't
2185          *        change while a STA structure is alive. As such, it should move
2186          *        to between the sta_info_alloc() and sta_info_insert() above.
2187          */
2188
2189         set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
2190                            WLAN_STA_AUTHORIZED);
2191
2192         rates = 0;
2193         basic_rates = 0;
2194         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2195
2196         for (i = 0; i < elems.supp_rates_len; i++) {
2197                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
2198
2199                 if (rate > 110)
2200                         have_higher_than_11mbit = true;
2201
2202                 for (j = 0; j < sband->n_bitrates; j++) {
2203                         if (sband->bitrates[j].bitrate == rate)
2204                                 rates |= BIT(j);
2205                         if (elems.supp_rates[i] & 0x80)
2206                                 basic_rates |= BIT(j);
2207                 }
2208         }
2209
2210         for (i = 0; i < elems.ext_supp_rates_len; i++) {
2211                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
2212
2213                 if (rate > 110)
2214                         have_higher_than_11mbit = true;
2215
2216                 for (j = 0; j < sband->n_bitrates; j++) {
2217                         if (sband->bitrates[j].bitrate == rate)
2218                                 rates |= BIT(j);
2219                         if (elems.ext_supp_rates[i] & 0x80)
2220                                 basic_rates |= BIT(j);
2221                 }
2222         }
2223
2224         sta->supp_rates[local->hw.conf.channel->band] = rates;
2225         sdata->basic_rates = basic_rates;
2226
2227         /* cf. IEEE 802.11 9.2.12 */
2228         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
2229             have_higher_than_11mbit)
2230                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
2231         else
2232                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
2233
2234         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
2235             (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
2236                 struct ieee80211_ht_bss_info bss_info;
2237                 ieee80211_ht_cap_ie_to_ht_info(
2238                                 (struct ieee80211_ht_cap *)
2239                                 elems.ht_cap_elem, &sta->ht_info);
2240                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2241                                 (struct ieee80211_ht_addt_info *)
2242                                 elems.ht_info_elem, &bss_info);
2243                 ieee80211_handle_ht(local, 1, &sta->ht_info, &bss_info);
2244         }
2245
2246         rate_control_rate_init(sta, local);
2247
2248         if (elems.wmm_param) {
2249                 set_sta_flags(sta, WLAN_STA_WME);
2250                 rcu_read_unlock();
2251                 ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
2252                                          elems.wmm_param_len);
2253         } else
2254                 rcu_read_unlock();
2255
2256         /* set AID and assoc capability,
2257          * ieee80211_set_associated() will tell the driver */
2258         bss_conf->aid = aid;
2259         bss_conf->assoc_capability = capab_info;
2260         ieee80211_set_associated(sdata, ifsta);
2261
2262         ieee80211_associated(sdata, ifsta);
2263 }
2264
2265
2266 static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
2267                                    struct ieee80211_if_sta *ifsta,
2268                                    struct ieee80211_sta_bss *bss)
2269 {
2270         struct ieee80211_local *local = sdata->local;
2271         int res, rates, i, j;
2272         struct sk_buff *skb;
2273         struct ieee80211_mgmt *mgmt;
2274         u8 *pos;
2275         struct ieee80211_supported_band *sband;
2276         union iwreq_data wrqu;
2277
2278         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2279
2280         /* Remove possible STA entries from other IBSS networks. */
2281         sta_info_flush_delayed(sdata);
2282
2283         if (local->ops->reset_tsf) {
2284                 /* Reset own TSF to allow time synchronization work. */
2285                 local->ops->reset_tsf(local_to_hw(local));
2286         }
2287         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2288         res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
2289         if (res)
2290                 return res;
2291
2292         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2293
2294         sdata->drop_unencrypted = bss->capability &
2295                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2296
2297         res = ieee80211_set_freq(sdata, bss->freq);
2298
2299         if (res)
2300                 return res;
2301
2302         /* Build IBSS probe response */
2303         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2304         if (skb) {
2305                 skb_reserve(skb, local->hw.extra_tx_headroom);
2306
2307                 mgmt = (struct ieee80211_mgmt *)
2308                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2309                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2310                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2311                                                   IEEE80211_STYPE_PROBE_RESP);
2312                 memset(mgmt->da, 0xff, ETH_ALEN);
2313                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
2314                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2315                 mgmt->u.beacon.beacon_int =
2316                         cpu_to_le16(local->hw.conf.beacon_int);
2317                 mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
2318                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2319
2320                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2321                 *pos++ = WLAN_EID_SSID;
2322                 *pos++ = ifsta->ssid_len;
2323                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2324
2325                 rates = bss->supp_rates_len;
2326                 if (rates > 8)
2327                         rates = 8;
2328                 pos = skb_put(skb, 2 + rates);
2329                 *pos++ = WLAN_EID_SUPP_RATES;
2330                 *pos++ = rates;
2331                 memcpy(pos, bss->supp_rates, rates);
2332
2333                 if (bss->band == IEEE80211_BAND_2GHZ) {
2334                         pos = skb_put(skb, 2 + 1);
2335                         *pos++ = WLAN_EID_DS_PARAMS;
2336                         *pos++ = 1;
2337                         *pos++ = ieee80211_frequency_to_channel(bss->freq);
2338                 }
2339
2340                 pos = skb_put(skb, 2 + 2);
2341                 *pos++ = WLAN_EID_IBSS_PARAMS;
2342                 *pos++ = 2;
2343                 /* FIX: set ATIM window based on scan results */
2344                 *pos++ = 0;
2345                 *pos++ = 0;
2346
2347                 if (bss->supp_rates_len > 8) {
2348                         rates = bss->supp_rates_len - 8;
2349                         pos = skb_put(skb, 2 + rates);
2350                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2351                         *pos++ = rates;
2352                         memcpy(pos, &bss->supp_rates[8], rates);
2353                 }
2354
2355                 ifsta->probe_resp = skb;
2356
2357                 ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
2358         }
2359
2360         rates = 0;
2361         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2362         for (i = 0; i < bss->supp_rates_len; i++) {
2363                 int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2364                 for (j = 0; j < sband->n_bitrates; j++)
2365                         if (sband->bitrates[j].bitrate == bitrate)
2366                                 rates |= BIT(j);
2367         }
2368         ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
2369
2370         ieee80211_sta_def_wmm_params(sdata, bss, 1);
2371
2372         ifsta->state = IEEE80211_STA_MLME_IBSS_JOINED;
2373         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2374
2375         memset(&wrqu, 0, sizeof(wrqu));
2376         memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
2377         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
2378
2379         return res;
2380 }
2381
2382 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
2383                             struct ieee802_11_elems *elems,
2384                             enum ieee80211_band band)
2385 {
2386         struct ieee80211_supported_band *sband;
2387         struct ieee80211_rate *bitrates;
2388         size_t num_rates;
2389         u64 supp_rates;
2390         int i, j;
2391         sband = local->hw.wiphy->bands[band];
2392
2393         if (!sband) {
2394                 WARN_ON(1);
2395                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2396         }
2397
2398         bitrates = sband->bitrates;
2399         num_rates = sband->n_bitrates;
2400         supp_rates = 0;
2401         for (i = 0; i < elems->supp_rates_len +
2402                      elems->ext_supp_rates_len; i++) {
2403                 u8 rate = 0;
2404                 int own_rate;
2405                 if (i < elems->supp_rates_len)
2406                         rate = elems->supp_rates[i];
2407                 else if (elems->ext_supp_rates)
2408                         rate = elems->ext_supp_rates
2409                                 [i - elems->supp_rates_len];
2410                 own_rate = 5 * (rate & 0x7f);
2411                 for (j = 0; j < num_rates; j++)
2412                         if (bitrates[j].bitrate == own_rate)
2413                                 supp_rates |= BIT(j);
2414         }
2415         return supp_rates;
2416 }
2417
2418 static u64 ieee80211_sta_get_mandatory_rates(struct ieee80211_local *local,
2419                                         enum ieee80211_band band)
2420 {
2421         struct ieee80211_supported_band *sband;
2422         struct ieee80211_rate *bitrates;
2423         u64 mandatory_rates;
2424         enum ieee80211_rate_flags mandatory_flag;
2425         int i;
2426
2427         sband = local->hw.wiphy->bands[band];
2428         if (!sband) {
2429                 WARN_ON(1);
2430                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2431         }
2432
2433         if (band == IEEE80211_BAND_2GHZ)
2434                 mandatory_flag = IEEE80211_RATE_MANDATORY_B;
2435         else
2436                 mandatory_flag = IEEE80211_RATE_MANDATORY_A;
2437
2438         bitrates = sband->bitrates;
2439         mandatory_rates = 0;
2440         for (i = 0; i < sband->n_bitrates; i++)
2441                 if (bitrates[i].flags & mandatory_flag)
2442                         mandatory_rates |= BIT(i);
2443         return mandatory_rates;
2444 }
2445
2446 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2447                                   struct ieee80211_mgmt *mgmt,
2448                                   size_t len,
2449                                   struct ieee80211_rx_status *rx_status,
2450                                   struct ieee802_11_elems *elems)
2451 {
2452         struct ieee80211_local *local = sdata->local;
2453         int freq, clen;
2454         struct ieee80211_sta_bss *bss;
2455         struct sta_info *sta;
2456         struct ieee80211_channel *channel;
2457         u64 beacon_timestamp, rx_timestamp;
2458         u64 supp_rates = 0;
2459         bool beacon = ieee80211_is_beacon(mgmt->frame_control);
2460         enum ieee80211_band band = rx_status->band;
2461         DECLARE_MAC_BUF(mac);
2462         DECLARE_MAC_BUF(mac2);
2463
2464         if (elems->ds_params && elems->ds_params_len == 1)
2465                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
2466         else
2467                 freq = rx_status->freq;
2468
2469         channel = ieee80211_get_channel(local->hw.wiphy, freq);
2470
2471         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
2472                 return;
2473
2474         if (ieee80211_vif_is_mesh(&sdata->vif) && elems->mesh_id &&
2475             elems->mesh_config && mesh_matches_local(elems, sdata)) {
2476                 supp_rates = ieee80211_sta_get_rates(local, elems, band);
2477
2478                 mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
2479                                       mesh_peer_accepts_plinks(elems));
2480         }
2481
2482         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems->supp_rates &&
2483             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2484                 supp_rates = ieee80211_sta_get_rates(local, elems, band);
2485
2486                 rcu_read_lock();
2487
2488                 sta = sta_info_get(local, mgmt->sa);
2489                 if (sta) {
2490                         u64 prev_rates;
2491
2492                         prev_rates = sta->supp_rates[band];
2493                         /* make sure mandatory rates are always added */
2494                         sta->supp_rates[band] = supp_rates |
2495                                 ieee80211_sta_get_mandatory_rates(local, band);
2496
2497 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2498                         if (sta->supp_rates[band] != prev_rates)
2499                                 printk(KERN_DEBUG "%s: updated supp_rates set "
2500                                     "for %s based on beacon info (0x%llx | "
2501                                     "0x%llx -> 0x%llx)\n",
2502                                     sdata->dev->name, print_mac(mac, sta->addr),
2503                                     (unsigned long long) prev_rates,
2504                                     (unsigned long long) supp_rates,
2505                                     (unsigned long long) sta->supp_rates[band]);
2506 #endif
2507                 } else {
2508                         ieee80211_ibss_add_sta(sdata, NULL, mgmt->bssid,
2509                                                mgmt->sa, supp_rates);
2510                 }
2511
2512                 rcu_read_unlock();
2513         }
2514
2515 #ifdef CONFIG_MAC80211_MESH
2516         if (elems->mesh_config)
2517                 bss = ieee80211_rx_mesh_bss_get(local, elems->mesh_id,
2518                                 elems->mesh_id_len, elems->mesh_config, freq);
2519         else
2520 #endif
2521                 bss = ieee80211_rx_bss_get(local, mgmt->bssid, freq,
2522                                            elems->ssid, elems->ssid_len);
2523         if (!bss) {
2524 #ifdef CONFIG_MAC80211_MESH
2525                 if (elems->mesh_config)
2526                         bss = ieee80211_rx_mesh_bss_add(local, elems->mesh_id,
2527                                 elems->mesh_id_len, elems->mesh_config,
2528                                 elems->mesh_config_len, freq);
2529                 else
2530 #endif
2531                         bss = ieee80211_rx_bss_add(sdata, mgmt->bssid, freq,
2532                                                   elems->ssid, elems->ssid_len);
2533                 if (!bss)
2534                         return;
2535         } else {
2536 #if 0
2537                 /* TODO: order by RSSI? */
2538                 spin_lock_bh(&local->sta_bss_lock);
2539                 list_move_tail(&bss->list, &local->sta_bss_list);
2540                 spin_unlock_bh(&local->sta_bss_lock);
2541 #endif
2542         }
2543
2544         /* save the ERP value so that it is available at association time */
2545         if (elems->erp_info && elems->erp_info_len >= 1) {
2546                 bss->erp_value = elems->erp_info[0];
2547                 bss->has_erp_value = 1;
2548         }
2549
2550         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
2551         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
2552
2553         if (elems->tim) {
2554                 struct ieee80211_tim_ie *tim_ie =
2555                         (struct ieee80211_tim_ie *)elems->tim;
2556                 bss->dtim_period = tim_ie->dtim_period;
2557         }
2558
2559         /* set default value for buggy APs */
2560         if (!elems->tim || bss->dtim_period == 0)
2561                 bss->dtim_period = 1;
2562
2563         bss->supp_rates_len = 0;
2564         if (elems->supp_rates) {
2565                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
2566                 if (clen > elems->supp_rates_len)
2567                         clen = elems->supp_rates_len;
2568                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
2569                        clen);
2570                 bss->supp_rates_len += clen;
2571         }
2572         if (elems->ext_supp_rates) {
2573                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
2574                 if (clen > elems->ext_supp_rates_len)
2575                         clen = elems->ext_supp_rates_len;
2576                 memcpy(&bss->supp_rates[bss->supp_rates_len],
2577                        elems->ext_supp_rates, clen);
2578                 bss->supp_rates_len += clen;
2579         }
2580
2581         bss->band = band;
2582
2583         beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
2584
2585         bss->timestamp = beacon_timestamp;
2586         bss->last_update = jiffies;
2587         bss->signal = rx_status->signal;
2588         bss->noise = rx_status->noise;
2589         bss->qual = rx_status->qual;
2590         if (!beacon)
2591                 bss->last_probe_resp = jiffies;
2592         /*
2593          * In STA mode, the remaining parameters should not be overridden
2594          * by beacons because they're not necessarily accurate there.
2595          */
2596         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
2597             bss->last_probe_resp && beacon) {
2598                 ieee80211_rx_bss_put(local, bss);
2599                 return;
2600         }
2601
2602         if (bss->ies == NULL || bss->ies_len < elems->total_len) {
2603                 kfree(bss->ies);
2604                 bss->ies = kmalloc(elems->total_len, GFP_ATOMIC);
2605         }
2606         if (bss->ies) {
2607                 memcpy(bss->ies, elems->ie_start, elems->total_len);
2608                 bss->ies_len = elems->total_len;
2609         } else
2610                 bss->ies_len = 0;
2611
2612         bss->wmm_used = elems->wmm_param || elems->wmm_info;
2613
2614         /* check if we need to merge IBSS */
2615         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
2616             !local->sta_sw_scanning && !local->sta_hw_scanning &&
2617             bss->capability & WLAN_CAPABILITY_IBSS &&
2618             bss->freq == local->oper_channel->center_freq &&
2619             elems->ssid_len == sdata->u.sta.ssid_len &&
2620             memcmp(elems->ssid, sdata->u.sta.ssid,
2621                                 sdata->u.sta.ssid_len) == 0) {
2622                 if (rx_status->flag & RX_FLAG_TSFT) {
2623                         /* in order for correct IBSS merging we need mactime
2624                          *
2625                          * since mactime is defined as the time the first data
2626                          * symbol of the frame hits the PHY, and the timestamp
2627                          * of the beacon is defined as "the time that the data
2628                          * symbol containing the first bit of the timestamp is
2629                          * transmitted to the PHY plus the transmitting STA’s
2630                          * delays through its local PHY from the MAC-PHY
2631                          * interface to its interface with the WM"
2632                          * (802.11 11.1.2) - equals the time this bit arrives at
2633                          * the receiver - we have to take into account the
2634                          * offset between the two.
2635                          * e.g: at 1 MBit that means mactime is 192 usec earlier
2636                          * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
2637                          */
2638                         int rate = local->hw.wiphy->bands[band]->
2639                                         bitrates[rx_status->rate_idx].bitrate;
2640                         rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
2641                 } else if (local && local->ops && local->ops->get_tsf)
2642                         /* second best option: get current TSF */
2643                         rx_timestamp = local->ops->get_tsf(local_to_hw(local));
2644                 else
2645                         /* can't merge without knowing the TSF */
2646                         rx_timestamp = -1LLU;
2647 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2648                 printk(KERN_DEBUG "RX beacon SA=%s BSSID="
2649                        "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
2650                        print_mac(mac, mgmt->sa),
2651                        print_mac(mac2, mgmt->bssid),
2652                        (unsigned long long)rx_timestamp,
2653                        (unsigned long long)beacon_timestamp,
2654                        (unsigned long long)(rx_timestamp - beacon_timestamp),
2655                        jiffies);
2656 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2657                 if (beacon_timestamp > rx_timestamp) {
2658 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2659                         printk(KERN_DEBUG "%s: beacon TSF higher than "
2660                                "local TSF - IBSS merge with BSSID %s\n",
2661                                sdata->dev->name, print_mac(mac, mgmt->bssid));
2662 #endif
2663                         ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
2664                         ieee80211_ibss_add_sta(sdata, NULL,
2665                                                mgmt->bssid, mgmt->sa,
2666                                                supp_rates);
2667                 }
2668         }
2669
2670         ieee80211_rx_bss_put(local, bss);
2671 }
2672
2673
2674 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2675                                          struct ieee80211_mgmt *mgmt,
2676                                          size_t len,
2677                                          struct ieee80211_rx_status *rx_status)
2678 {
2679         size_t baselen;
2680         struct ieee802_11_elems elems;
2681         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2682
2683         if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
2684                 return; /* ignore ProbeResp to foreign address */
2685
2686         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2687         if (baselen > len)
2688                 return;
2689
2690         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2691                                 &elems);
2692
2693         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2694
2695         /* direct probe may be part of the association flow */
2696         if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
2697                                                         &ifsta->request)) {
2698                 printk(KERN_DEBUG "%s direct probe responded\n",
2699                        sdata->dev->name);
2700                 ieee80211_authenticate(sdata, ifsta);
2701         }
2702 }
2703
2704
2705 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2706                                      struct ieee80211_mgmt *mgmt,
2707                                      size_t len,
2708                                      struct ieee80211_rx_status *rx_status)
2709 {
2710         struct ieee80211_if_sta *ifsta;
2711         size_t baselen;
2712         struct ieee802_11_elems elems;
2713         struct ieee80211_local *local = sdata->local;
2714         struct ieee80211_conf *conf = &local->hw.conf;
2715         u32 changed = 0;
2716
2717         /* Process beacon from the current BSS */
2718         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2719         if (baselen > len)
2720                 return;
2721
2722         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2723
2724         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2725
2726         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2727                 return;
2728         ifsta = &sdata->u.sta;
2729
2730         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
2731             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
2732                 return;
2733
2734         /* Do not send changes to driver if we are scanning. This removes
2735          * requirement that a driver's bss_info_changed/conf_tx functions
2736          * need to be atomic.
2737          * This is really ugly code, we should rewrite scanning and make
2738          * all this more understandable for humans.
2739          */
2740         if (local->sta_sw_scanning || local->sta_hw_scanning)
2741                 return;
2742
2743         ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
2744                                  elems.wmm_param_len);
2745
2746         if (elems.erp_info && elems.erp_info_len >= 1)
2747                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
2748         else {
2749                 u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
2750                 changed |= ieee80211_handle_protect_preamb(sdata, false,
2751                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
2752         }
2753
2754         if (elems.ht_cap_elem && elems.ht_info_elem &&
2755             elems.wmm_param && conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
2756                 struct ieee80211_ht_bss_info bss_info;
2757
2758                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2759                                 (struct ieee80211_ht_addt_info *)
2760                                 elems.ht_info_elem, &bss_info);
2761                 changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf,
2762                                                &bss_info);
2763         }
2764
2765         ieee80211_bss_info_change_notify(sdata, changed);
2766 }
2767
2768
2769 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
2770                                         struct ieee80211_if_sta *ifsta,
2771                                         struct ieee80211_mgmt *mgmt,
2772                                         size_t len,
2773                                         struct ieee80211_rx_status *rx_status)
2774 {
2775         struct ieee80211_local *local = sdata->local;
2776         int tx_last_beacon;
2777         struct sk_buff *skb;
2778         struct ieee80211_mgmt *resp;
2779         u8 *pos, *end;
2780         DECLARE_MAC_BUF(mac);
2781 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2782         DECLARE_MAC_BUF(mac2);
2783         DECLARE_MAC_BUF(mac3);
2784 #endif
2785
2786         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS ||
2787             ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
2788             len < 24 + 2 || !ifsta->probe_resp)
2789                 return;
2790
2791         if (local->ops->tx_last_beacon)
2792                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
2793         else
2794                 tx_last_beacon = 1;
2795
2796 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2797         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
2798                "%s (tx_last_beacon=%d)\n",
2799                sdata->dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
2800                print_mac(mac3, mgmt->bssid), tx_last_beacon);
2801 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2802
2803         if (!tx_last_beacon)
2804                 return;
2805
2806         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
2807             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2808                 return;
2809
2810         end = ((u8 *) mgmt) + len;
2811         pos = mgmt->u.probe_req.variable;
2812         if (pos[0] != WLAN_EID_SSID ||
2813             pos + 2 + pos[1] > end) {
2814 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2815                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
2816                        "from %s\n",
2817                        sdata->dev->name, print_mac(mac, mgmt->sa));
2818 #endif
2819                 return;
2820         }
2821         if (pos[1] != 0 &&
2822             (pos[1] != ifsta->ssid_len ||
2823              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
2824                 /* Ignore ProbeReq for foreign SSID */
2825                 return;
2826         }
2827
2828         /* Reply with ProbeResp */
2829         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
2830         if (!skb)
2831                 return;
2832
2833         resp = (struct ieee80211_mgmt *) skb->data;
2834         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2835 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2836         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
2837                sdata->dev->name, print_mac(mac, resp->da));
2838 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2839         ieee80211_sta_tx(sdata, skb, 0);
2840 }
2841
2842 static void ieee80211_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
2843                                      struct ieee80211_if_sta *ifsta,
2844                                      struct ieee80211_mgmt *mgmt,
2845                                      size_t len,
2846                                      struct ieee80211_rx_status *rx_status)
2847 {
2848         struct ieee80211_local *local = sdata->local;
2849
2850         /* all categories we currently handle have action_code */
2851         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2852                 return;
2853
2854         switch (mgmt->u.action.category) {
2855         case WLAN_CATEGORY_SPECTRUM_MGMT:
2856                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
2857                         break;
2858                 switch (mgmt->u.action.u.measurement.action_code) {
2859                 case WLAN_ACTION_SPCT_MSR_REQ:
2860                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2861                                    sizeof(mgmt->u.action.u.measurement)))
2862                                 break;
2863                         ieee80211_sta_process_measurement_req(sdata, mgmt, len);
2864                         break;
2865                 }
2866                 break;
2867         case WLAN_CATEGORY_BACK:
2868                 switch (mgmt->u.action.u.addba_req.action_code) {
2869                 case WLAN_ACTION_ADDBA_REQ:
2870                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2871                                    sizeof(mgmt->u.action.u.addba_req)))
2872                                 break;
2873                         ieee80211_sta_process_addba_request(local, mgmt, len);
2874                         break;
2875                 case WLAN_ACTION_ADDBA_RESP:
2876                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2877                                    sizeof(mgmt->u.action.u.addba_resp)))
2878                                 break;
2879                         ieee80211_sta_process_addba_resp(local, mgmt, len);
2880                         break;
2881                 case WLAN_ACTION_DELBA:
2882                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2883                                    sizeof(mgmt->u.action.u.delba)))
2884                                 break;
2885                         ieee80211_sta_process_delba(sdata, mgmt, len);
2886                         break;
2887                 }
2888                 break;
2889         case PLINK_CATEGORY:
2890                 if (ieee80211_vif_is_mesh(&sdata->vif))
2891                         mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
2892                 break;
2893         case MESH_PATH_SEL_CATEGORY:
2894                 if (ieee80211_vif_is_mesh(&sdata->vif))
2895                         mesh_rx_path_sel_frame(sdata, mgmt, len);
2896                 break;
2897         }
2898 }
2899
2900 void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
2901                            struct ieee80211_rx_status *rx_status)
2902 {
2903         struct ieee80211_local *local = sdata->local;
2904         struct ieee80211_if_sta *ifsta;
2905         struct ieee80211_mgmt *mgmt;
2906         u16 fc;
2907
2908         if (skb->len < 24)
2909                 goto fail;
2910
2911         ifsta = &sdata->u.sta;
2912
2913         mgmt = (struct ieee80211_mgmt *) skb->data;
2914         fc = le16_to_cpu(mgmt->frame_control);
2915
2916         switch (fc & IEEE80211_FCTL_STYPE) {
2917         case IEEE80211_STYPE_PROBE_REQ:
2918         case IEEE80211_STYPE_PROBE_RESP:
2919         case IEEE80211_STYPE_BEACON:
2920         case IEEE80211_STYPE_ACTION:
2921                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
2922         case IEEE80211_STYPE_AUTH:
2923         case IEEE80211_STYPE_ASSOC_RESP:
2924         case IEEE80211_STYPE_REASSOC_RESP:
2925         case IEEE80211_STYPE_DEAUTH:
2926         case IEEE80211_STYPE_DISASSOC:
2927                 skb_queue_tail(&ifsta->skb_queue, skb);
2928                 queue_work(local->hw.workqueue, &ifsta->work);
2929                 return;
2930         }
2931
2932  fail:
2933         kfree_skb(skb);
2934 }
2935
2936 static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
2937                                          struct sk_buff *skb)
2938 {
2939         struct ieee80211_rx_status *rx_status;
2940         struct ieee80211_if_sta *ifsta;
2941         struct ieee80211_mgmt *mgmt;
2942         u16 fc;
2943
2944         ifsta = &sdata->u.sta;
2945
2946         rx_status = (struct ieee80211_rx_status *) skb->cb;
2947         mgmt = (struct ieee80211_mgmt *) skb->data;
2948         fc = le16_to_cpu(mgmt->frame_control);
2949
2950         switch (fc & IEEE80211_FCTL_STYPE) {
2951         case IEEE80211_STYPE_PROBE_REQ:
2952                 ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt, skb->len,
2953                                             rx_status);
2954                 break;
2955         case IEEE80211_STYPE_PROBE_RESP:
2956                 ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len, rx_status);
2957                 break;
2958         case IEEE80211_STYPE_BEACON:
2959                 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
2960                 break;
2961         case IEEE80211_STYPE_AUTH:
2962                 ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
2963                 break;
2964         case IEEE80211_STYPE_ASSOC_RESP:
2965                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
2966                 break;
2967         case IEEE80211_STYPE_REASSOC_RESP:
2968                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
2969                 break;
2970         case IEEE80211_STYPE_DEAUTH:
2971                 ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
2972                 break;
2973         case IEEE80211_STYPE_DISASSOC:
2974                 ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt, skb->len);
2975                 break;
2976         case IEEE80211_STYPE_ACTION:
2977                 ieee80211_rx_mgmt_action(sdata, ifsta, mgmt, skb->len, rx_status);
2978                 break;
2979         }
2980
2981         kfree_skb(skb);
2982 }
2983
2984
2985 ieee80211_rx_result
2986 ieee80211_sta_rx_scan(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
2987                       struct ieee80211_rx_status *rx_status)
2988 {
2989         struct ieee80211_mgmt *mgmt;
2990         __le16 fc;
2991
2992         if (skb->len < 2)
2993                 return RX_DROP_UNUSABLE;
2994
2995         mgmt = (struct ieee80211_mgmt *) skb->data;
2996         fc = mgmt->frame_control;
2997
2998         if (ieee80211_is_ctl(fc))
2999                 return RX_CONTINUE;
3000
3001         if (skb->len < 24)
3002                 return RX_DROP_MONITOR;
3003
3004         if (ieee80211_is_probe_resp(fc)) {
3005                 ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len, rx_status);
3006                 dev_kfree_skb(skb);
3007                 return RX_QUEUED;
3008         }
3009
3010         if (ieee80211_is_beacon(fc)) {
3011                 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
3012                 dev_kfree_skb(skb);
3013                 return RX_QUEUED;
3014         }
3015
3016         return RX_CONTINUE;
3017 }
3018
3019
3020 static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
3021 {
3022         struct ieee80211_local *local = sdata->local;
3023         int active = 0;
3024         struct sta_info *sta;
3025
3026         rcu_read_lock();
3027
3028         list_for_each_entry_rcu(sta, &local->sta_list, list) {
3029                 if (sta->sdata == sdata &&
3030                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
3031                                jiffies)) {
3032                         active++;
3033                         break;
3034                 }
3035         }
3036
3037         rcu_read_unlock();
3038
3039         return active;
3040 }
3041
3042
3043 static void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata, unsigned long exp_time)
3044 {
3045         struct ieee80211_local *local = sdata->local;
3046         struct sta_info *sta, *tmp;
3047         LIST_HEAD(tmp_list);
3048         DECLARE_MAC_BUF(mac);
3049         unsigned long flags;
3050
3051         spin_lock_irqsave(&local->sta_lock, flags);
3052         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
3053                 if (time_after(jiffies, sta->last_rx + exp_time)) {
3054 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3055                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
3056                                sdata->dev->name, print_mac(mac, sta->addr));
3057 #endif
3058                         __sta_info_unlink(&sta);
3059                         if (sta)
3060                                 list_add(&sta->list, &tmp_list);
3061                 }
3062         spin_unlock_irqrestore(&local->sta_lock, flags);
3063
3064         list_for_each_entry_safe(sta, tmp, &tmp_list, list)
3065                 sta_info_destroy(sta);
3066 }
3067
3068
3069 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata,
3070                                      struct ieee80211_if_sta *ifsta)
3071 {
3072         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
3073
3074         ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
3075         if (ieee80211_sta_active_ibss(sdata))
3076                 return;
3077
3078         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
3079                "IBSS networks with same SSID (merge)\n", sdata->dev->name);
3080         ieee80211_sta_req_scan(sdata, ifsta->ssid, ifsta->ssid_len);
3081 }
3082
3083
3084 #ifdef CONFIG_MAC80211_MESH
3085 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
3086                            struct ieee80211_if_sta *ifsta)
3087 {
3088         bool free_plinks;
3089
3090         ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
3091         mesh_path_expire(sdata);
3092
3093         free_plinks = mesh_plink_availables(sdata);
3094         if (free_plinks != sdata->u.sta.accepting_plinks)
3095                 ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
3096
3097         mod_timer(&ifsta->timer, jiffies +
3098                         IEEE80211_MESH_HOUSEKEEPING_INTERVAL);
3099 }
3100
3101
3102 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
3103 {
3104         struct ieee80211_if_sta *ifsta;
3105         ifsta = &sdata->u.sta;
3106         ifsta->state = IEEE80211_STA_MLME_MESH_UP;
3107         ieee80211_sta_timer((unsigned long)sdata);
3108         ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
3109 }
3110 #endif
3111
3112
3113 void ieee80211_sta_timer(unsigned long data)
3114 {
3115         struct ieee80211_sub_if_data *sdata =
3116                 (struct ieee80211_sub_if_data *) data;
3117         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3118         struct ieee80211_local *local = sdata->local;
3119
3120         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
3121         queue_work(local->hw.workqueue, &ifsta->work);
3122 }
3123
3124 static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
3125                                      struct ieee80211_if_sta *ifsta)
3126 {
3127         struct ieee80211_local *local = sdata->local;
3128
3129         if (local->ops->reset_tsf) {
3130                 /* Reset own TSF to allow time synchronization work. */
3131                 local->ops->reset_tsf(local_to_hw(local));
3132         }
3133
3134         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
3135
3136
3137         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
3138                 ifsta->auth_alg = WLAN_AUTH_OPEN;
3139         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
3140                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
3141         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
3142                 ifsta->auth_alg = WLAN_AUTH_LEAP;
3143         else
3144                 ifsta->auth_alg = WLAN_AUTH_OPEN;
3145         ifsta->auth_transaction = -1;
3146         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
3147         ifsta->assoc_scan_tries = 0;
3148         ifsta->direct_probe_tries = 0;
3149         ifsta->auth_tries = 0;
3150         ifsta->assoc_tries = 0;
3151         netif_tx_stop_all_queues(sdata->dev);
3152         netif_carrier_off(sdata->dev);
3153 }
3154
3155
3156 void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
3157                             struct ieee80211_if_sta *ifsta)
3158 {
3159         struct ieee80211_local *local = sdata->local;
3160
3161         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3162                 return;
3163
3164         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
3165                              IEEE80211_STA_AUTO_BSSID_SEL)) &&
3166             (ifsta->flags & (IEEE80211_STA_SSID_SET |
3167                              IEEE80211_STA_AUTO_SSID_SEL))) {
3168
3169                 if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED)
3170                         ieee80211_set_disassoc(sdata, ifsta, true, true,
3171                                                WLAN_REASON_DEAUTH_LEAVING);
3172
3173                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
3174                 queue_work(local->hw.workqueue, &ifsta->work);
3175         }
3176 }
3177
3178 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
3179                                     const char *ssid, int ssid_len)
3180 {
3181         int tmp, hidden_ssid;
3182
3183         if (ssid_len == ifsta->ssid_len &&
3184             !memcmp(ifsta->ssid, ssid, ssid_len))
3185                 return 1;
3186
3187         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
3188                 return 0;
3189
3190         hidden_ssid = 1;
3191         tmp = ssid_len;
3192         while (tmp--) {
3193                 if (ssid[tmp] != '\0') {
3194                         hidden_ssid = 0;
3195                         break;
3196                 }
3197         }
3198
3199         if (hidden_ssid && ifsta->ssid_len == ssid_len)
3200                 return 1;
3201
3202         if (ssid_len == 1 && ssid[0] == ' ')
3203                 return 1;
3204
3205         return 0;
3206 }
3207
3208 static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
3209                                      struct ieee80211_if_sta *ifsta)
3210 {
3211         struct ieee80211_local *local = sdata->local;
3212         struct ieee80211_sta_bss *bss;
3213         struct ieee80211_supported_band *sband;
3214         u8 bssid[ETH_ALEN], *pos;
3215         int i;
3216         int ret;
3217         DECLARE_MAC_BUF(mac);
3218
3219 #if 0
3220         /* Easier testing, use fixed BSSID. */
3221         memset(bssid, 0xfe, ETH_ALEN);
3222 #else
3223         /* Generate random, not broadcast, locally administered BSSID. Mix in
3224          * own MAC address to make sure that devices that do not have proper
3225          * random number generator get different BSSID. */
3226         get_random_bytes(bssid, ETH_ALEN);
3227         for (i = 0; i < ETH_ALEN; i++)
3228                 bssid[i] ^= sdata->dev->dev_addr[i];
3229         bssid[0] &= ~0x01;
3230         bssid[0] |= 0x02;
3231 #endif
3232
3233         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
3234                sdata->dev->name, print_mac(mac, bssid));
3235
3236         bss = ieee80211_rx_bss_add(sdata, bssid,
3237                                    local->hw.conf.channel->center_freq,
3238                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
3239         if (!bss)
3240                 return -ENOMEM;
3241
3242         bss->band = local->hw.conf.channel->band;
3243         sband = local->hw.wiphy->bands[bss->band];
3244
3245         if (local->hw.conf.beacon_int == 0)
3246                 local->hw.conf.beacon_int = 100;
3247         bss->beacon_int = local->hw.conf.beacon_int;
3248         bss->last_update = jiffies;
3249         bss->capability = WLAN_CAPABILITY_IBSS;
3250
3251         if (sdata->default_key)
3252                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
3253         else
3254                 sdata->drop_unencrypted = 0;
3255
3256         bss->supp_rates_len = sband->n_bitrates;
3257         pos = bss->supp_rates;
3258         for (i = 0; i < sband->n_bitrates; i++) {
3259                 int rate = sband->bitrates[i].bitrate;
3260                 *pos++ = (u8) (rate / 5);
3261         }
3262
3263         ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
3264         ieee80211_rx_bss_put(local, bss);
3265         return ret;
3266 }
3267
3268
3269 static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
3270                                    struct ieee80211_if_sta *ifsta)
3271 {
3272         struct ieee80211_local *local = sdata->local;
3273         struct ieee80211_sta_bss *bss;
3274         int found = 0;
3275         u8 bssid[ETH_ALEN];
3276         int active_ibss;
3277         DECLARE_MAC_BUF(mac);
3278         DECLARE_MAC_BUF(mac2);
3279
3280         if (ifsta->ssid_len == 0)
3281                 return -EINVAL;
3282
3283         active_ibss = ieee80211_sta_active_ibss(sdata);
3284 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3285         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
3286                sdata->dev->name, active_ibss);
3287 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3288         spin_lock_bh(&local->sta_bss_lock);
3289         list_for_each_entry(bss, &local->sta_bss_list, list) {
3290                 if (ifsta->ssid_len != bss->ssid_len ||
3291                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
3292                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
3293                         continue;
3294 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3295                 printk(KERN_DEBUG "   bssid=%s found\n",
3296                        print_mac(mac, bss->bssid));
3297 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3298                 memcpy(bssid, bss->bssid, ETH_ALEN);
3299                 found = 1;
3300                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
3301                         break;
3302         }
3303         spin_unlock_bh(&local->sta_bss_lock);
3304
3305 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3306         if (found)
3307                 printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
3308                        "%s\n", print_mac(mac, bssid),
3309                        print_mac(mac2, ifsta->bssid));
3310 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3311
3312         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
3313                 int ret;
3314                 int search_freq;
3315
3316                 if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
3317                         search_freq = bss->freq;
3318                 else
3319                         search_freq = local->hw.conf.channel->center_freq;
3320
3321                 bss = ieee80211_rx_bss_get(local, bssid, search_freq,
3322                                            ifsta->ssid, ifsta->ssid_len);
3323                 if (!bss)
3324                         goto dont_join;
3325
3326                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
3327                        " based on configured SSID\n",
3328                        sdata->dev->name, print_mac(mac, bssid));
3329                 ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
3330                 ieee80211_rx_bss_put(local, bss);
3331                 return ret;
3332         }
3333
3334 dont_join:
3335 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3336         printk(KERN_DEBUG "   did not try to join ibss\n");
3337 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3338
3339         /* Selected IBSS not found in current scan results - try to scan */
3340         if (ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED &&
3341             !ieee80211_sta_active_ibss(sdata)) {
3342                 mod_timer(&ifsta->timer, jiffies +
3343                                       IEEE80211_IBSS_MERGE_INTERVAL);
3344         } else if (time_after(jiffies, local->last_scan_completed +
3345                               IEEE80211_SCAN_INTERVAL)) {
3346                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
3347                        "join\n", sdata->dev->name);
3348                 return ieee80211_sta_req_scan(sdata, ifsta->ssid,
3349                                               ifsta->ssid_len);
3350         } else if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED) {
3351                 int interval = IEEE80211_SCAN_INTERVAL;
3352
3353                 if (time_after(jiffies, ifsta->ibss_join_req +
3354                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
3355                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
3356                             (!(local->oper_channel->flags &
3357                                         IEEE80211_CHAN_NO_IBSS)))
3358                                 return ieee80211_sta_create_ibss(sdata, ifsta);
3359                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
3360                                 printk(KERN_DEBUG "%s: IBSS not allowed on"
3361                                        " %d MHz\n", sdata->dev->name,
3362                                        local->hw.conf.channel->center_freq);
3363                         }
3364
3365                         /* No IBSS found - decrease scan interval and continue
3366                          * scanning. */
3367                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
3368                 }
3369
3370                 ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
3371                 mod_timer(&ifsta->timer, jiffies + interval);
3372                 return 0;
3373         }
3374
3375         return 0;
3376 }
3377
3378
3379 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
3380 {
3381         struct ieee80211_if_sta *ifsta;
3382         int res;
3383
3384         if (len > IEEE80211_MAX_SSID_LEN)
3385                 return -EINVAL;
3386
3387         ifsta = &sdata->u.sta;
3388
3389         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
3390                 memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
3391                 memcpy(ifsta->ssid, ssid, len);
3392                 ifsta->ssid_len = len;
3393                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
3394
3395                 res = 0;
3396                 /*
3397                  * Hack! MLME code needs to be cleaned up to have different
3398                  * entry points for configuration and internal selection change
3399                  */
3400                 if (netif_running(sdata->dev))
3401                         res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
3402                 if (res) {
3403                         printk(KERN_DEBUG "%s: Failed to config new SSID to "
3404                                "the low-level driver\n", sdata->dev->name);
3405                         return res;
3406                 }
3407         }
3408
3409         if (len)
3410                 ifsta->flags |= IEEE80211_STA_SSID_SET;
3411         else
3412                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
3413
3414         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3415             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
3416                 ifsta->ibss_join_req = jiffies;
3417                 ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
3418                 return ieee80211_sta_find_ibss(sdata, ifsta);
3419         }
3420
3421         return 0;
3422 }
3423
3424
3425 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
3426 {
3427         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3428         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
3429         *len = ifsta->ssid_len;
3430         return 0;
3431 }
3432
3433
3434 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
3435 {
3436         struct ieee80211_if_sta *ifsta;
3437         int res;
3438
3439         ifsta = &sdata->u.sta;
3440
3441         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
3442                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
3443                 res = 0;
3444                 /*
3445                  * Hack! See also ieee80211_sta_set_ssid.
3446                  */
3447                 if (netif_running(sdata->dev))
3448                         res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
3449                 if (res) {
3450                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
3451                                "the low-level driver\n", sdata->dev->name);
3452                         return res;
3453                 }
3454         }
3455
3456         if (is_valid_ether_addr(bssid))
3457                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
3458         else
3459                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
3460
3461         return 0;
3462 }
3463
3464
3465 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata, char *ie, size_t len)
3466 {
3467         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3468
3469         kfree(ifsta->extra_ie);
3470         if (len == 0) {
3471                 ifsta->extra_ie = NULL;
3472                 ifsta->extra_ie_len = 0;
3473                 return 0;
3474         }
3475         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3476         if (!ifsta->extra_ie) {
3477                 ifsta->extra_ie_len = 0;
3478                 return -ENOMEM;
3479         }
3480         memcpy(ifsta->extra_ie, ie, len);
3481         ifsta->extra_ie_len = len;
3482         return 0;
3483 }
3484
3485
3486 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
3487                                         struct sk_buff *skb, u8 *bssid,
3488                                         u8 *addr, u64 supp_rates)
3489 {
3490         struct ieee80211_local *local = sdata->local;
3491         struct sta_info *sta;
3492         DECLARE_MAC_BUF(mac);
3493         int band = local->hw.conf.channel->band;
3494
3495         /* TODO: Could consider removing the least recently used entry and
3496          * allow new one to be added. */
3497         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3498                 if (net_ratelimit()) {
3499                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3500                                "entry %s\n", sdata->dev->name, print_mac(mac, addr));
3501                 }
3502                 return NULL;
3503         }
3504
3505         if (compare_ether_addr(bssid, sdata->u.sta.bssid))
3506                 return NULL;
3507
3508 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
3509         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
3510                wiphy_name(local->hw.wiphy), print_mac(mac, addr), sdata->dev->name);
3511 #endif
3512
3513         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
3514         if (!sta)
3515                 return NULL;
3516
3517         set_sta_flags(sta, WLAN_STA_AUTHORIZED);
3518
3519         /* make sure mandatory rates are always added */
3520         sta->supp_rates[band] = supp_rates |
3521                         ieee80211_sta_get_mandatory_rates(local, band);
3522
3523         rate_control_rate_init(sta, local);
3524
3525         if (sta_info_insert(sta))
3526                 return NULL;
3527
3528         return sta;
3529 }
3530
3531
3532 static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
3533                                      struct ieee80211_if_sta *ifsta)
3534 {
3535         struct ieee80211_local *local = sdata->local;
3536         struct ieee80211_sta_bss *bss, *selected = NULL;
3537         int top_rssi = 0, freq;
3538
3539         spin_lock_bh(&local->sta_bss_lock);
3540         freq = local->oper_channel->center_freq;
3541         list_for_each_entry(bss, &local->sta_bss_list, list) {
3542                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
3543                         continue;
3544
3545                 if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
3546                         IEEE80211_STA_AUTO_BSSID_SEL |
3547                         IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
3548                     (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
3549                      !!sdata->default_key))
3550                         continue;
3551
3552                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
3553                     bss->freq != freq)
3554                         continue;
3555
3556                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
3557                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
3558                         continue;
3559
3560                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
3561                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
3562                         continue;
3563
3564                 if (!selected || top_rssi < bss->signal) {
3565                         selected = bss;
3566                         top_rssi = bss->signal;
3567                 }
3568         }
3569         if (selected)
3570                 atomic_inc(&selected->users);
3571         spin_unlock_bh(&local->sta_bss_lock);
3572
3573         if (selected) {
3574                 ieee80211_set_freq(sdata, selected->freq);
3575                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
3576                         ieee80211_sta_set_ssid(sdata, selected->ssid,
3577                                                selected->ssid_len);
3578                 ieee80211_sta_set_bssid(sdata, selected->bssid);
3579                 ieee80211_sta_def_wmm_params(sdata, selected, 0);
3580
3581                 /* Send out direct probe if no probe resp was received or
3582                  * the one we have is outdated
3583                  */
3584                 if (!selected->last_probe_resp ||
3585                     time_after(jiffies, selected->last_probe_resp
3586                                         + IEEE80211_SCAN_RESULT_EXPIRE))
3587                         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
3588                 else
3589                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
3590
3591                 ieee80211_rx_bss_put(local, selected);
3592                 ieee80211_sta_reset_auth(sdata, ifsta);
3593                 return 0;
3594         } else {
3595                 if (ifsta->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
3596                         ifsta->assoc_scan_tries++;
3597                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
3598                                 ieee80211_sta_start_scan(sdata, NULL, 0);
3599                         else
3600                                 ieee80211_sta_start_scan(sdata, ifsta->ssid,
3601                                                          ifsta->ssid_len);
3602                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
3603                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
3604                 } else
3605                         ifsta->state = IEEE80211_STA_MLME_DISABLED;
3606         }
3607         return -1;
3608 }
3609
3610
3611 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
3612 {
3613         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3614
3615         printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
3616                sdata->dev->name, reason);
3617
3618         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3619             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
3620                 return -EINVAL;
3621
3622         ieee80211_set_disassoc(sdata, ifsta, true, true, reason);
3623         return 0;
3624 }
3625
3626
3627 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
3628 {
3629         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3630
3631         printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
3632                sdata->dev->name, reason);
3633
3634         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3635                 return -EINVAL;
3636
3637         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
3638                 return -1;
3639
3640         ieee80211_set_disassoc(sdata, ifsta, false, true, reason);
3641         return 0;
3642 }
3643
3644 void ieee80211_notify_mac(struct ieee80211_hw *hw,
3645                           enum ieee80211_notification_types  notif_type)
3646 {
3647         struct ieee80211_local *local = hw_to_local(hw);
3648         struct ieee80211_sub_if_data *sdata;
3649
3650         switch (notif_type) {
3651         case IEEE80211_NOTIFY_RE_ASSOC:
3652                 rcu_read_lock();
3653                 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3654                         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3655                                 continue;
3656
3657                         ieee80211_sta_req_auth(sdata, &sdata->u.sta);
3658                 }
3659                 rcu_read_unlock();
3660                 break;
3661         }
3662 }
3663 EXPORT_SYMBOL(ieee80211_notify_mac);
3664
3665 void ieee80211_sta_work(struct work_struct *work)
3666 {
3667         struct ieee80211_sub_if_data *sdata =
3668                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
3669         struct ieee80211_local *local = sdata->local;
3670         struct ieee80211_if_sta *ifsta;
3671         struct sk_buff *skb;
3672
3673         if (!netif_running(sdata->dev))
3674                 return;
3675
3676         if (local->sta_sw_scanning || local->sta_hw_scanning)
3677                 return;
3678
3679         if (WARN_ON(sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3680                     sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
3681                     sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
3682                 return;
3683         ifsta = &sdata->u.sta;
3684
3685         while ((skb = skb_dequeue(&ifsta->skb_queue)))
3686                 ieee80211_sta_rx_queued_mgmt(sdata, skb);
3687
3688 #ifdef CONFIG_MAC80211_MESH
3689         if (ifsta->preq_queue_len &&
3690             time_after(jiffies,
3691                        ifsta->last_preq + msecs_to_jiffies(ifsta->mshcfg.dot11MeshHWMPpreqMinInterval)))
3692                 mesh_path_start_discovery(sdata);
3693 #endif
3694
3695         if (ifsta->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
3696             ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
3697             ifsta->state != IEEE80211_STA_MLME_ASSOCIATE &&
3698             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
3699                 if (ifsta->scan_ssid_len)
3700                         ieee80211_sta_start_scan(sdata, ifsta->scan_ssid, ifsta->scan_ssid_len);
3701                 else
3702                         ieee80211_sta_start_scan(sdata, NULL, 0);
3703                 return;
3704         }
3705
3706         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
3707                 if (ieee80211_sta_config_auth(sdata, ifsta))
3708                         return;
3709                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
3710         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
3711                 return;
3712
3713         switch (ifsta->state) {
3714         case IEEE80211_STA_MLME_DISABLED:
3715                 break;
3716         case IEEE80211_STA_MLME_DIRECT_PROBE:
3717                 ieee80211_direct_probe(sdata, ifsta);
3718                 break;
3719         case IEEE80211_STA_MLME_AUTHENTICATE:
3720                 ieee80211_authenticate(sdata, ifsta);
3721                 break;
3722         case IEEE80211_STA_MLME_ASSOCIATE:
3723                 ieee80211_associate(sdata, ifsta);
3724                 break;
3725         case IEEE80211_STA_MLME_ASSOCIATED:
3726                 ieee80211_associated(sdata, ifsta);
3727                 break;
3728         case IEEE80211_STA_MLME_IBSS_SEARCH:
3729                 ieee80211_sta_find_ibss(sdata, ifsta);
3730                 break;
3731         case IEEE80211_STA_MLME_IBSS_JOINED:
3732                 ieee80211_sta_merge_ibss(sdata, ifsta);
3733                 break;
3734 #ifdef CONFIG_MAC80211_MESH
3735         case IEEE80211_STA_MLME_MESH_UP:
3736                 ieee80211_mesh_housekeeping(sdata, ifsta);
3737                 break;
3738 #endif
3739         default:
3740                 WARN_ON(1);
3741                 break;
3742         }
3743
3744         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
3745                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
3746                        "mixed-cell disabled - disassociate\n", sdata->dev->name);
3747
3748                 ieee80211_set_disassoc(sdata, ifsta, false, true,
3749                                         WLAN_REASON_UNSPECIFIED);
3750         }
3751 }
3752
3753 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3754 {
3755         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
3756         struct ieee80211_if_sta *ifsta;
3757
3758         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
3759                 ifsta = &sdata->u.sta;
3760                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
3761                     (!(ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED) &&
3762                     !ieee80211_sta_active_ibss(sdata)))
3763                         ieee80211_sta_find_ibss(sdata, ifsta);
3764         }
3765 }