Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
[linux-2.6.git] / net / mac80211 / mlme.c
1 /*
2  * BSS client mode implementation
3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
4  * Copyright 2004, Instant802 Networks, Inc.
5  * Copyright 2005, Devicescape Software, Inc.
6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License version 2 as
11  * published by the Free Software Foundation.
12  */
13
14 /* TODO:
15  * order BSS list by RSSI(?) ("quality of AP")
16  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
17  *    SSID)
18  */
19 #include <linux/delay.h>
20 #include <linux/if_ether.h>
21 #include <linux/skbuff.h>
22 #include <linux/netdevice.h>
23 #include <linux/if_arp.h>
24 #include <linux/wireless.h>
25 #include <linux/random.h>
26 #include <linux/etherdevice.h>
27 #include <linux/rtnetlink.h>
28 #include <net/iw_handler.h>
29 #include <asm/types.h>
30
31 #include <net/mac80211.h>
32 #include "ieee80211_i.h"
33 #include "rate.h"
34 #include "led.h"
35 #include "mesh.h"
36
37 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
38 #define IEEE80211_AUTH_MAX_TRIES 3
39 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
40 #define IEEE80211_ASSOC_MAX_TRIES 3
41 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
42 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
43 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
44 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
45 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
46 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
47 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
48
49 #define IEEE80211_PROBE_DELAY (HZ / 33)
50 #define IEEE80211_CHANNEL_TIME (HZ / 33)
51 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
52 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
53 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
54 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
55 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
56
57 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
58
59
60 #define ERP_INFO_USE_PROTECTION BIT(1)
61
62 /* mgmt header + 1 byte action code */
63 #define IEEE80211_MIN_ACTION_SIZE (24 + 1)
64
65 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
66 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
67 #define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
68 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
69 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
70
71 /* next values represent the buffer size for A-MPDU frame.
72  * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) */
73 #define IEEE80211_MIN_AMPDU_BUF 0x8
74 #define IEEE80211_MAX_AMPDU_BUF 0x40
75
76 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
77                                      u8 *ssid, size_t ssid_len);
78 static struct ieee80211_sta_bss *
79 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
80                      u8 *ssid, u8 ssid_len);
81 static void ieee80211_rx_bss_put(struct net_device *dev,
82                                  struct ieee80211_sta_bss *bss);
83 static int ieee80211_sta_find_ibss(struct net_device *dev,
84                                    struct ieee80211_if_sta *ifsta);
85 static int ieee80211_sta_wep_configured(struct net_device *dev);
86 static int ieee80211_sta_start_scan(struct net_device *dev,
87                                     u8 *ssid, size_t ssid_len);
88 static int ieee80211_sta_config_auth(struct net_device *dev,
89                                      struct ieee80211_if_sta *ifsta);
90 static void sta_rx_agg_session_timer_expired(unsigned long data);
91
92
93 void ieee802_11_parse_elems(u8 *start, size_t len,
94                             struct ieee802_11_elems *elems)
95 {
96         size_t left = len;
97         u8 *pos = start;
98
99         memset(elems, 0, sizeof(*elems));
100
101         while (left >= 2) {
102                 u8 id, elen;
103
104                 id = *pos++;
105                 elen = *pos++;
106                 left -= 2;
107
108                 if (elen > left)
109                         return;
110
111                 switch (id) {
112                 case WLAN_EID_SSID:
113                         elems->ssid = pos;
114                         elems->ssid_len = elen;
115                         break;
116                 case WLAN_EID_SUPP_RATES:
117                         elems->supp_rates = pos;
118                         elems->supp_rates_len = elen;
119                         break;
120                 case WLAN_EID_FH_PARAMS:
121                         elems->fh_params = pos;
122                         elems->fh_params_len = elen;
123                         break;
124                 case WLAN_EID_DS_PARAMS:
125                         elems->ds_params = pos;
126                         elems->ds_params_len = elen;
127                         break;
128                 case WLAN_EID_CF_PARAMS:
129                         elems->cf_params = pos;
130                         elems->cf_params_len = elen;
131                         break;
132                 case WLAN_EID_TIM:
133                         elems->tim = pos;
134                         elems->tim_len = elen;
135                         break;
136                 case WLAN_EID_IBSS_PARAMS:
137                         elems->ibss_params = pos;
138                         elems->ibss_params_len = elen;
139                         break;
140                 case WLAN_EID_CHALLENGE:
141                         elems->challenge = pos;
142                         elems->challenge_len = elen;
143                         break;
144                 case WLAN_EID_WPA:
145                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
146                             pos[2] == 0xf2) {
147                                 /* Microsoft OUI (00:50:F2) */
148                                 if (pos[3] == 1) {
149                                         /* OUI Type 1 - WPA IE */
150                                         elems->wpa = pos;
151                                         elems->wpa_len = elen;
152                                 } else if (elen >= 5 && pos[3] == 2) {
153                                         if (pos[4] == 0) {
154                                                 elems->wmm_info = pos;
155                                                 elems->wmm_info_len = elen;
156                                         } else if (pos[4] == 1) {
157                                                 elems->wmm_param = pos;
158                                                 elems->wmm_param_len = elen;
159                                         }
160                                 }
161                         }
162                         break;
163                 case WLAN_EID_RSN:
164                         elems->rsn = pos;
165                         elems->rsn_len = elen;
166                         break;
167                 case WLAN_EID_ERP_INFO:
168                         elems->erp_info = pos;
169                         elems->erp_info_len = elen;
170                         break;
171                 case WLAN_EID_EXT_SUPP_RATES:
172                         elems->ext_supp_rates = pos;
173                         elems->ext_supp_rates_len = elen;
174                         break;
175                 case WLAN_EID_HT_CAPABILITY:
176                         elems->ht_cap_elem = pos;
177                         elems->ht_cap_elem_len = elen;
178                         break;
179                 case WLAN_EID_HT_EXTRA_INFO:
180                         elems->ht_info_elem = pos;
181                         elems->ht_info_elem_len = elen;
182                         break;
183                 case WLAN_EID_MESH_ID:
184                         elems->mesh_id = pos;
185                         elems->mesh_id_len = elen;
186                         break;
187                 case WLAN_EID_MESH_CONFIG:
188                         elems->mesh_config = pos;
189                         elems->mesh_config_len = elen;
190                         break;
191                 case WLAN_EID_PEER_LINK:
192                         elems->peer_link = pos;
193                         elems->peer_link_len = elen;
194                         break;
195                 case WLAN_EID_PREQ:
196                         elems->preq = pos;
197                         elems->preq_len = elen;
198                         break;
199                 case WLAN_EID_PREP:
200                         elems->prep = pos;
201                         elems->prep_len = elen;
202                         break;
203                 case WLAN_EID_PERR:
204                         elems->perr = pos;
205                         elems->perr_len = elen;
206                         break;
207                 default:
208                         break;
209                 }
210
211                 left -= elen;
212                 pos += elen;
213         }
214 }
215
216
217 static int ecw2cw(int ecw)
218 {
219         return (1 << ecw) - 1;
220 }
221
222
223 static void ieee80211_sta_def_wmm_params(struct net_device *dev,
224                                          struct ieee80211_sta_bss *bss,
225                                          int ibss)
226 {
227         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
228         struct ieee80211_local *local = sdata->local;
229         int i, have_higher_than_11mbit = 0;
230
231
232         /* cf. IEEE 802.11 9.2.12 */
233         for (i = 0; i < bss->supp_rates_len; i++)
234                 if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
235                         have_higher_than_11mbit = 1;
236
237         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
238             have_higher_than_11mbit)
239                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
240         else
241                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
242
243
244         if (local->ops->conf_tx) {
245                 struct ieee80211_tx_queue_params qparam;
246
247                 memset(&qparam, 0, sizeof(qparam));
248
249                 qparam.aifs = 2;
250
251                 if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
252                     !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
253                         qparam.cw_min = 31;
254                 else
255                         qparam.cw_min = 15;
256
257                 qparam.cw_max = 1023;
258                 qparam.txop = 0;
259
260                 for (i = 0; i < local_to_hw(local)->queues; i++)
261                         local->ops->conf_tx(local_to_hw(local), i, &qparam);
262         }
263 }
264
265 static void ieee80211_sta_wmm_params(struct net_device *dev,
266                                      struct ieee80211_if_sta *ifsta,
267                                      u8 *wmm_param, size_t wmm_param_len)
268 {
269         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
270         struct ieee80211_tx_queue_params params;
271         size_t left;
272         int count;
273         u8 *pos;
274
275         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
276                 return;
277         count = wmm_param[6] & 0x0f;
278         if (count == ifsta->wmm_last_param_set)
279                 return;
280         ifsta->wmm_last_param_set = count;
281
282         pos = wmm_param + 8;
283         left = wmm_param_len - 8;
284
285         memset(&params, 0, sizeof(params));
286
287         if (!local->ops->conf_tx)
288                 return;
289
290         local->wmm_acm = 0;
291         for (; left >= 4; left -= 4, pos += 4) {
292                 int aci = (pos[0] >> 5) & 0x03;
293                 int acm = (pos[0] >> 4) & 0x01;
294                 int queue;
295
296                 switch (aci) {
297                 case 1:
298                         queue = 3;
299                         if (acm)
300                                 local->wmm_acm |= BIT(0) | BIT(3);
301                         break;
302                 case 2:
303                         queue = 1;
304                         if (acm)
305                                 local->wmm_acm |= BIT(4) | BIT(5);
306                         break;
307                 case 3:
308                         queue = 0;
309                         if (acm)
310                                 local->wmm_acm |= BIT(6) | BIT(7);
311                         break;
312                 case 0:
313                 default:
314                         queue = 2;
315                         if (acm)
316                                 local->wmm_acm |= BIT(1) | BIT(2);
317                         break;
318                 }
319
320                 params.aifs = pos[0] & 0x0f;
321                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
322                 params.cw_min = ecw2cw(pos[1] & 0x0f);
323                 params.txop = pos[2] | (pos[3] << 8);
324 #ifdef CONFIG_MAC80211_DEBUG
325                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
326                        "cWmin=%d cWmax=%d txop=%d\n",
327                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
328                        params.cw_max, params.txop);
329 #endif
330                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
331                  * AC for now) */
332                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
333                         printk(KERN_DEBUG "%s: failed to set TX queue "
334                                "parameters for queue %d\n", dev->name, queue);
335                 }
336         }
337 }
338
339 static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
340                                            bool use_protection,
341                                            bool use_short_preamble)
342 {
343         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
344         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
345         DECLARE_MAC_BUF(mac);
346         u32 changed = 0;
347
348         if (use_protection != bss_conf->use_cts_prot) {
349                 if (net_ratelimit()) {
350                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
351                                "%s)\n",
352                                sdata->dev->name,
353                                use_protection ? "enabled" : "disabled",
354                                print_mac(mac, ifsta->bssid));
355                 }
356                 bss_conf->use_cts_prot = use_protection;
357                 changed |= BSS_CHANGED_ERP_CTS_PROT;
358         }
359
360         if (use_short_preamble != bss_conf->use_short_preamble) {
361                 if (net_ratelimit()) {
362                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
363                                " (BSSID=%s)\n",
364                                sdata->dev->name,
365                                use_short_preamble ? "short" : "long",
366                                print_mac(mac, ifsta->bssid));
367                 }
368                 bss_conf->use_short_preamble = use_short_preamble;
369                 changed |= BSS_CHANGED_ERP_PREAMBLE;
370         }
371
372         return changed;
373 }
374
375 static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
376                                    u8 erp_value)
377 {
378         bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
379         bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
380
381         return ieee80211_handle_protect_preamb(sdata,
382                         use_protection, use_short_preamble);
383 }
384
385 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
386                                            struct ieee80211_sta_bss *bss)
387 {
388         u32 changed = 0;
389
390         if (bss->has_erp_value)
391                 changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
392         else {
393                 u16 capab = bss->capability;
394                 changed |= ieee80211_handle_protect_preamb(sdata, false,
395                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
396         }
397
398         return changed;
399 }
400
401 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
402                                    struct ieee80211_ht_info *ht_info)
403 {
404
405         if (ht_info == NULL)
406                 return -EINVAL;
407
408         memset(ht_info, 0, sizeof(*ht_info));
409
410         if (ht_cap_ie) {
411                 u8 ampdu_info = ht_cap_ie->ampdu_params_info;
412
413                 ht_info->ht_supported = 1;
414                 ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
415                 ht_info->ampdu_factor =
416                         ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
417                 ht_info->ampdu_density =
418                         (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
419                 memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
420         } else
421                 ht_info->ht_supported = 0;
422
423         return 0;
424 }
425
426 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
427                         struct ieee80211_ht_addt_info *ht_add_info_ie,
428                         struct ieee80211_ht_bss_info *bss_info)
429 {
430         if (bss_info == NULL)
431                 return -EINVAL;
432
433         memset(bss_info, 0, sizeof(*bss_info));
434
435         if (ht_add_info_ie) {
436                 u16 op_mode;
437                 op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
438
439                 bss_info->primary_channel = ht_add_info_ie->control_chan;
440                 bss_info->bss_cap = ht_add_info_ie->ht_param;
441                 bss_info->bss_op_mode = (u8)(op_mode & 0xff);
442         }
443
444         return 0;
445 }
446
447 static void ieee80211_sta_send_associnfo(struct net_device *dev,
448                                          struct ieee80211_if_sta *ifsta)
449 {
450         char *buf;
451         size_t len;
452         int i;
453         union iwreq_data wrqu;
454
455         if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
456                 return;
457
458         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
459                                 ifsta->assocresp_ies_len), GFP_KERNEL);
460         if (!buf)
461                 return;
462
463         len = sprintf(buf, "ASSOCINFO(");
464         if (ifsta->assocreq_ies) {
465                 len += sprintf(buf + len, "ReqIEs=");
466                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
467                         len += sprintf(buf + len, "%02x",
468                                        ifsta->assocreq_ies[i]);
469                 }
470         }
471         if (ifsta->assocresp_ies) {
472                 if (ifsta->assocreq_ies)
473                         len += sprintf(buf + len, " ");
474                 len += sprintf(buf + len, "RespIEs=");
475                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
476                         len += sprintf(buf + len, "%02x",
477                                        ifsta->assocresp_ies[i]);
478                 }
479         }
480         len += sprintf(buf + len, ")");
481
482         if (len > IW_CUSTOM_MAX) {
483                 len = sprintf(buf, "ASSOCRESPIE=");
484                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
485                         len += sprintf(buf + len, "%02x",
486                                        ifsta->assocresp_ies[i]);
487                 }
488         }
489
490         memset(&wrqu, 0, sizeof(wrqu));
491         wrqu.data.length = len;
492         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
493
494         kfree(buf);
495 }
496
497
498 static void ieee80211_set_associated(struct net_device *dev,
499                                      struct ieee80211_if_sta *ifsta,
500                                      bool assoc)
501 {
502         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
503         struct ieee80211_local *local = sdata->local;
504         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
505         union iwreq_data wrqu;
506         u32 changed = BSS_CHANGED_ASSOC;
507
508         if (assoc) {
509                 struct ieee80211_sta_bss *bss;
510
511                 ifsta->flags |= IEEE80211_STA_ASSOCIATED;
512
513                 if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
514                         return;
515
516                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
517                                            conf->channel->center_freq,
518                                            ifsta->ssid, ifsta->ssid_len);
519                 if (bss) {
520                         /* set timing information */
521                         sdata->bss_conf.beacon_int = bss->beacon_int;
522                         sdata->bss_conf.timestamp = bss->timestamp;
523
524                         changed |= ieee80211_handle_bss_capability(sdata, bss);
525
526                         ieee80211_rx_bss_put(dev, bss);
527                 }
528
529                 if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
530                         changed |= BSS_CHANGED_HT;
531                         sdata->bss_conf.assoc_ht = 1;
532                         sdata->bss_conf.ht_conf = &conf->ht_conf;
533                         sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
534                 }
535
536                 netif_carrier_on(dev);
537                 ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
538                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
539                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
540                 ieee80211_sta_send_associnfo(dev, ifsta);
541         } else {
542                 ieee80211_sta_tear_down_BA_sessions(dev, ifsta->bssid);
543                 ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
544                 netif_carrier_off(dev);
545                 ieee80211_reset_erp_info(dev);
546
547                 sdata->bss_conf.assoc_ht = 0;
548                 sdata->bss_conf.ht_conf = NULL;
549                 sdata->bss_conf.ht_bss_conf = NULL;
550
551                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
552         }
553         ifsta->last_probe = jiffies;
554         ieee80211_led_assoc(local, assoc);
555
556         sdata->bss_conf.assoc = assoc;
557         ieee80211_bss_info_change_notify(sdata, changed);
558         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
559         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
560 }
561
562 static void ieee80211_set_disassoc(struct net_device *dev,
563                                    struct ieee80211_if_sta *ifsta, int deauth)
564 {
565         if (deauth)
566                 ifsta->auth_tries = 0;
567         ifsta->assoc_tries = 0;
568         ieee80211_set_associated(dev, ifsta, 0);
569 }
570
571 void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
572                       int encrypt)
573 {
574         struct ieee80211_sub_if_data *sdata;
575         struct ieee80211_tx_packet_data *pkt_data;
576
577         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
578         skb->dev = sdata->local->mdev;
579         skb_set_mac_header(skb, 0);
580         skb_set_network_header(skb, 0);
581         skb_set_transport_header(skb, 0);
582
583         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
584         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
585         pkt_data->ifindex = sdata->dev->ifindex;
586         if (!encrypt)
587                 pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
588
589         dev_queue_xmit(skb);
590 }
591
592
593 static void ieee80211_send_auth(struct net_device *dev,
594                                 struct ieee80211_if_sta *ifsta,
595                                 int transaction, u8 *extra, size_t extra_len,
596                                 int encrypt)
597 {
598         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
599         struct sk_buff *skb;
600         struct ieee80211_mgmt *mgmt;
601
602         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
603                             sizeof(*mgmt) + 6 + extra_len);
604         if (!skb) {
605                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
606                        "frame\n", dev->name);
607                 return;
608         }
609         skb_reserve(skb, local->hw.extra_tx_headroom);
610
611         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
612         memset(mgmt, 0, 24 + 6);
613         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
614                                            IEEE80211_STYPE_AUTH);
615         if (encrypt)
616                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
617         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
618         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
619         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
620         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
621         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
622         ifsta->auth_transaction = transaction + 1;
623         mgmt->u.auth.status_code = cpu_to_le16(0);
624         if (extra)
625                 memcpy(skb_put(skb, extra_len), extra, extra_len);
626
627         ieee80211_sta_tx(dev, skb, encrypt);
628 }
629
630
631 static void ieee80211_authenticate(struct net_device *dev,
632                                    struct ieee80211_if_sta *ifsta)
633 {
634         DECLARE_MAC_BUF(mac);
635
636         ifsta->auth_tries++;
637         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
638                 printk(KERN_DEBUG "%s: authentication with AP %s"
639                        " timed out\n",
640                        dev->name, print_mac(mac, ifsta->bssid));
641                 ifsta->state = IEEE80211_DISABLED;
642                 return;
643         }
644
645         ifsta->state = IEEE80211_AUTHENTICATE;
646         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
647                dev->name, print_mac(mac, ifsta->bssid));
648
649         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
650
651         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
652 }
653
654 static int ieee80211_compatible_rates(struct ieee80211_sta_bss *bss,
655                                       struct ieee80211_supported_band *sband,
656                                       u64 *rates)
657 {
658         int i, j, count;
659         *rates = 0;
660         count = 0;
661         for (i = 0; i < bss->supp_rates_len; i++) {
662                 int rate = (bss->supp_rates[i] & 0x7F) * 5;
663
664                 for (j = 0; j < sband->n_bitrates; j++)
665                         if (sband->bitrates[j].bitrate == rate) {
666                                 *rates |= BIT(j);
667                                 count++;
668                                 break;
669                         }
670         }
671
672         return count;
673 }
674
675 static void ieee80211_send_assoc(struct net_device *dev,
676                                  struct ieee80211_if_sta *ifsta)
677 {
678         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
679         struct sk_buff *skb;
680         struct ieee80211_mgmt *mgmt;
681         u8 *pos, *ies;
682         int i, len, count, rates_len, supp_rates_len;
683         u16 capab;
684         struct ieee80211_sta_bss *bss;
685         int wmm = 0;
686         struct ieee80211_supported_band *sband;
687         u64 rates = 0;
688
689         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
690                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
691                             ifsta->ssid_len);
692         if (!skb) {
693                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
694                        "frame\n", dev->name);
695                 return;
696         }
697         skb_reserve(skb, local->hw.extra_tx_headroom);
698
699         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
700
701         capab = ifsta->capab;
702
703         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
704                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
705                         capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
706                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
707                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
708         }
709
710         bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
711                                    local->hw.conf.channel->center_freq,
712                                    ifsta->ssid, ifsta->ssid_len);
713         if (bss) {
714                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
715                         capab |= WLAN_CAPABILITY_PRIVACY;
716                 if (bss->wmm_ie)
717                         wmm = 1;
718                 ieee80211_rx_bss_put(dev, bss);
719         }
720
721         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
722         memset(mgmt, 0, 24);
723         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
724         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
725         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
726
727         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
728                 skb_put(skb, 10);
729                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
730                                                    IEEE80211_STYPE_REASSOC_REQ);
731                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
732                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
733                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
734                        ETH_ALEN);
735         } else {
736                 skb_put(skb, 4);
737                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
738                                                    IEEE80211_STYPE_ASSOC_REQ);
739                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
740                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
741         }
742
743         /* SSID */
744         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
745         *pos++ = WLAN_EID_SSID;
746         *pos++ = ifsta->ssid_len;
747         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
748
749         /* all supported rates should be added here but some APs
750          * (e.g. D-Link DAP 1353 in b-only mode) don't like that
751          * Therefore only add rates the AP supports */
752         rates_len = ieee80211_compatible_rates(bss, sband, &rates);
753         supp_rates_len = rates_len;
754         if (supp_rates_len > 8)
755                 supp_rates_len = 8;
756
757         len = sband->n_bitrates;
758         pos = skb_put(skb, supp_rates_len + 2);
759         *pos++ = WLAN_EID_SUPP_RATES;
760         *pos++ = supp_rates_len;
761
762         count = 0;
763         for (i = 0; i < sband->n_bitrates; i++) {
764                 if (BIT(i) & rates) {
765                         int rate = sband->bitrates[i].bitrate;
766                         *pos++ = (u8) (rate / 5);
767                         if (++count == 8)
768                                 break;
769                 }
770         }
771
772         if (count == 8) {
773                 pos = skb_put(skb, rates_len - count + 2);
774                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
775                 *pos++ = rates_len - count;
776
777                 for (i++; i < sband->n_bitrates; i++) {
778                         if (BIT(i) & rates) {
779                                 int rate = sband->bitrates[i].bitrate;
780                                 *pos++ = (u8) (rate / 5);
781                         }
782                 }
783         }
784
785         if (ifsta->extra_ie) {
786                 pos = skb_put(skb, ifsta->extra_ie_len);
787                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
788         }
789
790         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
791                 pos = skb_put(skb, 9);
792                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
793                 *pos++ = 7; /* len */
794                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
795                 *pos++ = 0x50;
796                 *pos++ = 0xf2;
797                 *pos++ = 2; /* WME */
798                 *pos++ = 0; /* WME info */
799                 *pos++ = 1; /* WME ver */
800                 *pos++ = 0;
801         }
802         /* wmm support is a must to HT */
803         if (wmm && sband->ht_info.ht_supported) {
804                 __le16 tmp = cpu_to_le16(sband->ht_info.cap);
805                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
806                 *pos++ = WLAN_EID_HT_CAPABILITY;
807                 *pos++ = sizeof(struct ieee80211_ht_cap);
808                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
809                 memcpy(pos, &tmp, sizeof(u16));
810                 pos += sizeof(u16);
811                 /* TODO: needs a define here for << 2 */
812                 *pos++ = sband->ht_info.ampdu_factor |
813                          (sband->ht_info.ampdu_density << 2);
814                 memcpy(pos, sband->ht_info.supp_mcs_set, 16);
815         }
816
817         kfree(ifsta->assocreq_ies);
818         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
819         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
820         if (ifsta->assocreq_ies)
821                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
822
823         ieee80211_sta_tx(dev, skb, 0);
824 }
825
826
827 static void ieee80211_send_deauth(struct net_device *dev,
828                                   struct ieee80211_if_sta *ifsta, u16 reason)
829 {
830         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
831         struct sk_buff *skb;
832         struct ieee80211_mgmt *mgmt;
833
834         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
835         if (!skb) {
836                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
837                        "frame\n", dev->name);
838                 return;
839         }
840         skb_reserve(skb, local->hw.extra_tx_headroom);
841
842         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
843         memset(mgmt, 0, 24);
844         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
845         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
846         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
847         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
848                                            IEEE80211_STYPE_DEAUTH);
849         skb_put(skb, 2);
850         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
851
852         ieee80211_sta_tx(dev, skb, 0);
853 }
854
855
856 static void ieee80211_send_disassoc(struct net_device *dev,
857                                     struct ieee80211_if_sta *ifsta, u16 reason)
858 {
859         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
860         struct sk_buff *skb;
861         struct ieee80211_mgmt *mgmt;
862
863         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
864         if (!skb) {
865                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
866                        "frame\n", dev->name);
867                 return;
868         }
869         skb_reserve(skb, local->hw.extra_tx_headroom);
870
871         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
872         memset(mgmt, 0, 24);
873         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
874         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
875         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
876         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
877                                            IEEE80211_STYPE_DISASSOC);
878         skb_put(skb, 2);
879         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
880
881         ieee80211_sta_tx(dev, skb, 0);
882 }
883
884
885 static int ieee80211_privacy_mismatch(struct net_device *dev,
886                                       struct ieee80211_if_sta *ifsta)
887 {
888         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
889         struct ieee80211_sta_bss *bss;
890         int bss_privacy;
891         int wep_privacy;
892         int privacy_invoked;
893
894         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
895                 return 0;
896
897         bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
898                                    local->hw.conf.channel->center_freq,
899                                    ifsta->ssid, ifsta->ssid_len);
900         if (!bss)
901                 return 0;
902
903         bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
904         wep_privacy = !!ieee80211_sta_wep_configured(dev);
905         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
906
907         ieee80211_rx_bss_put(dev, bss);
908
909         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
910                 return 0;
911
912         return 1;
913 }
914
915
916 static void ieee80211_associate(struct net_device *dev,
917                                 struct ieee80211_if_sta *ifsta)
918 {
919         DECLARE_MAC_BUF(mac);
920
921         ifsta->assoc_tries++;
922         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
923                 printk(KERN_DEBUG "%s: association with AP %s"
924                        " timed out\n",
925                        dev->name, print_mac(mac, ifsta->bssid));
926                 ifsta->state = IEEE80211_DISABLED;
927                 return;
928         }
929
930         ifsta->state = IEEE80211_ASSOCIATE;
931         printk(KERN_DEBUG "%s: associate with AP %s\n",
932                dev->name, print_mac(mac, ifsta->bssid));
933         if (ieee80211_privacy_mismatch(dev, ifsta)) {
934                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
935                        "mixed-cell disabled - abort association\n", dev->name);
936                 ifsta->state = IEEE80211_DISABLED;
937                 return;
938         }
939
940         ieee80211_send_assoc(dev, ifsta);
941
942         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
943 }
944
945
946 static void ieee80211_associated(struct net_device *dev,
947                                  struct ieee80211_if_sta *ifsta)
948 {
949         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
950         struct sta_info *sta;
951         int disassoc;
952         DECLARE_MAC_BUF(mac);
953
954         /* TODO: start monitoring current AP signal quality and number of
955          * missed beacons. Scan other channels every now and then and search
956          * for better APs. */
957         /* TODO: remove expired BSSes */
958
959         ifsta->state = IEEE80211_ASSOCIATED;
960
961         rcu_read_lock();
962
963         sta = sta_info_get(local, ifsta->bssid);
964         if (!sta) {
965                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
966                        dev->name, print_mac(mac, ifsta->bssid));
967                 disassoc = 1;
968         } else {
969                 disassoc = 0;
970                 if (time_after(jiffies,
971                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
972                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
973                                 printk(KERN_DEBUG "%s: No ProbeResp from "
974                                        "current AP %s - assume out of "
975                                        "range\n",
976                                        dev->name, print_mac(mac, ifsta->bssid));
977                                 disassoc = 1;
978                                 sta_info_unlink(&sta);
979                         } else
980                                 ieee80211_send_probe_req(dev, ifsta->bssid,
981                                                          local->scan_ssid,
982                                                          local->scan_ssid_len);
983                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
984                 } else {
985                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
986                         if (time_after(jiffies, ifsta->last_probe +
987                                        IEEE80211_PROBE_INTERVAL)) {
988                                 ifsta->last_probe = jiffies;
989                                 ieee80211_send_probe_req(dev, ifsta->bssid,
990                                                          ifsta->ssid,
991                                                          ifsta->ssid_len);
992                         }
993                 }
994         }
995
996         rcu_read_unlock();
997
998         if (disassoc && sta)
999                 sta_info_destroy(sta);
1000
1001         if (disassoc) {
1002                 ifsta->state = IEEE80211_DISABLED;
1003                 ieee80211_set_associated(dev, ifsta, 0);
1004         } else {
1005                 mod_timer(&ifsta->timer, jiffies +
1006                                       IEEE80211_MONITORING_INTERVAL);
1007         }
1008 }
1009
1010
1011 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
1012                                      u8 *ssid, size_t ssid_len)
1013 {
1014         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1015         struct ieee80211_supported_band *sband;
1016         struct sk_buff *skb;
1017         struct ieee80211_mgmt *mgmt;
1018         u8 *pos, *supp_rates, *esupp_rates = NULL;
1019         int i;
1020
1021         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
1022         if (!skb) {
1023                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
1024                        "request\n", dev->name);
1025                 return;
1026         }
1027         skb_reserve(skb, local->hw.extra_tx_headroom);
1028
1029         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1030         memset(mgmt, 0, 24);
1031         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1032                                            IEEE80211_STYPE_PROBE_REQ);
1033         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1034         if (dst) {
1035                 memcpy(mgmt->da, dst, ETH_ALEN);
1036                 memcpy(mgmt->bssid, dst, ETH_ALEN);
1037         } else {
1038                 memset(mgmt->da, 0xff, ETH_ALEN);
1039                 memset(mgmt->bssid, 0xff, ETH_ALEN);
1040         }
1041         pos = skb_put(skb, 2 + ssid_len);
1042         *pos++ = WLAN_EID_SSID;
1043         *pos++ = ssid_len;
1044         memcpy(pos, ssid, ssid_len);
1045
1046         supp_rates = skb_put(skb, 2);
1047         supp_rates[0] = WLAN_EID_SUPP_RATES;
1048         supp_rates[1] = 0;
1049         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1050
1051         for (i = 0; i < sband->n_bitrates; i++) {
1052                 struct ieee80211_rate *rate = &sband->bitrates[i];
1053                 if (esupp_rates) {
1054                         pos = skb_put(skb, 1);
1055                         esupp_rates[1]++;
1056                 } else if (supp_rates[1] == 8) {
1057                         esupp_rates = skb_put(skb, 3);
1058                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
1059                         esupp_rates[1] = 1;
1060                         pos = &esupp_rates[2];
1061                 } else {
1062                         pos = skb_put(skb, 1);
1063                         supp_rates[1]++;
1064                 }
1065                 *pos = rate->bitrate / 5;
1066         }
1067
1068         ieee80211_sta_tx(dev, skb, 0);
1069 }
1070
1071
1072 static int ieee80211_sta_wep_configured(struct net_device *dev)
1073 {
1074         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1075         if (!sdata || !sdata->default_key ||
1076             sdata->default_key->conf.alg != ALG_WEP)
1077                 return 0;
1078         return 1;
1079 }
1080
1081
1082 static void ieee80211_auth_completed(struct net_device *dev,
1083                                      struct ieee80211_if_sta *ifsta)
1084 {
1085         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
1086         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
1087         ieee80211_associate(dev, ifsta);
1088 }
1089
1090
1091 static void ieee80211_auth_challenge(struct net_device *dev,
1092                                      struct ieee80211_if_sta *ifsta,
1093                                      struct ieee80211_mgmt *mgmt,
1094                                      size_t len)
1095 {
1096         u8 *pos;
1097         struct ieee802_11_elems elems;
1098
1099         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
1100         pos = mgmt->u.auth.variable;
1101         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1102         if (!elems.challenge) {
1103                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
1104                        "frame\n", dev->name);
1105                 return;
1106         }
1107         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
1108                             elems.challenge_len + 2, 1);
1109 }
1110
1111 static void ieee80211_send_addba_resp(struct net_device *dev, u8 *da, u16 tid,
1112                                         u8 dialog_token, u16 status, u16 policy,
1113                                         u16 buf_size, u16 timeout)
1114 {
1115         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1116         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1117         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1118         struct sk_buff *skb;
1119         struct ieee80211_mgmt *mgmt;
1120         u16 capab;
1121
1122         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1123
1124         if (!skb) {
1125                 printk(KERN_DEBUG "%s: failed to allocate buffer "
1126                        "for addba resp frame\n", dev->name);
1127                 return;
1128         }
1129
1130         skb_reserve(skb, local->hw.extra_tx_headroom);
1131         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1132         memset(mgmt, 0, 24);
1133         memcpy(mgmt->da, da, ETH_ALEN);
1134         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1135         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1136                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1137         else
1138                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1139         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1140                                            IEEE80211_STYPE_ACTION);
1141
1142         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
1143         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1144         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
1145         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
1146
1147         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
1148         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1149         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
1150
1151         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
1152         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
1153         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
1154
1155         ieee80211_sta_tx(dev, skb, 0);
1156
1157         return;
1158 }
1159
1160 void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
1161                                 u16 tid, u8 dialog_token, u16 start_seq_num,
1162                                 u16 agg_size, u16 timeout)
1163 {
1164         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1165         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1166         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1167         struct sk_buff *skb;
1168         struct ieee80211_mgmt *mgmt;
1169         u16 capab;
1170
1171         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1172
1173         if (!skb) {
1174                 printk(KERN_ERR "%s: failed to allocate buffer "
1175                                 "for addba request frame\n", dev->name);
1176                 return;
1177         }
1178         skb_reserve(skb, local->hw.extra_tx_headroom);
1179         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1180         memset(mgmt, 0, 24);
1181         memcpy(mgmt->da, da, ETH_ALEN);
1182         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1183         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1184                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1185         else
1186                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1187
1188         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1189                                         IEEE80211_STYPE_ACTION);
1190
1191         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
1192
1193         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1194         mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
1195
1196         mgmt->u.action.u.addba_req.dialog_token = dialog_token;
1197         capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
1198         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1199         capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
1200
1201         mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
1202
1203         mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
1204         mgmt->u.action.u.addba_req.start_seq_num =
1205                                         cpu_to_le16(start_seq_num << 4);
1206
1207         ieee80211_sta_tx(dev, skb, 0);
1208 }
1209
1210 static void ieee80211_sta_process_addba_request(struct net_device *dev,
1211                                                 struct ieee80211_mgmt *mgmt,
1212                                                 size_t len)
1213 {
1214         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1215         struct ieee80211_hw *hw = &local->hw;
1216         struct ieee80211_conf *conf = &hw->conf;
1217         struct sta_info *sta;
1218         struct tid_ampdu_rx *tid_agg_rx;
1219         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
1220         u8 dialog_token;
1221         int ret = -EOPNOTSUPP;
1222         DECLARE_MAC_BUF(mac);
1223
1224         rcu_read_lock();
1225
1226         sta = sta_info_get(local, mgmt->sa);
1227         if (!sta) {
1228                 rcu_read_unlock();
1229                 return;
1230         }
1231
1232         /* extract session parameters from addba request frame */
1233         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
1234         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
1235         start_seq_num =
1236                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
1237
1238         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1239         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
1240         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1241         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
1242
1243         status = WLAN_STATUS_REQUEST_DECLINED;
1244
1245         /* sanity check for incoming parameters:
1246          * check if configuration can support the BA policy
1247          * and if buffer size does not exceeds max value */
1248         if (((ba_policy != 1)
1249                 && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
1250                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
1251                 status = WLAN_STATUS_INVALID_QOS_PARAM;
1252 #ifdef CONFIG_MAC80211_HT_DEBUG
1253                 if (net_ratelimit())
1254                         printk(KERN_DEBUG "AddBA Req with bad params from "
1255                                 "%s on tid %u. policy %d, buffer size %d\n",
1256                                 print_mac(mac, mgmt->sa), tid, ba_policy,
1257                                 buf_size);
1258 #endif /* CONFIG_MAC80211_HT_DEBUG */
1259                 goto end_no_lock;
1260         }
1261         /* determine default buffer size */
1262         if (buf_size == 0) {
1263                 struct ieee80211_supported_band *sband;
1264
1265                 sband = local->hw.wiphy->bands[conf->channel->band];
1266                 buf_size = IEEE80211_MIN_AMPDU_BUF;
1267                 buf_size = buf_size << sband->ht_info.ampdu_factor;
1268         }
1269
1270
1271         /* examine state machine */
1272         spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
1273
1274         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
1275 #ifdef CONFIG_MAC80211_HT_DEBUG
1276                 if (net_ratelimit())
1277                         printk(KERN_DEBUG "unexpected AddBA Req from "
1278                                 "%s on tid %u\n",
1279                                 print_mac(mac, mgmt->sa), tid);
1280 #endif /* CONFIG_MAC80211_HT_DEBUG */
1281                 goto end;
1282         }
1283
1284         /* prepare A-MPDU MLME for Rx aggregation */
1285         sta->ampdu_mlme.tid_rx[tid] =
1286                         kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
1287         if (!sta->ampdu_mlme.tid_rx[tid]) {
1288                 if (net_ratelimit())
1289                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
1290                                         tid);
1291                 goto end;
1292         }
1293         /* rx timer */
1294         sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
1295                                 sta_rx_agg_session_timer_expired;
1296         sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
1297                                 (unsigned long)&sta->timer_to_tid[tid];
1298         init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
1299
1300         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
1301
1302         /* prepare reordering buffer */
1303         tid_agg_rx->reorder_buf =
1304                 kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
1305         if (!tid_agg_rx->reorder_buf) {
1306                 if (net_ratelimit())
1307                         printk(KERN_ERR "can not allocate reordering buffer "
1308                                "to tid %d\n", tid);
1309                 kfree(sta->ampdu_mlme.tid_rx[tid]);
1310                 goto end;
1311         }
1312         memset(tid_agg_rx->reorder_buf, 0,
1313                 buf_size * sizeof(struct sk_buf *));
1314
1315         if (local->ops->ampdu_action)
1316                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
1317                                                sta->addr, tid, &start_seq_num);
1318 #ifdef CONFIG_MAC80211_HT_DEBUG
1319         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
1320 #endif /* CONFIG_MAC80211_HT_DEBUG */
1321
1322         if (ret) {
1323                 kfree(tid_agg_rx->reorder_buf);
1324                 kfree(tid_agg_rx);
1325                 sta->ampdu_mlme.tid_rx[tid] = NULL;
1326                 goto end;
1327         }
1328
1329         /* change state and send addba resp */
1330         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
1331         tid_agg_rx->dialog_token = dialog_token;
1332         tid_agg_rx->ssn = start_seq_num;
1333         tid_agg_rx->head_seq_num = start_seq_num;
1334         tid_agg_rx->buf_size = buf_size;
1335         tid_agg_rx->timeout = timeout;
1336         tid_agg_rx->stored_mpdu_num = 0;
1337         status = WLAN_STATUS_SUCCESS;
1338 end:
1339         spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1340
1341 end_no_lock:
1342         ieee80211_send_addba_resp(sta->sdata->dev, sta->addr, tid,
1343                                   dialog_token, status, 1, buf_size, timeout);
1344         rcu_read_unlock();
1345 }
1346
1347 static void ieee80211_sta_process_addba_resp(struct net_device *dev,
1348                                              struct ieee80211_mgmt *mgmt,
1349                                              size_t len)
1350 {
1351         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1352         struct ieee80211_hw *hw = &local->hw;
1353         struct sta_info *sta;
1354         u16 capab;
1355         u16 tid;
1356         u8 *state;
1357
1358         rcu_read_lock();
1359
1360         sta = sta_info_get(local, mgmt->sa);
1361         if (!sta) {
1362                 rcu_read_unlock();
1363                 return;
1364         }
1365
1366         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
1367         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1368
1369         state = &sta->ampdu_mlme.tid_state_tx[tid];
1370
1371         spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
1372
1373         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1374                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1375                 printk(KERN_DEBUG "state not HT_ADDBA_REQUESTED_MSK:"
1376                         "%d\n", *state);
1377                 goto addba_resp_exit;
1378         }
1379
1380         if (mgmt->u.action.u.addba_resp.dialog_token !=
1381                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
1382                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1383 #ifdef CONFIG_MAC80211_HT_DEBUG
1384                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
1385 #endif /* CONFIG_MAC80211_HT_DEBUG */
1386                 goto addba_resp_exit;
1387         }
1388
1389         del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
1390 #ifdef CONFIG_MAC80211_HT_DEBUG
1391         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
1392 #endif /* CONFIG_MAC80211_HT_DEBUG */
1393         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
1394                         == WLAN_STATUS_SUCCESS) {
1395                 if (*state & HT_ADDBA_RECEIVED_MSK)
1396                         printk(KERN_DEBUG "double addBA response\n");
1397
1398                 *state |= HT_ADDBA_RECEIVED_MSK;
1399                 sta->ampdu_mlme.addba_req_num[tid] = 0;
1400
1401                 if (*state == HT_AGG_STATE_OPERATIONAL) {
1402                         printk(KERN_DEBUG "Aggregation on for tid %d \n", tid);
1403                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
1404                 }
1405
1406                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1407                 printk(KERN_DEBUG "recipient accepted agg: tid %d \n", tid);
1408         } else {
1409                 printk(KERN_DEBUG "recipient rejected agg: tid %d \n", tid);
1410
1411                 sta->ampdu_mlme.addba_req_num[tid]++;
1412                 /* this will allow the state check in stop_BA_session */
1413                 *state = HT_AGG_STATE_OPERATIONAL;
1414                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1415                 ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
1416                                              WLAN_BACK_INITIATOR);
1417         }
1418
1419 addba_resp_exit:
1420         rcu_read_unlock();
1421 }
1422
1423 void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
1424                           u16 initiator, u16 reason_code)
1425 {
1426         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1427         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1428         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1429         struct sk_buff *skb;
1430         struct ieee80211_mgmt *mgmt;
1431         u16 params;
1432
1433         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1434
1435         if (!skb) {
1436                 printk(KERN_ERR "%s: failed to allocate buffer "
1437                                         "for delba frame\n", dev->name);
1438                 return;
1439         }
1440
1441         skb_reserve(skb, local->hw.extra_tx_headroom);
1442         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1443         memset(mgmt, 0, 24);
1444         memcpy(mgmt->da, da, ETH_ALEN);
1445         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1446         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1447                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1448         else
1449                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1450         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1451                                         IEEE80211_STYPE_ACTION);
1452
1453         skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
1454
1455         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1456         mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
1457         params = (u16)(initiator << 11);        /* bit 11 initiator */
1458         params |= (u16)(tid << 12);             /* bit 15:12 TID number */
1459
1460         mgmt->u.action.u.delba.params = cpu_to_le16(params);
1461         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
1462
1463         ieee80211_sta_tx(dev, skb, 0);
1464 }
1465
1466 void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
1467                                         u16 initiator, u16 reason)
1468 {
1469         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1470         struct ieee80211_hw *hw = &local->hw;
1471         struct sta_info *sta;
1472         int ret, i;
1473         DECLARE_MAC_BUF(mac);
1474
1475         rcu_read_lock();
1476
1477         sta = sta_info_get(local, ra);
1478         if (!sta) {
1479                 rcu_read_unlock();
1480                 return;
1481         }
1482
1483         /* check if TID is in operational state */
1484         spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
1485         if (sta->ampdu_mlme.tid_state_rx[tid]
1486                                 != HT_AGG_STATE_OPERATIONAL) {
1487                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1488                 rcu_read_unlock();
1489                 return;
1490         }
1491         sta->ampdu_mlme.tid_state_rx[tid] =
1492                 HT_AGG_STATE_REQ_STOP_BA_MSK |
1493                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
1494         spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1495
1496         /* stop HW Rx aggregation. ampdu_action existence
1497          * already verified in session init so we add the BUG_ON */
1498         BUG_ON(!local->ops->ampdu_action);
1499
1500 #ifdef CONFIG_MAC80211_HT_DEBUG
1501         printk(KERN_DEBUG "Rx BA session stop requested for %s tid %u\n",
1502                                 print_mac(mac, ra), tid);
1503 #endif /* CONFIG_MAC80211_HT_DEBUG */
1504
1505         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
1506                                         ra, tid, NULL);
1507         if (ret)
1508                 printk(KERN_DEBUG "HW problem - can not stop rx "
1509                                 "aggergation for tid %d\n", tid);
1510
1511         /* shutdown timer has not expired */
1512         if (initiator != WLAN_BACK_TIMER)
1513                 del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
1514
1515         /* check if this is a self generated aggregation halt */
1516         if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
1517                 ieee80211_send_delba(dev, ra, tid, 0, reason);
1518
1519         /* free the reordering buffer */
1520         for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
1521                 if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
1522                         /* release the reordered frames */
1523                         dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
1524                         sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
1525                         sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
1526                 }
1527         }
1528         /* free resources */
1529         kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
1530         kfree(sta->ampdu_mlme.tid_rx[tid]);
1531         sta->ampdu_mlme.tid_rx[tid] = NULL;
1532         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
1533
1534         rcu_read_unlock();
1535 }
1536
1537
1538 static void ieee80211_sta_process_delba(struct net_device *dev,
1539                         struct ieee80211_mgmt *mgmt, size_t len)
1540 {
1541         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1542         struct sta_info *sta;
1543         u16 tid, params;
1544         u16 initiator;
1545         DECLARE_MAC_BUF(mac);
1546
1547         rcu_read_lock();
1548
1549         sta = sta_info_get(local, mgmt->sa);
1550         if (!sta) {
1551                 rcu_read_unlock();
1552                 return;
1553         }
1554
1555         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1556         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1557         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1558
1559 #ifdef CONFIG_MAC80211_HT_DEBUG
1560         if (net_ratelimit())
1561                 printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
1562                         print_mac(mac, mgmt->sa),
1563                         initiator ? "initiator" : "recipient", tid,
1564                         mgmt->u.action.u.delba.reason_code);
1565 #endif /* CONFIG_MAC80211_HT_DEBUG */
1566
1567         if (initiator == WLAN_BACK_INITIATOR)
1568                 ieee80211_sta_stop_rx_ba_session(dev, sta->addr, tid,
1569                                                  WLAN_BACK_INITIATOR, 0);
1570         else { /* WLAN_BACK_RECIPIENT */
1571                 spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
1572                 sta->ampdu_mlme.tid_state_tx[tid] =
1573                                 HT_AGG_STATE_OPERATIONAL;
1574                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1575                 ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
1576                                              WLAN_BACK_RECIPIENT);
1577         }
1578         rcu_read_unlock();
1579 }
1580
1581 /*
1582  * After sending add Block Ack request we activated a timer until
1583  * add Block Ack response will arrive from the recipient.
1584  * If this timer expires sta_addba_resp_timer_expired will be executed.
1585  */
1586 void sta_addba_resp_timer_expired(unsigned long data)
1587 {
1588         /* not an elegant detour, but there is no choice as the timer passes
1589          * only one argument, and both sta_info and TID are needed, so init
1590          * flow in sta_info_create gives the TID as data, while the timer_to_id
1591          * array gives the sta through container_of */
1592         u16 tid = *(int *)data;
1593         struct sta_info *temp_sta = container_of((void *)data,
1594                 struct sta_info, timer_to_tid[tid]);
1595
1596         struct ieee80211_local *local = temp_sta->local;
1597         struct ieee80211_hw *hw = &local->hw;
1598         struct sta_info *sta;
1599         u8 *state;
1600
1601         rcu_read_lock();
1602
1603         sta = sta_info_get(local, temp_sta->addr);
1604         if (!sta) {
1605                 rcu_read_unlock();
1606                 return;
1607         }
1608
1609         state = &sta->ampdu_mlme.tid_state_tx[tid];
1610         /* check if the TID waits for addBA response */
1611         spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
1612         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1613                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1614                 *state = HT_AGG_STATE_IDLE;
1615                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
1616                                 "expecting addBA response there", tid);
1617                 goto timer_expired_exit;
1618         }
1619
1620         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
1621
1622         /* go through the state check in stop_BA_session */
1623         *state = HT_AGG_STATE_OPERATIONAL;
1624         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1625         ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
1626                                      WLAN_BACK_INITIATOR);
1627
1628 timer_expired_exit:
1629         rcu_read_unlock();
1630 }
1631
1632 /*
1633  * After accepting the AddBA Request we activated a timer,
1634  * resetting it after each frame that arrives from the originator.
1635  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
1636  */
1637 static void sta_rx_agg_session_timer_expired(unsigned long data)
1638 {
1639         /* not an elegant detour, but there is no choice as the timer passes
1640          * only one argument, and verious sta_info are needed here, so init
1641          * flow in sta_info_create gives the TID as data, while the timer_to_id
1642          * array gives the sta through container_of */
1643         u8 *ptid = (u8 *)data;
1644         u8 *timer_to_id = ptid - *ptid;
1645         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
1646                                          timer_to_tid[0]);
1647
1648         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
1649         ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
1650                                          (u16)*ptid, WLAN_BACK_TIMER,
1651                                          WLAN_REASON_QSTA_TIMEOUT);
1652 }
1653
1654 void ieee80211_sta_tear_down_BA_sessions(struct net_device *dev, u8 *addr)
1655 {
1656         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1657         int i;
1658
1659         for (i = 0; i <  STA_TID_NUM; i++) {
1660                 ieee80211_stop_tx_ba_session(&local->hw, addr, i,
1661                                              WLAN_BACK_INITIATOR);
1662                 ieee80211_sta_stop_rx_ba_session(dev, addr, i,
1663                                                  WLAN_BACK_RECIPIENT,
1664                                                  WLAN_REASON_QSTA_LEAVE_QBSS);
1665         }
1666 }
1667
1668 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
1669                                    struct ieee80211_if_sta *ifsta,
1670                                    struct ieee80211_mgmt *mgmt,
1671                                    size_t len)
1672 {
1673         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1674         u16 auth_alg, auth_transaction, status_code;
1675         DECLARE_MAC_BUF(mac);
1676
1677         if (ifsta->state != IEEE80211_AUTHENTICATE &&
1678             sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
1679                 printk(KERN_DEBUG "%s: authentication frame received from "
1680                        "%s, but not in authenticate state - ignored\n",
1681                        dev->name, print_mac(mac, mgmt->sa));
1682                 return;
1683         }
1684
1685         if (len < 24 + 6) {
1686                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
1687                        "received from %s - ignored\n",
1688                        dev->name, len, print_mac(mac, mgmt->sa));
1689                 return;
1690         }
1691
1692         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1693             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1694                 printk(KERN_DEBUG "%s: authentication frame received from "
1695                        "unknown AP (SA=%s BSSID=%s) - "
1696                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1697                        print_mac(mac, mgmt->bssid));
1698                 return;
1699         }
1700
1701         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1702             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
1703                 printk(KERN_DEBUG "%s: authentication frame received from "
1704                        "unknown BSSID (SA=%s BSSID=%s) - "
1705                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1706                        print_mac(mac, mgmt->bssid));
1707                 return;
1708         }
1709
1710         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1711         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1712         status_code = le16_to_cpu(mgmt->u.auth.status_code);
1713
1714         printk(KERN_DEBUG "%s: RX authentication from %s (alg=%d "
1715                "transaction=%d status=%d)\n",
1716                dev->name, print_mac(mac, mgmt->sa), auth_alg,
1717                auth_transaction, status_code);
1718
1719         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
1720                 /* IEEE 802.11 standard does not require authentication in IBSS
1721                  * networks and most implementations do not seem to use it.
1722                  * However, try to reply to authentication attempts if someone
1723                  * has actually implemented this.
1724                  * TODO: Could implement shared key authentication. */
1725                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
1726                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
1727                                "frame (alg=%d transaction=%d)\n",
1728                                dev->name, auth_alg, auth_transaction);
1729                         return;
1730                 }
1731                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
1732         }
1733
1734         if (auth_alg != ifsta->auth_alg ||
1735             auth_transaction != ifsta->auth_transaction) {
1736                 printk(KERN_DEBUG "%s: unexpected authentication frame "
1737                        "(alg=%d transaction=%d)\n",
1738                        dev->name, auth_alg, auth_transaction);
1739                 return;
1740         }
1741
1742         if (status_code != WLAN_STATUS_SUCCESS) {
1743                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
1744                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
1745                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1746                         u8 algs[3];
1747                         const int num_algs = ARRAY_SIZE(algs);
1748                         int i, pos;
1749                         algs[0] = algs[1] = algs[2] = 0xff;
1750                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1751                                 algs[0] = WLAN_AUTH_OPEN;
1752                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1753                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1754                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1755                                 algs[2] = WLAN_AUTH_LEAP;
1756                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1757                                 pos = 0;
1758                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1759                                 pos = 1;
1760                         else
1761                                 pos = 2;
1762                         for (i = 0; i < num_algs; i++) {
1763                                 pos++;
1764                                 if (pos >= num_algs)
1765                                         pos = 0;
1766                                 if (algs[pos] == ifsta->auth_alg ||
1767                                     algs[pos] == 0xff)
1768                                         continue;
1769                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1770                                     !ieee80211_sta_wep_configured(dev))
1771                                         continue;
1772                                 ifsta->auth_alg = algs[pos];
1773                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
1774                                        "next try\n",
1775                                        dev->name, ifsta->auth_alg);
1776                                 break;
1777                         }
1778                 }
1779                 return;
1780         }
1781
1782         switch (ifsta->auth_alg) {
1783         case WLAN_AUTH_OPEN:
1784         case WLAN_AUTH_LEAP:
1785                 ieee80211_auth_completed(dev, ifsta);
1786                 break;
1787         case WLAN_AUTH_SHARED_KEY:
1788                 if (ifsta->auth_transaction == 4)
1789                         ieee80211_auth_completed(dev, ifsta);
1790                 else
1791                         ieee80211_auth_challenge(dev, ifsta, mgmt, len);
1792                 break;
1793         }
1794 }
1795
1796
1797 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
1798                                      struct ieee80211_if_sta *ifsta,
1799                                      struct ieee80211_mgmt *mgmt,
1800                                      size_t len)
1801 {
1802         u16 reason_code;
1803         DECLARE_MAC_BUF(mac);
1804
1805         if (len < 24 + 2) {
1806                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
1807                        "received from %s - ignored\n",
1808                        dev->name, len, print_mac(mac, mgmt->sa));
1809                 return;
1810         }
1811
1812         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1813                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1814                        "unknown AP (SA=%s BSSID=%s) - "
1815                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1816                        print_mac(mac, mgmt->bssid));
1817                 return;
1818         }
1819
1820         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1821
1822         printk(KERN_DEBUG "%s: RX deauthentication from %s"
1823                " (reason=%d)\n",
1824                dev->name, print_mac(mac, mgmt->sa), reason_code);
1825
1826         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
1827                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1828
1829         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1830             ifsta->state == IEEE80211_ASSOCIATE ||
1831             ifsta->state == IEEE80211_ASSOCIATED) {
1832                 ifsta->state = IEEE80211_AUTHENTICATE;
1833                 mod_timer(&ifsta->timer, jiffies +
1834                                       IEEE80211_RETRY_AUTH_INTERVAL);
1835         }
1836
1837         ieee80211_set_disassoc(dev, ifsta, 1);
1838         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1839 }
1840
1841
1842 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1843                                        struct ieee80211_if_sta *ifsta,
1844                                        struct ieee80211_mgmt *mgmt,
1845                                        size_t len)
1846 {
1847         u16 reason_code;
1848         DECLARE_MAC_BUF(mac);
1849
1850         if (len < 24 + 2) {
1851                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1852                        "received from %s - ignored\n",
1853                        dev->name, len, print_mac(mac, mgmt->sa));
1854                 return;
1855         }
1856
1857         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1858                 printk(KERN_DEBUG "%s: disassociation frame received from "
1859                        "unknown AP (SA=%s BSSID=%s) - "
1860                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1861                        print_mac(mac, mgmt->bssid));
1862                 return;
1863         }
1864
1865         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1866
1867         printk(KERN_DEBUG "%s: RX disassociation from %s"
1868                " (reason=%d)\n",
1869                dev->name, print_mac(mac, mgmt->sa), reason_code);
1870
1871         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1872                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1873
1874         if (ifsta->state == IEEE80211_ASSOCIATED) {
1875                 ifsta->state = IEEE80211_ASSOCIATE;
1876                 mod_timer(&ifsta->timer, jiffies +
1877                                       IEEE80211_RETRY_AUTH_INTERVAL);
1878         }
1879
1880         ieee80211_set_disassoc(dev, ifsta, 0);
1881 }
1882
1883
1884 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
1885                                          struct ieee80211_if_sta *ifsta,
1886                                          struct ieee80211_mgmt *mgmt,
1887                                          size_t len,
1888                                          int reassoc)
1889 {
1890         struct ieee80211_local *local = sdata->local;
1891         struct net_device *dev = sdata->dev;
1892         struct ieee80211_supported_band *sband;
1893         struct sta_info *sta;
1894         u64 rates, basic_rates;
1895         u16 capab_info, status_code, aid;
1896         struct ieee802_11_elems elems;
1897         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
1898         u8 *pos;
1899         int i, j;
1900         DECLARE_MAC_BUF(mac);
1901         bool have_higher_than_11mbit = false;
1902
1903         /* AssocResp and ReassocResp have identical structure, so process both
1904          * of them in this function. */
1905
1906         if (ifsta->state != IEEE80211_ASSOCIATE) {
1907                 printk(KERN_DEBUG "%s: association frame received from "
1908                        "%s, but not in associate state - ignored\n",
1909                        dev->name, print_mac(mac, mgmt->sa));
1910                 return;
1911         }
1912
1913         if (len < 24 + 6) {
1914                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1915                        "received from %s - ignored\n",
1916                        dev->name, len, print_mac(mac, mgmt->sa));
1917                 return;
1918         }
1919
1920         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1921                 printk(KERN_DEBUG "%s: association frame received from "
1922                        "unknown AP (SA=%s BSSID=%s) - "
1923                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1924                        print_mac(mac, mgmt->bssid));
1925                 return;
1926         }
1927
1928         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1929         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1930         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1931
1932         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
1933                "status=%d aid=%d)\n",
1934                dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
1935                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
1936
1937         if (status_code != WLAN_STATUS_SUCCESS) {
1938                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1939                        dev->name, status_code);
1940                 /* if this was a reassociation, ensure we try a "full"
1941                  * association next time. This works around some broken APs
1942                  * which do not correctly reject reassociation requests. */
1943                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1944                 return;
1945         }
1946
1947         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1948                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1949                        "set\n", dev->name, aid);
1950         aid &= ~(BIT(15) | BIT(14));
1951
1952         pos = mgmt->u.assoc_resp.variable;
1953         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1954
1955         if (!elems.supp_rates) {
1956                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1957                        dev->name);
1958                 return;
1959         }
1960
1961         printk(KERN_DEBUG "%s: associated\n", dev->name);
1962         ifsta->aid = aid;
1963         ifsta->ap_capab = capab_info;
1964
1965         kfree(ifsta->assocresp_ies);
1966         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1967         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1968         if (ifsta->assocresp_ies)
1969                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1970
1971         rcu_read_lock();
1972
1973         /* Add STA entry for the AP */
1974         sta = sta_info_get(local, ifsta->bssid);
1975         if (!sta) {
1976                 struct ieee80211_sta_bss *bss;
1977                 int err;
1978
1979                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
1980                 if (!sta) {
1981                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
1982                                " the AP\n", dev->name);
1983                         rcu_read_unlock();
1984                         return;
1985                 }
1986                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
1987                                            local->hw.conf.channel->center_freq,
1988                                            ifsta->ssid, ifsta->ssid_len);
1989                 if (bss) {
1990                         sta->last_rssi = bss->rssi;
1991                         sta->last_signal = bss->signal;
1992                         sta->last_noise = bss->noise;
1993                         ieee80211_rx_bss_put(dev, bss);
1994                 }
1995
1996                 err = sta_info_insert(sta);
1997                 if (err) {
1998                         printk(KERN_DEBUG "%s: failed to insert STA entry for"
1999                                " the AP (error %d)\n", dev->name, err);
2000                         rcu_read_unlock();
2001                         return;
2002                 }
2003         }
2004
2005         /*
2006          * FIXME: Do we really need to update the sta_info's information here?
2007          *        We already know about the AP (we found it in our list) so it
2008          *        should already be filled with the right info, no?
2009          *        As is stands, all this is racy because typically we assume
2010          *        the information that is filled in here (except flags) doesn't
2011          *        change while a STA structure is alive. As such, it should move
2012          *        to between the sta_info_alloc() and sta_info_insert() above.
2013          */
2014
2015         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
2016                       WLAN_STA_AUTHORIZED;
2017
2018         rates = 0;
2019         basic_rates = 0;
2020         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2021
2022         for (i = 0; i < elems.supp_rates_len; i++) {
2023                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
2024
2025                 if (rate > 110)
2026                         have_higher_than_11mbit = true;
2027
2028                 for (j = 0; j < sband->n_bitrates; j++) {
2029                         if (sband->bitrates[j].bitrate == rate)
2030                                 rates |= BIT(j);
2031                         if (elems.supp_rates[i] & 0x80)
2032                                 basic_rates |= BIT(j);
2033                 }
2034         }
2035
2036         for (i = 0; i < elems.ext_supp_rates_len; i++) {
2037                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
2038
2039                 if (rate > 110)
2040                         have_higher_than_11mbit = true;
2041
2042                 for (j = 0; j < sband->n_bitrates; j++) {
2043                         if (sband->bitrates[j].bitrate == rate)
2044                                 rates |= BIT(j);
2045                         if (elems.ext_supp_rates[i] & 0x80)
2046                                 basic_rates |= BIT(j);
2047                 }
2048         }
2049
2050         sta->supp_rates[local->hw.conf.channel->band] = rates;
2051         sdata->basic_rates = basic_rates;
2052
2053         /* cf. IEEE 802.11 9.2.12 */
2054         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
2055             have_higher_than_11mbit)
2056                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
2057         else
2058                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
2059
2060         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param) {
2061                 struct ieee80211_ht_bss_info bss_info;
2062                 ieee80211_ht_cap_ie_to_ht_info(
2063                                 (struct ieee80211_ht_cap *)
2064                                 elems.ht_cap_elem, &sta->ht_info);
2065                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2066                                 (struct ieee80211_ht_addt_info *)
2067                                 elems.ht_info_elem, &bss_info);
2068                 ieee80211_handle_ht(local, 1, &sta->ht_info, &bss_info);
2069         }
2070
2071         rate_control_rate_init(sta, local);
2072
2073         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
2074                 sta->flags |= WLAN_STA_WME;
2075                 rcu_read_unlock();
2076                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
2077                                          elems.wmm_param_len);
2078         } else
2079                 rcu_read_unlock();
2080
2081         /* set AID and assoc capability,
2082          * ieee80211_set_associated() will tell the driver */
2083         bss_conf->aid = aid;
2084         bss_conf->assoc_capability = capab_info;
2085         ieee80211_set_associated(dev, ifsta, 1);
2086
2087         ieee80211_associated(dev, ifsta);
2088 }
2089
2090
2091 /* Caller must hold local->sta_bss_lock */
2092 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
2093                                         struct ieee80211_sta_bss *bss)
2094 {
2095         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2096         u8 hash_idx;
2097
2098         if (bss_mesh_cfg(bss))
2099                 hash_idx = mesh_id_hash(bss_mesh_id(bss),
2100                                         bss_mesh_id_len(bss));
2101         else
2102                 hash_idx = STA_HASH(bss->bssid);
2103
2104         bss->hnext = local->sta_bss_hash[hash_idx];
2105         local->sta_bss_hash[hash_idx] = bss;
2106 }
2107
2108
2109 /* Caller must hold local->sta_bss_lock */
2110 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
2111                                         struct ieee80211_sta_bss *bss)
2112 {
2113         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2114         struct ieee80211_sta_bss *b, *prev = NULL;
2115         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
2116         while (b) {
2117                 if (b == bss) {
2118                         if (!prev)
2119                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
2120                                         bss->hnext;
2121                         else
2122                                 prev->hnext = bss->hnext;
2123                         break;
2124                 }
2125                 prev = b;
2126                 b = b->hnext;
2127         }
2128 }
2129
2130
2131 static struct ieee80211_sta_bss *
2132 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int freq,
2133                      u8 *ssid, u8 ssid_len)
2134 {
2135         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2136         struct ieee80211_sta_bss *bss;
2137
2138         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
2139         if (!bss)
2140                 return NULL;
2141         atomic_inc(&bss->users);
2142         atomic_inc(&bss->users);
2143         memcpy(bss->bssid, bssid, ETH_ALEN);
2144         bss->freq = freq;
2145         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
2146                 memcpy(bss->ssid, ssid, ssid_len);
2147                 bss->ssid_len = ssid_len;
2148         }
2149
2150         spin_lock_bh(&local->sta_bss_lock);
2151         /* TODO: order by RSSI? */
2152         list_add_tail(&bss->list, &local->sta_bss_list);
2153         __ieee80211_rx_bss_hash_add(dev, bss);
2154         spin_unlock_bh(&local->sta_bss_lock);
2155         return bss;
2156 }
2157
2158 static struct ieee80211_sta_bss *
2159 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
2160                      u8 *ssid, u8 ssid_len)
2161 {
2162         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2163         struct ieee80211_sta_bss *bss;
2164
2165         spin_lock_bh(&local->sta_bss_lock);
2166         bss = local->sta_bss_hash[STA_HASH(bssid)];
2167         while (bss) {
2168                 if (!bss_mesh_cfg(bss) &&
2169                     !memcmp(bss->bssid, bssid, ETH_ALEN) &&
2170                     bss->freq == freq &&
2171                     bss->ssid_len == ssid_len &&
2172                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
2173                         atomic_inc(&bss->users);
2174                         break;
2175                 }
2176                 bss = bss->hnext;
2177         }
2178         spin_unlock_bh(&local->sta_bss_lock);
2179         return bss;
2180 }
2181
2182 #ifdef CONFIG_MAC80211_MESH
2183 static struct ieee80211_sta_bss *
2184 ieee80211_rx_mesh_bss_get(struct net_device *dev, u8 *mesh_id, int mesh_id_len,
2185                           u8 *mesh_cfg, int freq)
2186 {
2187         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2188         struct ieee80211_sta_bss *bss;
2189
2190         spin_lock_bh(&local->sta_bss_lock);
2191         bss = local->sta_bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
2192         while (bss) {
2193                 if (bss_mesh_cfg(bss) &&
2194                     !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
2195                     bss->freq == freq &&
2196                     mesh_id_len == bss->mesh_id_len &&
2197                     (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
2198                                                  mesh_id_len))) {
2199                         atomic_inc(&bss->users);
2200                         break;
2201                 }
2202                 bss = bss->hnext;
2203         }
2204         spin_unlock_bh(&local->sta_bss_lock);
2205         return bss;
2206 }
2207
2208 static struct ieee80211_sta_bss *
2209 ieee80211_rx_mesh_bss_add(struct net_device *dev, u8 *mesh_id, int mesh_id_len,
2210                           u8 *mesh_cfg, int mesh_config_len, int freq)
2211 {
2212         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2213         struct ieee80211_sta_bss *bss;
2214
2215         if (mesh_config_len != MESH_CFG_LEN)
2216                 return NULL;
2217
2218         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
2219         if (!bss)
2220                 return NULL;
2221
2222         bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
2223         if (!bss->mesh_cfg) {
2224                 kfree(bss);
2225                 return NULL;
2226         }
2227
2228         if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
2229                 bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
2230                 if (!bss->mesh_id) {
2231                         kfree(bss->mesh_cfg);
2232                         kfree(bss);
2233                         return NULL;
2234                 }
2235                 memcpy(bss->mesh_id, mesh_id, mesh_id_len);
2236         }
2237
2238         atomic_inc(&bss->users);
2239         atomic_inc(&bss->users);
2240         memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
2241         bss->mesh_id_len = mesh_id_len;
2242         bss->freq = freq;
2243         spin_lock_bh(&local->sta_bss_lock);
2244         /* TODO: order by RSSI? */
2245         list_add_tail(&bss->list, &local->sta_bss_list);
2246         __ieee80211_rx_bss_hash_add(dev, bss);
2247         spin_unlock_bh(&local->sta_bss_lock);
2248         return bss;
2249 }
2250 #endif
2251
2252 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
2253 {
2254         kfree(bss->wpa_ie);
2255         kfree(bss->rsn_ie);
2256         kfree(bss->wmm_ie);
2257         kfree(bss->ht_ie);
2258         kfree(bss_mesh_id(bss));
2259         kfree(bss_mesh_cfg(bss));
2260         kfree(bss);
2261 }
2262
2263
2264 static void ieee80211_rx_bss_put(struct net_device *dev,
2265                                  struct ieee80211_sta_bss *bss)
2266 {
2267         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2268
2269         local_bh_disable();
2270         if (!atomic_dec_and_lock(&bss->users, &local->sta_bss_lock)) {
2271                 local_bh_enable();
2272                 return;
2273         }
2274
2275         __ieee80211_rx_bss_hash_del(dev, bss);
2276         list_del(&bss->list);
2277         spin_unlock_bh(&local->sta_bss_lock);
2278         ieee80211_rx_bss_free(bss);
2279 }
2280
2281
2282 void ieee80211_rx_bss_list_init(struct net_device *dev)
2283 {
2284         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2285         spin_lock_init(&local->sta_bss_lock);
2286         INIT_LIST_HEAD(&local->sta_bss_list);
2287 }
2288
2289
2290 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
2291 {
2292         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2293         struct ieee80211_sta_bss *bss, *tmp;
2294
2295         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
2296                 ieee80211_rx_bss_put(dev, bss);
2297 }
2298
2299
2300 static int ieee80211_sta_join_ibss(struct net_device *dev,
2301                                    struct ieee80211_if_sta *ifsta,
2302                                    struct ieee80211_sta_bss *bss)
2303 {
2304         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2305         int res, rates, i, j;
2306         struct sk_buff *skb;
2307         struct ieee80211_mgmt *mgmt;
2308         struct ieee80211_tx_control control;
2309         struct rate_selection ratesel;
2310         u8 *pos;
2311         struct ieee80211_sub_if_data *sdata;
2312         struct ieee80211_supported_band *sband;
2313
2314         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2315
2316         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2317
2318         /* Remove possible STA entries from other IBSS networks. */
2319         sta_info_flush_delayed(sdata);
2320
2321         if (local->ops->reset_tsf) {
2322                 /* Reset own TSF to allow time synchronization work. */
2323                 local->ops->reset_tsf(local_to_hw(local));
2324         }
2325         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2326         res = ieee80211_if_config(dev);
2327         if (res)
2328                 return res;
2329
2330         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2331
2332         sdata->drop_unencrypted = bss->capability &
2333                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2334
2335         res = ieee80211_set_freq(local, bss->freq);
2336
2337         if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
2338                 printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
2339                        "%d MHz\n", dev->name, local->oper_channel->center_freq);
2340                 return -1;
2341         }
2342
2343         /* Set beacon template */
2344         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2345         do {
2346                 if (!skb)
2347                         break;
2348
2349                 skb_reserve(skb, local->hw.extra_tx_headroom);
2350
2351                 mgmt = (struct ieee80211_mgmt *)
2352                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2353                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2354                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2355                                                    IEEE80211_STYPE_BEACON);
2356                 memset(mgmt->da, 0xff, ETH_ALEN);
2357                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2358                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2359                 mgmt->u.beacon.beacon_int =
2360                         cpu_to_le16(local->hw.conf.beacon_int);
2361                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2362
2363                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2364                 *pos++ = WLAN_EID_SSID;
2365                 *pos++ = ifsta->ssid_len;
2366                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2367
2368                 rates = bss->supp_rates_len;
2369                 if (rates > 8)
2370                         rates = 8;
2371                 pos = skb_put(skb, 2 + rates);
2372                 *pos++ = WLAN_EID_SUPP_RATES;
2373                 *pos++ = rates;
2374                 memcpy(pos, bss->supp_rates, rates);
2375
2376                 if (bss->band == IEEE80211_BAND_2GHZ) {
2377                         pos = skb_put(skb, 2 + 1);
2378                         *pos++ = WLAN_EID_DS_PARAMS;
2379                         *pos++ = 1;
2380                         *pos++ = ieee80211_frequency_to_channel(bss->freq);
2381                 }
2382
2383                 pos = skb_put(skb, 2 + 2);
2384                 *pos++ = WLAN_EID_IBSS_PARAMS;
2385                 *pos++ = 2;
2386                 /* FIX: set ATIM window based on scan results */
2387                 *pos++ = 0;
2388                 *pos++ = 0;
2389
2390                 if (bss->supp_rates_len > 8) {
2391                         rates = bss->supp_rates_len - 8;
2392                         pos = skb_put(skb, 2 + rates);
2393                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2394                         *pos++ = rates;
2395                         memcpy(pos, &bss->supp_rates[8], rates);
2396                 }
2397
2398                 memset(&control, 0, sizeof(control));
2399                 rate_control_get_rate(dev, sband, skb, &ratesel);
2400                 if (!ratesel.rate) {
2401                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2402                                "for IBSS beacon\n", dev->name);
2403                         break;
2404                 }
2405                 control.vif = &sdata->vif;
2406                 control.tx_rate = ratesel.rate;
2407                 if (sdata->bss_conf.use_short_preamble &&
2408                     ratesel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
2409                         control.flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
2410                 control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
2411                 control.flags |= IEEE80211_TXCTL_NO_ACK;
2412                 control.retry_limit = 1;
2413
2414                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2415                 if (ifsta->probe_resp) {
2416                         mgmt = (struct ieee80211_mgmt *)
2417                                 ifsta->probe_resp->data;
2418                         mgmt->frame_control =
2419                                 IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2420                                              IEEE80211_STYPE_PROBE_RESP);
2421                 } else {
2422                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2423                                "template for IBSS\n", dev->name);
2424                 }
2425
2426                 if (local->ops->beacon_update &&
2427                     local->ops->beacon_update(local_to_hw(local),
2428                                              skb, &control) == 0) {
2429                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2430                                "template\n", dev->name);
2431                         skb = NULL;
2432                 }
2433
2434                 rates = 0;
2435                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2436                 for (i = 0; i < bss->supp_rates_len; i++) {
2437                         int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2438                         for (j = 0; j < sband->n_bitrates; j++)
2439                                 if (sband->bitrates[j].bitrate == bitrate)
2440                                         rates |= BIT(j);
2441                 }
2442                 ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
2443
2444                 ieee80211_sta_def_wmm_params(dev, bss, 1);
2445         } while (0);
2446
2447         if (skb) {
2448                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2449                        "template\n", dev->name);
2450                 dev_kfree_skb(skb);
2451         }
2452
2453         ifsta->state = IEEE80211_IBSS_JOINED;
2454         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2455
2456         ieee80211_rx_bss_put(dev, bss);
2457
2458         return res;
2459 }
2460
2461 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
2462                             struct ieee802_11_elems *elems,
2463                             enum ieee80211_band band)
2464 {
2465         struct ieee80211_supported_band *sband;
2466         struct ieee80211_rate *bitrates;
2467         size_t num_rates;
2468         u64 supp_rates;
2469         int i, j;
2470         sband = local->hw.wiphy->bands[band];
2471
2472         if (!sband) {
2473                 WARN_ON(1);
2474                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2475         }
2476
2477         bitrates = sband->bitrates;
2478         num_rates = sband->n_bitrates;
2479         supp_rates = 0;
2480         for (i = 0; i < elems->supp_rates_len +
2481                      elems->ext_supp_rates_len; i++) {
2482                 u8 rate = 0;
2483                 int own_rate;
2484                 if (i < elems->supp_rates_len)
2485                         rate = elems->supp_rates[i];
2486                 else if (elems->ext_supp_rates)
2487                         rate = elems->ext_supp_rates
2488                                 [i - elems->supp_rates_len];
2489                 own_rate = 5 * (rate & 0x7f);
2490                 for (j = 0; j < num_rates; j++)
2491                         if (bitrates[j].bitrate == own_rate)
2492                                 supp_rates |= BIT(j);
2493         }
2494         return supp_rates;
2495 }
2496
2497
2498 static void ieee80211_rx_bss_info(struct net_device *dev,
2499                                   struct ieee80211_mgmt *mgmt,
2500                                   size_t len,
2501                                   struct ieee80211_rx_status *rx_status,
2502                                   int beacon)
2503 {
2504         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2505         struct ieee802_11_elems elems;
2506         size_t baselen;
2507         int freq, clen;
2508         struct ieee80211_sta_bss *bss;
2509         struct sta_info *sta;
2510         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2511         u64 beacon_timestamp, rx_timestamp;
2512         struct ieee80211_channel *channel;
2513         DECLARE_MAC_BUF(mac);
2514         DECLARE_MAC_BUF(mac2);
2515
2516         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
2517                 return; /* ignore ProbeResp to foreign address */
2518
2519 #if 0
2520         printk(KERN_DEBUG "%s: RX %s from %s to %s\n",
2521                dev->name, beacon ? "Beacon" : "Probe Response",
2522                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da));
2523 #endif
2524
2525         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2526         if (baselen > len)
2527                 return;
2528
2529         beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
2530         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2531
2532         if (ieee80211_vif_is_mesh(&sdata->vif) && elems.mesh_id &&
2533             elems.mesh_config && mesh_matches_local(&elems, dev)) {
2534                 u64 rates = ieee80211_sta_get_rates(local, &elems,
2535                                                 rx_status->band);
2536
2537                 mesh_neighbour_update(mgmt->sa, rates, dev,
2538                                       mesh_peer_accepts_plinks(&elems, dev));
2539         }
2540
2541         rcu_read_lock();
2542
2543         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
2544             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
2545             (sta = sta_info_get(local, mgmt->sa))) {
2546                 u64 prev_rates;
2547                 u64 supp_rates = ieee80211_sta_get_rates(local, &elems,
2548                                                         rx_status->band);
2549
2550                 prev_rates = sta->supp_rates[rx_status->band];
2551                 sta->supp_rates[rx_status->band] &= supp_rates;
2552                 if (sta->supp_rates[rx_status->band] == 0) {
2553                         /* No matching rates - this should not really happen.
2554                          * Make sure that at least one rate is marked
2555                          * supported to avoid issues with TX rate ctrl. */
2556                         sta->supp_rates[rx_status->band] =
2557                                 sdata->u.sta.supp_rates_bits[rx_status->band];
2558                 }
2559                 if (sta->supp_rates[rx_status->band] != prev_rates) {
2560                         printk(KERN_DEBUG "%s: updated supp_rates set for "
2561                                "%s based on beacon info (0x%llx & 0x%llx -> "
2562                                "0x%llx)\n",
2563                                dev->name, print_mac(mac, sta->addr),
2564                                (unsigned long long) prev_rates,
2565                                (unsigned long long) supp_rates,
2566                                (unsigned long long) sta->supp_rates[rx_status->band]);
2567                 }
2568         }
2569
2570         rcu_read_unlock();
2571
2572         if (elems.ds_params && elems.ds_params_len == 1)
2573                 freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
2574         else
2575                 freq = rx_status->freq;
2576
2577         channel = ieee80211_get_channel(local->hw.wiphy, freq);
2578
2579         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
2580                 return;
2581
2582 #ifdef CONFIG_MAC80211_MESH
2583         if (elems.mesh_config)
2584                 bss = ieee80211_rx_mesh_bss_get(dev, elems.mesh_id,
2585                                 elems.mesh_id_len, elems.mesh_config, freq);
2586         else
2587 #endif
2588                 bss = ieee80211_rx_bss_get(dev, mgmt->bssid, freq,
2589                                            elems.ssid, elems.ssid_len);
2590         if (!bss) {
2591 #ifdef CONFIG_MAC80211_MESH
2592                 if (elems.mesh_config)
2593                         bss = ieee80211_rx_mesh_bss_add(dev, elems.mesh_id,
2594                                 elems.mesh_id_len, elems.mesh_config,
2595                                 elems.mesh_config_len, freq);
2596                 else
2597 #endif
2598                         bss = ieee80211_rx_bss_add(dev, mgmt->bssid, freq,
2599                                                    elems.ssid, elems.ssid_len);
2600                 if (!bss)
2601                         return;
2602         } else {
2603 #if 0
2604                 /* TODO: order by RSSI? */
2605                 spin_lock_bh(&local->sta_bss_lock);
2606                 list_move_tail(&bss->list, &local->sta_bss_list);
2607                 spin_unlock_bh(&local->sta_bss_lock);
2608 #endif
2609         }
2610
2611         /* save the ERP value so that it is available at association time */
2612         if (elems.erp_info && elems.erp_info_len >= 1) {
2613                 bss->erp_value = elems.erp_info[0];
2614                 bss->has_erp_value = 1;
2615         }
2616
2617         if (elems.ht_cap_elem &&
2618              (!bss->ht_ie || bss->ht_ie_len != elems.ht_cap_elem_len ||
2619              memcmp(bss->ht_ie, elems.ht_cap_elem, elems.ht_cap_elem_len))) {
2620                 kfree(bss->ht_ie);
2621                 bss->ht_ie = kmalloc(elems.ht_cap_elem_len + 2, GFP_ATOMIC);
2622                 if (bss->ht_ie) {
2623                         memcpy(bss->ht_ie, elems.ht_cap_elem - 2,
2624                                 elems.ht_cap_elem_len + 2);
2625                         bss->ht_ie_len = elems.ht_cap_elem_len + 2;
2626                 } else
2627                         bss->ht_ie_len = 0;
2628         } else if (!elems.ht_cap_elem && bss->ht_ie) {
2629                 kfree(bss->ht_ie);
2630                 bss->ht_ie = NULL;
2631                 bss->ht_ie_len = 0;
2632         }
2633
2634         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
2635         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
2636
2637         bss->supp_rates_len = 0;
2638         if (elems.supp_rates) {
2639                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
2640                 if (clen > elems.supp_rates_len)
2641                         clen = elems.supp_rates_len;
2642                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
2643                        clen);
2644                 bss->supp_rates_len += clen;
2645         }
2646         if (elems.ext_supp_rates) {
2647                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
2648                 if (clen > elems.ext_supp_rates_len)
2649                         clen = elems.ext_supp_rates_len;
2650                 memcpy(&bss->supp_rates[bss->supp_rates_len],
2651                        elems.ext_supp_rates, clen);
2652                 bss->supp_rates_len += clen;
2653         }
2654
2655         bss->band = rx_status->band;
2656
2657         bss->timestamp = beacon_timestamp;
2658         bss->last_update = jiffies;
2659         bss->rssi = rx_status->ssi;
2660         bss->signal = rx_status->signal;
2661         bss->noise = rx_status->noise;
2662         if (!beacon && !bss->probe_resp)
2663                 bss->probe_resp = true;
2664
2665         /*
2666          * In STA mode, the remaining parameters should not be overridden
2667          * by beacons because they're not necessarily accurate there.
2668          */
2669         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
2670             bss->probe_resp && beacon) {
2671                 ieee80211_rx_bss_put(dev, bss);
2672                 return;
2673         }
2674
2675         if (elems.wpa &&
2676             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
2677              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
2678                 kfree(bss->wpa_ie);
2679                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
2680                 if (bss->wpa_ie) {
2681                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
2682                         bss->wpa_ie_len = elems.wpa_len + 2;
2683                 } else
2684                         bss->wpa_ie_len = 0;
2685         } else if (!elems.wpa && bss->wpa_ie) {
2686                 kfree(bss->wpa_ie);
2687                 bss->wpa_ie = NULL;
2688                 bss->wpa_ie_len = 0;
2689         }
2690
2691         if (elems.rsn &&
2692             (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
2693              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
2694                 kfree(bss->rsn_ie);
2695                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
2696                 if (bss->rsn_ie) {
2697                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
2698                         bss->rsn_ie_len = elems.rsn_len + 2;
2699                 } else
2700                         bss->rsn_ie_len = 0;
2701         } else if (!elems.rsn && bss->rsn_ie) {
2702                 kfree(bss->rsn_ie);
2703                 bss->rsn_ie = NULL;
2704                 bss->rsn_ie_len = 0;
2705         }
2706
2707         /*
2708          * Cf.
2709          * http://www.wipo.int/pctdb/en/wo.jsp?wo=2007047181&IA=WO2007047181&DISPLAY=DESC
2710          *
2711          * quoting:
2712          *
2713          * In particular, "Wi-Fi CERTIFIED for WMM - Support for Multimedia
2714          * Applications with Quality of Service in Wi-Fi Networks," Wi- Fi
2715          * Alliance (September 1, 2004) is incorporated by reference herein.
2716          * The inclusion of the WMM Parameters in probe responses and
2717          * association responses is mandatory for WMM enabled networks. The
2718          * inclusion of the WMM Parameters in beacons, however, is optional.
2719          */
2720
2721         if (elems.wmm_param &&
2722             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
2723              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
2724                 kfree(bss->wmm_ie);
2725                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
2726                 if (bss->wmm_ie) {
2727                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
2728                                elems.wmm_param_len + 2);
2729                         bss->wmm_ie_len = elems.wmm_param_len + 2;
2730                 } else
2731                         bss->wmm_ie_len = 0;
2732         } else if (elems.wmm_info &&
2733                     (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_info_len ||
2734                      memcmp(bss->wmm_ie, elems.wmm_info, elems.wmm_info_len))) {
2735                  /* As for certain AP's Fifth bit is not set in WMM IE in
2736                   * beacon frames.So while parsing the beacon frame the
2737                   * wmm_info structure is used instead of wmm_param.
2738                   * wmm_info structure was never used to set bss->wmm_ie.
2739                   * This code fixes this problem by copying the WME
2740                   * information from wmm_info to bss->wmm_ie and enabling
2741                   * n-band association.
2742                   */
2743                 kfree(bss->wmm_ie);
2744                 bss->wmm_ie = kmalloc(elems.wmm_info_len + 2, GFP_ATOMIC);
2745                 if (bss->wmm_ie) {
2746                         memcpy(bss->wmm_ie, elems.wmm_info - 2,
2747                                elems.wmm_info_len + 2);
2748                         bss->wmm_ie_len = elems.wmm_info_len + 2;
2749                 } else
2750                         bss->wmm_ie_len = 0;
2751         } else if (!elems.wmm_param && !elems.wmm_info && bss->wmm_ie) {
2752                 kfree(bss->wmm_ie);
2753                 bss->wmm_ie = NULL;
2754                 bss->wmm_ie_len = 0;
2755         }
2756
2757         /* check if we need to merge IBSS */
2758         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
2759             !local->sta_sw_scanning && !local->sta_hw_scanning &&
2760             bss->capability & WLAN_CAPABILITY_IBSS &&
2761             bss->freq == local->oper_channel->center_freq &&
2762             elems.ssid_len == sdata->u.sta.ssid_len &&
2763             memcmp(elems.ssid, sdata->u.sta.ssid, sdata->u.sta.ssid_len) == 0) {
2764                 if (rx_status->flag & RX_FLAG_TSFT) {
2765                         /* in order for correct IBSS merging we need mactime
2766                          *
2767                          * since mactime is defined as the time the first data
2768                          * symbol of the frame hits the PHY, and the timestamp
2769                          * of the beacon is defined as "the time that the data
2770                          * symbol containing the first bit of the timestamp is
2771                          * transmitted to the PHY plus the transmitting STA’s
2772                          * delays through its local PHY from the MAC-PHY
2773                          * interface to its interface with the WM"
2774                          * (802.11 11.1.2) - equals the time this bit arrives at
2775                          * the receiver - we have to take into account the
2776                          * offset between the two.
2777                          * e.g: at 1 MBit that means mactime is 192 usec earlier
2778                          * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
2779                          */
2780                         int rate = local->hw.wiphy->bands[rx_status->band]->
2781                                         bitrates[rx_status->rate_idx].bitrate;
2782                         rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
2783                 } else if (local && local->ops && local->ops->get_tsf)
2784                         /* second best option: get current TSF */
2785                         rx_timestamp = local->ops->get_tsf(local_to_hw(local));
2786                 else
2787                         /* can't merge without knowing the TSF */
2788                         rx_timestamp = -1LLU;
2789 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2790                 printk(KERN_DEBUG "RX beacon SA=%s BSSID="
2791                        "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
2792                        print_mac(mac, mgmt->sa),
2793                        print_mac(mac2, mgmt->bssid),
2794                        (unsigned long long)rx_timestamp,
2795                        (unsigned long long)beacon_timestamp,
2796                        (unsigned long long)(rx_timestamp - beacon_timestamp),
2797                        jiffies);
2798 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2799                 if (beacon_timestamp > rx_timestamp) {
2800 #ifndef CONFIG_MAC80211_IBSS_DEBUG
2801                         if (net_ratelimit())
2802 #endif
2803                                 printk(KERN_DEBUG "%s: beacon TSF higher than "
2804                                        "local TSF - IBSS merge with BSSID %s\n",
2805                                        dev->name, print_mac(mac, mgmt->bssid));
2806                         ieee80211_sta_join_ibss(dev, &sdata->u.sta, bss);
2807                         ieee80211_ibss_add_sta(dev, NULL,
2808                                                mgmt->bssid, mgmt->sa);
2809                 }
2810         }
2811
2812         ieee80211_rx_bss_put(dev, bss);
2813 }
2814
2815
2816 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
2817                                          struct ieee80211_mgmt *mgmt,
2818                                          size_t len,
2819                                          struct ieee80211_rx_status *rx_status)
2820 {
2821         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
2822 }
2823
2824
2825 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
2826                                      struct ieee80211_mgmt *mgmt,
2827                                      size_t len,
2828                                      struct ieee80211_rx_status *rx_status)
2829 {
2830         struct ieee80211_sub_if_data *sdata;
2831         struct ieee80211_if_sta *ifsta;
2832         size_t baselen;
2833         struct ieee802_11_elems elems;
2834         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2835         struct ieee80211_conf *conf = &local->hw.conf;
2836         u32 changed = 0;
2837
2838         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
2839
2840         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2841         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2842                 return;
2843         ifsta = &sdata->u.sta;
2844
2845         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
2846             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
2847                 return;
2848
2849         /* Process beacon from the current BSS */
2850         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2851         if (baselen > len)
2852                 return;
2853
2854         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2855
2856         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
2857                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
2858                                          elems.wmm_param_len);
2859         }
2860
2861         /* Do not send changes to driver if we are scanning. This removes
2862          * requirement that driver's bss_info_changed function needs to be
2863          * atomic. */
2864         if (local->sta_sw_scanning || local->sta_hw_scanning)
2865                 return;
2866
2867         if (elems.erp_info && elems.erp_info_len >= 1)
2868                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
2869         else {
2870                 u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
2871                 changed |= ieee80211_handle_protect_preamb(sdata, false,
2872                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
2873         }
2874
2875         if (elems.ht_cap_elem && elems.ht_info_elem &&
2876             elems.wmm_param && conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
2877                 struct ieee80211_ht_bss_info bss_info;
2878
2879                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2880                                 (struct ieee80211_ht_addt_info *)
2881                                 elems.ht_info_elem, &bss_info);
2882                 changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf,
2883                                                &bss_info);
2884         }
2885
2886         ieee80211_bss_info_change_notify(sdata, changed);
2887 }
2888
2889
2890 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
2891                                         struct ieee80211_if_sta *ifsta,
2892                                         struct ieee80211_mgmt *mgmt,
2893                                         size_t len,
2894                                         struct ieee80211_rx_status *rx_status)
2895 {
2896         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2897         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2898         int tx_last_beacon;
2899         struct sk_buff *skb;
2900         struct ieee80211_mgmt *resp;
2901         u8 *pos, *end;
2902         DECLARE_MAC_BUF(mac);
2903 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2904         DECLARE_MAC_BUF(mac2);
2905         DECLARE_MAC_BUF(mac3);
2906 #endif
2907
2908         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS ||
2909             ifsta->state != IEEE80211_IBSS_JOINED ||
2910             len < 24 + 2 || !ifsta->probe_resp)
2911                 return;
2912
2913         if (local->ops->tx_last_beacon)
2914                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
2915         else
2916                 tx_last_beacon = 1;
2917
2918 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2919         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
2920                "%s (tx_last_beacon=%d)\n",
2921                dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
2922                print_mac(mac3, mgmt->bssid), tx_last_beacon);
2923 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2924
2925         if (!tx_last_beacon)
2926                 return;
2927
2928         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
2929             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2930                 return;
2931
2932         end = ((u8 *) mgmt) + len;
2933         pos = mgmt->u.probe_req.variable;
2934         if (pos[0] != WLAN_EID_SSID ||
2935             pos + 2 + pos[1] > end) {
2936                 if (net_ratelimit()) {
2937                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
2938                                "from %s\n",
2939                                dev->name, print_mac(mac, mgmt->sa));
2940                 }
2941                 return;
2942         }
2943         if (pos[1] != 0 &&
2944             (pos[1] != ifsta->ssid_len ||
2945              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
2946                 /* Ignore ProbeReq for foreign SSID */
2947                 return;
2948         }
2949
2950         /* Reply with ProbeResp */
2951         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
2952         if (!skb)
2953                 return;
2954
2955         resp = (struct ieee80211_mgmt *) skb->data;
2956         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2957 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2958         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
2959                dev->name, print_mac(mac, resp->da));
2960 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2961         ieee80211_sta_tx(dev, skb, 0);
2962 }
2963
2964 static void ieee80211_rx_mgmt_action(struct net_device *dev,
2965                                      struct ieee80211_if_sta *ifsta,
2966                                      struct ieee80211_mgmt *mgmt,
2967                                      size_t len,
2968                                      struct ieee80211_rx_status *rx_status)
2969 {
2970         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2971
2972         if (len < IEEE80211_MIN_ACTION_SIZE)
2973                 return;
2974
2975         switch (mgmt->u.action.category) {
2976         case WLAN_CATEGORY_BACK:
2977                 switch (mgmt->u.action.u.addba_req.action_code) {
2978                 case WLAN_ACTION_ADDBA_REQ:
2979                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2980                                    sizeof(mgmt->u.action.u.addba_req)))
2981                                 break;
2982                         ieee80211_sta_process_addba_request(dev, mgmt, len);
2983                         break;
2984                 case WLAN_ACTION_ADDBA_RESP:
2985                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2986                                    sizeof(mgmt->u.action.u.addba_resp)))
2987                                 break;
2988                         ieee80211_sta_process_addba_resp(dev, mgmt, len);
2989                         break;
2990                 case WLAN_ACTION_DELBA:
2991                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2992                                    sizeof(mgmt->u.action.u.delba)))
2993                                 break;
2994                         ieee80211_sta_process_delba(dev, mgmt, len);
2995                         break;
2996                 default:
2997                         if (net_ratelimit())
2998                            printk(KERN_DEBUG "%s: Rx unknown A-MPDU action\n",
2999                                         dev->name);
3000                         break;
3001                 }
3002                 break;
3003         case PLINK_CATEGORY:
3004                 if (ieee80211_vif_is_mesh(&sdata->vif))
3005                         mesh_rx_plink_frame(dev, mgmt, len, rx_status);
3006                 break;
3007         case MESH_PATH_SEL_CATEGORY:
3008                 if (ieee80211_vif_is_mesh(&sdata->vif))
3009                         mesh_rx_path_sel_frame(dev, mgmt, len);
3010                 break;
3011         default:
3012                 if (net_ratelimit())
3013                         printk(KERN_DEBUG "%s: Rx unknown action frame - "
3014                         "category=%d\n", dev->name, mgmt->u.action.category);
3015                 break;
3016         }
3017 }
3018
3019 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
3020                            struct ieee80211_rx_status *rx_status)
3021 {
3022         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3023         struct ieee80211_sub_if_data *sdata;
3024         struct ieee80211_if_sta *ifsta;
3025         struct ieee80211_mgmt *mgmt;
3026         u16 fc;
3027
3028         if (skb->len < 24)
3029                 goto fail;
3030
3031         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3032         ifsta = &sdata->u.sta;
3033
3034         mgmt = (struct ieee80211_mgmt *) skb->data;
3035         fc = le16_to_cpu(mgmt->frame_control);
3036
3037         switch (fc & IEEE80211_FCTL_STYPE) {
3038         case IEEE80211_STYPE_PROBE_REQ:
3039         case IEEE80211_STYPE_PROBE_RESP:
3040         case IEEE80211_STYPE_BEACON:
3041         case IEEE80211_STYPE_ACTION:
3042                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
3043         case IEEE80211_STYPE_AUTH:
3044         case IEEE80211_STYPE_ASSOC_RESP:
3045         case IEEE80211_STYPE_REASSOC_RESP:
3046         case IEEE80211_STYPE_DEAUTH:
3047         case IEEE80211_STYPE_DISASSOC:
3048                 skb_queue_tail(&ifsta->skb_queue, skb);
3049                 queue_work(local->hw.workqueue, &ifsta->work);
3050                 return;
3051         default:
3052                 printk(KERN_DEBUG "%s: received unknown management frame - "
3053                        "stype=%d\n", dev->name,
3054                        (fc & IEEE80211_FCTL_STYPE) >> 4);
3055                 break;
3056         }
3057
3058  fail:
3059         kfree_skb(skb);
3060 }
3061
3062
3063 static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
3064                                          struct sk_buff *skb)
3065 {
3066         struct ieee80211_rx_status *rx_status;
3067         struct ieee80211_sub_if_data *sdata;
3068         struct ieee80211_if_sta *ifsta;
3069         struct ieee80211_mgmt *mgmt;
3070         u16 fc;
3071
3072         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3073         ifsta = &sdata->u.sta;
3074
3075         rx_status = (struct ieee80211_rx_status *) skb->cb;
3076         mgmt = (struct ieee80211_mgmt *) skb->data;
3077         fc = le16_to_cpu(mgmt->frame_control);
3078
3079         switch (fc & IEEE80211_FCTL_STYPE) {
3080         case IEEE80211_STYPE_PROBE_REQ:
3081                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
3082                                             rx_status);
3083                 break;
3084         case IEEE80211_STYPE_PROBE_RESP:
3085                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
3086                 break;
3087         case IEEE80211_STYPE_BEACON:
3088                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
3089                 break;
3090         case IEEE80211_STYPE_AUTH:
3091                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
3092                 break;
3093         case IEEE80211_STYPE_ASSOC_RESP:
3094                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
3095                 break;
3096         case IEEE80211_STYPE_REASSOC_RESP:
3097                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
3098                 break;
3099         case IEEE80211_STYPE_DEAUTH:
3100                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
3101                 break;
3102         case IEEE80211_STYPE_DISASSOC:
3103                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
3104                 break;
3105         case IEEE80211_STYPE_ACTION:
3106                 ieee80211_rx_mgmt_action(dev, ifsta, mgmt, skb->len, rx_status);
3107                 break;
3108         }
3109
3110         kfree_skb(skb);
3111 }
3112
3113
3114 ieee80211_rx_result
3115 ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
3116                       struct ieee80211_rx_status *rx_status)
3117 {
3118         struct ieee80211_mgmt *mgmt;
3119         u16 fc;
3120
3121         if (skb->len < 2)
3122                 return RX_DROP_UNUSABLE;
3123
3124         mgmt = (struct ieee80211_mgmt *) skb->data;
3125         fc = le16_to_cpu(mgmt->frame_control);
3126
3127         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
3128                 return RX_CONTINUE;
3129
3130         if (skb->len < 24)
3131                 return RX_DROP_MONITOR;
3132
3133         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
3134                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
3135                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
3136                                                      skb->len, rx_status);
3137                         dev_kfree_skb(skb);
3138                         return RX_QUEUED;
3139                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
3140                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
3141                                                  rx_status);
3142                         dev_kfree_skb(skb);
3143                         return RX_QUEUED;
3144                 }
3145         }
3146         return RX_CONTINUE;
3147 }
3148
3149
3150 static int ieee80211_sta_active_ibss(struct net_device *dev)
3151 {
3152         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3153         int active = 0;
3154         struct sta_info *sta;
3155         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3156
3157         rcu_read_lock();
3158
3159         list_for_each_entry_rcu(sta, &local->sta_list, list) {
3160                 if (sta->sdata == sdata &&
3161                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
3162                                jiffies)) {
3163                         active++;
3164                         break;
3165                 }
3166         }
3167
3168         rcu_read_unlock();
3169
3170         return active;
3171 }
3172
3173
3174 static void ieee80211_sta_expire(struct net_device *dev, unsigned long exp_time)
3175 {
3176         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3177         struct sta_info *sta, *tmp;
3178         LIST_HEAD(tmp_list);
3179         DECLARE_MAC_BUF(mac);
3180         unsigned long flags;
3181
3182         spin_lock_irqsave(&local->sta_lock, flags);
3183         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
3184                 if (time_after(jiffies, sta->last_rx + exp_time)) {
3185                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
3186                                dev->name, print_mac(mac, sta->addr));
3187                         __sta_info_unlink(&sta);
3188                         if (sta)
3189                                 list_add(&sta->list, &tmp_list);
3190                 }
3191         spin_unlock_irqrestore(&local->sta_lock, flags);
3192
3193         list_for_each_entry_safe(sta, tmp, &tmp_list, list)
3194                 sta_info_destroy(sta);
3195 }
3196
3197
3198 static void ieee80211_sta_merge_ibss(struct net_device *dev,
3199                                      struct ieee80211_if_sta *ifsta)
3200 {
3201         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
3202
3203         ieee80211_sta_expire(dev, IEEE80211_IBSS_INACTIVITY_LIMIT);
3204         if (ieee80211_sta_active_ibss(dev))
3205                 return;
3206
3207         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
3208                "IBSS networks with same SSID (merge)\n", dev->name);
3209         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
3210 }
3211
3212
3213 #ifdef CONFIG_MAC80211_MESH
3214 static void ieee80211_mesh_housekeeping(struct net_device *dev,
3215                            struct ieee80211_if_sta *ifsta)
3216 {
3217         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3218         bool free_plinks;
3219
3220         ieee80211_sta_expire(dev, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
3221         mesh_path_expire(dev);
3222
3223         free_plinks = mesh_plink_availables(sdata);
3224         if (free_plinks != sdata->u.sta.accepting_plinks)
3225                 ieee80211_if_config_beacon(dev);
3226
3227         mod_timer(&ifsta->timer, jiffies +
3228                         IEEE80211_MESH_HOUSEKEEPING_INTERVAL);
3229 }
3230
3231
3232 void ieee80211_start_mesh(struct net_device *dev)
3233 {
3234         struct ieee80211_if_sta *ifsta;
3235         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3236         ifsta = &sdata->u.sta;
3237         ifsta->state = IEEE80211_MESH_UP;
3238         ieee80211_sta_timer((unsigned long)sdata);
3239 }
3240 #endif
3241
3242
3243 void ieee80211_sta_timer(unsigned long data)
3244 {
3245         struct ieee80211_sub_if_data *sdata =
3246                 (struct ieee80211_sub_if_data *) data;
3247         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3248         struct ieee80211_local *local = wdev_priv(&sdata->wdev);
3249
3250         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
3251         queue_work(local->hw.workqueue, &ifsta->work);
3252 }
3253
3254 void ieee80211_sta_work(struct work_struct *work)
3255 {
3256         struct ieee80211_sub_if_data *sdata =
3257                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
3258         struct net_device *dev = sdata->dev;
3259         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3260         struct ieee80211_if_sta *ifsta;
3261         struct sk_buff *skb;
3262
3263         if (!netif_running(dev))
3264                 return;
3265
3266         if (local->sta_sw_scanning || local->sta_hw_scanning)
3267                 return;
3268
3269         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3270             sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
3271             sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT) {
3272                 printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
3273                        "(type=%d)\n", dev->name, sdata->vif.type);
3274                 return;
3275         }
3276         ifsta = &sdata->u.sta;
3277
3278         while ((skb = skb_dequeue(&ifsta->skb_queue)))
3279                 ieee80211_sta_rx_queued_mgmt(dev, skb);
3280
3281 #ifdef CONFIG_MAC80211_MESH
3282         if (ifsta->preq_queue_len &&
3283             time_after(jiffies,
3284                        ifsta->last_preq + msecs_to_jiffies(ifsta->mshcfg.dot11MeshHWMPpreqMinInterval)))
3285                 mesh_path_start_discovery(dev);
3286 #endif
3287
3288         if (ifsta->state != IEEE80211_AUTHENTICATE &&
3289             ifsta->state != IEEE80211_ASSOCIATE &&
3290             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
3291                 if (ifsta->scan_ssid_len)
3292                         ieee80211_sta_start_scan(dev, ifsta->scan_ssid, ifsta->scan_ssid_len);
3293                 else
3294                         ieee80211_sta_start_scan(dev, NULL, 0);
3295                 return;
3296         }
3297
3298         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
3299                 if (ieee80211_sta_config_auth(dev, ifsta))
3300                         return;
3301                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
3302         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
3303                 return;
3304
3305         switch (ifsta->state) {
3306         case IEEE80211_DISABLED:
3307                 break;
3308         case IEEE80211_AUTHENTICATE:
3309                 ieee80211_authenticate(dev, ifsta);
3310                 break;
3311         case IEEE80211_ASSOCIATE:
3312                 ieee80211_associate(dev, ifsta);
3313                 break;
3314         case IEEE80211_ASSOCIATED:
3315                 ieee80211_associated(dev, ifsta);
3316                 break;
3317         case IEEE80211_IBSS_SEARCH:
3318                 ieee80211_sta_find_ibss(dev, ifsta);
3319                 break;
3320         case IEEE80211_IBSS_JOINED:
3321                 ieee80211_sta_merge_ibss(dev, ifsta);
3322                 break;
3323 #ifdef CONFIG_MAC80211_MESH
3324         case IEEE80211_MESH_UP:
3325                 ieee80211_mesh_housekeeping(dev, ifsta);
3326                 break;
3327 #endif
3328         default:
3329                 printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
3330                        ifsta->state);
3331                 break;
3332         }
3333
3334         if (ieee80211_privacy_mismatch(dev, ifsta)) {
3335                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
3336                        "mixed-cell disabled - disassociate\n", dev->name);
3337
3338                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
3339                 ieee80211_set_disassoc(dev, ifsta, 0);
3340         }
3341 }
3342
3343
3344 static void ieee80211_sta_reset_auth(struct net_device *dev,
3345                                      struct ieee80211_if_sta *ifsta)
3346 {
3347         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3348
3349         if (local->ops->reset_tsf) {
3350                 /* Reset own TSF to allow time synchronization work. */
3351                 local->ops->reset_tsf(local_to_hw(local));
3352         }
3353
3354         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
3355
3356
3357         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
3358                 ifsta->auth_alg = WLAN_AUTH_OPEN;
3359         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
3360                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
3361         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
3362                 ifsta->auth_alg = WLAN_AUTH_LEAP;
3363         else
3364                 ifsta->auth_alg = WLAN_AUTH_OPEN;
3365         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
3366                ifsta->auth_alg);
3367         ifsta->auth_transaction = -1;
3368         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
3369         ifsta->auth_tries = ifsta->assoc_tries = 0;
3370         netif_carrier_off(dev);
3371 }
3372
3373
3374 void ieee80211_sta_req_auth(struct net_device *dev,
3375                             struct ieee80211_if_sta *ifsta)
3376 {
3377         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3378         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3379
3380         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3381                 return;
3382
3383         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
3384                                 IEEE80211_STA_AUTO_BSSID_SEL)) &&
3385             (ifsta->flags & (IEEE80211_STA_SSID_SET |
3386                                 IEEE80211_STA_AUTO_SSID_SEL))) {
3387                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
3388                 queue_work(local->hw.workqueue, &ifsta->work);
3389         }
3390 }
3391
3392 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
3393                                     const char *ssid, int ssid_len)
3394 {
3395         int tmp, hidden_ssid;
3396
3397         if (ssid_len == ifsta->ssid_len &&
3398             !memcmp(ifsta->ssid, ssid, ssid_len))
3399                 return 1;
3400
3401         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
3402                 return 0;
3403
3404         hidden_ssid = 1;
3405         tmp = ssid_len;
3406         while (tmp--) {
3407                 if (ssid[tmp] != '\0') {
3408                         hidden_ssid = 0;
3409                         break;
3410                 }
3411         }
3412
3413         if (hidden_ssid && ifsta->ssid_len == ssid_len)
3414                 return 1;
3415
3416         if (ssid_len == 1 && ssid[0] == ' ')
3417                 return 1;
3418
3419         return 0;
3420 }
3421
3422 static int ieee80211_sta_config_auth(struct net_device *dev,
3423                                      struct ieee80211_if_sta *ifsta)
3424 {
3425         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3426         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3427         struct ieee80211_sta_bss *bss, *selected = NULL;
3428         int top_rssi = 0, freq;
3429
3430         if (!(ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
3431             IEEE80211_STA_AUTO_BSSID_SEL | IEEE80211_STA_AUTO_CHANNEL_SEL))) {
3432                 ifsta->state = IEEE80211_AUTHENTICATE;
3433                 ieee80211_sta_reset_auth(dev, ifsta);
3434                 return 0;
3435         }
3436
3437         spin_lock_bh(&local->sta_bss_lock);
3438         freq = local->oper_channel->center_freq;
3439         list_for_each_entry(bss, &local->sta_bss_list, list) {
3440                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
3441                         continue;
3442
3443                 if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
3444                     !!sdata->default_key)
3445                         continue;
3446
3447                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
3448                     bss->freq != freq)
3449                         continue;
3450
3451                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
3452                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
3453                         continue;
3454
3455                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
3456                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
3457                         continue;
3458
3459                 if (!selected || top_rssi < bss->rssi) {
3460                         selected = bss;
3461                         top_rssi = bss->rssi;
3462                 }
3463         }
3464         if (selected)
3465                 atomic_inc(&selected->users);
3466         spin_unlock_bh(&local->sta_bss_lock);
3467
3468         if (selected) {
3469                 ieee80211_set_freq(local, selected->freq);
3470                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
3471                         ieee80211_sta_set_ssid(dev, selected->ssid,
3472                                                selected->ssid_len);
3473                 ieee80211_sta_set_bssid(dev, selected->bssid);
3474                 ieee80211_sta_def_wmm_params(dev, selected, 0);
3475                 ieee80211_rx_bss_put(dev, selected);
3476                 ifsta->state = IEEE80211_AUTHENTICATE;
3477                 ieee80211_sta_reset_auth(dev, ifsta);
3478                 return 0;
3479         } else {
3480                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
3481                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
3482                                 ieee80211_sta_start_scan(dev, NULL, 0);
3483                         else
3484                                 ieee80211_sta_start_scan(dev, ifsta->ssid,
3485                                                          ifsta->ssid_len);
3486                         ifsta->state = IEEE80211_AUTHENTICATE;
3487                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
3488                 } else
3489                         ifsta->state = IEEE80211_DISABLED;
3490         }
3491         return -1;
3492 }
3493
3494
3495 static int ieee80211_sta_create_ibss(struct net_device *dev,
3496                                      struct ieee80211_if_sta *ifsta)
3497 {
3498         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3499         struct ieee80211_sta_bss *bss;
3500         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3501         struct ieee80211_supported_band *sband;
3502         u8 bssid[ETH_ALEN], *pos;
3503         int i;
3504         DECLARE_MAC_BUF(mac);
3505
3506 #if 0
3507         /* Easier testing, use fixed BSSID. */
3508         memset(bssid, 0xfe, ETH_ALEN);
3509 #else
3510         /* Generate random, not broadcast, locally administered BSSID. Mix in
3511          * own MAC address to make sure that devices that do not have proper
3512          * random number generator get different BSSID. */
3513         get_random_bytes(bssid, ETH_ALEN);
3514         for (i = 0; i < ETH_ALEN; i++)
3515                 bssid[i] ^= dev->dev_addr[i];
3516         bssid[0] &= ~0x01;
3517         bssid[0] |= 0x02;
3518 #endif
3519
3520         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
3521                dev->name, print_mac(mac, bssid));
3522
3523         bss = ieee80211_rx_bss_add(dev, bssid,
3524                                    local->hw.conf.channel->center_freq,
3525                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
3526         if (!bss)
3527                 return -ENOMEM;
3528
3529         bss->band = local->hw.conf.channel->band;
3530         sband = local->hw.wiphy->bands[bss->band];
3531
3532         if (local->hw.conf.beacon_int == 0)
3533                 local->hw.conf.beacon_int = 10000;
3534         bss->beacon_int = local->hw.conf.beacon_int;
3535         bss->last_update = jiffies;
3536         bss->capability = WLAN_CAPABILITY_IBSS;
3537
3538         if (sdata->default_key)
3539                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
3540         else
3541                 sdata->drop_unencrypted = 0;
3542
3543         bss->supp_rates_len = sband->n_bitrates;
3544         pos = bss->supp_rates;
3545         for (i = 0; i < sband->n_bitrates; i++) {
3546                 int rate = sband->bitrates[i].bitrate;
3547                 *pos++ = (u8) (rate / 5);
3548         }
3549
3550         return ieee80211_sta_join_ibss(dev, ifsta, bss);
3551 }
3552
3553
3554 static int ieee80211_sta_find_ibss(struct net_device *dev,
3555                                    struct ieee80211_if_sta *ifsta)
3556 {
3557         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3558         struct ieee80211_sta_bss *bss;
3559         int found = 0;
3560         u8 bssid[ETH_ALEN];
3561         int active_ibss;
3562         DECLARE_MAC_BUF(mac);
3563         DECLARE_MAC_BUF(mac2);
3564
3565         if (ifsta->ssid_len == 0)
3566                 return -EINVAL;
3567
3568         active_ibss = ieee80211_sta_active_ibss(dev);
3569 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3570         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
3571                dev->name, active_ibss);
3572 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3573         spin_lock_bh(&local->sta_bss_lock);
3574         list_for_each_entry(bss, &local->sta_bss_list, list) {
3575                 if (ifsta->ssid_len != bss->ssid_len ||
3576                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
3577                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
3578                         continue;
3579 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3580                 printk(KERN_DEBUG "   bssid=%s found\n",
3581                        print_mac(mac, bss->bssid));
3582 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3583                 memcpy(bssid, bss->bssid, ETH_ALEN);
3584                 found = 1;
3585                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
3586                         break;
3587         }
3588         spin_unlock_bh(&local->sta_bss_lock);
3589
3590 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3591         printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
3592                "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
3593 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3594         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
3595             (bss = ieee80211_rx_bss_get(dev, bssid,
3596                                         local->hw.conf.channel->center_freq,
3597                                         ifsta->ssid, ifsta->ssid_len))) {
3598                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
3599                        " based on configured SSID\n",
3600                        dev->name, print_mac(mac, bssid));
3601                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
3602         }
3603 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3604         printk(KERN_DEBUG "   did not try to join ibss\n");
3605 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3606
3607         /* Selected IBSS not found in current scan results - try to scan */
3608         if (ifsta->state == IEEE80211_IBSS_JOINED &&
3609             !ieee80211_sta_active_ibss(dev)) {
3610                 mod_timer(&ifsta->timer, jiffies +
3611                                       IEEE80211_IBSS_MERGE_INTERVAL);
3612         } else if (time_after(jiffies, local->last_scan_completed +
3613                               IEEE80211_SCAN_INTERVAL)) {
3614                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
3615                        "join\n", dev->name);
3616                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
3617                                               ifsta->ssid_len);
3618         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
3619                 int interval = IEEE80211_SCAN_INTERVAL;
3620
3621                 if (time_after(jiffies, ifsta->ibss_join_req +
3622                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
3623                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
3624                             (!(local->oper_channel->flags &
3625                                         IEEE80211_CHAN_NO_IBSS)))
3626                                 return ieee80211_sta_create_ibss(dev, ifsta);
3627                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
3628                                 printk(KERN_DEBUG "%s: IBSS not allowed on"
3629                                        " %d MHz\n", dev->name,
3630                                        local->hw.conf.channel->center_freq);
3631                         }
3632
3633                         /* No IBSS found - decrease scan interval and continue
3634                          * scanning. */
3635                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
3636                 }
3637
3638                 ifsta->state = IEEE80211_IBSS_SEARCH;
3639                 mod_timer(&ifsta->timer, jiffies + interval);
3640                 return 0;
3641         }
3642
3643         return 0;
3644 }
3645
3646
3647 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
3648 {
3649         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3650         struct ieee80211_if_sta *ifsta;
3651
3652         if (len > IEEE80211_MAX_SSID_LEN)
3653                 return -EINVAL;
3654
3655         ifsta = &sdata->u.sta;
3656
3657         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
3658                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
3659         memcpy(ifsta->ssid, ssid, len);
3660         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
3661         ifsta->ssid_len = len;
3662
3663         if (len)
3664                 ifsta->flags |= IEEE80211_STA_SSID_SET;
3665         else
3666                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
3667         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3668             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
3669                 ifsta->ibss_join_req = jiffies;
3670                 ifsta->state = IEEE80211_IBSS_SEARCH;
3671                 return ieee80211_sta_find_ibss(dev, ifsta);
3672         }
3673         return 0;
3674 }
3675
3676
3677 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
3678 {
3679         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3680         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3681         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
3682         *len = ifsta->ssid_len;
3683         return 0;
3684 }
3685
3686
3687 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
3688 {
3689         struct ieee80211_sub_if_data *sdata;
3690         struct ieee80211_if_sta *ifsta;
3691         int res;
3692
3693         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3694         ifsta = &sdata->u.sta;
3695
3696         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
3697                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
3698                 res = ieee80211_if_config(dev);
3699                 if (res) {
3700                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
3701                                "the low-level driver\n", dev->name);
3702                         return res;
3703                 }
3704         }
3705
3706         if (is_valid_ether_addr(bssid))
3707                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
3708         else
3709                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
3710
3711         return 0;
3712 }
3713
3714
3715 static void ieee80211_send_nullfunc(struct ieee80211_local *local,
3716                                     struct ieee80211_sub_if_data *sdata,
3717                                     int powersave)
3718 {
3719         struct sk_buff *skb;
3720         struct ieee80211_hdr *nullfunc;
3721         u16 fc;
3722
3723         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
3724         if (!skb) {
3725                 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
3726                        "frame\n", sdata->dev->name);
3727                 return;
3728         }
3729         skb_reserve(skb, local->hw.extra_tx_headroom);
3730
3731         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
3732         memset(nullfunc, 0, 24);
3733         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
3734              IEEE80211_FCTL_TODS;
3735         if (powersave)
3736                 fc |= IEEE80211_FCTL_PM;
3737         nullfunc->frame_control = cpu_to_le16(fc);
3738         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
3739         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
3740         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
3741
3742         ieee80211_sta_tx(sdata->dev, skb, 0);
3743 }
3744
3745
3746 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
3747 {
3748         if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
3749             ieee80211_vif_is_mesh(&sdata->vif))
3750                 ieee80211_sta_timer((unsigned long)sdata);
3751 }
3752
3753 void ieee80211_scan_completed(struct ieee80211_hw *hw)
3754 {
3755         struct ieee80211_local *local = hw_to_local(hw);
3756         struct net_device *dev = local->scan_dev;
3757         struct ieee80211_sub_if_data *sdata;
3758         union iwreq_data wrqu;
3759
3760         local->last_scan_completed = jiffies;
3761         memset(&wrqu, 0, sizeof(wrqu));
3762         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
3763
3764         if (local->sta_hw_scanning) {
3765                 local->sta_hw_scanning = 0;
3766                 if (ieee80211_hw_config(local))
3767                         printk(KERN_DEBUG "%s: failed to restore operational "
3768                                "channel after scan\n", dev->name);
3769                 /* Restart STA timer for HW scan case */
3770                 rcu_read_lock();
3771                 list_for_each_entry_rcu(sdata, &local->interfaces, list)
3772                         ieee80211_restart_sta_timer(sdata);
3773                 rcu_read_unlock();
3774
3775                 goto done;
3776         }
3777
3778         local->sta_sw_scanning = 0;
3779         if (ieee80211_hw_config(local))
3780                 printk(KERN_DEBUG "%s: failed to restore operational "
3781                        "channel after scan\n", dev->name);
3782
3783
3784         netif_tx_lock_bh(local->mdev);
3785         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
3786         local->ops->configure_filter(local_to_hw(local),
3787                                      FIF_BCN_PRBRESP_PROMISC,
3788                                      &local->filter_flags,
3789                                      local->mdev->mc_count,
3790                                      local->mdev->mc_list);
3791
3792         netif_tx_unlock_bh(local->mdev);
3793
3794         rcu_read_lock();
3795         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3796
3797                 /* No need to wake the master device. */
3798                 if (sdata->dev == local->mdev)
3799                         continue;
3800
3801                 /* Tell AP we're back */
3802                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
3803                     sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
3804                         ieee80211_send_nullfunc(local, sdata, 0);
3805
3806                 ieee80211_restart_sta_timer(sdata);
3807
3808                 netif_wake_queue(sdata->dev);
3809         }
3810         rcu_read_unlock();
3811
3812 done:
3813         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3814         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
3815                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3816                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
3817                     (!ifsta->state == IEEE80211_IBSS_JOINED &&
3818                     !ieee80211_sta_active_ibss(dev)))
3819                         ieee80211_sta_find_ibss(dev, ifsta);
3820         }
3821 }
3822 EXPORT_SYMBOL(ieee80211_scan_completed);
3823
3824 void ieee80211_sta_scan_work(struct work_struct *work)
3825 {
3826         struct ieee80211_local *local =
3827                 container_of(work, struct ieee80211_local, scan_work.work);
3828         struct net_device *dev = local->scan_dev;
3829         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3830         struct ieee80211_supported_band *sband;
3831         struct ieee80211_channel *chan;
3832         int skip;
3833         unsigned long next_delay = 0;
3834
3835         if (!local->sta_sw_scanning)
3836                 return;
3837
3838         switch (local->scan_state) {
3839         case SCAN_SET_CHANNEL:
3840                 /*
3841                  * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
3842                  * after we successfully scanned the last channel of the last
3843                  * band (and the last band is supported by the hw)
3844                  */
3845                 if (local->scan_band < IEEE80211_NUM_BANDS)
3846                         sband = local->hw.wiphy->bands[local->scan_band];
3847                 else
3848                         sband = NULL;
3849
3850                 /*
3851                  * If we are at an unsupported band and have more bands
3852                  * left to scan, advance to the next supported one.
3853                  */
3854                 while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
3855                         local->scan_band++;
3856                         sband = local->hw.wiphy->bands[local->scan_band];
3857                         local->scan_channel_idx = 0;
3858                 }
3859
3860                 /* if no more bands/channels left, complete scan */
3861                 if (!sband || local->scan_channel_idx >= sband->n_channels) {
3862                         ieee80211_scan_completed(local_to_hw(local));
3863                         return;
3864                 }
3865                 skip = 0;
3866                 chan = &sband->channels[local->scan_channel_idx];
3867
3868                 if (chan->flags & IEEE80211_CHAN_DISABLED ||
3869                     (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3870                      chan->flags & IEEE80211_CHAN_NO_IBSS))
3871                         skip = 1;
3872
3873                 if (!skip) {
3874                         local->scan_channel = chan;
3875                         if (ieee80211_hw_config(local)) {
3876                                 printk(KERN_DEBUG "%s: failed to set freq to "
3877                                        "%d MHz for scan\n", dev->name,
3878                                        chan->center_freq);
3879                                 skip = 1;
3880                         }
3881                 }
3882
3883                 /* advance state machine to next channel/band */
3884                 local->scan_channel_idx++;
3885                 if (local->scan_channel_idx >= sband->n_channels) {
3886                         /*
3887                          * scan_band may end up == IEEE80211_NUM_BANDS, but
3888                          * we'll catch that case above and complete the scan
3889                          * if that is the case.
3890                          */
3891                         local->scan_band++;
3892                         local->scan_channel_idx = 0;
3893                 }
3894
3895                 if (skip)
3896                         break;
3897
3898                 next_delay = IEEE80211_PROBE_DELAY +
3899                              usecs_to_jiffies(local->hw.channel_change_time);
3900                 local->scan_state = SCAN_SEND_PROBE;
3901                 break;
3902         case SCAN_SEND_PROBE:
3903                 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
3904                 local->scan_state = SCAN_SET_CHANNEL;
3905
3906                 if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
3907                         break;
3908                 ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
3909                                          local->scan_ssid_len);
3910                 next_delay = IEEE80211_CHANNEL_TIME;
3911                 break;
3912         }
3913
3914         if (local->sta_sw_scanning)
3915                 queue_delayed_work(local->hw.workqueue, &local->scan_work,
3916                                    next_delay);
3917 }
3918
3919
3920 static int ieee80211_sta_start_scan(struct net_device *dev,
3921                                     u8 *ssid, size_t ssid_len)
3922 {
3923         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3924         struct ieee80211_sub_if_data *sdata;
3925
3926         if (ssid_len > IEEE80211_MAX_SSID_LEN)
3927                 return -EINVAL;
3928
3929         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
3930          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
3931          * BSSID: MACAddress
3932          * SSID
3933          * ScanType: ACTIVE, PASSIVE
3934          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
3935          *    a Probe frame during active scanning
3936          * ChannelList
3937          * MinChannelTime (>= ProbeDelay), in TU
3938          * MaxChannelTime: (>= MinChannelTime), in TU
3939          */
3940
3941          /* MLME-SCAN.confirm
3942           * BSSDescriptionSet
3943           * ResultCode: SUCCESS, INVALID_PARAMETERS
3944          */
3945
3946         if (local->sta_sw_scanning || local->sta_hw_scanning) {
3947                 if (local->scan_dev == dev)
3948                         return 0;
3949                 return -EBUSY;
3950         }
3951
3952         if (local->ops->hw_scan) {
3953                 int rc = local->ops->hw_scan(local_to_hw(local),
3954                                              ssid, ssid_len);
3955                 if (!rc) {
3956                         local->sta_hw_scanning = 1;
3957                         local->scan_dev = dev;
3958                 }
3959                 return rc;
3960         }
3961
3962         local->sta_sw_scanning = 1;
3963
3964         rcu_read_lock();
3965         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3966
3967                 /* Don't stop the master interface, otherwise we can't transmit
3968                  * probes! */
3969                 if (sdata->dev == local->mdev)
3970                         continue;
3971
3972                 netif_stop_queue(sdata->dev);
3973                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
3974                     (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
3975                         ieee80211_send_nullfunc(local, sdata, 1);
3976         }
3977         rcu_read_unlock();
3978
3979         if (ssid) {
3980                 local->scan_ssid_len = ssid_len;
3981                 memcpy(local->scan_ssid, ssid, ssid_len);
3982         } else
3983                 local->scan_ssid_len = 0;
3984         local->scan_state = SCAN_SET_CHANNEL;
3985         local->scan_channel_idx = 0;
3986         local->scan_band = IEEE80211_BAND_2GHZ;
3987         local->scan_dev = dev;
3988
3989         netif_tx_lock_bh(local->mdev);
3990         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
3991         local->ops->configure_filter(local_to_hw(local),
3992                                      FIF_BCN_PRBRESP_PROMISC,
3993                                      &local->filter_flags,
3994                                      local->mdev->mc_count,
3995                                      local->mdev->mc_list);
3996         netif_tx_unlock_bh(local->mdev);
3997
3998         /* TODO: start scan as soon as all nullfunc frames are ACKed */
3999         queue_delayed_work(local->hw.workqueue, &local->scan_work,
4000                            IEEE80211_CHANNEL_TIME);
4001
4002         return 0;
4003 }
4004
4005
4006 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
4007 {
4008         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4009         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
4010         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
4011
4012         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
4013                 return ieee80211_sta_start_scan(dev, ssid, ssid_len);
4014
4015         if (local->sta_sw_scanning || local->sta_hw_scanning) {
4016                 if (local->scan_dev == dev)
4017                         return 0;
4018                 return -EBUSY;
4019         }
4020
4021         ifsta->scan_ssid_len = ssid_len;
4022         if (ssid_len)
4023                 memcpy(ifsta->scan_ssid, ssid, ssid_len);
4024         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
4025         queue_work(local->hw.workqueue, &ifsta->work);
4026         return 0;
4027 }
4028
4029 static char *
4030 ieee80211_sta_scan_result(struct net_device *dev,
4031                           struct ieee80211_sta_bss *bss,
4032                           char *current_ev, char *end_buf)
4033 {
4034         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
4035         struct iw_event iwe;
4036
4037         if (time_after(jiffies,
4038                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
4039                 return current_ev;
4040
4041         memset(&iwe, 0, sizeof(iwe));
4042         iwe.cmd = SIOCGIWAP;
4043         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
4044         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
4045         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
4046                                           IW_EV_ADDR_LEN);
4047
4048         memset(&iwe, 0, sizeof(iwe));
4049         iwe.cmd = SIOCGIWESSID;
4050         if (bss_mesh_cfg(bss)) {
4051                 iwe.u.data.length = bss_mesh_id_len(bss);
4052                 iwe.u.data.flags = 1;
4053                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
4054                                                   bss_mesh_id(bss));
4055         } else {
4056                 iwe.u.data.length = bss->ssid_len;
4057                 iwe.u.data.flags = 1;
4058                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
4059                                                   bss->ssid);
4060         }
4061
4062         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
4063             || bss_mesh_cfg(bss)) {
4064                 memset(&iwe, 0, sizeof(iwe));
4065                 iwe.cmd = SIOCGIWMODE;
4066                 if (bss_mesh_cfg(bss))
4067                         iwe.u.mode = IW_MODE_MESH;
4068                 else if (bss->capability & WLAN_CAPABILITY_ESS)
4069                         iwe.u.mode = IW_MODE_MASTER;
4070                 else
4071                         iwe.u.mode = IW_MODE_ADHOC;
4072                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
4073                                                   IW_EV_UINT_LEN);
4074         }
4075
4076         memset(&iwe, 0, sizeof(iwe));
4077         iwe.cmd = SIOCGIWFREQ;
4078         iwe.u.freq.m = bss->freq;
4079         iwe.u.freq.e = 6;
4080         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
4081                                           IW_EV_FREQ_LEN);
4082
4083         memset(&iwe, 0, sizeof(iwe));
4084         iwe.cmd = SIOCGIWFREQ;
4085         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
4086         iwe.u.freq.e = 0;
4087         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
4088                                           IW_EV_FREQ_LEN);
4089
4090         memset(&iwe, 0, sizeof(iwe));
4091         iwe.cmd = IWEVQUAL;
4092         iwe.u.qual.qual = bss->signal;
4093         iwe.u.qual.level = bss->rssi;
4094         iwe.u.qual.noise = bss->noise;
4095         iwe.u.qual.updated = local->wstats_flags;
4096         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
4097                                           IW_EV_QUAL_LEN);
4098
4099         memset(&iwe, 0, sizeof(iwe));
4100         iwe.cmd = SIOCGIWENCODE;
4101         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
4102                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
4103         else
4104                 iwe.u.data.flags = IW_ENCODE_DISABLED;
4105         iwe.u.data.length = 0;
4106         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
4107
4108         if (bss && bss->wpa_ie) {
4109                 memset(&iwe, 0, sizeof(iwe));
4110                 iwe.cmd = IWEVGENIE;
4111                 iwe.u.data.length = bss->wpa_ie_len;
4112                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
4113                                                   bss->wpa_ie);
4114         }
4115
4116         if (bss && bss->rsn_ie) {
4117                 memset(&iwe, 0, sizeof(iwe));
4118                 iwe.cmd = IWEVGENIE;
4119                 iwe.u.data.length = bss->rsn_ie_len;
4120                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
4121                                                   bss->rsn_ie);
4122         }
4123
4124         if (bss && bss->supp_rates_len > 0) {
4125                 /* display all supported rates in readable format */
4126                 char *p = current_ev + IW_EV_LCP_LEN;
4127                 int i;
4128
4129                 memset(&iwe, 0, sizeof(iwe));
4130                 iwe.cmd = SIOCGIWRATE;
4131                 /* Those two flags are ignored... */
4132                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
4133
4134                 for (i = 0; i < bss->supp_rates_len; i++) {
4135                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
4136                                                         0x7f) * 500000);
4137                         p = iwe_stream_add_value(current_ev, p,
4138                                         end_buf, &iwe, IW_EV_PARAM_LEN);
4139                 }
4140                 current_ev = p;
4141         }
4142
4143         if (bss) {
4144                 char *buf;
4145                 buf = kmalloc(30, GFP_ATOMIC);
4146                 if (buf) {
4147                         memset(&iwe, 0, sizeof(iwe));
4148                         iwe.cmd = IWEVCUSTOM;
4149                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
4150                         iwe.u.data.length = strlen(buf);
4151                         current_ev = iwe_stream_add_point(current_ev, end_buf,
4152                                                           &iwe, buf);
4153                         kfree(buf);
4154                 }
4155         }
4156
4157         if (bss_mesh_cfg(bss)) {
4158                 char *buf;
4159                 u8 *cfg = bss_mesh_cfg(bss);
4160                 buf = kmalloc(50, GFP_ATOMIC);
4161                 if (buf) {
4162                         memset(&iwe, 0, sizeof(iwe));
4163                         iwe.cmd = IWEVCUSTOM;
4164                         sprintf(buf, "Mesh network (version %d)", cfg[0]);
4165                         iwe.u.data.length = strlen(buf);
4166                         current_ev = iwe_stream_add_point(current_ev, end_buf,
4167                                                           &iwe, buf);
4168                         sprintf(buf, "Path Selection Protocol ID: "
4169                                 "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
4170                                                         cfg[4]);
4171                         iwe.u.data.length = strlen(buf);
4172                         current_ev = iwe_stream_add_point(current_ev, end_buf,
4173                                                           &iwe, buf);
4174                         sprintf(buf, "Path Selection Metric ID: "
4175                                 "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
4176                                                         cfg[8]);
4177                         iwe.u.data.length = strlen(buf);
4178                         current_ev = iwe_stream_add_point(current_ev, end_buf,
4179                                                           &iwe, buf);
4180                         sprintf(buf, "Congestion Control Mode ID: "
4181                                 "0x%02X%02X%02X%02X", cfg[9], cfg[10],
4182                                                         cfg[11], cfg[12]);
4183                         iwe.u.data.length = strlen(buf);
4184                         current_ev = iwe_stream_add_point(current_ev, end_buf,
4185                                                           &iwe, buf);
4186                         sprintf(buf, "Channel Precedence: "
4187                                 "0x%02X%02X%02X%02X", cfg[13], cfg[14],
4188                                                         cfg[15], cfg[16]);
4189                         iwe.u.data.length = strlen(buf);
4190                         current_ev = iwe_stream_add_point(current_ev, end_buf,
4191                                                           &iwe, buf);
4192                         kfree(buf);
4193                 }
4194         }
4195
4196         return current_ev;
4197 }
4198
4199
4200 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
4201 {
4202         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
4203         char *current_ev = buf;
4204         char *end_buf = buf + len;
4205         struct ieee80211_sta_bss *bss;
4206
4207         spin_lock_bh(&local->sta_bss_lock);
4208         list_for_each_entry(bss, &local->sta_bss_list, list) {
4209                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
4210                         spin_unlock_bh(&local->sta_bss_lock);
4211                         return -E2BIG;
4212                 }
4213                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
4214                                                        end_buf);
4215         }
4216         spin_unlock_bh(&local->sta_bss_lock);
4217         return current_ev - buf;
4218 }
4219
4220
4221 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
4222 {
4223         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4224         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
4225
4226         kfree(ifsta->extra_ie);
4227         if (len == 0) {
4228                 ifsta->extra_ie = NULL;
4229                 ifsta->extra_ie_len = 0;
4230                 return 0;
4231         }
4232         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
4233         if (!ifsta->extra_ie) {
4234                 ifsta->extra_ie_len = 0;
4235                 return -ENOMEM;
4236         }
4237         memcpy(ifsta->extra_ie, ie, len);
4238         ifsta->extra_ie_len = len;
4239         return 0;
4240 }
4241
4242
4243 struct sta_info *ieee80211_ibss_add_sta(struct net_device *dev,
4244                                         struct sk_buff *skb, u8 *bssid,
4245                                         u8 *addr)
4246 {
4247         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
4248         struct sta_info *sta;
4249         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4250         DECLARE_MAC_BUF(mac);
4251
4252         /* TODO: Could consider removing the least recently used entry and
4253          * allow new one to be added. */
4254         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
4255                 if (net_ratelimit()) {
4256                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
4257                                "entry %s\n", dev->name, print_mac(mac, addr));
4258                 }
4259                 return NULL;
4260         }
4261
4262         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
4263                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
4264
4265         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
4266         if (!sta)
4267                 return NULL;
4268
4269         sta->flags |= WLAN_STA_AUTHORIZED;
4270
4271         sta->supp_rates[local->hw.conf.channel->band] =
4272                 sdata->u.sta.supp_rates_bits[local->hw.conf.channel->band];
4273
4274         rate_control_rate_init(sta, local);
4275
4276         if (sta_info_insert(sta))
4277                 return NULL;
4278
4279         return sta;
4280 }
4281
4282
4283 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
4284 {
4285         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4286         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
4287
4288         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
4289                dev->name, reason);
4290
4291         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
4292             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
4293                 return -EINVAL;
4294
4295         ieee80211_send_deauth(dev, ifsta, reason);
4296         ieee80211_set_disassoc(dev, ifsta, 1);
4297         return 0;
4298 }
4299
4300
4301 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
4302 {
4303         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4304         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
4305
4306         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
4307                dev->name, reason);
4308
4309         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
4310                 return -EINVAL;
4311
4312         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
4313                 return -1;
4314
4315         ieee80211_send_disassoc(dev, ifsta, reason);
4316         ieee80211_set_disassoc(dev, ifsta, 0);
4317         return 0;
4318 }
4319
4320 void ieee80211_notify_mac(struct ieee80211_hw *hw,
4321                           enum ieee80211_notification_types  notif_type)
4322 {
4323         struct ieee80211_local *local = hw_to_local(hw);
4324         struct ieee80211_sub_if_data *sdata;
4325
4326         switch (notif_type) {
4327         case IEEE80211_NOTIFY_RE_ASSOC:
4328                 rcu_read_lock();
4329                 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4330
4331                         if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
4332                                 ieee80211_sta_req_auth(sdata->dev,
4333                                                        &sdata->u.sta);
4334                         }
4335
4336                 }
4337                 rcu_read_unlock();
4338                 break;
4339         }
4340 }
4341 EXPORT_SYMBOL(ieee80211_notify_mac);