net/mac80211/mlme.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/wireless.h>
  20 #include <linux/random.h>
  21 #include <linux/etherdevice.h>
  22 #include <linux/rtnetlink.h>
  23 #include <net/iw_handler.h>
  24 #include <net/mac80211.h>
  25
  26 #include "ieee80211_i.h"
  27 #include "rate.h"
  28 #include "led.h"
  29 #include "mesh.h"
  30
  31 #define IEEE80211_ASSOC_SCANS_MAX_TRIES 2
  32 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  33 #define IEEE80211_AUTH_MAX_TRIES 3
  34 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  35 #define IEEE80211_ASSOC_MAX_TRIES 3
  36 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  37 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
  38 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  39 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  40 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  41 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  42 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
  43
  44 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  45 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  46 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
  47
  48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  49
  50
  51 /* mgmt header + 1 byte category code */
  52 #define IEEE80211_MIN_ACTION_SIZE (24 + 1)
  53
  54 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
  55 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
  56 #define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
  57 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
  58 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
  59
  60 /* next values represent the buffer size for A-MPDU frame.
  61  * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) */
  62 #define IEEE80211_MIN_AMPDU_BUF 0x8
  63 #define IEEE80211_MAX_AMPDU_BUF 0x40
  64
  65 /* utils */
  66 static int ecw2cw(int ecw)
  67 {
  68         return (1 << ecw) - 1;
  69 }
  70
  71 static u8 *ieee80211_bss_get_ie(struct ieee80211_sta_bss *bss, u8 ie)
  72 {
  73         u8 *end, *pos;
  74
  75         pos = bss->ies;
  76         if (pos == NULL)
  77                 return NULL;
  78         end = pos + bss->ies_len;
  79
  80         while (pos + 1 < end) {
  81                 if (pos + 2 + pos[1] > end)
  82                         break;
  83                 if (pos[0] == ie)
  84                         return pos;
  85                 pos += 2 + pos[1];
  86         }
  87
  88         return NULL;
  89 }
  90
  91 /* frame sending functions */
  92 void ieee80211_sta_tx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
  93                       int encrypt)
  94 {
  95         skb->dev = sdata->local->mdev;
  96         skb_set_mac_header(skb, 0);
  97         skb_set_network_header(skb, 0);
  98         skb_set_transport_header(skb, 0);
  99
 100         skb->iif = sdata->dev->ifindex;
 101         skb->do_not_encrypt = !encrypt;
 102
 103         dev_queue_xmit(skb);
 104 }
 105
 106 static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
 107                                 struct ieee80211_if_sta *ifsta,
 108                                 int transaction, u8 *extra, size_t extra_len,
 109                                 int encrypt)
 110 {
 111         struct ieee80211_local *local = sdata->local;
 112         struct sk_buff *skb;
 113         struct ieee80211_mgmt *mgmt;
 114
 115         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 116                             sizeof(*mgmt) + 6 + extra_len);
 117         if (!skb) {
 118                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 119                        "frame\n", sdata->dev->name);
 120                 return;
 121         }
 122         skb_reserve(skb, local->hw.extra_tx_headroom);
 123
 124         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 125         memset(mgmt, 0, 24 + 6);
 126         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 127                                           IEEE80211_STYPE_AUTH);
 128         if (encrypt)
 129                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 130         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 131         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 132         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 133         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 134         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 135         ifsta->auth_transaction = transaction + 1;
 136         mgmt->u.auth.status_code = cpu_to_le16(0);
 137         if (extra)
 138                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 139
 140         ieee80211_sta_tx(sdata, skb, encrypt);
 141 }
 142
 143 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
 144                               u8 *ssid, size_t ssid_len)
 145 {
 146         struct ieee80211_local *local = sdata->local;
 147         struct ieee80211_supported_band *sband;
 148         struct sk_buff *skb;
 149         struct ieee80211_mgmt *mgmt;
 150         u8 *pos, *supp_rates, *esupp_rates = NULL;
 151         int i;
 152
 153         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 154         if (!skb) {
 155                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 156                        "request\n", sdata->dev->name);
 157                 return;
 158         }
 159         skb_reserve(skb, local->hw.extra_tx_headroom);
 160
 161         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 162         memset(mgmt, 0, 24);
 163         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 164                                           IEEE80211_STYPE_PROBE_REQ);
 165         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 166         if (dst) {
 167                 memcpy(mgmt->da, dst, ETH_ALEN);
 168                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 169         } else {
 170                 memset(mgmt->da, 0xff, ETH_ALEN);
 171                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 172         }
 173         pos = skb_put(skb, 2 + ssid_len);
 174         *pos++ = WLAN_EID_SSID;
 175         *pos++ = ssid_len;
 176         memcpy(pos, ssid, ssid_len);
 177
 178         supp_rates = skb_put(skb, 2);
 179         supp_rates[0] = WLAN_EID_SUPP_RATES;
 180         supp_rates[1] = 0;
 181         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 182
 183         for (i = 0; i < sband->n_bitrates; i++) {
 184                 struct ieee80211_rate *rate = &sband->bitrates[i];
 185                 if (esupp_rates) {
 186                         pos = skb_put(skb, 1);
 187                         esupp_rates[1]++;
 188                 } else if (supp_rates[1] == 8) {
 189                         esupp_rates = skb_put(skb, 3);
 190                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 191                         esupp_rates[1] = 1;
 192                         pos = &esupp_rates[2];
 193                 } else {
 194                         pos = skb_put(skb, 1);
 195                         supp_rates[1]++;
 196                 }
 197                 *pos = rate->bitrate / 5;
 198         }
 199
 200         ieee80211_sta_tx(sdata, skb, 0);
 201 }
 202
 203 /* MLME */
 204 static void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
 205                                          struct ieee80211_sta_bss *bss,
 206                                          int ibss)
 207 {
 208         struct ieee80211_local *local = sdata->local;
 209         int i, have_higher_than_11mbit = 0;
 210
 211
 212         /* cf. IEEE 802.11 9.2.12 */
 213         for (i = 0; i < bss->supp_rates_len; i++)
 214                 if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
 215                         have_higher_than_11mbit = 1;
 216
 217         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
 218             have_higher_than_11mbit)
 219                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
 220         else
 221                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 222
 223
 224         if (local->ops->conf_tx) {
 225                 struct ieee80211_tx_queue_params qparam;
 226
 227                 memset(&qparam, 0, sizeof(qparam));
 228
 229                 qparam.aifs = 2;
 230
 231                 if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
 232                     !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
 233                         qparam.cw_min = 31;
 234                 else
 235                         qparam.cw_min = 15;
 236
 237                 qparam.cw_max = 1023;
 238                 qparam.txop = 0;
 239
 240                 for (i = 0; i < local_to_hw(local)->queues; i++)
 241                         local->ops->conf_tx(local_to_hw(local), i, &qparam);
 242         }
 243 }
 244
 245 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 246                                      struct ieee80211_if_sta *ifsta,
 247                                      u8 *wmm_param, size_t wmm_param_len)
 248 {
 249         struct ieee80211_tx_queue_params params;
 250         size_t left;
 251         int count;
 252         u8 *pos;
 253
 254         if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
 255                 return;
 256
 257         if (!wmm_param)
 258                 return;
 259
 260         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 261                 return;
 262         count = wmm_param[6] & 0x0f;
 263         if (count == ifsta->wmm_last_param_set)
 264                 return;
 265         ifsta->wmm_last_param_set = count;
 266
 267         pos = wmm_param + 8;
 268         left = wmm_param_len - 8;
 269
 270         memset(&params, 0, sizeof(params));
 271
 272         if (!local->ops->conf_tx)
 273                 return;
 274
 275         local->wmm_acm = 0;
 276         for (; left >= 4; left -= 4, pos += 4) {
 277                 int aci = (pos[0] >> 5) & 0x03;
 278                 int acm = (pos[0] >> 4) & 0x01;
 279                 int queue;
 280
 281                 switch (aci) {
 282                 case 1:
 283                         queue = 3;
 284                         if (acm)
 285                                 local->wmm_acm |= BIT(0) | BIT(3);
 286                         break;
 287                 case 2:
 288                         queue = 1;
 289                         if (acm)
 290                                 local->wmm_acm |= BIT(4) | BIT(5);
 291                         break;
 292                 case 3:
 293                         queue = 0;
 294                         if (acm)
 295                                 local->wmm_acm |= BIT(6) | BIT(7);
 296                         break;
 297                 case 0:
 298                 default:
 299                         queue = 2;
 300                         if (acm)
 301                                 local->wmm_acm |= BIT(1) | BIT(2);
 302                         break;
 303                 }
 304
 305                 params.aifs = pos[0] & 0x0f;
 306                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 307                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 308                 params.txop = get_unaligned_le16(pos + 2);
 309 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 310                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 311                        "cWmin=%d cWmax=%d txop=%d\n",
 312                        local->mdev->name, queue, aci, acm, params.aifs, params.cw_min,
 313                        params.cw_max, params.txop);
 314 #endif
 315                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 316                  * AC for now) */
 317                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 318                         printk(KERN_DEBUG "%s: failed to set TX queue "
 319                                "parameters for queue %d\n", local->mdev->name, queue);
 320                 }
 321         }
 322 }
 323
 324 static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
 325                                            bool use_protection,
 326                                            bool use_short_preamble)
 327 {
 328         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
 329 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 330         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 331         DECLARE_MAC_BUF(mac);
 332 #endif
 333         u32 changed = 0;
 334
 335         if (use_protection != bss_conf->use_cts_prot) {
 336 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 337                 if (net_ratelimit()) {
 338                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 339                                "%s)\n",
 340                                sdata->dev->name,
 341                                use_protection ? "enabled" : "disabled",
 342                                print_mac(mac, ifsta->bssid));
 343                 }
 344 #endif
 345                 bss_conf->use_cts_prot = use_protection;
 346                 changed |= BSS_CHANGED_ERP_CTS_PROT;
 347         }
 348
 349         if (use_short_preamble != bss_conf->use_short_preamble) {
 350 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 351                 if (net_ratelimit()) {
 352                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 353                                " (BSSID=%s)\n",
 354                                sdata->dev->name,
 355                                use_short_preamble ? "short" : "long",
 356                                print_mac(mac, ifsta->bssid));
 357                 }
 358 #endif
 359                 bss_conf->use_short_preamble = use_short_preamble;
 360                 changed |= BSS_CHANGED_ERP_PREAMBLE;
 361         }
 362
 363         return changed;
 364 }
 365
 366 static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
 367                                    u8 erp_value)
 368 {
 369         bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 370         bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
 371
 372         return ieee80211_handle_protect_preamb(sdata,
 373                         use_protection, use_short_preamble);
 374 }
 375
 376 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 377                                            struct ieee80211_sta_bss *bss)
 378 {
 379         u32 changed = 0;
 380
 381         if (bss->has_erp_value)
 382                 changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
 383         else {
 384                 u16 capab = bss->capability;
 385                 changed |= ieee80211_handle_protect_preamb(sdata, false,
 386                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
 387         }
 388
 389         return changed;
 390 }
 391
 392 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
 393                                    struct ieee80211_ht_info *ht_info)
 394 {
 395
 396         if (ht_info == NULL)
 397                 return -EINVAL;
 398
 399         memset(ht_info, 0, sizeof(*ht_info));
 400
 401         if (ht_cap_ie) {
 402                 u8 ampdu_info = ht_cap_ie->ampdu_params_info;
 403
 404                 ht_info->ht_supported = 1;
 405                 ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
 406                 ht_info->ampdu_factor =
 407                         ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
 408                 ht_info->ampdu_density =
 409                         (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
 410                 memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
 411         } else
 412                 ht_info->ht_supported = 0;
 413
 414         return 0;
 415 }
 416
 417 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
 418                         struct ieee80211_ht_addt_info *ht_add_info_ie,
 419                         struct ieee80211_ht_bss_info *bss_info)
 420 {
 421         if (bss_info == NULL)
 422                 return -EINVAL;
 423
 424         memset(bss_info, 0, sizeof(*bss_info));
 425
 426         if (ht_add_info_ie) {
 427                 u16 op_mode;
 428                 op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
 429
 430                 bss_info->primary_channel = ht_add_info_ie->control_chan;
 431                 bss_info->bss_cap = ht_add_info_ie->ht_param;
 432                 bss_info->bss_op_mode = (u8)(op_mode & 0xff);
 433         }
 434
 435         return 0;
 436 }
 437
 438 static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata,
 439                                         struct ieee80211_if_sta *ifsta)
 440 {
 441         union iwreq_data wrqu;
 442         memset(&wrqu, 0, sizeof(wrqu));
 443         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
 444                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 445         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 446         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
 447 }
 448
 449 static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
 450                                          struct ieee80211_if_sta *ifsta)
 451 {
 452         union iwreq_data wrqu;
 453
 454         if (ifsta->assocreq_ies) {
 455                 memset(&wrqu, 0, sizeof(wrqu));
 456                 wrqu.data.length = ifsta->assocreq_ies_len;
 457                 wireless_send_event(sdata->dev, IWEVASSOCREQIE, &wrqu,
 458                                     ifsta->assocreq_ies);
 459         }
 460         if (ifsta->assocresp_ies) {
 461                 memset(&wrqu, 0, sizeof(wrqu));
 462                 wrqu.data.length = ifsta->assocresp_ies_len;
 463                 wireless_send_event(sdata->dev, IWEVASSOCRESPIE, &wrqu,
 464                                     ifsta->assocresp_ies);
 465         }
 466 }
 467
 468
 469 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 470                                      struct ieee80211_if_sta *ifsta)
 471 {
 472         struct ieee80211_local *local = sdata->local;
 473         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
 474         u32 changed = BSS_CHANGED_ASSOC;
 475
 476         struct ieee80211_sta_bss *bss;
 477
 478         ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 479
 480         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
 481                 return;
 482
 483         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 484                                    conf->channel->center_freq,
 485                                    ifsta->ssid, ifsta->ssid_len);
 486         if (bss) {
 487                 /* set timing information */
 488                 sdata->bss_conf.beacon_int = bss->beacon_int;
 489                 sdata->bss_conf.timestamp = bss->timestamp;
 490                 sdata->bss_conf.dtim_period = bss->dtim_period;
 491
 492                 changed |= ieee80211_handle_bss_capability(sdata, bss);
 493
 494                 ieee80211_rx_bss_put(local, bss);
 495         }
 496
 497         if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
 498                 changed |= BSS_CHANGED_HT;
 499                 sdata->bss_conf.assoc_ht = 1;
 500                 sdata->bss_conf.ht_conf = &conf->ht_conf;
 501                 sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
 502         }
 503
 504         ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 505         memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 506         ieee80211_sta_send_associnfo(sdata, ifsta);
 507
 508         ifsta->last_probe = jiffies;
 509         ieee80211_led_assoc(local, 1);
 510
 511         sdata->bss_conf.assoc = 1;
 512         ieee80211_bss_info_change_notify(sdata, changed);
 513
 514         netif_tx_start_all_queues(sdata->dev);
 515         netif_carrier_on(sdata->dev);
 516
 517         ieee80211_sta_send_apinfo(sdata, ifsta);
 518 }
 519
 520 static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
 521                                    struct ieee80211_if_sta *ifsta)
 522 {
 523         DECLARE_MAC_BUF(mac);
 524
 525         ifsta->direct_probe_tries++;
 526         if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
 527                 printk(KERN_DEBUG "%s: direct probe to AP %s timed out\n",
 528                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 529                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 530                 return;
 531         }
 532
 533         printk(KERN_DEBUG "%s: direct probe to AP %s try %d\n",
 534                         sdata->dev->name, print_mac(mac, ifsta->bssid),
 535                         ifsta->direct_probe_tries);
 536
 537         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 538
 539         set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifsta->request);
 540
 541         /* Direct probe is sent to broadcast address as some APs
 542          * will not answer to direct packet in unassociated state.
 543          */
 544         ieee80211_send_probe_req(sdata, NULL,
 545                                  ifsta->ssid, ifsta->ssid_len);
 546
 547         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 548 }
 549
 550
 551 static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
 552                                    struct ieee80211_if_sta *ifsta)
 553 {
 554         DECLARE_MAC_BUF(mac);
 555
 556         ifsta->auth_tries++;
 557         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 558                 printk(KERN_DEBUG "%s: authentication with AP %s"
 559                        " timed out\n",
 560                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 561                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 562                 return;
 563         }
 564
 565         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
 566         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
 567                sdata->dev->name, print_mac(mac, ifsta->bssid));
 568
 569         ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
 570
 571         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 572 }
 573
 574 static int ieee80211_compatible_rates(struct ieee80211_sta_bss *bss,
 575                                       struct ieee80211_supported_band *sband,
 576                                       u64 *rates)
 577 {
 578         int i, j, count;
 579         *rates = 0;
 580         count = 0;
 581         for (i = 0; i < bss->supp_rates_len; i++) {
 582                 int rate = (bss->supp_rates[i] & 0x7F) * 5;
 583
 584                 for (j = 0; j < sband->n_bitrates; j++)
 585                         if (sband->bitrates[j].bitrate == rate) {
 586                                 *rates |= BIT(j);
 587                                 count++;
 588                                 break;
 589                         }
 590         }
 591
 592         return count;
 593 }
 594
 595 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 596                                  struct ieee80211_if_sta *ifsta)
 597 {
 598         struct ieee80211_local *local = sdata->local;
 599         struct sk_buff *skb;
 600         struct ieee80211_mgmt *mgmt;
 601         u8 *pos, *ies, *ht_add_ie;
 602         int i, len, count, rates_len, supp_rates_len;
 603         u16 capab;
 604         struct ieee80211_sta_bss *bss;
 605         int wmm = 0;
 606         struct ieee80211_supported_band *sband;
 607         u64 rates = 0;
 608
 609         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 610                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 611                             ifsta->ssid_len);
 612         if (!skb) {
 613                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 614                        "frame\n", sdata->dev->name);
 615                 return;
 616         }
 617         skb_reserve(skb, local->hw.extra_tx_headroom);
 618
 619         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 620
 621         capab = ifsta->capab;
 622
 623         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
 624                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
 625                         capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 626                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
 627                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 628         }
 629
 630         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 631                                    local->hw.conf.channel->center_freq,
 632                                    ifsta->ssid, ifsta->ssid_len);
 633         if (bss) {
 634                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 635                         capab |= WLAN_CAPABILITY_PRIVACY;
 636                 if (bss->wmm_used)
 637                         wmm = 1;
 638
 639                 /* get all rates supported by the device and the AP as
 640                  * some APs don't like getting a superset of their rates
 641                  * in the association request (e.g. D-Link DAP 1353 in
 642                  * b-only mode) */
 643                 rates_len = ieee80211_compatible_rates(bss, sband, &rates);
 644
 645                 if ((bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
 646                     (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
 647                         capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 648
 649                 ieee80211_rx_bss_put(local, bss);
 650         } else {
 651                 rates = ~0;
 652                 rates_len = sband->n_bitrates;
 653         }
 654
 655         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 656         memset(mgmt, 0, 24);
 657         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 658         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 659         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 660
 661         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 662                 skb_put(skb, 10);
 663                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 664                                                   IEEE80211_STYPE_REASSOC_REQ);
 665                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 666                 mgmt->u.reassoc_req.listen_interval =
 667                                 cpu_to_le16(local->hw.conf.listen_interval);
 668                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 669                        ETH_ALEN);
 670         } else {
 671                 skb_put(skb, 4);
 672                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 673                                                   IEEE80211_STYPE_ASSOC_REQ);
 674                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 675                 mgmt->u.reassoc_req.listen_interval =
 676                                 cpu_to_le16(local->hw.conf.listen_interval);
 677         }
 678
 679         /* SSID */
 680         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 681         *pos++ = WLAN_EID_SSID;
 682         *pos++ = ifsta->ssid_len;
 683         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 684
 685         /* add all rates which were marked to be used above */
 686         supp_rates_len = rates_len;
 687         if (supp_rates_len > 8)
 688                 supp_rates_len = 8;
 689
 690         len = sband->n_bitrates;
 691         pos = skb_put(skb, supp_rates_len + 2);
 692         *pos++ = WLAN_EID_SUPP_RATES;
 693         *pos++ = supp_rates_len;
 694
 695         count = 0;
 696         for (i = 0; i < sband->n_bitrates; i++) {
 697                 if (BIT(i) & rates) {
 698                         int rate = sband->bitrates[i].bitrate;
 699                         *pos++ = (u8) (rate / 5);
 700                         if (++count == 8)
 701                                 break;
 702                 }
 703         }
 704
 705         if (rates_len > count) {
 706                 pos = skb_put(skb, rates_len - count + 2);
 707                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 708                 *pos++ = rates_len - count;
 709
 710                 for (i++; i < sband->n_bitrates; i++) {
 711                         if (BIT(i) & rates) {
 712                                 int rate = sband->bitrates[i].bitrate;
 713                                 *pos++ = (u8) (rate / 5);
 714                         }
 715                 }
 716         }
 717
 718         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
 719                 /* 1. power capabilities */
 720                 pos = skb_put(skb, 4);
 721                 *pos++ = WLAN_EID_PWR_CAPABILITY;
 722                 *pos++ = 2;
 723                 *pos++ = 0; /* min tx power */
 724                 *pos++ = local->hw.conf.channel->max_power; /* max tx power */
 725
 726                 /* 2. supported channels */
 727                 /* TODO: get this in reg domain format */
 728                 pos = skb_put(skb, 2 * sband->n_channels + 2);
 729                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
 730                 *pos++ = 2 * sband->n_channels;
 731                 for (i = 0; i < sband->n_channels; i++) {
 732                         *pos++ = ieee80211_frequency_to_channel(
 733                                         sband->channels[i].center_freq);
 734                         *pos++ = 1; /* one channel in the subband*/
 735                 }
 736         }
 737
 738         if (ifsta->extra_ie) {
 739                 pos = skb_put(skb, ifsta->extra_ie_len);
 740                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 741         }
 742
 743         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 744                 pos = skb_put(skb, 9);
 745                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 746                 *pos++ = 7; /* len */
 747                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 748                 *pos++ = 0x50;
 749                 *pos++ = 0xf2;
 750                 *pos++ = 2; /* WME */
 751                 *pos++ = 0; /* WME info */
 752                 *pos++ = 1; /* WME ver */
 753                 *pos++ = 0;
 754         }
 755
 756         /* wmm support is a must to HT */
 757         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
 758             sband->ht_info.ht_supported &&
 759             (ht_add_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_EXTRA_INFO))) {
 760                 struct ieee80211_ht_addt_info *ht_add_info =
 761                         (struct ieee80211_ht_addt_info *)ht_add_ie;
 762                 u16 cap = sband->ht_info.cap;
 763                 __le16 tmp;
 764                 u32 flags = local->hw.conf.channel->flags;
 765
 766                 switch (ht_add_info->ht_param & IEEE80211_HT_IE_CHA_SEC_OFFSET) {
 767                 case IEEE80211_HT_IE_CHA_SEC_ABOVE:
 768                         if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
 769                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
 770                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 771                         }
 772                         break;
 773                 case IEEE80211_HT_IE_CHA_SEC_BELOW:
 774                         if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
 775                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
 776                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 777                         }
 778                         break;
 779                 }
 780
 781                 tmp = cpu_to_le16(cap);
 782                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
 783                 *pos++ = WLAN_EID_HT_CAPABILITY;
 784                 *pos++ = sizeof(struct ieee80211_ht_cap);
 785                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
 786                 memcpy(pos, &tmp, sizeof(u16));
 787                 pos += sizeof(u16);
 788                 /* TODO: needs a define here for << 2 */
 789                 *pos++ = sband->ht_info.ampdu_factor |
 790                          (sband->ht_info.ampdu_density << 2);
 791                 memcpy(pos, sband->ht_info.supp_mcs_set, 16);
 792         }
 793
 794         kfree(ifsta->assocreq_ies);
 795         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 796         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 797         if (ifsta->assocreq_ies)
 798                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 799
 800         ieee80211_sta_tx(sdata, skb, 0);
 801 }
 802
 803
 804 static void ieee80211_send_deauth(struct ieee80211_sub_if_data *sdata,
 805                                   struct ieee80211_if_sta *ifsta, u16 reason)
 806 {
 807         struct ieee80211_local *local = sdata->local;
 808         struct sk_buff *skb;
 809         struct ieee80211_mgmt *mgmt;
 810
 811         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 812         if (!skb) {
 813                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 814                        "frame\n", sdata->dev->name);
 815                 return;
 816         }
 817         skb_reserve(skb, local->hw.extra_tx_headroom);
 818
 819         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 820         memset(mgmt, 0, 24);
 821         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 822         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 823         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 824         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 825                                           IEEE80211_STYPE_DEAUTH);
 826         skb_put(skb, 2);
 827         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 828
 829         ieee80211_sta_tx(sdata, skb, 0);
 830 }
 831
 832 static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
 833 {
 834         if (!sdata || !sdata->default_key ||
 835             sdata->default_key->conf.alg != ALG_WEP)
 836                 return 0;
 837         return 1;
 838 }
 839
 840 static void ieee80211_send_disassoc(struct ieee80211_sub_if_data *sdata,
 841                                     struct ieee80211_if_sta *ifsta, u16 reason)
 842 {
 843         struct ieee80211_local *local = sdata->local;
 844         struct sk_buff *skb;
 845         struct ieee80211_mgmt *mgmt;
 846
 847         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 848         if (!skb) {
 849                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 850                        "frame\n", sdata->dev->name);
 851                 return;
 852         }
 853         skb_reserve(skb, local->hw.extra_tx_headroom);
 854
 855         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 856         memset(mgmt, 0, 24);
 857         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 858         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 859         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 860         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 861                                           IEEE80211_STYPE_DISASSOC);
 862         skb_put(skb, 2);
 863         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 864
 865         ieee80211_sta_tx(sdata, skb, 0);
 866 }
 867
 868 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 869                                    struct ieee80211_if_sta *ifsta, bool deauth,
 870                                    bool self_disconnected, u16 reason)
 871 {
 872         struct ieee80211_local *local = sdata->local;
 873         struct sta_info *sta;
 874         u32 changed = BSS_CHANGED_ASSOC;
 875
 876         rcu_read_lock();
 877
 878         sta = sta_info_get(local, ifsta->bssid);
 879         if (!sta) {
 880                 rcu_read_unlock();
 881                 return;
 882         }
 883
 884         if (deauth) {
 885                 ifsta->direct_probe_tries = 0;
 886                 ifsta->auth_tries = 0;
 887         }
 888         ifsta->assoc_scan_tries = 0;
 889         ifsta->assoc_tries = 0;
 890
 891         netif_tx_stop_all_queues(sdata->dev);
 892         netif_carrier_off(sdata->dev);
 893
 894         ieee80211_sta_tear_down_BA_sessions(sdata, sta->addr);
 895
 896         if (self_disconnected) {
 897                 if (deauth)
 898                         ieee80211_send_deauth(sdata, ifsta, reason);
 899                 else
 900                         ieee80211_send_disassoc(sdata, ifsta, reason);
 901         }
 902
 903         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
 904         changed |= ieee80211_reset_erp_info(sdata);
 905
 906         if (sdata->bss_conf.assoc_ht)
 907                 changed |= BSS_CHANGED_HT;
 908
 909         sdata->bss_conf.assoc_ht = 0;
 910         sdata->bss_conf.ht_conf = NULL;
 911         sdata->bss_conf.ht_bss_conf = NULL;
 912
 913         ieee80211_led_assoc(local, 0);
 914         sdata->bss_conf.assoc = 0;
 915
 916         ieee80211_sta_send_apinfo(sdata, ifsta);
 917
 918         if (self_disconnected)
 919                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 920
 921         sta_info_unlink(&sta);
 922
 923         rcu_read_unlock();
 924
 925         sta_info_destroy(sta);
 926 }
 927
 928 static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
 929                                       struct ieee80211_if_sta *ifsta)
 930 {
 931         struct ieee80211_local *local = sdata->local;
 932         struct ieee80211_sta_bss *bss;
 933         int bss_privacy;
 934         int wep_privacy;
 935         int privacy_invoked;
 936
 937         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
 938                 return 0;
 939
 940         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 941                                    local->hw.conf.channel->center_freq,
 942                                    ifsta->ssid, ifsta->ssid_len);
 943         if (!bss)
 944                 return 0;
 945
 946         bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
 947         wep_privacy = !!ieee80211_sta_wep_configured(sdata);
 948         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 949
 950         ieee80211_rx_bss_put(local, bss);
 951
 952         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
 953                 return 0;
 954
 955         return 1;
 956 }
 957
 958 static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
 959                                 struct ieee80211_if_sta *ifsta)
 960 {
 961         DECLARE_MAC_BUF(mac);
 962
 963         ifsta->assoc_tries++;
 964         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 965                 printk(KERN_DEBUG "%s: association with AP %s"
 966                        " timed out\n",
 967                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 968                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 969                 return;
 970         }
 971
 972         ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
 973         printk(KERN_DEBUG "%s: associate with AP %s\n",
 974                sdata->dev->name, print_mac(mac, ifsta->bssid));
 975         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
 976                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 977                        "mixed-cell disabled - abort association\n", sdata->dev->name);
 978                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 979                 return;
 980         }
 981
 982         ieee80211_send_assoc(sdata, ifsta);
 983
 984         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 985 }
 986
 987
 988 static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
 989                                  struct ieee80211_if_sta *ifsta)
 990 {
 991         struct ieee80211_local *local = sdata->local;
 992         struct sta_info *sta;
 993         int disassoc;
 994         DECLARE_MAC_BUF(mac);
 995
 996         /* TODO: start monitoring current AP signal quality and number of
 997          * missed beacons. Scan other channels every now and then and search
 998          * for better APs. */
 999         /* TODO: remove expired BSSes */
1000
1001         ifsta->state = IEEE80211_STA_MLME_ASSOCIATED;
1002
1003         rcu_read_lock();
1004
1005         sta = sta_info_get(local, ifsta->bssid);
1006         if (!sta) {
1007                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
1008                        sdata->dev->name, print_mac(mac, ifsta->bssid));
1009                 disassoc = 1;
1010         } else {
1011                 disassoc = 0;
1012                 if (time_after(jiffies,
1013                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
1014                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
1015                                 printk(KERN_DEBUG "%s: No ProbeResp from "
1016                                        "current AP %s - assume out of "
1017                                        "range\n",
1018                                        sdata->dev->name, print_mac(mac, ifsta->bssid));
1019                                 disassoc = 1;
1020                         } else
1021                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
1022                                                          local->scan_ssid,
1023                                                          local->scan_ssid_len);
1024                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
1025                 } else {
1026                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
1027                         if (time_after(jiffies, ifsta->last_probe +
1028                                        IEEE80211_PROBE_INTERVAL)) {
1029                                 ifsta->last_probe = jiffies;
1030                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
1031                                                          ifsta->ssid,
1032                                                          ifsta->ssid_len);
1033                         }
1034                 }
1035         }
1036
1037         rcu_read_unlock();
1038
1039         if (disassoc)
1040                 ieee80211_set_disassoc(sdata, ifsta, true, true,
1041                                         WLAN_REASON_PREV_AUTH_NOT_VALID);
1042         else
1043                 mod_timer(&ifsta->timer, jiffies +
1044                                       IEEE80211_MONITORING_INTERVAL);
1045 }
1046
1047
1048 static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
1049                                      struct ieee80211_if_sta *ifsta)
1050 {
1051         printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
1052         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
1053         ieee80211_associate(sdata, ifsta);
1054 }
1055
1056
1057 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
1058                                      struct ieee80211_if_sta *ifsta,
1059                                      struct ieee80211_mgmt *mgmt,
1060                                      size_t len)
1061 {
1062         u8 *pos;
1063         struct ieee802_11_elems elems;
1064
1065         pos = mgmt->u.auth.variable;
1066         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1067         if (!elems.challenge)
1068                 return;
1069         ieee80211_send_auth(sdata, ifsta, 3, elems.challenge - 2,
1070                             elems.challenge_len + 2, 1);
1071 }
1072
1073 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
1074                                         u8 dialog_token, u16 status, u16 policy,
1075                                         u16 buf_size, u16 timeout)
1076 {
1077         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1078         struct ieee80211_local *local = sdata->local;
1079         struct sk_buff *skb;
1080         struct ieee80211_mgmt *mgmt;
1081         u16 capab;
1082
1083         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1084
1085         if (!skb) {
1086                 printk(KERN_DEBUG "%s: failed to allocate buffer "
1087                        "for addba resp frame\n", sdata->dev->name);
1088                 return;
1089         }
1090
1091         skb_reserve(skb, local->hw.extra_tx_headroom);
1092         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1093         memset(mgmt, 0, 24);
1094         memcpy(mgmt->da, da, ETH_ALEN);
1095         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1096         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1097                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
1098         else
1099                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1100         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1101                                           IEEE80211_STYPE_ACTION);
1102
1103         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
1104         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1105         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
1106         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
1107
1108         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
1109         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1110         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
1111
1112         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
1113         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
1114         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
1115
1116         ieee80211_sta_tx(sdata, skb, 0);
1117
1118         return;
1119 }
1120
1121 void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata, const u8 *da,
1122                                 u16 tid, u8 dialog_token, u16 start_seq_num,
1123                                 u16 agg_size, u16 timeout)
1124 {
1125         struct ieee80211_local *local = sdata->local;
1126         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1127         struct sk_buff *skb;
1128         struct ieee80211_mgmt *mgmt;
1129         u16 capab;
1130
1131         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1132
1133         if (!skb) {
1134                 printk(KERN_ERR "%s: failed to allocate buffer "
1135                                 "for addba request frame\n", sdata->dev->name);
1136                 return;
1137         }
1138         skb_reserve(skb, local->hw.extra_tx_headroom);
1139         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1140         memset(mgmt, 0, 24);
1141         memcpy(mgmt->da, da, ETH_ALEN);
1142         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1143         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1144                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
1145         else
1146                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1147
1148         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1149                                           IEEE80211_STYPE_ACTION);
1150
1151         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
1152
1153         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1154         mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
1155
1156         mgmt->u.action.u.addba_req.dialog_token = dialog_token;
1157         capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
1158         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1159         capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
1160
1161         mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
1162
1163         mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
1164         mgmt->u.action.u.addba_req.start_seq_num =
1165                                         cpu_to_le16(start_seq_num << 4);
1166
1167         ieee80211_sta_tx(sdata, skb, 0);
1168 }
1169
1170 /*
1171  * After accepting the AddBA Request we activated a timer,
1172  * resetting it after each frame that arrives from the originator.
1173  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
1174  */
1175 static void sta_rx_agg_session_timer_expired(unsigned long data)
1176 {
1177         /* not an elegant detour, but there is no choice as the timer passes
1178          * only one argument, and various sta_info are needed here, so init
1179          * flow in sta_info_create gives the TID as data, while the timer_to_id
1180          * array gives the sta through container_of */
1181         u8 *ptid = (u8 *)data;
1182         u8 *timer_to_id = ptid - *ptid;
1183         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
1184                                          timer_to_tid[0]);
1185
1186 #ifdef CONFIG_MAC80211_HT_DEBUG
1187         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
1188 #endif
1189         ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->addr,
1190                                          (u16)*ptid, WLAN_BACK_TIMER,
1191                                          WLAN_REASON_QSTA_TIMEOUT);
1192 }
1193
1194 static void ieee80211_sta_process_addba_request(struct ieee80211_local *local,
1195                                                 struct ieee80211_mgmt *mgmt,
1196                                                 size_t len)
1197 {
1198         struct ieee80211_hw *hw = &local->hw;
1199         struct ieee80211_conf *conf = &hw->conf;
1200         struct sta_info *sta;
1201         struct tid_ampdu_rx *tid_agg_rx;
1202         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
1203         u8 dialog_token;
1204         int ret = -EOPNOTSUPP;
1205         DECLARE_MAC_BUF(mac);
1206
1207         rcu_read_lock();
1208
1209         sta = sta_info_get(local, mgmt->sa);
1210         if (!sta) {
1211                 rcu_read_unlock();
1212                 return;
1213         }
1214
1215         /* extract session parameters from addba request frame */
1216         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
1217         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
1218         start_seq_num =
1219                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
1220
1221         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1222         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
1223         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1224         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
1225
1226         status = WLAN_STATUS_REQUEST_DECLINED;
1227
1228         /* sanity check for incoming parameters:
1229          * check if configuration can support the BA policy
1230          * and if buffer size does not exceeds max value */
1231         if (((ba_policy != 1)
1232                 && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
1233                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
1234                 status = WLAN_STATUS_INVALID_QOS_PARAM;
1235 #ifdef CONFIG_MAC80211_HT_DEBUG
1236                 if (net_ratelimit())
1237                         printk(KERN_DEBUG "AddBA Req with bad params from "
1238                                 "%s on tid %u. policy %d, buffer size %d\n",
1239                                 print_mac(mac, mgmt->sa), tid, ba_policy,
1240                                 buf_size);
1241 #endif /* CONFIG_MAC80211_HT_DEBUG */
1242                 goto end_no_lock;
1243         }
1244         /* determine default buffer size */
1245         if (buf_size == 0) {
1246                 struct ieee80211_supported_band *sband;
1247
1248                 sband = local->hw.wiphy->bands[conf->channel->band];
1249                 buf_size = IEEE80211_MIN_AMPDU_BUF;
1250                 buf_size = buf_size << sband->ht_info.ampdu_factor;
1251         }
1252
1253
1254         /* examine state machine */
1255         spin_lock_bh(&sta->lock);
1256
1257         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
1258 #ifdef CONFIG_MAC80211_HT_DEBUG
1259                 if (net_ratelimit())
1260                         printk(KERN_DEBUG "unexpected AddBA Req from "
1261                                 "%s on tid %u\n",
1262                                 print_mac(mac, mgmt->sa), tid);
1263 #endif /* CONFIG_MAC80211_HT_DEBUG */
1264                 goto end;
1265         }
1266
1267         /* prepare A-MPDU MLME for Rx aggregation */
1268         sta->ampdu_mlme.tid_rx[tid] =
1269                         kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
1270         if (!sta->ampdu_mlme.tid_rx[tid]) {
1271 #ifdef CONFIG_MAC80211_HT_DEBUG
1272                 if (net_ratelimit())
1273                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
1274                                         tid);
1275 #endif
1276                 goto end;
1277         }
1278         /* rx timer */
1279         sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
1280                                 sta_rx_agg_session_timer_expired;
1281         sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
1282                                 (unsigned long)&sta->timer_to_tid[tid];
1283         init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
1284
1285         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
1286
1287         /* prepare reordering buffer */
1288         tid_agg_rx->reorder_buf =
1289                 kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
1290         if (!tid_agg_rx->reorder_buf) {
1291 #ifdef CONFIG_MAC80211_HT_DEBUG
1292                 if (net_ratelimit())
1293                         printk(KERN_ERR "can not allocate reordering buffer "
1294                                "to tid %d\n", tid);
1295 #endif
1296                 kfree(sta->ampdu_mlme.tid_rx[tid]);
1297                 goto end;
1298         }
1299         memset(tid_agg_rx->reorder_buf, 0,
1300                 buf_size * sizeof(struct sk_buff *));
1301
1302         if (local->ops->ampdu_action)
1303                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
1304                                                sta->addr, tid, &start_seq_num);
1305 #ifdef CONFIG_MAC80211_HT_DEBUG
1306         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
1307 #endif /* CONFIG_MAC80211_HT_DEBUG */
1308
1309         if (ret) {
1310                 kfree(tid_agg_rx->reorder_buf);
1311                 kfree(tid_agg_rx);
1312                 sta->ampdu_mlme.tid_rx[tid] = NULL;
1313                 goto end;
1314         }
1315
1316         /* change state and send addba resp */
1317         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
1318         tid_agg_rx->dialog_token = dialog_token;
1319         tid_agg_rx->ssn = start_seq_num;
1320         tid_agg_rx->head_seq_num = start_seq_num;
1321         tid_agg_rx->buf_size = buf_size;
1322         tid_agg_rx->timeout = timeout;
1323         tid_agg_rx->stored_mpdu_num = 0;
1324         status = WLAN_STATUS_SUCCESS;
1325 end:
1326         spin_unlock_bh(&sta->lock);
1327
1328 end_no_lock:
1329         ieee80211_send_addba_resp(sta->sdata, sta->addr, tid,
1330                                   dialog_token, status, 1, buf_size, timeout);
1331         rcu_read_unlock();
1332 }
1333
1334 static void ieee80211_sta_process_addba_resp(struct ieee80211_local *local,
1335                                              struct ieee80211_mgmt *mgmt,
1336                                              size_t len)
1337 {
1338         struct ieee80211_hw *hw = &local->hw;
1339         struct sta_info *sta;
1340         u16 capab;
1341         u16 tid;
1342         u8 *state;
1343
1344         rcu_read_lock();
1345
1346         sta = sta_info_get(local, mgmt->sa);
1347         if (!sta) {
1348                 rcu_read_unlock();
1349                 return;
1350         }
1351
1352         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
1353         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1354
1355         state = &sta->ampdu_mlme.tid_state_tx[tid];
1356
1357         spin_lock_bh(&sta->lock);
1358
1359         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1360                 spin_unlock_bh(&sta->lock);
1361                 goto addba_resp_exit;
1362         }
1363
1364         if (mgmt->u.action.u.addba_resp.dialog_token !=
1365                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
1366                 spin_unlock_bh(&sta->lock);
1367 #ifdef CONFIG_MAC80211_HT_DEBUG
1368                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
1369 #endif /* CONFIG_MAC80211_HT_DEBUG */
1370                 goto addba_resp_exit;
1371         }
1372
1373         del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
1374 #ifdef CONFIG_MAC80211_HT_DEBUG
1375         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
1376 #endif /* CONFIG_MAC80211_HT_DEBUG */
1377         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
1378                         == WLAN_STATUS_SUCCESS) {
1379                 *state |= HT_ADDBA_RECEIVED_MSK;
1380                 sta->ampdu_mlme.addba_req_num[tid] = 0;
1381
1382                 if (*state == HT_AGG_STATE_OPERATIONAL)
1383                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
1384
1385                 spin_unlock_bh(&sta->lock);
1386         } else {
1387                 sta->ampdu_mlme.addba_req_num[tid]++;
1388                 /* this will allow the state check in stop_BA_session */
1389                 *state = HT_AGG_STATE_OPERATIONAL;
1390                 spin_unlock_bh(&sta->lock);
1391                 ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
1392                                              WLAN_BACK_INITIATOR);
1393         }
1394
1395 addba_resp_exit:
1396         rcu_read_unlock();
1397 }
1398
1399 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata, const u8 *da, u16 tid,
1400                           u16 initiator, u16 reason_code)
1401 {
1402         struct ieee80211_local *local = sdata->local;
1403         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1404         struct sk_buff *skb;
1405         struct ieee80211_mgmt *mgmt;
1406         u16 params;
1407
1408         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1409
1410         if (!skb) {
1411                 printk(KERN_ERR "%s: failed to allocate buffer "
1412                                         "for delba frame\n", sdata->dev->name);
1413                 return;
1414         }
1415
1416         skb_reserve(skb, local->hw.extra_tx_headroom);
1417         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1418         memset(mgmt, 0, 24);
1419         memcpy(mgmt->da, da, ETH_ALEN);
1420         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1421         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1422                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
1423         else
1424                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1425         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1426                                           IEEE80211_STYPE_ACTION);
1427
1428         skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
1429
1430         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1431         mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
1432         params = (u16)(initiator << 11);        /* bit 11 initiator */
1433         params |= (u16)(tid << 12);             /* bit 15:12 TID number */
1434
1435         mgmt->u.action.u.delba.params = cpu_to_le16(params);
1436         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
1437
1438         ieee80211_sta_tx(sdata, skb, 0);
1439 }
1440
1441 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
1442 {
1443         struct ieee80211_local *local = sdata->local;
1444         struct sk_buff *skb;
1445         struct ieee80211_bar *bar;
1446         u16 bar_control = 0;
1447
1448         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
1449         if (!skb) {
1450                 printk(KERN_ERR "%s: failed to allocate buffer for "
1451                         "bar frame\n", sdata->dev->name);
1452                 return;
1453         }
1454         skb_reserve(skb, local->hw.extra_tx_headroom);
1455         bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
1456         memset(bar, 0, sizeof(*bar));
1457         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1458                                          IEEE80211_STYPE_BACK_REQ);
1459         memcpy(bar->ra, ra, ETH_ALEN);
1460         memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
1461         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
1462         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
1463         bar_control |= (u16)(tid << 12);
1464         bar->control = cpu_to_le16(bar_control);
1465         bar->start_seq_num = cpu_to_le16(ssn);
1466
1467         ieee80211_sta_tx(sdata, skb, 0);
1468 }
1469
1470 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
1471                                         u16 initiator, u16 reason)
1472 {
1473         struct ieee80211_local *local = sdata->local;
1474         struct ieee80211_hw *hw = &local->hw;
1475         struct sta_info *sta;
1476         int ret, i;
1477         DECLARE_MAC_BUF(mac);
1478
1479         rcu_read_lock();
1480
1481         sta = sta_info_get(local, ra);
1482         if (!sta) {
1483                 rcu_read_unlock();
1484                 return;
1485         }
1486
1487         /* check if TID is in operational state */
1488         spin_lock_bh(&sta->lock);
1489         if (sta->ampdu_mlme.tid_state_rx[tid]
1490                                 != HT_AGG_STATE_OPERATIONAL) {
1491                 spin_unlock_bh(&sta->lock);
1492                 rcu_read_unlock();
1493                 return;
1494         }
1495         sta->ampdu_mlme.tid_state_rx[tid] =
1496                 HT_AGG_STATE_REQ_STOP_BA_MSK |
1497                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
1498         spin_unlock_bh(&sta->lock);
1499
1500         /* stop HW Rx aggregation. ampdu_action existence
1501          * already verified in session init so we add the BUG_ON */
1502         BUG_ON(!local->ops->ampdu_action);
1503
1504 #ifdef CONFIG_MAC80211_HT_DEBUG
1505         printk(KERN_DEBUG "Rx BA session stop requested for %s tid %u\n",
1506                                 print_mac(mac, ra), tid);
1507 #endif /* CONFIG_MAC80211_HT_DEBUG */
1508
1509         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
1510                                         ra, tid, NULL);
1511         if (ret)
1512                 printk(KERN_DEBUG "HW problem - can not stop rx "
1513                                 "aggregation for tid %d\n", tid);
1514
1515         /* shutdown timer has not expired */
1516         if (initiator != WLAN_BACK_TIMER)
1517                 del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
1518
1519         /* check if this is a self generated aggregation halt */
1520         if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
1521                 ieee80211_send_delba(sdata, ra, tid, 0, reason);
1522
1523         /* free the reordering buffer */
1524         for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
1525                 if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
1526                         /* release the reordered frames */
1527                         dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
1528                         sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
1529                         sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
1530                 }
1531         }
1532         /* free resources */
1533         kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
1534         kfree(sta->ampdu_mlme.tid_rx[tid]);
1535         sta->ampdu_mlme.tid_rx[tid] = NULL;
1536         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
1537
1538         rcu_read_unlock();
1539 }
1540
1541
1542 static void ieee80211_sta_process_delba(struct ieee80211_sub_if_data *sdata,
1543                         struct ieee80211_mgmt *mgmt, size_t len)
1544 {
1545         struct ieee80211_local *local = sdata->local;
1546         struct sta_info *sta;
1547         u16 tid, params;
1548         u16 initiator;
1549         DECLARE_MAC_BUF(mac);
1550
1551         rcu_read_lock();
1552
1553         sta = sta_info_get(local, mgmt->sa);
1554         if (!sta) {
1555                 rcu_read_unlock();
1556                 return;
1557         }
1558
1559         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1560         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1561         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1562
1563 #ifdef CONFIG_MAC80211_HT_DEBUG
1564         if (net_ratelimit())
1565                 printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
1566                         print_mac(mac, mgmt->sa),
1567                         initiator ? "initiator" : "recipient", tid,
1568                         mgmt->u.action.u.delba.reason_code);
1569 #endif /* CONFIG_MAC80211_HT_DEBUG */
1570
1571         if (initiator == WLAN_BACK_INITIATOR)
1572                 ieee80211_sta_stop_rx_ba_session(sdata, sta->addr, tid,
1573                                                  WLAN_BACK_INITIATOR, 0);
1574         else { /* WLAN_BACK_RECIPIENT */
1575                 spin_lock_bh(&sta->lock);
1576                 sta->ampdu_mlme.tid_state_tx[tid] =
1577                                 HT_AGG_STATE_OPERATIONAL;
1578                 spin_unlock_bh(&sta->lock);
1579                 ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
1580                                              WLAN_BACK_RECIPIENT);
1581         }
1582         rcu_read_unlock();
1583 }
1584
1585 /*
1586  * After sending add Block Ack request we activated a timer until
1587  * add Block Ack response will arrive from the recipient.
1588  * If this timer expires sta_addba_resp_timer_expired will be executed.
1589  */
1590 void sta_addba_resp_timer_expired(unsigned long data)
1591 {
1592         /* not an elegant detour, but there is no choice as the timer passes
1593          * only one argument, and both sta_info and TID are needed, so init
1594          * flow in sta_info_create gives the TID as data, while the timer_to_id
1595          * array gives the sta through container_of */
1596         u16 tid = *(u8 *)data;
1597         struct sta_info *temp_sta = container_of((void *)data,
1598                 struct sta_info, timer_to_tid[tid]);
1599
1600         struct ieee80211_local *local = temp_sta->local;
1601         struct ieee80211_hw *hw = &local->hw;
1602         struct sta_info *sta;
1603         u8 *state;
1604
1605         rcu_read_lock();
1606
1607         sta = sta_info_get(local, temp_sta->addr);
1608         if (!sta) {
1609                 rcu_read_unlock();
1610                 return;
1611         }
1612
1613         state = &sta->ampdu_mlme.tid_state_tx[tid];
1614         /* check if the TID waits for addBA response */
1615         spin_lock_bh(&sta->lock);
1616         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1617                 spin_unlock_bh(&sta->lock);
1618                 *state = HT_AGG_STATE_IDLE;
1619 #ifdef CONFIG_MAC80211_HT_DEBUG
1620                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
1621                                 "expecting addBA response there", tid);
1622 #endif
1623                 goto timer_expired_exit;
1624         }
1625
1626 #ifdef CONFIG_MAC80211_HT_DEBUG
1627         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
1628 #endif
1629
1630         /* go through the state check in stop_BA_session */
1631         *state = HT_AGG_STATE_OPERATIONAL;
1632         spin_unlock_bh(&sta->lock);
1633         ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
1634                                      WLAN_BACK_INITIATOR);
1635
1636 timer_expired_exit:
1637         rcu_read_unlock();
1638 }
1639
1640 void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr)
1641 {
1642         struct ieee80211_local *local = sdata->local;
1643         int i;
1644
1645         for (i = 0; i <  STA_TID_NUM; i++) {
1646                 ieee80211_stop_tx_ba_session(&local->hw, addr, i,
1647                                              WLAN_BACK_INITIATOR);
1648                 ieee80211_sta_stop_rx_ba_session(sdata, addr, i,
1649                                                  WLAN_BACK_RECIPIENT,
1650                                                  WLAN_REASON_QSTA_LEAVE_QBSS);
1651         }
1652 }
1653
1654 static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_data *sdata,
1655                                         struct ieee80211_msrment_ie *request_ie,
1656                                         const u8 *da, const u8 *bssid,
1657                                         u8 dialog_token)
1658 {
1659         struct ieee80211_local *local = sdata->local;
1660         struct sk_buff *skb;
1661         struct ieee80211_mgmt *msr_report;
1662
1663         skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
1664                                 sizeof(struct ieee80211_msrment_ie));
1665
1666         if (!skb) {
1667                 printk(KERN_ERR "%s: failed to allocate buffer for "
1668                                 "measurement report frame\n", sdata->dev->name);
1669                 return;
1670         }
1671
1672         skb_reserve(skb, local->hw.extra_tx_headroom);
1673         msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
1674         memset(msr_report, 0, 24);
1675         memcpy(msr_report->da, da, ETH_ALEN);
1676         memcpy(msr_report->sa, sdata->dev->dev_addr, ETH_ALEN);
1677         memcpy(msr_report->bssid, bssid, ETH_ALEN);
1678         msr_report->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1679                                                 IEEE80211_STYPE_ACTION);
1680
1681         skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
1682         msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
1683         msr_report->u.action.u.measurement.action_code =
1684                                 WLAN_ACTION_SPCT_MSR_RPRT;
1685         msr_report->u.action.u.measurement.dialog_token = dialog_token;
1686
1687         msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
1688         msr_report->u.action.u.measurement.length =
1689                         sizeof(struct ieee80211_msrment_ie);
1690
1691         memset(&msr_report->u.action.u.measurement.msr_elem, 0,
1692                 sizeof(struct ieee80211_msrment_ie));
1693         msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
1694         msr_report->u.action.u.measurement.msr_elem.mode |=
1695                         IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
1696         msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
1697
1698         ieee80211_sta_tx(sdata, skb, 0);
1699 }
1700
1701 static void ieee80211_sta_process_measurement_req(struct ieee80211_sub_if_data *sdata,
1702                                                 struct ieee80211_mgmt *mgmt,
1703                                                 size_t len)
1704 {
1705         /*
1706          * Ignoring measurement request is spec violation.
1707          * Mandatory measurements must be reported optional
1708          * measurements might be refused or reported incapable
1709          * For now just refuse
1710          * TODO: Answer basic measurement as unmeasured
1711          */
1712         ieee80211_send_refuse_measurement_request(sdata,
1713                         &mgmt->u.action.u.measurement.msr_elem,
1714                         mgmt->sa, mgmt->bssid,
1715                         mgmt->u.action.u.measurement.dialog_token);
1716 }
1717
1718
1719 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
1720                                    struct ieee80211_if_sta *ifsta,
1721                                    struct ieee80211_mgmt *mgmt,
1722                                    size_t len)
1723 {
1724         u16 auth_alg, auth_transaction, status_code;
1725         DECLARE_MAC_BUF(mac);
1726
1727         if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
1728             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
1729                 return;
1730
1731         if (len < 24 + 6)
1732                 return;
1733
1734         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1735             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
1736                 return;
1737
1738         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1739             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1740                 return;
1741
1742         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1743         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1744         status_code = le16_to_cpu(mgmt->u.auth.status_code);
1745
1746         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
1747                 /*
1748                  * IEEE 802.11 standard does not require authentication in IBSS
1749                  * networks and most implementations do not seem to use it.
1750                  * However, try to reply to authentication attempts if someone
1751                  * has actually implemented this.
1752                  */
1753                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
1754                         return;
1755                 ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
1756         }
1757
1758         if (auth_alg != ifsta->auth_alg ||
1759             auth_transaction != ifsta->auth_transaction)
1760                 return;
1761
1762         if (status_code != WLAN_STATUS_SUCCESS) {
1763                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1764                         u8 algs[3];
1765                         const int num_algs = ARRAY_SIZE(algs);
1766                         int i, pos;
1767                         algs[0] = algs[1] = algs[2] = 0xff;
1768                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1769                                 algs[0] = WLAN_AUTH_OPEN;
1770                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1771                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1772                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1773                                 algs[2] = WLAN_AUTH_LEAP;
1774                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1775                                 pos = 0;
1776                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1777                                 pos = 1;
1778                         else
1779                                 pos = 2;
1780                         for (i = 0; i < num_algs; i++) {
1781                                 pos++;
1782                                 if (pos >= num_algs)
1783                                         pos = 0;
1784                                 if (algs[pos] == ifsta->auth_alg ||
1785                                     algs[pos] == 0xff)
1786                                         continue;
1787                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1788                                     !ieee80211_sta_wep_configured(sdata))
1789                                         continue;
1790                                 ifsta->auth_alg = algs[pos];
1791                                 break;
1792                         }
1793                 }
1794                 return;
1795         }
1796
1797         switch (ifsta->auth_alg) {
1798         case WLAN_AUTH_OPEN:
1799         case WLAN_AUTH_LEAP:
1800                 ieee80211_auth_completed(sdata, ifsta);
1801                 break;
1802         case WLAN_AUTH_SHARED_KEY:
1803                 if (ifsta->auth_transaction == 4)
1804                         ieee80211_auth_completed(sdata, ifsta);
1805                 else
1806                         ieee80211_auth_challenge(sdata, ifsta, mgmt, len);
1807                 break;
1808         }
1809 }
1810
1811
1812 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
1813                                      struct ieee80211_if_sta *ifsta,
1814                                      struct ieee80211_mgmt *mgmt,
1815                                      size_t len)
1816 {
1817         u16 reason_code;
1818         DECLARE_MAC_BUF(mac);
1819
1820         if (len < 24 + 2)
1821                 return;
1822
1823         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
1824                 return;
1825
1826         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1827
1828         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
1829                 printk(KERN_DEBUG "%s: deauthenticated\n", sdata->dev->name);
1830
1831         if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
1832             ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
1833             ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
1834                 ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
1835                 mod_timer(&ifsta->timer, jiffies +
1836                                       IEEE80211_RETRY_AUTH_INTERVAL);
1837         }
1838
1839         ieee80211_set_disassoc(sdata, ifsta, true, false, 0);
1840         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1841 }
1842
1843
1844 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
1845                                        struct ieee80211_if_sta *ifsta,
1846                                        struct ieee80211_mgmt *mgmt,
1847                                        size_t len)
1848 {
1849         u16 reason_code;
1850         DECLARE_MAC_BUF(mac);
1851
1852         if (len < 24 + 2)
1853                 return;
1854
1855         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
1856                 return;
1857
1858         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1859
1860         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1861                 printk(KERN_DEBUG "%s: disassociated\n", sdata->dev->name);
1862
1863         if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
1864                 ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
1865                 mod_timer(&ifsta->timer, jiffies +
1866                                       IEEE80211_RETRY_AUTH_INTERVAL);
1867         }
1868
1869         ieee80211_set_disassoc(sdata, ifsta, false, false, 0);
1870 }
1871
1872
1873 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
1874                                          struct ieee80211_if_sta *ifsta,
1875                                          struct ieee80211_mgmt *mgmt,
1876                                          size_t len,
1877                                          int reassoc)
1878 {
1879         struct ieee80211_local *local = sdata->local;
1880         struct ieee80211_supported_band *sband;
1881         struct sta_info *sta;
1882         u64 rates, basic_rates;
1883         u16 capab_info, status_code, aid;
1884         struct ieee802_11_elems elems;
1885         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
1886         u8 *pos;
1887         int i, j;
1888         DECLARE_MAC_BUF(mac);
1889         bool have_higher_than_11mbit = false;
1890
1891         /* AssocResp and ReassocResp have identical structure, so process both
1892          * of them in this function. */
1893
1894         if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATE)
1895                 return;
1896
1897         if (len < 24 + 6)
1898                 return;
1899
1900         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
1901                 return;
1902
1903         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1904         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1905         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1906
1907         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
1908                "status=%d aid=%d)\n",
1909                sdata->dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
1910                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
1911
1912         if (status_code != WLAN_STATUS_SUCCESS) {
1913                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1914                        sdata->dev->name, status_code);
1915                 /* if this was a reassociation, ensure we try a "full"
1916                  * association next time. This works around some broken APs
1917                  * which do not correctly reject reassociation requests. */
1918                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1919                 return;
1920         }
1921
1922         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1923                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1924                        "set\n", sdata->dev->name, aid);
1925         aid &= ~(BIT(15) | BIT(14));
1926
1927         pos = mgmt->u.assoc_resp.variable;
1928         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1929
1930         if (!elems.supp_rates) {
1931                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1932                        sdata->dev->name);
1933                 return;
1934         }
1935
1936         printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
1937         ifsta->aid = aid;
1938         ifsta->ap_capab = capab_info;
1939
1940         kfree(ifsta->assocresp_ies);
1941         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1942         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1943         if (ifsta->assocresp_ies)
1944                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1945
1946         rcu_read_lock();
1947
1948         /* Add STA entry for the AP */
1949         sta = sta_info_get(local, ifsta->bssid);
1950         if (!sta) {
1951                 struct ieee80211_sta_bss *bss;
1952                 int err;
1953
1954                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
1955                 if (!sta) {
1956                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
1957                                " the AP\n", sdata->dev->name);
1958                         rcu_read_unlock();
1959                         return;
1960                 }
1961                 bss = ieee80211_rx_bss_get(local, ifsta->bssid,
1962                                            local->hw.conf.channel->center_freq,
1963                                            ifsta->ssid, ifsta->ssid_len);
1964                 if (bss) {
1965                         sta->last_signal = bss->signal;
1966                         sta->last_qual = bss->qual;
1967                         sta->last_noise = bss->noise;
1968                         ieee80211_rx_bss_put(local, bss);
1969                 }
1970
1971                 err = sta_info_insert(sta);
1972                 if (err) {
1973                         printk(KERN_DEBUG "%s: failed to insert STA entry for"
1974                                " the AP (error %d)\n", sdata->dev->name, err);
1975                         rcu_read_unlock();
1976                         return;
1977                 }
1978                 /* update new sta with its last rx activity */
1979                 sta->last_rx = jiffies;
1980         }
1981
1982         /*
1983          * FIXME: Do we really need to update the sta_info's information here?
1984          *        We already know about the AP (we found it in our list) so it
1985          *        should already be filled with the right info, no?
1986          *        As is stands, all this is racy because typically we assume
1987          *        the information that is filled in here (except flags) doesn't
1988          *        change while a STA structure is alive. As such, it should move
1989          *        to between the sta_info_alloc() and sta_info_insert() above.
1990          */
1991
1992         set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
1993                            WLAN_STA_AUTHORIZED);
1994
1995         rates = 0;
1996         basic_rates = 0;
1997         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1998
1999         for (i = 0; i < elems.supp_rates_len; i++) {
2000                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
2001
2002                 if (rate > 110)
2003                         have_higher_than_11mbit = true;
2004
2005                 for (j = 0; j < sband->n_bitrates; j++) {
2006                         if (sband->bitrates[j].bitrate == rate)
2007                                 rates |= BIT(j);
2008                         if (elems.supp_rates[i] & 0x80)
2009                                 basic_rates |= BIT(j);
2010                 }
2011         }
2012
2013         for (i = 0; i < elems.ext_supp_rates_len; i++) {
2014                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
2015
2016                 if (rate > 110)
2017                         have_higher_than_11mbit = true;
2018
2019                 for (j = 0; j < sband->n_bitrates; j++) {
2020                         if (sband->bitrates[j].bitrate == rate)
2021                                 rates |= BIT(j);
2022                         if (elems.ext_supp_rates[i] & 0x80)
2023                                 basic_rates |= BIT(j);
2024                 }
2025         }
2026
2027         sta->supp_rates[local->hw.conf.channel->band] = rates;
2028         sdata->basic_rates = basic_rates;
2029
2030         /* cf. IEEE 802.11 9.2.12 */
2031         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
2032             have_higher_than_11mbit)
2033                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
2034         else
2035                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
2036
2037         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
2038             (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
2039                 struct ieee80211_ht_bss_info bss_info;
2040                 ieee80211_ht_cap_ie_to_ht_info(
2041                                 (struct ieee80211_ht_cap *)
2042                                 elems.ht_cap_elem, &sta->ht_info);
2043                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2044                                 (struct ieee80211_ht_addt_info *)
2045                                 elems.ht_info_elem, &bss_info);
2046                 ieee80211_handle_ht(local, 1, &sta->ht_info, &bss_info);
2047         }
2048
2049         rate_control_rate_init(sta, local);
2050
2051         if (elems.wmm_param) {
2052                 set_sta_flags(sta, WLAN_STA_WME);
2053                 rcu_read_unlock();
2054                 ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
2055                                          elems.wmm_param_len);
2056         } else
2057                 rcu_read_unlock();
2058
2059         /* set AID and assoc capability,
2060          * ieee80211_set_associated() will tell the driver */
2061         bss_conf->aid = aid;
2062         bss_conf->assoc_capability = capab_info;
2063         ieee80211_set_associated(sdata, ifsta);
2064
2065         ieee80211_associated(sdata, ifsta);
2066 }
2067
2068
2069 static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
2070                                    struct ieee80211_if_sta *ifsta,
2071                                    struct ieee80211_sta_bss *bss)
2072 {
2073         struct ieee80211_local *local = sdata->local;
2074         int res, rates, i, j;
2075         struct sk_buff *skb;
2076         struct ieee80211_mgmt *mgmt;
2077         u8 *pos;
2078         struct ieee80211_supported_band *sband;
2079         union iwreq_data wrqu;
2080
2081         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2082
2083         /* Remove possible STA entries from other IBSS networks. */
2084         sta_info_flush_delayed(sdata);
2085
2086         if (local->ops->reset_tsf) {
2087                 /* Reset own TSF to allow time synchronization work. */
2088                 local->ops->reset_tsf(local_to_hw(local));
2089         }
2090         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2091         res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
2092         if (res)
2093                 return res;
2094
2095         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2096
2097         sdata->drop_unencrypted = bss->capability &
2098                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2099
2100         res = ieee80211_set_freq(sdata, bss->freq);
2101
2102         if (res)
2103                 return res;
2104
2105         /* Build IBSS probe response */
2106         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2107         if (skb) {
2108                 skb_reserve(skb, local->hw.extra_tx_headroom);
2109
2110                 mgmt = (struct ieee80211_mgmt *)
2111                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2112                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2113                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2114                                                   IEEE80211_STYPE_PROBE_RESP);
2115                 memset(mgmt->da, 0xff, ETH_ALEN);
2116                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
2117                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2118                 mgmt->u.beacon.beacon_int =
2119                         cpu_to_le16(local->hw.conf.beacon_int);
2120                 mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
2121                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2122
2123                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2124                 *pos++ = WLAN_EID_SSID;
2125                 *pos++ = ifsta->ssid_len;
2126                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2127
2128                 rates = bss->supp_rates_len;
2129                 if (rates > 8)
2130                         rates = 8;
2131                 pos = skb_put(skb, 2 + rates);
2132                 *pos++ = WLAN_EID_SUPP_RATES;
2133                 *pos++ = rates;
2134                 memcpy(pos, bss->supp_rates, rates);
2135
2136                 if (bss->band == IEEE80211_BAND_2GHZ) {
2137                         pos = skb_put(skb, 2 + 1);
2138                         *pos++ = WLAN_EID_DS_PARAMS;
2139                         *pos++ = 1;
2140                         *pos++ = ieee80211_frequency_to_channel(bss->freq);
2141                 }
2142
2143                 pos = skb_put(skb, 2 + 2);
2144                 *pos++ = WLAN_EID_IBSS_PARAMS;
2145                 *pos++ = 2;
2146                 /* FIX: set ATIM window based on scan results */
2147                 *pos++ = 0;
2148                 *pos++ = 0;
2149
2150                 if (bss->supp_rates_len > 8) {
2151                         rates = bss->supp_rates_len - 8;
2152                         pos = skb_put(skb, 2 + rates);
2153                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2154                         *pos++ = rates;
2155                         memcpy(pos, &bss->supp_rates[8], rates);
2156                 }
2157
2158                 ifsta->probe_resp = skb;
2159
2160                 ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
2161         }
2162
2163         rates = 0;
2164         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2165         for (i = 0; i < bss->supp_rates_len; i++) {
2166                 int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2167                 for (j = 0; j < sband->n_bitrates; j++)
2168                         if (sband->bitrates[j].bitrate == bitrate)
2169                                 rates |= BIT(j);
2170         }
2171         ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
2172
2173         ieee80211_sta_def_wmm_params(sdata, bss, 1);
2174
2175         ifsta->state = IEEE80211_STA_MLME_IBSS_JOINED;
2176         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2177
2178         memset(&wrqu, 0, sizeof(wrqu));
2179         memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
2180         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
2181
2182         return res;
2183 }
2184
2185 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
2186                             struct ieee802_11_elems *elems,
2187                             enum ieee80211_band band)
2188 {
2189         struct ieee80211_supported_band *sband;
2190         struct ieee80211_rate *bitrates;
2191         size_t num_rates;
2192         u64 supp_rates;
2193         int i, j;
2194         sband = local->hw.wiphy->bands[band];
2195
2196         if (!sband) {
2197                 WARN_ON(1);
2198                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2199         }
2200
2201         bitrates = sband->bitrates;
2202         num_rates = sband->n_bitrates;
2203         supp_rates = 0;
2204         for (i = 0; i < elems->supp_rates_len +
2205                      elems->ext_supp_rates_len; i++) {
2206                 u8 rate = 0;
2207                 int own_rate;
2208                 if (i < elems->supp_rates_len)
2209                         rate = elems->supp_rates[i];
2210                 else if (elems->ext_supp_rates)
2211                         rate = elems->ext_supp_rates
2212                                 [i - elems->supp_rates_len];
2213                 own_rate = 5 * (rate & 0x7f);
2214                 for (j = 0; j < num_rates; j++)
2215                         if (bitrates[j].bitrate == own_rate)
2216                                 supp_rates |= BIT(j);
2217         }
2218         return supp_rates;
2219 }
2220
2221 static u64 ieee80211_sta_get_mandatory_rates(struct ieee80211_local *local,
2222                                         enum ieee80211_band band)
2223 {
2224         struct ieee80211_supported_band *sband;
2225         struct ieee80211_rate *bitrates;
2226         u64 mandatory_rates;
2227         enum ieee80211_rate_flags mandatory_flag;
2228         int i;
2229
2230         sband = local->hw.wiphy->bands[band];
2231         if (!sband) {
2232                 WARN_ON(1);
2233                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2234         }
2235
2236         if (band == IEEE80211_BAND_2GHZ)
2237                 mandatory_flag = IEEE80211_RATE_MANDATORY_B;
2238         else
2239                 mandatory_flag = IEEE80211_RATE_MANDATORY_A;
2240
2241         bitrates = sband->bitrates;
2242         mandatory_rates = 0;
2243         for (i = 0; i < sband->n_bitrates; i++)
2244                 if (bitrates[i].flags & mandatory_flag)
2245                         mandatory_rates |= BIT(i);
2246         return mandatory_rates;
2247 }
2248
2249 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2250                                   struct ieee80211_mgmt *mgmt,
2251                                   size_t len,
2252                                   struct ieee80211_rx_status *rx_status,
2253                                   struct ieee802_11_elems *elems,
2254                                   bool beacon)
2255 {
2256         struct ieee80211_local *local = sdata->local;
2257         int freq;
2258         struct ieee80211_sta_bss *bss;
2259         struct sta_info *sta;
2260         struct ieee80211_channel *channel;
2261         u64 beacon_timestamp, rx_timestamp;
2262         u64 supp_rates = 0;
2263         enum ieee80211_band band = rx_status->band;
2264         DECLARE_MAC_BUF(mac);
2265         DECLARE_MAC_BUF(mac2);
2266
2267         if (elems->ds_params && elems->ds_params_len == 1)
2268                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
2269         else
2270                 freq = rx_status->freq;
2271
2272         channel = ieee80211_get_channel(local->hw.wiphy, freq);
2273
2274         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
2275                 return;
2276
2277         if (ieee80211_vif_is_mesh(&sdata->vif) && elems->mesh_id &&
2278             elems->mesh_config && mesh_matches_local(elems, sdata)) {
2279                 supp_rates = ieee80211_sta_get_rates(local, elems, band);
2280
2281                 mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
2282                                       mesh_peer_accepts_plinks(elems));
2283         }
2284
2285         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems->supp_rates &&
2286             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2287                 supp_rates = ieee80211_sta_get_rates(local, elems, band);
2288
2289                 rcu_read_lock();
2290
2291                 sta = sta_info_get(local, mgmt->sa);
2292                 if (sta) {
2293                         u64 prev_rates;
2294
2295                         prev_rates = sta->supp_rates[band];
2296                         /* make sure mandatory rates are always added */
2297                         sta->supp_rates[band] = supp_rates |
2298                                 ieee80211_sta_get_mandatory_rates(local, band);
2299
2300 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2301                         if (sta->supp_rates[band] != prev_rates)
2302                                 printk(KERN_DEBUG "%s: updated supp_rates set "
2303                                     "for %s based on beacon info (0x%llx | "
2304                                     "0x%llx -> 0x%llx)\n",
2305                                     sdata->dev->name, print_mac(mac, sta->addr),
2306                                     (unsigned long long) prev_rates,
2307                                     (unsigned long long) supp_rates,
2308                                     (unsigned long long) sta->supp_rates[band]);
2309 #endif
2310                 } else {
2311                         ieee80211_ibss_add_sta(sdata, NULL, mgmt->bssid,
2312                                                mgmt->sa, supp_rates);
2313                 }
2314
2315                 rcu_read_unlock();
2316         }
2317
2318         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2319                                         freq, beacon);
2320         if (!bss)
2321                 return;
2322
2323         /* was just updated in ieee80211_bss_info_update */
2324         beacon_timestamp = bss->timestamp;
2325
2326         /*
2327          * In STA mode, the remaining parameters should not be overridden
2328          * by beacons because they're not necessarily accurate there.
2329          */
2330         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
2331             bss->last_probe_resp && beacon) {
2332                 ieee80211_rx_bss_put(local, bss);
2333                 return;
2334         }
2335
2336         /* check if we need to merge IBSS */
2337         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
2338             bss->capability & WLAN_CAPABILITY_IBSS &&
2339             bss->freq == local->oper_channel->center_freq &&
2340             elems->ssid_len == sdata->u.sta.ssid_len &&
2341             memcmp(elems->ssid, sdata->u.sta.ssid,
2342                                 sdata->u.sta.ssid_len) == 0) {
2343                 if (rx_status->flag & RX_FLAG_TSFT) {
2344                         /* in order for correct IBSS merging we need mactime
2345                          *
2346                          * since mactime is defined as the time the first data
2347                          * symbol of the frame hits the PHY, and the timestamp
2348                          * of the beacon is defined as "the time that the data
2349                          * symbol containing the first bit of the timestamp is
2350                          * transmitted to the PHY plus the transmitting STA’s
2351                          * delays through its local PHY from the MAC-PHY
2352                          * interface to its interface with the WM"
2353                          * (802.11 11.1.2) - equals the time this bit arrives at
2354                          * the receiver - we have to take into account the
2355                          * offset between the two.
2356                          * e.g: at 1 MBit that means mactime is 192 usec earlier
2357                          * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
2358                          */
2359                         int rate = local->hw.wiphy->bands[band]->
2360                                         bitrates[rx_status->rate_idx].bitrate;
2361                         rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
2362                 } else if (local && local->ops && local->ops->get_tsf)
2363                         /* second best option: get current TSF */
2364                         rx_timestamp = local->ops->get_tsf(local_to_hw(local));
2365                 else
2366                         /* can't merge without knowing the TSF */
2367                         rx_timestamp = -1LLU;
2368 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2369                 printk(KERN_DEBUG "RX beacon SA=%s BSSID="
2370                        "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
2371                        print_mac(mac, mgmt->sa),
2372                        print_mac(mac2, mgmt->bssid),
2373                        (unsigned long long)rx_timestamp,
2374                        (unsigned long long)beacon_timestamp,
2375                        (unsigned long long)(rx_timestamp - beacon_timestamp),
2376                        jiffies);
2377 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2378                 if (beacon_timestamp > rx_timestamp) {
2379 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2380                         printk(KERN_DEBUG "%s: beacon TSF higher than "
2381                                "local TSF - IBSS merge with BSSID %s\n",
2382                                sdata->dev->name, print_mac(mac, mgmt->bssid));
2383 #endif
2384                         ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
2385                         ieee80211_ibss_add_sta(sdata, NULL,
2386                                                mgmt->bssid, mgmt->sa,
2387                                                supp_rates);
2388                 }
2389         }
2390
2391         ieee80211_rx_bss_put(local, bss);
2392 }
2393
2394
2395 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2396                                          struct ieee80211_mgmt *mgmt,
2397                                          size_t len,
2398                                          struct ieee80211_rx_status *rx_status)
2399 {
2400         size_t baselen;
2401         struct ieee802_11_elems elems;
2402         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2403
2404         if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
2405                 return; /* ignore ProbeResp to foreign address */
2406
2407         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2408         if (baselen > len)
2409                 return;
2410
2411         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2412                                 &elems);
2413
2414         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
2415
2416         /* direct probe may be part of the association flow */
2417         if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
2418                                                         &ifsta->request)) {
2419                 printk(KERN_DEBUG "%s direct probe responded\n",
2420                        sdata->dev->name);
2421                 ieee80211_authenticate(sdata, ifsta);
2422         }
2423 }
2424
2425
2426 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2427                                      struct ieee80211_mgmt *mgmt,
2428                                      size_t len,
2429                                      struct ieee80211_rx_status *rx_status)
2430 {
2431         struct ieee80211_if_sta *ifsta;
2432         size_t baselen;
2433         struct ieee802_11_elems elems;
2434         struct ieee80211_local *local = sdata->local;
2435         struct ieee80211_conf *conf = &local->hw.conf;
2436         u32 changed = 0;
2437
2438         /* Process beacon from the current BSS */
2439         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2440         if (baselen > len)
2441                 return;
2442
2443         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2444
2445         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
2446
2447         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2448                 return;
2449         ifsta = &sdata->u.sta;
2450
2451         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
2452             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
2453                 return;
2454
2455         ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
2456                                  elems.wmm_param_len);
2457
2458         if (elems.erp_info && elems.erp_info_len >= 1)
2459                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
2460         else {
2461                 u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
2462                 changed |= ieee80211_handle_protect_preamb(sdata, false,
2463                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
2464         }
2465
2466         if (elems.ht_cap_elem && elems.ht_info_elem &&
2467             elems.wmm_param && conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
2468                 struct ieee80211_ht_bss_info bss_info;
2469
2470                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2471                                 (struct ieee80211_ht_addt_info *)
2472                                 elems.ht_info_elem, &bss_info);
2473                 changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf,
2474                                                &bss_info);
2475         }
2476
2477         ieee80211_bss_info_change_notify(sdata, changed);
2478 }
2479
2480
2481 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
2482                                         struct ieee80211_if_sta *ifsta,
2483                                         struct ieee80211_mgmt *mgmt,
2484                                         size_t len,
2485                                         struct ieee80211_rx_status *rx_status)
2486 {
2487         struct ieee80211_local *local = sdata->local;
2488         int tx_last_beacon;
2489         struct sk_buff *skb;
2490         struct ieee80211_mgmt *resp;
2491         u8 *pos, *end;
2492         DECLARE_MAC_BUF(mac);
2493 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2494         DECLARE_MAC_BUF(mac2);
2495         DECLARE_MAC_BUF(mac3);
2496 #endif
2497
2498         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS ||
2499             ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
2500             len < 24 + 2 || !ifsta->probe_resp)
2501                 return;
2502
2503         if (local->ops->tx_last_beacon)
2504                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
2505         else
2506                 tx_last_beacon = 1;
2507
2508 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2509         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
2510                "%s (tx_last_beacon=%d)\n",
2511                sdata->dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
2512                print_mac(mac3, mgmt->bssid), tx_last_beacon);
2513 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2514
2515         if (!tx_last_beacon)
2516                 return;
2517
2518         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
2519             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2520                 return;
2521
2522         end = ((u8 *) mgmt) + len;
2523         pos = mgmt->u.probe_req.variable;
2524         if (pos[0] != WLAN_EID_SSID ||
2525             pos + 2 + pos[1] > end) {
2526 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2527                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
2528                        "from %s\n",
2529                        sdata->dev->name, print_mac(mac, mgmt->sa));
2530 #endif
2531                 return;
2532         }
2533         if (pos[1] != 0 &&
2534             (pos[1] != ifsta->ssid_len ||
2535              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
2536                 /* Ignore ProbeReq for foreign SSID */
2537                 return;
2538         }
2539
2540         /* Reply with ProbeResp */
2541         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
2542         if (!skb)
2543                 return;
2544
2545         resp = (struct ieee80211_mgmt *) skb->data;
2546         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2547 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2548         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
2549                sdata->dev->name, print_mac(mac, resp->da));
2550 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2551         ieee80211_sta_tx(sdata, skb, 0);
2552 }
2553
2554 static void ieee80211_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
2555                                      struct ieee80211_if_sta *ifsta,
2556                                      struct ieee80211_mgmt *mgmt,
2557                                      size_t len,
2558                                      struct ieee80211_rx_status *rx_status)
2559 {
2560         struct ieee80211_local *local = sdata->local;
2561
2562         /* all categories we currently handle have action_code */
2563         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2564                 return;
2565
2566         switch (mgmt->u.action.category) {
2567         case WLAN_CATEGORY_SPECTRUM_MGMT:
2568                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
2569                         break;
2570                 switch (mgmt->u.action.u.measurement.action_code) {
2571                 case WLAN_ACTION_SPCT_MSR_REQ:
2572                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2573                                    sizeof(mgmt->u.action.u.measurement)))
2574                                 break;
2575                         ieee80211_sta_process_measurement_req(sdata, mgmt, len);
2576                         break;
2577                 }
2578                 break;
2579         case WLAN_CATEGORY_BACK:
2580                 switch (mgmt->u.action.u.addba_req.action_code) {
2581                 case WLAN_ACTION_ADDBA_REQ:
2582                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2583                                    sizeof(mgmt->u.action.u.addba_req)))
2584                                 break;
2585                         ieee80211_sta_process_addba_request(local, mgmt, len);
2586                         break;
2587                 case WLAN_ACTION_ADDBA_RESP:
2588                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2589                                    sizeof(mgmt->u.action.u.addba_resp)))
2590                                 break;
2591                         ieee80211_sta_process_addba_resp(local, mgmt, len);
2592                         break;
2593                 case WLAN_ACTION_DELBA:
2594                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2595                                    sizeof(mgmt->u.action.u.delba)))
2596                                 break;
2597                         ieee80211_sta_process_delba(sdata, mgmt, len);
2598                         break;
2599                 }
2600                 break;
2601         case PLINK_CATEGORY:
2602                 if (ieee80211_vif_is_mesh(&sdata->vif))
2603                         mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
2604                 break;
2605         case MESH_PATH_SEL_CATEGORY:
2606                 if (ieee80211_vif_is_mesh(&sdata->vif))
2607                         mesh_rx_path_sel_frame(sdata, mgmt, len);
2608                 break;
2609         }
2610 }
2611
2612 void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
2613                            struct ieee80211_rx_status *rx_status)
2614 {
2615         struct ieee80211_local *local = sdata->local;
2616         struct ieee80211_if_sta *ifsta;
2617         struct ieee80211_mgmt *mgmt;
2618         u16 fc;
2619
2620         if (skb->len < 24)
2621                 goto fail;
2622
2623         ifsta = &sdata->u.sta;
2624
2625         mgmt = (struct ieee80211_mgmt *) skb->data;
2626         fc = le16_to_cpu(mgmt->frame_control);
2627
2628         switch (fc & IEEE80211_FCTL_STYPE) {
2629         case IEEE80211_STYPE_PROBE_REQ:
2630         case IEEE80211_STYPE_PROBE_RESP:
2631         case IEEE80211_STYPE_BEACON:
2632         case IEEE80211_STYPE_ACTION:
2633                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
2634         case IEEE80211_STYPE_AUTH:
2635         case IEEE80211_STYPE_ASSOC_RESP:
2636         case IEEE80211_STYPE_REASSOC_RESP:
2637         case IEEE80211_STYPE_DEAUTH:
2638         case IEEE80211_STYPE_DISASSOC:
2639                 skb_queue_tail(&ifsta->skb_queue, skb);
2640                 queue_work(local->hw.workqueue, &ifsta->work);
2641                 return;
2642         }
2643
2644  fail:
2645         kfree_skb(skb);
2646 }
2647
2648 static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
2649                                          struct sk_buff *skb)
2650 {
2651         struct ieee80211_rx_status *rx_status;
2652         struct ieee80211_if_sta *ifsta;
2653         struct ieee80211_mgmt *mgmt;
2654         u16 fc;
2655
2656         ifsta = &sdata->u.sta;
2657
2658         rx_status = (struct ieee80211_rx_status *) skb->cb;
2659         mgmt = (struct ieee80211_mgmt *) skb->data;
2660         fc = le16_to_cpu(mgmt->frame_control);
2661
2662         switch (fc & IEEE80211_FCTL_STYPE) {
2663         case IEEE80211_STYPE_PROBE_REQ:
2664                 ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt, skb->len,
2665                                             rx_status);
2666                 break;
2667         case IEEE80211_STYPE_PROBE_RESP:
2668                 ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len, rx_status);
2669                 break;
2670         case IEEE80211_STYPE_BEACON:
2671                 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
2672                 break;
2673         case IEEE80211_STYPE_AUTH:
2674                 ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
2675                 break;
2676         case IEEE80211_STYPE_ASSOC_RESP:
2677                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
2678                 break;
2679         case IEEE80211_STYPE_REASSOC_RESP:
2680                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
2681                 break;
2682         case IEEE80211_STYPE_DEAUTH:
2683                 ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
2684                 break;
2685         case IEEE80211_STYPE_DISASSOC:
2686                 ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt, skb->len);
2687                 break;
2688         case IEEE80211_STYPE_ACTION:
2689                 ieee80211_rx_mgmt_action(sdata, ifsta, mgmt, skb->len, rx_status);
2690                 break;
2691         }
2692
2693         kfree_skb(skb);
2694 }
2695
2696
2697 static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
2698 {
2699         struct ieee80211_local *local = sdata->local;
2700         int active = 0;
2701         struct sta_info *sta;
2702
2703         rcu_read_lock();
2704
2705         list_for_each_entry_rcu(sta, &local->sta_list, list) {
2706                 if (sta->sdata == sdata &&
2707                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2708                                jiffies)) {
2709                         active++;
2710                         break;
2711                 }
2712         }
2713
2714         rcu_read_unlock();
2715
2716         return active;
2717 }
2718
2719
2720 static void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata, unsigned long exp_time)
2721 {
2722         struct ieee80211_local *local = sdata->local;
2723         struct sta_info *sta, *tmp;
2724         LIST_HEAD(tmp_list);
2725         DECLARE_MAC_BUF(mac);
2726         unsigned long flags;
2727
2728         spin_lock_irqsave(&local->sta_lock, flags);
2729         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
2730                 if (time_after(jiffies, sta->last_rx + exp_time)) {
2731 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2732                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
2733                                sdata->dev->name, print_mac(mac, sta->addr));
2734 #endif
2735                         __sta_info_unlink(&sta);
2736                         if (sta)
2737                                 list_add(&sta->list, &tmp_list);
2738                 }
2739         spin_unlock_irqrestore(&local->sta_lock, flags);
2740
2741         list_for_each_entry_safe(sta, tmp, &tmp_list, list)
2742                 sta_info_destroy(sta);
2743 }
2744
2745
2746 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata,
2747                                      struct ieee80211_if_sta *ifsta)
2748 {
2749         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2750
2751         ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
2752         if (ieee80211_sta_active_ibss(sdata))
2753                 return;
2754
2755         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
2756                "IBSS networks with same SSID (merge)\n", sdata->dev->name);
2757         ieee80211_sta_req_scan(sdata, ifsta->ssid, ifsta->ssid_len);
2758 }
2759
2760
2761 #ifdef CONFIG_MAC80211_MESH
2762 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
2763                            struct ieee80211_if_sta *ifsta)
2764 {
2765         bool free_plinks;
2766
2767         ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
2768         mesh_path_expire(sdata);
2769
2770         free_plinks = mesh_plink_availables(sdata);
2771         if (free_plinks != sdata->u.sta.accepting_plinks)
2772                 ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
2773
2774         mod_timer(&ifsta->timer, jiffies +
2775                         IEEE80211_MESH_HOUSEKEEPING_INTERVAL);
2776 }
2777
2778
2779 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
2780 {
2781         struct ieee80211_if_sta *ifsta;
2782         ifsta = &sdata->u.sta;
2783         ifsta->state = IEEE80211_STA_MLME_MESH_UP;
2784         ieee80211_sta_timer((unsigned long)sdata);
2785         ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
2786 }
2787 #endif
2788
2789
2790 void ieee80211_sta_timer(unsigned long data)
2791 {
2792         struct ieee80211_sub_if_data *sdata =
2793                 (struct ieee80211_sub_if_data *) data;
2794         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2795         struct ieee80211_local *local = sdata->local;
2796
2797         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2798         queue_work(local->hw.workqueue, &ifsta->work);
2799 }
2800
2801 static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
2802                                      struct ieee80211_if_sta *ifsta)
2803 {
2804         struct ieee80211_local *local = sdata->local;
2805
2806         if (local->ops->reset_tsf) {
2807                 /* Reset own TSF to allow time synchronization work. */
2808                 local->ops->reset_tsf(local_to_hw(local));
2809         }
2810
2811         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
2812
2813
2814         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
2815                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2816         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2817                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
2818         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
2819                 ifsta->auth_alg = WLAN_AUTH_LEAP;
2820         else
2821                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2822         ifsta->auth_transaction = -1;
2823         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
2824         ifsta->assoc_scan_tries = 0;
2825         ifsta->direct_probe_tries = 0;
2826         ifsta->auth_tries = 0;
2827         ifsta->assoc_tries = 0;
2828         netif_tx_stop_all_queues(sdata->dev);
2829         netif_carrier_off(sdata->dev);
2830 }
2831
2832
2833 void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
2834                             struct ieee80211_if_sta *ifsta)
2835 {
2836         struct ieee80211_local *local = sdata->local;
2837
2838         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2839                 return;
2840
2841         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
2842                              IEEE80211_STA_AUTO_BSSID_SEL)) &&
2843             (ifsta->flags & (IEEE80211_STA_SSID_SET |
2844                              IEEE80211_STA_AUTO_SSID_SEL))) {
2845
2846                 if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED)
2847                         ieee80211_set_disassoc(sdata, ifsta, true, true,
2848                                                WLAN_REASON_DEAUTH_LEAVING);
2849
2850                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2851                 queue_work(local->hw.workqueue, &ifsta->work);
2852         }
2853 }
2854
2855 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
2856                                     const char *ssid, int ssid_len)
2857 {
2858         int tmp, hidden_ssid;
2859
2860         if (ssid_len == ifsta->ssid_len &&
2861             !memcmp(ifsta->ssid, ssid, ssid_len))
2862                 return 1;
2863
2864         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
2865                 return 0;
2866
2867         hidden_ssid = 1;
2868         tmp = ssid_len;
2869         while (tmp--) {
2870                 if (ssid[tmp] != '\0') {
2871                         hidden_ssid = 0;
2872                         break;
2873                 }
2874         }
2875
2876         if (hidden_ssid && ifsta->ssid_len == ssid_len)
2877                 return 1;
2878
2879         if (ssid_len == 1 && ssid[0] == ' ')
2880                 return 1;
2881
2882         return 0;
2883 }
2884
2885 static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
2886                                      struct ieee80211_if_sta *ifsta)
2887 {
2888         struct ieee80211_local *local = sdata->local;
2889         struct ieee80211_sta_bss *bss;
2890         struct ieee80211_supported_band *sband;
2891         u8 bssid[ETH_ALEN], *pos;
2892         int i;
2893         int ret;
2894         DECLARE_MAC_BUF(mac);
2895
2896 #if 0
2897         /* Easier testing, use fixed BSSID. */
2898         memset(bssid, 0xfe, ETH_ALEN);
2899 #else
2900         /* Generate random, not broadcast, locally administered BSSID. Mix in
2901          * own MAC address to make sure that devices that do not have proper
2902          * random number generator get different BSSID. */
2903         get_random_bytes(bssid, ETH_ALEN);
2904         for (i = 0; i < ETH_ALEN; i++)
2905                 bssid[i] ^= sdata->dev->dev_addr[i];
2906         bssid[0] &= ~0x01;
2907         bssid[0] |= 0x02;
2908 #endif
2909
2910         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
2911                sdata->dev->name, print_mac(mac, bssid));
2912
2913         bss = ieee80211_rx_bss_add(local, bssid,
2914                                    local->hw.conf.channel->center_freq,
2915                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
2916         if (!bss)
2917                 return -ENOMEM;
2918
2919         bss->band = local->hw.conf.channel->band;
2920         sband = local->hw.wiphy->bands[bss->band];
2921
2922         if (local->hw.conf.beacon_int == 0)
2923                 local->hw.conf.beacon_int = 100;
2924         bss->beacon_int = local->hw.conf.beacon_int;
2925         bss->last_update = jiffies;
2926         bss->capability = WLAN_CAPABILITY_IBSS;
2927
2928         if (sdata->default_key)
2929                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
2930         else
2931                 sdata->drop_unencrypted = 0;
2932
2933         bss->supp_rates_len = sband->n_bitrates;
2934         pos = bss->supp_rates;
2935         for (i = 0; i < sband->n_bitrates; i++) {
2936                 int rate = sband->bitrates[i].bitrate;
2937                 *pos++ = (u8) (rate / 5);
2938         }
2939
2940         ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
2941         ieee80211_rx_bss_put(local, bss);
2942         return ret;
2943 }
2944
2945
2946 static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
2947                                    struct ieee80211_if_sta *ifsta)
2948 {
2949         struct ieee80211_local *local = sdata->local;
2950         struct ieee80211_sta_bss *bss;
2951         int found = 0;
2952         u8 bssid[ETH_ALEN];
2953         int active_ibss;
2954         DECLARE_MAC_BUF(mac);
2955         DECLARE_MAC_BUF(mac2);
2956
2957         if (ifsta->ssid_len == 0)
2958                 return -EINVAL;
2959
2960         active_ibss = ieee80211_sta_active_ibss(sdata);
2961 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2962         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2963                sdata->dev->name, active_ibss);
2964 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2965         spin_lock_bh(&local->sta_bss_lock);
2966         list_for_each_entry(bss, &local->sta_bss_list, list) {
2967                 if (ifsta->ssid_len != bss->ssid_len ||
2968                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2969                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2970                         continue;
2971 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2972                 printk(KERN_DEBUG "   bssid=%s found\n",
2973                        print_mac(mac, bss->bssid));
2974 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2975                 memcpy(bssid, bss->bssid, ETH_ALEN);
2976                 found = 1;
2977                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2978                         break;
2979         }
2980         spin_unlock_bh(&local->sta_bss_lock);
2981
2982 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2983         if (found)
2984                 printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
2985                        "%s\n", print_mac(mac, bssid),
2986                        print_mac(mac2, ifsta->bssid));
2987 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2988
2989         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
2990                 int ret;
2991                 int search_freq;
2992
2993                 if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
2994                         search_freq = bss->freq;
2995                 else
2996                         search_freq = local->hw.conf.channel->center_freq;
2997
2998                 bss = ieee80211_rx_bss_get(local, bssid, search_freq,
2999                                            ifsta->ssid, ifsta->ssid_len);
3000                 if (!bss)
3001                         goto dont_join;
3002
3003                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
3004                        " based on configured SSID\n",
3005                        sdata->dev->name, print_mac(mac, bssid));
3006                 ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
3007                 ieee80211_rx_bss_put(local, bss);
3008                 return ret;
3009         }
3010
3011 dont_join:
3012 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3013         printk(KERN_DEBUG "   did not try to join ibss\n");
3014 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3015
3016         /* Selected IBSS not found in current scan results - try to scan */
3017         if (ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED &&
3018             !ieee80211_sta_active_ibss(sdata)) {
3019                 mod_timer(&ifsta->timer, jiffies +
3020                                       IEEE80211_IBSS_MERGE_INTERVAL);
3021         } else if (time_after(jiffies, local->last_scan_completed +
3022                               IEEE80211_SCAN_INTERVAL)) {
3023                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
3024                        "join\n", sdata->dev->name);
3025                 return ieee80211_sta_req_scan(sdata, ifsta->ssid,
3026                                               ifsta->ssid_len);
3027         } else if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED) {
3028                 int interval = IEEE80211_SCAN_INTERVAL;
3029
3030                 if (time_after(jiffies, ifsta->ibss_join_req +
3031                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
3032                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
3033                             (!(local->oper_channel->flags &
3034                                         IEEE80211_CHAN_NO_IBSS)))
3035                                 return ieee80211_sta_create_ibss(sdata, ifsta);
3036                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
3037                                 printk(KERN_DEBUG "%s: IBSS not allowed on"
3038                                        " %d MHz\n", sdata->dev->name,
3039                                        local->hw.conf.channel->center_freq);
3040                         }
3041
3042                         /* No IBSS found - decrease scan interval and continue
3043                          * scanning. */
3044                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
3045                 }
3046
3047                 ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
3048                 mod_timer(&ifsta->timer, jiffies + interval);
3049                 return 0;
3050         }
3051
3052         return 0;
3053 }
3054
3055
3056 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
3057 {
3058         struct ieee80211_if_sta *ifsta;
3059         int res;
3060
3061         if (len > IEEE80211_MAX_SSID_LEN)
3062                 return -EINVAL;
3063
3064         ifsta = &sdata->u.sta;
3065
3066         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
3067                 memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
3068                 memcpy(ifsta->ssid, ssid, len);
3069                 ifsta->ssid_len = len;
3070                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
3071
3072                 res = 0;
3073                 /*
3074                  * Hack! MLME code needs to be cleaned up to have different
3075                  * entry points for configuration and internal selection change
3076                  */
3077                 if (netif_running(sdata->dev))
3078                         res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
3079                 if (res) {
3080                         printk(KERN_DEBUG "%s: Failed to config new SSID to "
3081                                "the low-level driver\n", sdata->dev->name);
3082                         return res;
3083                 }
3084         }
3085
3086         if (len)
3087                 ifsta->flags |= IEEE80211_STA_SSID_SET;
3088         else
3089                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
3090
3091         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3092             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
3093                 ifsta->ibss_join_req = jiffies;
3094                 ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
3095                 return ieee80211_sta_find_ibss(sdata, ifsta);
3096         }
3097
3098         return 0;
3099 }
3100
3101
3102 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
3103 {
3104         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3105         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
3106         *len = ifsta->ssid_len;
3107         return 0;
3108 }
3109
3110
3111 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
3112 {
3113         struct ieee80211_if_sta *ifsta;
3114         int res;
3115
3116         ifsta = &sdata->u.sta;
3117
3118         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
3119                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
3120                 res = 0;
3121                 /*
3122                  * Hack! See also ieee80211_sta_set_ssid.
3123                  */
3124                 if (netif_running(sdata->dev))
3125                         res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
3126                 if (res) {
3127                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
3128                                "the low-level driver\n", sdata->dev->name);
3129                         return res;
3130                 }
3131         }
3132
3133         if (is_valid_ether_addr(bssid))
3134                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
3135         else
3136                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
3137
3138         return 0;
3139 }
3140
3141
3142 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata, char *ie, size_t len)
3143 {
3144         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3145
3146         kfree(ifsta->extra_ie);
3147         if (len == 0) {
3148                 ifsta->extra_ie = NULL;
3149                 ifsta->extra_ie_len = 0;
3150                 return 0;
3151         }
3152         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3153         if (!ifsta->extra_ie) {
3154                 ifsta->extra_ie_len = 0;
3155                 return -ENOMEM;
3156         }
3157         memcpy(ifsta->extra_ie, ie, len);
3158         ifsta->extra_ie_len = len;
3159         return 0;
3160 }
3161
3162
3163 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
3164                                         struct sk_buff *skb, u8 *bssid,
3165                                         u8 *addr, u64 supp_rates)
3166 {
3167         struct ieee80211_local *local = sdata->local;
3168         struct sta_info *sta;
3169         DECLARE_MAC_BUF(mac);
3170         int band = local->hw.conf.channel->band;
3171
3172         /* TODO: Could consider removing the least recently used entry and
3173          * allow new one to be added. */
3174         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3175                 if (net_ratelimit()) {
3176                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3177                                "entry %s\n", sdata->dev->name, print_mac(mac, addr));
3178                 }
3179                 return NULL;
3180         }
3181
3182         if (compare_ether_addr(bssid, sdata->u.sta.bssid))
3183                 return NULL;
3184
3185 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
3186         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
3187                wiphy_name(local->hw.wiphy), print_mac(mac, addr), sdata->dev->name);
3188 #endif
3189
3190         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
3191         if (!sta)
3192                 return NULL;
3193
3194         set_sta_flags(sta, WLAN_STA_AUTHORIZED);
3195
3196         /* make sure mandatory rates are always added */
3197         sta->supp_rates[band] = supp_rates |
3198                         ieee80211_sta_get_mandatory_rates(local, band);
3199
3200         rate_control_rate_init(sta, local);
3201
3202         if (sta_info_insert(sta))
3203                 return NULL;
3204
3205         return sta;
3206 }
3207
3208
3209 static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
3210                                      struct ieee80211_if_sta *ifsta)
3211 {
3212         struct ieee80211_local *local = sdata->local;
3213         struct ieee80211_sta_bss *bss, *selected = NULL;
3214         int top_rssi = 0, freq;
3215
3216         spin_lock_bh(&local->sta_bss_lock);
3217         freq = local->oper_channel->center_freq;
3218         list_for_each_entry(bss, &local->sta_bss_list, list) {
3219                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
3220                         continue;
3221
3222                 if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
3223                         IEEE80211_STA_AUTO_BSSID_SEL |
3224                         IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
3225                     (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
3226                      !!sdata->default_key))
3227                         continue;
3228
3229                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
3230                     bss->freq != freq)
3231                         continue;
3232
3233                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
3234                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
3235                         continue;
3236
3237                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
3238                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
3239                         continue;
3240
3241                 if (!selected || top_rssi < bss->signal) {
3242                         selected = bss;
3243                         top_rssi = bss->signal;
3244                 }
3245         }
3246         if (selected)
3247                 atomic_inc(&selected->users);
3248         spin_unlock_bh(&local->sta_bss_lock);
3249
3250         if (selected) {
3251                 ieee80211_set_freq(sdata, selected->freq);
3252                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
3253                         ieee80211_sta_set_ssid(sdata, selected->ssid,
3254                                                selected->ssid_len);
3255                 ieee80211_sta_set_bssid(sdata, selected->bssid);
3256                 ieee80211_sta_def_wmm_params(sdata, selected, 0);
3257
3258                 /* Send out direct probe if no probe resp was received or
3259                  * the one we have is outdated
3260                  */
3261                 if (!selected->last_probe_resp ||
3262                     time_after(jiffies, selected->last_probe_resp
3263                                         + IEEE80211_SCAN_RESULT_EXPIRE))
3264                         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
3265                 else
3266                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
3267
3268                 ieee80211_rx_bss_put(local, selected);
3269                 ieee80211_sta_reset_auth(sdata, ifsta);
3270                 return 0;
3271         } else {
3272                 if (ifsta->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
3273                         ifsta->assoc_scan_tries++;
3274                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
3275                                 ieee80211_sta_start_scan(sdata, NULL, 0);
3276                         else
3277                                 ieee80211_sta_start_scan(sdata, ifsta->ssid,
3278                                                          ifsta->ssid_len);
3279                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
3280                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
3281                 } else
3282                         ifsta->state = IEEE80211_STA_MLME_DISABLED;
3283         }
3284         return -1;
3285 }
3286
3287
3288 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
3289 {
3290         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3291
3292         printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
3293                sdata->dev->name, reason);
3294
3295         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3296             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
3297                 return -EINVAL;
3298
3299         ieee80211_set_disassoc(sdata, ifsta, true, true, reason);
3300         return 0;
3301 }
3302
3303
3304 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
3305 {
3306         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3307
3308         printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
3309                sdata->dev->name, reason);
3310
3311         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3312                 return -EINVAL;
3313
3314         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
3315                 return -1;
3316
3317         ieee80211_set_disassoc(sdata, ifsta, false, true, reason);
3318         return 0;
3319 }
3320
3321 void ieee80211_notify_mac(struct ieee80211_hw *hw,
3322                           enum ieee80211_notification_types  notif_type)
3323 {
3324         struct ieee80211_local *local = hw_to_local(hw);
3325         struct ieee80211_sub_if_data *sdata;
3326
3327         switch (notif_type) {
3328         case IEEE80211_NOTIFY_RE_ASSOC:
3329                 rcu_read_lock();
3330                 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3331                         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3332                                 continue;
3333
3334                         ieee80211_sta_req_auth(sdata, &sdata->u.sta);
3335                 }
3336                 rcu_read_unlock();
3337                 break;
3338         }
3339 }
3340 EXPORT_SYMBOL(ieee80211_notify_mac);
3341
3342 void ieee80211_sta_work(struct work_struct *work)
3343 {
3344         struct ieee80211_sub_if_data *sdata =
3345                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
3346         struct ieee80211_local *local = sdata->local;
3347         struct ieee80211_if_sta *ifsta;
3348         struct sk_buff *skb;
3349
3350         if (!netif_running(sdata->dev))
3351                 return;
3352
3353         if (local->sta_sw_scanning || local->sta_hw_scanning)
3354                 return;
3355
3356         if (WARN_ON(sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3357                     sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
3358                     sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
3359                 return;
3360         ifsta = &sdata->u.sta;
3361
3362         while ((skb = skb_dequeue(&ifsta->skb_queue)))
3363                 ieee80211_sta_rx_queued_mgmt(sdata, skb);
3364
3365 #ifdef CONFIG_MAC80211_MESH
3366         if (ifsta->preq_queue_len &&
3367             time_after(jiffies,
3368                        ifsta->last_preq + msecs_to_jiffies(ifsta->mshcfg.dot11MeshHWMPpreqMinInterval)))
3369                 mesh_path_start_discovery(sdata);
3370 #endif
3371
3372         if (ifsta->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
3373             ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
3374             ifsta->state != IEEE80211_STA_MLME_ASSOCIATE &&
3375             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
3376                 if (ifsta->scan_ssid_len)
3377                         ieee80211_sta_start_scan(sdata, ifsta->scan_ssid, ifsta->scan_ssid_len);
3378                 else
3379                         ieee80211_sta_start_scan(sdata, NULL, 0);
3380                 return;
3381         }
3382
3383         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
3384                 if (ieee80211_sta_config_auth(sdata, ifsta))
3385                         return;
3386                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
3387         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
3388                 return;
3389
3390         switch (ifsta->state) {
3391         case IEEE80211_STA_MLME_DISABLED:
3392                 break;
3393         case IEEE80211_STA_MLME_DIRECT_PROBE:
3394                 ieee80211_direct_probe(sdata, ifsta);
3395                 break;
3396         case IEEE80211_STA_MLME_AUTHENTICATE:
3397                 ieee80211_authenticate(sdata, ifsta);
3398                 break;
3399         case IEEE80211_STA_MLME_ASSOCIATE:
3400                 ieee80211_associate(sdata, ifsta);
3401                 break;
3402         case IEEE80211_STA_MLME_ASSOCIATED:
3403                 ieee80211_associated(sdata, ifsta);
3404                 break;
3405         case IEEE80211_STA_MLME_IBSS_SEARCH:
3406                 ieee80211_sta_find_ibss(sdata, ifsta);
3407                 break;
3408         case IEEE80211_STA_MLME_IBSS_JOINED:
3409                 ieee80211_sta_merge_ibss(sdata, ifsta);
3410                 break;
3411 #ifdef CONFIG_MAC80211_MESH
3412         case IEEE80211_STA_MLME_MESH_UP:
3413                 ieee80211_mesh_housekeeping(sdata, ifsta);
3414                 break;
3415 #endif
3416         default:
3417                 WARN_ON(1);
3418                 break;
3419         }
3420
3421         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
3422                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
3423                        "mixed-cell disabled - disassociate\n", sdata->dev->name);
3424
3425                 ieee80211_set_disassoc(sdata, ifsta, false, true,
3426                                         WLAN_REASON_UNSPECIFIED);
3427         }
3428 }
3429
3430 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3431 {
3432         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
3433         struct ieee80211_if_sta *ifsta;
3434
3435         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
3436                 ifsta = &sdata->u.sta;
3437                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
3438                     (!(ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED) &&
3439                     !ieee80211_sta_active_ibss(sdata)))
3440                         ieee80211_sta_find_ibss(sdata, ifsta);
3441         }
3442 }