SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/mac80211/mlme.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/wireless.h>
  20 #include <linux/random.h>
  21 #include <linux/etherdevice.h>
  22 #include <linux/rtnetlink.h>
  23 #include <net/iw_handler.h>
  24 #include <net/mac80211.h>
  25
  26 #include "ieee80211_i.h"
  27 #include "rate.h"
  28 #include "led.h"
  29 #include "mesh.h"
  30
  31 #define IEEE80211_ASSOC_SCANS_MAX_TRIES 2
  32 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  33 #define IEEE80211_AUTH_MAX_TRIES 3
  34 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  35 #define IEEE80211_ASSOC_MAX_TRIES 3
  36 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  37 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
  38 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  39 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  40 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  41 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  42 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
  43
  44 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  45 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  46 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
  47
  48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  49
  50
  51 /* utils */
  52 static int ecw2cw(int ecw)
  53 {
  54         return (1 << ecw) - 1;
  55 }
  56
  57 static u8 *ieee80211_bss_get_ie(struct ieee80211_sta_bss *bss, u8 ie)
  58 {
  59         u8 *end, *pos;
  60
  61         pos = bss->ies;
  62         if (pos == NULL)
  63                 return NULL;
  64         end = pos + bss->ies_len;
  65
  66         while (pos + 1 < end) {
  67                 if (pos + 2 + pos[1] > end)
  68                         break;
  69                 if (pos[0] == ie)
  70                         return pos;
  71                 pos += 2 + pos[1];
  72         }
  73
  74         return NULL;
  75 }
  76
  77 /* frame sending functions */
  78 void ieee80211_sta_tx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
  79                       int encrypt)
  80 {
  81         skb->dev = sdata->local->mdev;
  82         skb_set_mac_header(skb, 0);
  83         skb_set_network_header(skb, 0);
  84         skb_set_transport_header(skb, 0);
  85
  86         skb->iif = sdata->dev->ifindex;
  87         skb->do_not_encrypt = !encrypt;
  88
  89         dev_queue_xmit(skb);
  90 }
  91
  92 static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
  93                                 struct ieee80211_if_sta *ifsta,
  94                                 int transaction, u8 *extra, size_t extra_len,
  95                                 int encrypt)
  96 {
  97         struct ieee80211_local *local = sdata->local;
  98         struct sk_buff *skb;
  99         struct ieee80211_mgmt *mgmt;
 100
 101         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 102                             sizeof(*mgmt) + 6 + extra_len);
 103         if (!skb) {
 104                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 105                        "frame\n", sdata->dev->name);
 106                 return;
 107         }
 108         skb_reserve(skb, local->hw.extra_tx_headroom);
 109
 110         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 111         memset(mgmt, 0, 24 + 6);
 112         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 113                                           IEEE80211_STYPE_AUTH);
 114         if (encrypt)
 115                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 116         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 117         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 118         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 119         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 120         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 121         ifsta->auth_transaction = transaction + 1;
 122         mgmt->u.auth.status_code = cpu_to_le16(0);
 123         if (extra)
 124                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 125
 126         ieee80211_sta_tx(sdata, skb, encrypt);
 127 }
 128
 129 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
 130                               u8 *ssid, size_t ssid_len)
 131 {
 132         struct ieee80211_local *local = sdata->local;
 133         struct ieee80211_supported_band *sband;
 134         struct sk_buff *skb;
 135         struct ieee80211_mgmt *mgmt;
 136         u8 *pos, *supp_rates, *esupp_rates = NULL;
 137         int i;
 138
 139         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 140         if (!skb) {
 141                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 142                        "request\n", sdata->dev->name);
 143                 return;
 144         }
 145         skb_reserve(skb, local->hw.extra_tx_headroom);
 146
 147         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 148         memset(mgmt, 0, 24);
 149         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 150                                           IEEE80211_STYPE_PROBE_REQ);
 151         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 152         if (dst) {
 153                 memcpy(mgmt->da, dst, ETH_ALEN);
 154                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 155         } else {
 156                 memset(mgmt->da, 0xff, ETH_ALEN);
 157                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 158         }
 159         pos = skb_put(skb, 2 + ssid_len);
 160         *pos++ = WLAN_EID_SSID;
 161         *pos++ = ssid_len;
 162         memcpy(pos, ssid, ssid_len);
 163
 164         supp_rates = skb_put(skb, 2);
 165         supp_rates[0] = WLAN_EID_SUPP_RATES;
 166         supp_rates[1] = 0;
 167         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 168
 169         for (i = 0; i < sband->n_bitrates; i++) {
 170                 struct ieee80211_rate *rate = &sband->bitrates[i];
 171                 if (esupp_rates) {
 172                         pos = skb_put(skb, 1);
 173                         esupp_rates[1]++;
 174                 } else if (supp_rates[1] == 8) {
 175                         esupp_rates = skb_put(skb, 3);
 176                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 177                         esupp_rates[1] = 1;
 178                         pos = &esupp_rates[2];
 179                 } else {
 180                         pos = skb_put(skb, 1);
 181                         supp_rates[1]++;
 182                 }
 183                 *pos = rate->bitrate / 5;
 184         }
 185
 186         ieee80211_sta_tx(sdata, skb, 0);
 187 }
 188
 189 /* MLME */
 190 static void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
 191                                          struct ieee80211_sta_bss *bss)
 192 {
 193         struct ieee80211_local *local = sdata->local;
 194         int i, have_higher_than_11mbit = 0;
 195
 196
 197         /* cf. IEEE 802.11 9.2.12 */
 198         for (i = 0; i < bss->supp_rates_len; i++)
 199                 if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
 200                         have_higher_than_11mbit = 1;
 201
 202         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
 203             have_higher_than_11mbit)
 204                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
 205         else
 206                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 207
 208
 209         if (local->ops->conf_tx) {
 210                 struct ieee80211_tx_queue_params qparam;
 211
 212                 memset(&qparam, 0, sizeof(qparam));
 213
 214                 qparam.aifs = 2;
 215
 216                 if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
 217                     !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
 218                         qparam.cw_min = 31;
 219                 else
 220                         qparam.cw_min = 15;
 221
 222                 qparam.cw_max = 1023;
 223                 qparam.txop = 0;
 224
 225                 for (i = 0; i < local_to_hw(local)->queues; i++)
 226                         local->ops->conf_tx(local_to_hw(local), i, &qparam);
 227         }
 228 }
 229
 230 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 231                                      struct ieee80211_if_sta *ifsta,
 232                                      u8 *wmm_param, size_t wmm_param_len)
 233 {
 234         struct ieee80211_tx_queue_params params;
 235         size_t left;
 236         int count;
 237         u8 *pos;
 238
 239         if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
 240                 return;
 241
 242         if (!wmm_param)
 243                 return;
 244
 245         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 246                 return;
 247         count = wmm_param[6] & 0x0f;
 248         if (count == ifsta->wmm_last_param_set)
 249                 return;
 250         ifsta->wmm_last_param_set = count;
 251
 252         pos = wmm_param + 8;
 253         left = wmm_param_len - 8;
 254
 255         memset(&params, 0, sizeof(params));
 256
 257         if (!local->ops->conf_tx)
 258                 return;
 259
 260         local->wmm_acm = 0;
 261         for (; left >= 4; left -= 4, pos += 4) {
 262                 int aci = (pos[0] >> 5) & 0x03;
 263                 int acm = (pos[0] >> 4) & 0x01;
 264                 int queue;
 265
 266                 switch (aci) {
 267                 case 1:
 268                         queue = 3;
 269                         if (acm)
 270                                 local->wmm_acm |= BIT(0) | BIT(3);
 271                         break;
 272                 case 2:
 273                         queue = 1;
 274                         if (acm)
 275                                 local->wmm_acm |= BIT(4) | BIT(5);
 276                         break;
 277                 case 3:
 278                         queue = 0;
 279                         if (acm)
 280                                 local->wmm_acm |= BIT(6) | BIT(7);
 281                         break;
 282                 case 0:
 283                 default:
 284                         queue = 2;
 285                         if (acm)
 286                                 local->wmm_acm |= BIT(1) | BIT(2);
 287                         break;
 288                 }
 289
 290                 params.aifs = pos[0] & 0x0f;
 291                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 292                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 293                 params.txop = get_unaligned_le16(pos + 2);
 294 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 295                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 296                        "cWmin=%d cWmax=%d txop=%d\n",
 297                        local->mdev->name, queue, aci, acm, params.aifs, params.cw_min,
 298                        params.cw_max, params.txop);
 299 #endif
 300                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 301                  * AC for now) */
 302                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 303                         printk(KERN_DEBUG "%s: failed to set TX queue "
 304                                "parameters for queue %d\n", local->mdev->name, queue);
 305                 }
 306         }
 307 }
 308
 309 static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
 310                                            bool use_protection,
 311                                            bool use_short_preamble)
 312 {
 313         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
 314 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 315         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 316         DECLARE_MAC_BUF(mac);
 317 #endif
 318         u32 changed = 0;
 319
 320         if (use_protection != bss_conf->use_cts_prot) {
 321 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 322                 if (net_ratelimit()) {
 323                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 324                                "%s)\n",
 325                                sdata->dev->name,
 326                                use_protection ? "enabled" : "disabled",
 327                                print_mac(mac, ifsta->bssid));
 328                 }
 329 #endif
 330                 bss_conf->use_cts_prot = use_protection;
 331                 changed |= BSS_CHANGED_ERP_CTS_PROT;
 332         }
 333
 334         if (use_short_preamble != bss_conf->use_short_preamble) {
 335 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 336                 if (net_ratelimit()) {
 337                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 338                                " (BSSID=%s)\n",
 339                                sdata->dev->name,
 340                                use_short_preamble ? "short" : "long",
 341                                print_mac(mac, ifsta->bssid));
 342                 }
 343 #endif
 344                 bss_conf->use_short_preamble = use_short_preamble;
 345                 changed |= BSS_CHANGED_ERP_PREAMBLE;
 346         }
 347
 348         return changed;
 349 }
 350
 351 static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
 352                                    u8 erp_value)
 353 {
 354         bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 355         bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
 356
 357         return ieee80211_handle_protect_preamb(sdata,
 358                         use_protection, use_short_preamble);
 359 }
 360
 361 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 362                                            struct ieee80211_sta_bss *bss)
 363 {
 364         u32 changed = 0;
 365
 366         if (bss->has_erp_value)
 367                 changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
 368         else {
 369                 u16 capab = bss->capability;
 370                 changed |= ieee80211_handle_protect_preamb(sdata, false,
 371                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
 372         }
 373
 374         return changed;
 375 }
 376
 377 static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata,
 378                                         struct ieee80211_if_sta *ifsta)
 379 {
 380         union iwreq_data wrqu;
 381         memset(&wrqu, 0, sizeof(wrqu));
 382         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
 383                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 384         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 385         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
 386 }
 387
 388 static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
 389                                          struct ieee80211_if_sta *ifsta)
 390 {
 391         union iwreq_data wrqu;
 392
 393         if (ifsta->assocreq_ies) {
 394                 memset(&wrqu, 0, sizeof(wrqu));
 395                 wrqu.data.length = ifsta->assocreq_ies_len;
 396                 wireless_send_event(sdata->dev, IWEVASSOCREQIE, &wrqu,
 397                                     ifsta->assocreq_ies);
 398         }
 399         if (ifsta->assocresp_ies) {
 400                 memset(&wrqu, 0, sizeof(wrqu));
 401                 wrqu.data.length = ifsta->assocresp_ies_len;
 402                 wireless_send_event(sdata->dev, IWEVASSOCRESPIE, &wrqu,
 403                                     ifsta->assocresp_ies);
 404         }
 405 }
 406
 407
 408 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 409                                      struct ieee80211_if_sta *ifsta)
 410 {
 411         struct ieee80211_local *local = sdata->local;
 412         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
 413         u32 changed = BSS_CHANGED_ASSOC;
 414
 415         struct ieee80211_sta_bss *bss;
 416
 417         ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 418
 419         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
 420                 return;
 421
 422         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 423                                    conf->channel->center_freq,
 424                                    ifsta->ssid, ifsta->ssid_len);
 425         if (bss) {
 426                 /* set timing information */
 427                 sdata->bss_conf.beacon_int = bss->beacon_int;
 428                 sdata->bss_conf.timestamp = bss->timestamp;
 429                 sdata->bss_conf.dtim_period = bss->dtim_period;
 430
 431                 changed |= ieee80211_handle_bss_capability(sdata, bss);
 432
 433                 ieee80211_rx_bss_put(local, bss);
 434         }
 435
 436         if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
 437                 changed |= BSS_CHANGED_HT;
 438                 sdata->bss_conf.assoc_ht = 1;
 439                 sdata->bss_conf.ht_conf = &conf->ht_conf;
 440                 sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
 441         }
 442
 443         ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 444         memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 445         ieee80211_sta_send_associnfo(sdata, ifsta);
 446
 447         ifsta->last_probe = jiffies;
 448         ieee80211_led_assoc(local, 1);
 449
 450         sdata->bss_conf.assoc = 1;
 451         ieee80211_bss_info_change_notify(sdata, changed);
 452
 453         netif_tx_start_all_queues(sdata->dev);
 454         netif_carrier_on(sdata->dev);
 455
 456         ieee80211_sta_send_apinfo(sdata, ifsta);
 457 }
 458
 459 static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
 460                                    struct ieee80211_if_sta *ifsta)
 461 {
 462         DECLARE_MAC_BUF(mac);
 463
 464         ifsta->direct_probe_tries++;
 465         if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
 466                 printk(KERN_DEBUG "%s: direct probe to AP %s timed out\n",
 467                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 468                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 469                 return;
 470         }
 471
 472         printk(KERN_DEBUG "%s: direct probe to AP %s try %d\n",
 473                         sdata->dev->name, print_mac(mac, ifsta->bssid),
 474                         ifsta->direct_probe_tries);
 475
 476         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 477
 478         set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifsta->request);
 479
 480         /* Direct probe is sent to broadcast address as some APs
 481          * will not answer to direct packet in unassociated state.
 482          */
 483         ieee80211_send_probe_req(sdata, NULL,
 484                                  ifsta->ssid, ifsta->ssid_len);
 485
 486         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 487 }
 488
 489
 490 static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
 491                                    struct ieee80211_if_sta *ifsta)
 492 {
 493         DECLARE_MAC_BUF(mac);
 494
 495         ifsta->auth_tries++;
 496         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 497                 printk(KERN_DEBUG "%s: authentication with AP %s"
 498                        " timed out\n",
 499                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 500                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 501                 return;
 502         }
 503
 504         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
 505         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
 506                sdata->dev->name, print_mac(mac, ifsta->bssid));
 507
 508         ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
 509
 510         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 511 }
 512
 513 static int ieee80211_compatible_rates(struct ieee80211_sta_bss *bss,
 514                                       struct ieee80211_supported_band *sband,
 515                                       u64 *rates)
 516 {
 517         int i, j, count;
 518         *rates = 0;
 519         count = 0;
 520         for (i = 0; i < bss->supp_rates_len; i++) {
 521                 int rate = (bss->supp_rates[i] & 0x7F) * 5;
 522
 523                 for (j = 0; j < sband->n_bitrates; j++)
 524                         if (sband->bitrates[j].bitrate == rate) {
 525                                 *rates |= BIT(j);
 526                                 count++;
 527                                 break;
 528                         }
 529         }
 530
 531         return count;
 532 }
 533
 534 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 535                                  struct ieee80211_if_sta *ifsta)
 536 {
 537         struct ieee80211_local *local = sdata->local;
 538         struct sk_buff *skb;
 539         struct ieee80211_mgmt *mgmt;
 540         u8 *pos, *ies, *ht_add_ie;
 541         int i, len, count, rates_len, supp_rates_len;
 542         u16 capab;
 543         struct ieee80211_sta_bss *bss;
 544         int wmm = 0;
 545         struct ieee80211_supported_band *sband;
 546         u64 rates = 0;
 547
 548         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 549                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 550                             ifsta->ssid_len);
 551         if (!skb) {
 552                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 553                        "frame\n", sdata->dev->name);
 554                 return;
 555         }
 556         skb_reserve(skb, local->hw.extra_tx_headroom);
 557
 558         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 559
 560         capab = ifsta->capab;
 561
 562         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
 563                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
 564                         capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 565                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
 566                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 567         }
 568
 569         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 570                                    local->hw.conf.channel->center_freq,
 571                                    ifsta->ssid, ifsta->ssid_len);
 572         if (bss) {
 573                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 574                         capab |= WLAN_CAPABILITY_PRIVACY;
 575                 if (bss->wmm_used)
 576                         wmm = 1;
 577
 578                 /* get all rates supported by the device and the AP as
 579                  * some APs don't like getting a superset of their rates
 580                  * in the association request (e.g. D-Link DAP 1353 in
 581                  * b-only mode) */
 582                 rates_len = ieee80211_compatible_rates(bss, sband, &rates);
 583
 584                 if ((bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
 585                     (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
 586                         capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 587
 588                 ieee80211_rx_bss_put(local, bss);
 589         } else {
 590                 rates = ~0;
 591                 rates_len = sband->n_bitrates;
 592         }
 593
 594         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 595         memset(mgmt, 0, 24);
 596         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 597         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 598         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 599
 600         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 601                 skb_put(skb, 10);
 602                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 603                                                   IEEE80211_STYPE_REASSOC_REQ);
 604                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 605                 mgmt->u.reassoc_req.listen_interval =
 606                                 cpu_to_le16(local->hw.conf.listen_interval);
 607                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 608                        ETH_ALEN);
 609         } else {
 610                 skb_put(skb, 4);
 611                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 612                                                   IEEE80211_STYPE_ASSOC_REQ);
 613                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 614                 mgmt->u.reassoc_req.listen_interval =
 615                                 cpu_to_le16(local->hw.conf.listen_interval);
 616         }
 617
 618         /* SSID */
 619         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 620         *pos++ = WLAN_EID_SSID;
 621         *pos++ = ifsta->ssid_len;
 622         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 623
 624         /* add all rates which were marked to be used above */
 625         supp_rates_len = rates_len;
 626         if (supp_rates_len > 8)
 627                 supp_rates_len = 8;
 628
 629         len = sband->n_bitrates;
 630         pos = skb_put(skb, supp_rates_len + 2);
 631         *pos++ = WLAN_EID_SUPP_RATES;
 632         *pos++ = supp_rates_len;
 633
 634         count = 0;
 635         for (i = 0; i < sband->n_bitrates; i++) {
 636                 if (BIT(i) & rates) {
 637                         int rate = sband->bitrates[i].bitrate;
 638                         *pos++ = (u8) (rate / 5);
 639                         if (++count == 8)
 640                                 break;
 641                 }
 642         }
 643
 644         if (rates_len > count) {
 645                 pos = skb_put(skb, rates_len - count + 2);
 646                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 647                 *pos++ = rates_len - count;
 648
 649                 for (i++; i < sband->n_bitrates; i++) {
 650                         if (BIT(i) & rates) {
 651                                 int rate = sband->bitrates[i].bitrate;
 652                                 *pos++ = (u8) (rate / 5);
 653                         }
 654                 }
 655         }
 656
 657         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
 658                 /* 1. power capabilities */
 659                 pos = skb_put(skb, 4);
 660                 *pos++ = WLAN_EID_PWR_CAPABILITY;
 661                 *pos++ = 2;
 662                 *pos++ = 0; /* min tx power */
 663                 *pos++ = local->hw.conf.channel->max_power; /* max tx power */
 664
 665                 /* 2. supported channels */
 666                 /* TODO: get this in reg domain format */
 667                 pos = skb_put(skb, 2 * sband->n_channels + 2);
 668                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
 669                 *pos++ = 2 * sband->n_channels;
 670                 for (i = 0; i < sband->n_channels; i++) {
 671                         *pos++ = ieee80211_frequency_to_channel(
 672                                         sband->channels[i].center_freq);
 673                         *pos++ = 1; /* one channel in the subband*/
 674                 }
 675         }
 676
 677         if (ifsta->extra_ie) {
 678                 pos = skb_put(skb, ifsta->extra_ie_len);
 679                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 680         }
 681
 682         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 683                 pos = skb_put(skb, 9);
 684                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 685                 *pos++ = 7; /* len */
 686                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 687                 *pos++ = 0x50;
 688                 *pos++ = 0xf2;
 689                 *pos++ = 2; /* WME */
 690                 *pos++ = 0; /* WME info */
 691                 *pos++ = 1; /* WME ver */
 692                 *pos++ = 0;
 693         }
 694
 695         /* wmm support is a must to HT */
 696         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
 697             sband->ht_info.ht_supported &&
 698             (ht_add_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_EXTRA_INFO))) {
 699                 struct ieee80211_ht_addt_info *ht_add_info =
 700                         (struct ieee80211_ht_addt_info *)ht_add_ie;
 701                 u16 cap = sband->ht_info.cap;
 702                 __le16 tmp;
 703                 u32 flags = local->hw.conf.channel->flags;
 704
 705                 switch (ht_add_info->ht_param & IEEE80211_HT_IE_CHA_SEC_OFFSET) {
 706                 case IEEE80211_HT_IE_CHA_SEC_ABOVE:
 707                         if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
 708                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
 709                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 710                         }
 711                         break;
 712                 case IEEE80211_HT_IE_CHA_SEC_BELOW:
 713                         if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
 714                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
 715                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 716                         }
 717                         break;
 718                 }
 719
 720                 tmp = cpu_to_le16(cap);
 721                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
 722                 *pos++ = WLAN_EID_HT_CAPABILITY;
 723                 *pos++ = sizeof(struct ieee80211_ht_cap);
 724                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
 725                 memcpy(pos, &tmp, sizeof(u16));
 726                 pos += sizeof(u16);
 727                 /* TODO: needs a define here for << 2 */
 728                 *pos++ = sband->ht_info.ampdu_factor |
 729                          (sband->ht_info.ampdu_density << 2);
 730                 memcpy(pos, sband->ht_info.supp_mcs_set, 16);
 731         }
 732
 733         kfree(ifsta->assocreq_ies);
 734         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 735         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 736         if (ifsta->assocreq_ies)
 737                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 738
 739         ieee80211_sta_tx(sdata, skb, 0);
 740 }
 741
 742
 743 static void ieee80211_send_deauth(struct ieee80211_sub_if_data *sdata,
 744                                   struct ieee80211_if_sta *ifsta, u16 reason)
 745 {
 746         struct ieee80211_local *local = sdata->local;
 747         struct sk_buff *skb;
 748         struct ieee80211_mgmt *mgmt;
 749
 750         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 751         if (!skb) {
 752                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 753                        "frame\n", sdata->dev->name);
 754                 return;
 755         }
 756         skb_reserve(skb, local->hw.extra_tx_headroom);
 757
 758         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 759         memset(mgmt, 0, 24);
 760         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 761         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 762         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 763         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 764                                           IEEE80211_STYPE_DEAUTH);
 765         skb_put(skb, 2);
 766         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 767
 768         ieee80211_sta_tx(sdata, skb, 0);
 769 }
 770
 771 static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
 772 {
 773         if (!sdata || !sdata->default_key ||
 774             sdata->default_key->conf.alg != ALG_WEP)
 775                 return 0;
 776         return 1;
 777 }
 778
 779 static void ieee80211_send_disassoc(struct ieee80211_sub_if_data *sdata,
 780                                     struct ieee80211_if_sta *ifsta, u16 reason)
 781 {
 782         struct ieee80211_local *local = sdata->local;
 783         struct sk_buff *skb;
 784         struct ieee80211_mgmt *mgmt;
 785
 786         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 787         if (!skb) {
 788                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 789                        "frame\n", sdata->dev->name);
 790                 return;
 791         }
 792         skb_reserve(skb, local->hw.extra_tx_headroom);
 793
 794         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 795         memset(mgmt, 0, 24);
 796         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 797         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 798         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 799         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 800                                           IEEE80211_STYPE_DISASSOC);
 801         skb_put(skb, 2);
 802         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 803
 804         ieee80211_sta_tx(sdata, skb, 0);
 805 }
 806
 807 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 808                                    struct ieee80211_if_sta *ifsta, bool deauth,
 809                                    bool self_disconnected, u16 reason)
 810 {
 811         struct ieee80211_local *local = sdata->local;
 812         struct sta_info *sta;
 813         u32 changed = BSS_CHANGED_ASSOC;
 814
 815         rcu_read_lock();
 816
 817         sta = sta_info_get(local, ifsta->bssid);
 818         if (!sta) {
 819                 rcu_read_unlock();
 820                 return;
 821         }
 822
 823         if (deauth) {
 824                 ifsta->direct_probe_tries = 0;
 825                 ifsta->auth_tries = 0;
 826         }
 827         ifsta->assoc_scan_tries = 0;
 828         ifsta->assoc_tries = 0;
 829
 830         netif_tx_stop_all_queues(sdata->dev);
 831         netif_carrier_off(sdata->dev);
 832
 833         ieee80211_sta_tear_down_BA_sessions(sdata, sta->addr);
 834
 835         if (self_disconnected) {
 836                 if (deauth)
 837                         ieee80211_send_deauth(sdata, ifsta, reason);
 838                 else
 839                         ieee80211_send_disassoc(sdata, ifsta, reason);
 840         }
 841
 842         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
 843         changed |= ieee80211_reset_erp_info(sdata);
 844
 845         if (sdata->bss_conf.assoc_ht)
 846                 changed |= BSS_CHANGED_HT;
 847
 848         sdata->bss_conf.assoc_ht = 0;
 849         sdata->bss_conf.ht_conf = NULL;
 850         sdata->bss_conf.ht_bss_conf = NULL;
 851
 852         ieee80211_led_assoc(local, 0);
 853         sdata->bss_conf.assoc = 0;
 854
 855         ieee80211_sta_send_apinfo(sdata, ifsta);
 856
 857         if (self_disconnected)
 858                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 859
 860         sta_info_unlink(&sta);
 861
 862         rcu_read_unlock();
 863
 864         sta_info_destroy(sta);
 865 }
 866
 867 static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
 868                                       struct ieee80211_if_sta *ifsta)
 869 {
 870         struct ieee80211_local *local = sdata->local;
 871         struct ieee80211_sta_bss *bss;
 872         int bss_privacy;
 873         int wep_privacy;
 874         int privacy_invoked;
 875
 876         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
 877                 return 0;
 878
 879         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 880                                    local->hw.conf.channel->center_freq,
 881                                    ifsta->ssid, ifsta->ssid_len);
 882         if (!bss)
 883                 return 0;
 884
 885         bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
 886         wep_privacy = !!ieee80211_sta_wep_configured(sdata);
 887         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 888
 889         ieee80211_rx_bss_put(local, bss);
 890
 891         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
 892                 return 0;
 893
 894         return 1;
 895 }
 896
 897 static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
 898                                 struct ieee80211_if_sta *ifsta)
 899 {
 900         DECLARE_MAC_BUF(mac);
 901
 902         ifsta->assoc_tries++;
 903         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 904                 printk(KERN_DEBUG "%s: association with AP %s"
 905                        " timed out\n",
 906                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 907                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 908                 return;
 909         }
 910
 911         ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
 912         printk(KERN_DEBUG "%s: associate with AP %s\n",
 913                sdata->dev->name, print_mac(mac, ifsta->bssid));
 914         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
 915                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 916                        "mixed-cell disabled - abort association\n", sdata->dev->name);
 917                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 918                 return;
 919         }
 920
 921         ieee80211_send_assoc(sdata, ifsta);
 922
 923         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 924 }
 925
 926
 927 static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
 928                                  struct ieee80211_if_sta *ifsta)
 929 {
 930         struct ieee80211_local *local = sdata->local;
 931         struct sta_info *sta;
 932         int disassoc;
 933         DECLARE_MAC_BUF(mac);
 934
 935         /* TODO: start monitoring current AP signal quality and number of
 936          * missed beacons. Scan other channels every now and then and search
 937          * for better APs. */
 938         /* TODO: remove expired BSSes */
 939
 940         ifsta->state = IEEE80211_STA_MLME_ASSOCIATED;
 941
 942         rcu_read_lock();
 943
 944         sta = sta_info_get(local, ifsta->bssid);
 945         if (!sta) {
 946                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
 947                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 948                 disassoc = 1;
 949         } else {
 950                 disassoc = 0;
 951                 if (time_after(jiffies,
 952                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 953                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
 954                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 955                                        "current AP %s - assume out of "
 956                                        "range\n",
 957                                        sdata->dev->name, print_mac(mac, ifsta->bssid));
 958                                 disassoc = 1;
 959                         } else
 960                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
 961                                                          local->scan_ssid,
 962                                                          local->scan_ssid_len);
 963                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
 964                 } else {
 965                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 966                         if (time_after(jiffies, ifsta->last_probe +
 967                                        IEEE80211_PROBE_INTERVAL)) {
 968                                 ifsta->last_probe = jiffies;
 969                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
 970                                                          ifsta->ssid,
 971                                                          ifsta->ssid_len);
 972                         }
 973                 }
 974         }
 975
 976         rcu_read_unlock();
 977
 978         if (disassoc)
 979                 ieee80211_set_disassoc(sdata, ifsta, true, true,
 980                                         WLAN_REASON_PREV_AUTH_NOT_VALID);
 981         else
 982                 mod_timer(&ifsta->timer, jiffies +
 983                                       IEEE80211_MONITORING_INTERVAL);
 984 }
 985
 986
 987 static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
 988                                      struct ieee80211_if_sta *ifsta)
 989 {
 990         printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
 991         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
 992         ieee80211_associate(sdata, ifsta);
 993 }
 994
 995
 996 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
 997                                      struct ieee80211_if_sta *ifsta,
 998                                      struct ieee80211_mgmt *mgmt,
 999                                      size_t len)
1000 {
1001         u8 *pos;
1002         struct ieee802_11_elems elems;
1003
1004         pos = mgmt->u.auth.variable;
1005         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1006         if (!elems.challenge)
1007                 return;
1008         ieee80211_send_auth(sdata, ifsta, 3, elems.challenge - 2,
1009                             elems.challenge_len + 2, 1);
1010 }
1011
1012 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
1013                                         u8 dialog_token, u16 status, u16 policy,
1014                                         u16 buf_size, u16 timeout)
1015 {
1016         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1017         struct ieee80211_local *local = sdata->local;
1018         struct sk_buff *skb;
1019         struct ieee80211_mgmt *mgmt;
1020         u16 capab;
1021
1022         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
1023
1024         if (!skb) {
1025                 printk(KERN_DEBUG "%s: failed to allocate buffer "
1026                        "for addba resp frame\n", sdata->dev->name);
1027                 return;
1028         }
1029
1030         skb_reserve(skb, local->hw.extra_tx_headroom);
1031         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1032         memset(mgmt, 0, 24);
1033         memcpy(mgmt->da, da, ETH_ALEN);
1034         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1035         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1036                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
1037         else
1038                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1039         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1040                                           IEEE80211_STYPE_ACTION);
1041
1042         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
1043         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1044         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
1045         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
1046
1047         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
1048         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1049         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
1050
1051         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
1052         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
1053         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
1054
1055         ieee80211_sta_tx(sdata, skb, 0);
1056
1057         return;
1058 }
1059
1060 /*
1061  * After accepting the AddBA Request we activated a timer,
1062  * resetting it after each frame that arrives from the originator.
1063  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
1064  */
1065 static void sta_rx_agg_session_timer_expired(unsigned long data)
1066 {
1067         /* not an elegant detour, but there is no choice as the timer passes
1068          * only one argument, and various sta_info are needed here, so init
1069          * flow in sta_info_create gives the TID as data, while the timer_to_id
1070          * array gives the sta through container_of */
1071         u8 *ptid = (u8 *)data;
1072         u8 *timer_to_id = ptid - *ptid;
1073         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
1074                                          timer_to_tid[0]);
1075
1076 #ifdef CONFIG_MAC80211_HT_DEBUG
1077         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
1078 #endif
1079         ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->addr,
1080                                          (u16)*ptid, WLAN_BACK_TIMER,
1081                                          WLAN_REASON_QSTA_TIMEOUT);
1082 }
1083
1084 static void ieee80211_sta_process_addba_request(struct ieee80211_local *local,
1085                                                 struct ieee80211_mgmt *mgmt,
1086                                                 size_t len)
1087 {
1088         struct ieee80211_hw *hw = &local->hw;
1089         struct ieee80211_conf *conf = &hw->conf;
1090         struct sta_info *sta;
1091         struct tid_ampdu_rx *tid_agg_rx;
1092         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
1093         u8 dialog_token;
1094         int ret = -EOPNOTSUPP;
1095         DECLARE_MAC_BUF(mac);
1096
1097         rcu_read_lock();
1098
1099         sta = sta_info_get(local, mgmt->sa);
1100         if (!sta) {
1101                 rcu_read_unlock();
1102                 return;
1103         }
1104
1105         /* extract session parameters from addba request frame */
1106         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
1107         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
1108         start_seq_num =
1109                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
1110
1111         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1112         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
1113         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1114         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
1115
1116         status = WLAN_STATUS_REQUEST_DECLINED;
1117
1118         /* sanity check for incoming parameters:
1119          * check if configuration can support the BA policy
1120          * and if buffer size does not exceeds max value */
1121         if (((ba_policy != 1)
1122                 && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
1123                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
1124                 status = WLAN_STATUS_INVALID_QOS_PARAM;
1125 #ifdef CONFIG_MAC80211_HT_DEBUG
1126                 if (net_ratelimit())
1127                         printk(KERN_DEBUG "AddBA Req with bad params from "
1128                                 "%s on tid %u. policy %d, buffer size %d\n",
1129                                 print_mac(mac, mgmt->sa), tid, ba_policy,
1130                                 buf_size);
1131 #endif /* CONFIG_MAC80211_HT_DEBUG */
1132                 goto end_no_lock;
1133         }
1134         /* determine default buffer size */
1135         if (buf_size == 0) {
1136                 struct ieee80211_supported_band *sband;
1137
1138                 sband = local->hw.wiphy->bands[conf->channel->band];
1139                 buf_size = IEEE80211_MIN_AMPDU_BUF;
1140                 buf_size = buf_size << sband->ht_info.ampdu_factor;
1141         }
1142
1143
1144         /* examine state machine */
1145         spin_lock_bh(&sta->lock);
1146
1147         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
1148 #ifdef CONFIG_MAC80211_HT_DEBUG
1149                 if (net_ratelimit())
1150                         printk(KERN_DEBUG "unexpected AddBA Req from "
1151                                 "%s on tid %u\n",
1152                                 print_mac(mac, mgmt->sa), tid);
1153 #endif /* CONFIG_MAC80211_HT_DEBUG */
1154                 goto end;
1155         }
1156
1157         /* prepare A-MPDU MLME for Rx aggregation */
1158         sta->ampdu_mlme.tid_rx[tid] =
1159                         kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
1160         if (!sta->ampdu_mlme.tid_rx[tid]) {
1161 #ifdef CONFIG_MAC80211_HT_DEBUG
1162                 if (net_ratelimit())
1163                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
1164                                         tid);
1165 #endif
1166                 goto end;
1167         }
1168         /* rx timer */
1169         sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
1170                                 sta_rx_agg_session_timer_expired;
1171         sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
1172                                 (unsigned long)&sta->timer_to_tid[tid];
1173         init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
1174
1175         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
1176
1177         /* prepare reordering buffer */
1178         tid_agg_rx->reorder_buf =
1179                 kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
1180         if (!tid_agg_rx->reorder_buf) {
1181 #ifdef CONFIG_MAC80211_HT_DEBUG
1182                 if (net_ratelimit())
1183                         printk(KERN_ERR "can not allocate reordering buffer "
1184                                "to tid %d\n", tid);
1185 #endif
1186                 kfree(sta->ampdu_mlme.tid_rx[tid]);
1187                 goto end;
1188         }
1189         memset(tid_agg_rx->reorder_buf, 0,
1190                 buf_size * sizeof(struct sk_buff *));
1191
1192         if (local->ops->ampdu_action)
1193                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
1194                                                sta->addr, tid, &start_seq_num);
1195 #ifdef CONFIG_MAC80211_HT_DEBUG
1196         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
1197 #endif /* CONFIG_MAC80211_HT_DEBUG */
1198
1199         if (ret) {
1200                 kfree(tid_agg_rx->reorder_buf);
1201                 kfree(tid_agg_rx);
1202                 sta->ampdu_mlme.tid_rx[tid] = NULL;
1203                 goto end;
1204         }
1205
1206         /* change state and send addba resp */
1207         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
1208         tid_agg_rx->dialog_token = dialog_token;
1209         tid_agg_rx->ssn = start_seq_num;
1210         tid_agg_rx->head_seq_num = start_seq_num;
1211         tid_agg_rx->buf_size = buf_size;
1212         tid_agg_rx->timeout = timeout;
1213         tid_agg_rx->stored_mpdu_num = 0;
1214         status = WLAN_STATUS_SUCCESS;
1215 end:
1216         spin_unlock_bh(&sta->lock);
1217
1218 end_no_lock:
1219         ieee80211_send_addba_resp(sta->sdata, sta->addr, tid,
1220                                   dialog_token, status, 1, buf_size, timeout);
1221         rcu_read_unlock();
1222 }
1223
1224 static void ieee80211_sta_process_addba_resp(struct ieee80211_local *local,
1225                                              struct ieee80211_mgmt *mgmt,
1226                                              size_t len)
1227 {
1228         struct ieee80211_hw *hw = &local->hw;
1229         struct sta_info *sta;
1230         u16 capab;
1231         u16 tid;
1232         u8 *state;
1233
1234         rcu_read_lock();
1235
1236         sta = sta_info_get(local, mgmt->sa);
1237         if (!sta) {
1238                 rcu_read_unlock();
1239                 return;
1240         }
1241
1242         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
1243         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1244
1245         state = &sta->ampdu_mlme.tid_state_tx[tid];
1246
1247         spin_lock_bh(&sta->lock);
1248
1249         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1250                 spin_unlock_bh(&sta->lock);
1251                 goto addba_resp_exit;
1252         }
1253
1254         if (mgmt->u.action.u.addba_resp.dialog_token !=
1255                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
1256                 spin_unlock_bh(&sta->lock);
1257 #ifdef CONFIG_MAC80211_HT_DEBUG
1258                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
1259 #endif /* CONFIG_MAC80211_HT_DEBUG */
1260                 goto addba_resp_exit;
1261         }
1262
1263         del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
1264 #ifdef CONFIG_MAC80211_HT_DEBUG
1265         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
1266 #endif /* CONFIG_MAC80211_HT_DEBUG */
1267         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
1268                         == WLAN_STATUS_SUCCESS) {
1269                 *state |= HT_ADDBA_RECEIVED_MSK;
1270                 sta->ampdu_mlme.addba_req_num[tid] = 0;
1271
1272                 if (*state == HT_AGG_STATE_OPERATIONAL)
1273                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
1274
1275                 spin_unlock_bh(&sta->lock);
1276         } else {
1277                 sta->ampdu_mlme.addba_req_num[tid]++;
1278                 /* this will allow the state check in stop_BA_session */
1279                 *state = HT_AGG_STATE_OPERATIONAL;
1280                 spin_unlock_bh(&sta->lock);
1281                 ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
1282                                              WLAN_BACK_INITIATOR);
1283         }
1284
1285 addba_resp_exit:
1286         rcu_read_unlock();
1287 }
1288
1289 static void ieee80211_sta_process_delba(struct ieee80211_sub_if_data *sdata,
1290                         struct ieee80211_mgmt *mgmt, size_t len)
1291 {
1292         struct ieee80211_local *local = sdata->local;
1293         struct sta_info *sta;
1294         u16 tid, params;
1295         u16 initiator;
1296         DECLARE_MAC_BUF(mac);
1297
1298         rcu_read_lock();
1299
1300         sta = sta_info_get(local, mgmt->sa);
1301         if (!sta) {
1302                 rcu_read_unlock();
1303                 return;
1304         }
1305
1306         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1307         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1308         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1309
1310 #ifdef CONFIG_MAC80211_HT_DEBUG
1311         if (net_ratelimit())
1312                 printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
1313                         print_mac(mac, mgmt->sa),
1314                         initiator ? "initiator" : "recipient", tid,
1315                         mgmt->u.action.u.delba.reason_code);
1316 #endif /* CONFIG_MAC80211_HT_DEBUG */
1317
1318         if (initiator == WLAN_BACK_INITIATOR)
1319                 ieee80211_sta_stop_rx_ba_session(sdata, sta->addr, tid,
1320                                                  WLAN_BACK_INITIATOR, 0);
1321         else { /* WLAN_BACK_RECIPIENT */
1322                 spin_lock_bh(&sta->lock);
1323                 sta->ampdu_mlme.tid_state_tx[tid] =
1324                                 HT_AGG_STATE_OPERATIONAL;
1325                 spin_unlock_bh(&sta->lock);
1326                 ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
1327                                              WLAN_BACK_RECIPIENT);
1328         }
1329         rcu_read_unlock();
1330 }
1331
1332 static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_data *sdata,
1333                                         struct ieee80211_msrment_ie *request_ie,
1334                                         const u8 *da, const u8 *bssid,
1335                                         u8 dialog_token)
1336 {
1337         struct ieee80211_local *local = sdata->local;
1338         struct sk_buff *skb;
1339         struct ieee80211_mgmt *msr_report;
1340
1341         skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
1342                                 sizeof(struct ieee80211_msrment_ie));
1343
1344         if (!skb) {
1345                 printk(KERN_ERR "%s: failed to allocate buffer for "
1346                                 "measurement report frame\n", sdata->dev->name);
1347                 return;
1348         }
1349
1350         skb_reserve(skb, local->hw.extra_tx_headroom);
1351         msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
1352         memset(msr_report, 0, 24);
1353         memcpy(msr_report->da, da, ETH_ALEN);
1354         memcpy(msr_report->sa, sdata->dev->dev_addr, ETH_ALEN);
1355         memcpy(msr_report->bssid, bssid, ETH_ALEN);
1356         msr_report->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1357                                                 IEEE80211_STYPE_ACTION);
1358
1359         skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
1360         msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
1361         msr_report->u.action.u.measurement.action_code =
1362                                 WLAN_ACTION_SPCT_MSR_RPRT;
1363         msr_report->u.action.u.measurement.dialog_token = dialog_token;
1364
1365         msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
1366         msr_report->u.action.u.measurement.length =
1367                         sizeof(struct ieee80211_msrment_ie);
1368
1369         memset(&msr_report->u.action.u.measurement.msr_elem, 0,
1370                 sizeof(struct ieee80211_msrment_ie));
1371         msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
1372         msr_report->u.action.u.measurement.msr_elem.mode |=
1373                         IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
1374         msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
1375
1376         ieee80211_sta_tx(sdata, skb, 0);
1377 }
1378
1379 static void ieee80211_sta_process_measurement_req(struct ieee80211_sub_if_data *sdata,
1380                                                 struct ieee80211_mgmt *mgmt,
1381                                                 size_t len)
1382 {
1383         /*
1384          * Ignoring measurement request is spec violation.
1385          * Mandatory measurements must be reported optional
1386          * measurements might be refused or reported incapable
1387          * For now just refuse
1388          * TODO: Answer basic measurement as unmeasured
1389          */
1390         ieee80211_send_refuse_measurement_request(sdata,
1391                         &mgmt->u.action.u.measurement.msr_elem,
1392                         mgmt->sa, mgmt->bssid,
1393                         mgmt->u.action.u.measurement.dialog_token);
1394 }
1395
1396
1397 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
1398                                    struct ieee80211_if_sta *ifsta,
1399                                    struct ieee80211_mgmt *mgmt,
1400                                    size_t len)
1401 {
1402         u16 auth_alg, auth_transaction, status_code;
1403         DECLARE_MAC_BUF(mac);
1404
1405         if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
1406             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
1407                 return;
1408
1409         if (len < 24 + 6)
1410                 return;
1411
1412         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1413             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
1414                 return;
1415
1416         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1417             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1418                 return;
1419
1420         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1421         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1422         status_code = le16_to_cpu(mgmt->u.auth.status_code);
1423
1424         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
1425                 /*
1426                  * IEEE 802.11 standard does not require authentication in IBSS
1427                  * networks and most implementations do not seem to use it.
1428                  * However, try to reply to authentication attempts if someone
1429                  * has actually implemented this.
1430                  */
1431                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
1432                         return;
1433                 ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
1434         }
1435
1436         if (auth_alg != ifsta->auth_alg ||
1437             auth_transaction != ifsta->auth_transaction)
1438                 return;
1439
1440         if (status_code != WLAN_STATUS_SUCCESS) {
1441                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1442                         u8 algs[3];
1443                         const int num_algs = ARRAY_SIZE(algs);
1444                         int i, pos;
1445                         algs[0] = algs[1] = algs[2] = 0xff;
1446                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1447                                 algs[0] = WLAN_AUTH_OPEN;
1448                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1449                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1450                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1451                                 algs[2] = WLAN_AUTH_LEAP;
1452                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1453                                 pos = 0;
1454                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1455                                 pos = 1;
1456                         else
1457                                 pos = 2;
1458                         for (i = 0; i < num_algs; i++) {
1459                                 pos++;
1460                                 if (pos >= num_algs)
1461                                         pos = 0;
1462                                 if (algs[pos] == ifsta->auth_alg ||
1463                                     algs[pos] == 0xff)
1464                                         continue;
1465                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1466                                     !ieee80211_sta_wep_configured(sdata))
1467                                         continue;
1468                                 ifsta->auth_alg = algs[pos];
1469                                 break;
1470                         }
1471                 }
1472                 return;
1473         }
1474
1475         switch (ifsta->auth_alg) {
1476         case WLAN_AUTH_OPEN:
1477         case WLAN_AUTH_LEAP:
1478                 ieee80211_auth_completed(sdata, ifsta);
1479                 break;
1480         case WLAN_AUTH_SHARED_KEY:
1481                 if (ifsta->auth_transaction == 4)
1482                         ieee80211_auth_completed(sdata, ifsta);
1483                 else
1484                         ieee80211_auth_challenge(sdata, ifsta, mgmt, len);
1485                 break;
1486         }
1487 }
1488
1489
1490 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
1491                                      struct ieee80211_if_sta *ifsta,
1492                                      struct ieee80211_mgmt *mgmt,
1493                                      size_t len)
1494 {
1495         u16 reason_code;
1496         DECLARE_MAC_BUF(mac);
1497
1498         if (len < 24 + 2)
1499                 return;
1500
1501         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
1502                 return;
1503
1504         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1505
1506         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
1507                 printk(KERN_DEBUG "%s: deauthenticated\n", sdata->dev->name);
1508
1509         if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
1510             ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
1511             ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
1512                 ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
1513                 mod_timer(&ifsta->timer, jiffies +
1514                                       IEEE80211_RETRY_AUTH_INTERVAL);
1515         }
1516
1517         ieee80211_set_disassoc(sdata, ifsta, true, false, 0);
1518         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1519 }
1520
1521
1522 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
1523                                        struct ieee80211_if_sta *ifsta,
1524                                        struct ieee80211_mgmt *mgmt,
1525                                        size_t len)
1526 {
1527         u16 reason_code;
1528         DECLARE_MAC_BUF(mac);
1529
1530         if (len < 24 + 2)
1531                 return;
1532
1533         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
1534                 return;
1535
1536         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1537
1538         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1539                 printk(KERN_DEBUG "%s: disassociated\n", sdata->dev->name);
1540
1541         if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
1542                 ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
1543                 mod_timer(&ifsta->timer, jiffies +
1544                                       IEEE80211_RETRY_AUTH_INTERVAL);
1545         }
1546
1547         ieee80211_set_disassoc(sdata, ifsta, false, false, 0);
1548 }
1549
1550
1551 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
1552                                          struct ieee80211_if_sta *ifsta,
1553                                          struct ieee80211_mgmt *mgmt,
1554                                          size_t len,
1555                                          int reassoc)
1556 {
1557         struct ieee80211_local *local = sdata->local;
1558         struct ieee80211_supported_band *sband;
1559         struct sta_info *sta;
1560         u64 rates, basic_rates;
1561         u16 capab_info, status_code, aid;
1562         struct ieee802_11_elems elems;
1563         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
1564         u8 *pos;
1565         int i, j;
1566         DECLARE_MAC_BUF(mac);
1567         bool have_higher_than_11mbit = false;
1568
1569         /* AssocResp and ReassocResp have identical structure, so process both
1570          * of them in this function. */
1571
1572         if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATE)
1573                 return;
1574
1575         if (len < 24 + 6)
1576                 return;
1577
1578         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
1579                 return;
1580
1581         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1582         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1583         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1584
1585         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
1586                "status=%d aid=%d)\n",
1587                sdata->dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
1588                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
1589
1590         if (status_code != WLAN_STATUS_SUCCESS) {
1591                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1592                        sdata->dev->name, status_code);
1593                 /* if this was a reassociation, ensure we try a "full"
1594                  * association next time. This works around some broken APs
1595                  * which do not correctly reject reassociation requests. */
1596                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1597                 return;
1598         }
1599
1600         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1601                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1602                        "set\n", sdata->dev->name, aid);
1603         aid &= ~(BIT(15) | BIT(14));
1604
1605         pos = mgmt->u.assoc_resp.variable;
1606         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1607
1608         if (!elems.supp_rates) {
1609                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1610                        sdata->dev->name);
1611                 return;
1612         }
1613
1614         printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
1615         ifsta->aid = aid;
1616         ifsta->ap_capab = capab_info;
1617
1618         kfree(ifsta->assocresp_ies);
1619         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1620         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1621         if (ifsta->assocresp_ies)
1622                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1623
1624         rcu_read_lock();
1625
1626         /* Add STA entry for the AP */
1627         sta = sta_info_get(local, ifsta->bssid);
1628         if (!sta) {
1629                 struct ieee80211_sta_bss *bss;
1630                 int err;
1631
1632                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
1633                 if (!sta) {
1634                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
1635                                " the AP\n", sdata->dev->name);
1636                         rcu_read_unlock();
1637                         return;
1638                 }
1639                 bss = ieee80211_rx_bss_get(local, ifsta->bssid,
1640                                            local->hw.conf.channel->center_freq,
1641                                            ifsta->ssid, ifsta->ssid_len);
1642                 if (bss) {
1643                         sta->last_signal = bss->signal;
1644                         sta->last_qual = bss->qual;
1645                         sta->last_noise = bss->noise;
1646                         ieee80211_rx_bss_put(local, bss);
1647                 }
1648
1649                 err = sta_info_insert(sta);
1650                 if (err) {
1651                         printk(KERN_DEBUG "%s: failed to insert STA entry for"
1652                                " the AP (error %d)\n", sdata->dev->name, err);
1653                         rcu_read_unlock();
1654                         return;
1655                 }
1656                 /* update new sta with its last rx activity */
1657                 sta->last_rx = jiffies;
1658         }
1659
1660         /*
1661          * FIXME: Do we really need to update the sta_info's information here?
1662          *        We already know about the AP (we found it in our list) so it
1663          *        should already be filled with the right info, no?
1664          *        As is stands, all this is racy because typically we assume
1665          *        the information that is filled in here (except flags) doesn't
1666          *        change while a STA structure is alive. As such, it should move
1667          *        to between the sta_info_alloc() and sta_info_insert() above.
1668          */
1669
1670         set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
1671                            WLAN_STA_AUTHORIZED);
1672
1673         rates = 0;
1674         basic_rates = 0;
1675         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1676
1677         for (i = 0; i < elems.supp_rates_len; i++) {
1678                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1679
1680                 if (rate > 110)
1681                         have_higher_than_11mbit = true;
1682
1683                 for (j = 0; j < sband->n_bitrates; j++) {
1684                         if (sband->bitrates[j].bitrate == rate)
1685                                 rates |= BIT(j);
1686                         if (elems.supp_rates[i] & 0x80)
1687                                 basic_rates |= BIT(j);
1688                 }
1689         }
1690
1691         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1692                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1693
1694                 if (rate > 110)
1695                         have_higher_than_11mbit = true;
1696
1697                 for (j = 0; j < sband->n_bitrates; j++) {
1698                         if (sband->bitrates[j].bitrate == rate)
1699                                 rates |= BIT(j);
1700                         if (elems.ext_supp_rates[i] & 0x80)
1701                                 basic_rates |= BIT(j);
1702                 }
1703         }
1704
1705         sta->supp_rates[local->hw.conf.channel->band] = rates;
1706         sdata->basic_rates = basic_rates;
1707
1708         /* cf. IEEE 802.11 9.2.12 */
1709         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
1710             have_higher_than_11mbit)
1711                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
1712         else
1713                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
1714
1715         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
1716             (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1717                 struct ieee80211_ht_bss_info bss_info;
1718                 ieee80211_ht_cap_ie_to_ht_info(
1719                                 (struct ieee80211_ht_cap *)
1720                                 elems.ht_cap_elem, &sta->ht_info);
1721                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
1722                                 (struct ieee80211_ht_addt_info *)
1723                                 elems.ht_info_elem, &bss_info);
1724                 ieee80211_handle_ht(local, 1, &sta->ht_info, &bss_info);
1725         }
1726
1727         rate_control_rate_init(sta, local);
1728
1729         if (elems.wmm_param) {
1730                 set_sta_flags(sta, WLAN_STA_WME);
1731                 rcu_read_unlock();
1732                 ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
1733                                          elems.wmm_param_len);
1734         } else
1735                 rcu_read_unlock();
1736
1737         /* set AID and assoc capability,
1738          * ieee80211_set_associated() will tell the driver */
1739         bss_conf->aid = aid;
1740         bss_conf->assoc_capability = capab_info;
1741         ieee80211_set_associated(sdata, ifsta);
1742
1743         ieee80211_associated(sdata, ifsta);
1744 }
1745
1746
1747 static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
1748                                    struct ieee80211_if_sta *ifsta,
1749                                    struct ieee80211_sta_bss *bss)
1750 {
1751         struct ieee80211_local *local = sdata->local;
1752         int res, rates, i, j;
1753         struct sk_buff *skb;
1754         struct ieee80211_mgmt *mgmt;
1755         u8 *pos;
1756         struct ieee80211_supported_band *sband;
1757         union iwreq_data wrqu;
1758
1759         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1760
1761         /* Remove possible STA entries from other IBSS networks. */
1762         sta_info_flush_delayed(sdata);
1763
1764         if (local->ops->reset_tsf) {
1765                 /* Reset own TSF to allow time synchronization work. */
1766                 local->ops->reset_tsf(local_to_hw(local));
1767         }
1768         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
1769         res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
1770         if (res)
1771                 return res;
1772
1773         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
1774
1775         sdata->drop_unencrypted = bss->capability &
1776                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
1777
1778         res = ieee80211_set_freq(sdata, bss->freq);
1779
1780         if (res)
1781                 return res;
1782
1783         /* Build IBSS probe response */
1784         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
1785         if (skb) {
1786                 skb_reserve(skb, local->hw.extra_tx_headroom);
1787
1788                 mgmt = (struct ieee80211_mgmt *)
1789                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
1790                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
1791                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1792                                                   IEEE80211_STYPE_PROBE_RESP);
1793                 memset(mgmt->da, 0xff, ETH_ALEN);
1794                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
1795                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1796                 mgmt->u.beacon.beacon_int =
1797                         cpu_to_le16(local->hw.conf.beacon_int);
1798                 mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
1799                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
1800
1801                 pos = skb_put(skb, 2 + ifsta->ssid_len);
1802                 *pos++ = WLAN_EID_SSID;
1803                 *pos++ = ifsta->ssid_len;
1804                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
1805
1806                 rates = bss->supp_rates_len;
1807                 if (rates > 8)
1808                         rates = 8;
1809                 pos = skb_put(skb, 2 + rates);
1810                 *pos++ = WLAN_EID_SUPP_RATES;
1811                 *pos++ = rates;
1812                 memcpy(pos, bss->supp_rates, rates);
1813
1814                 if (bss->band == IEEE80211_BAND_2GHZ) {
1815                         pos = skb_put(skb, 2 + 1);
1816                         *pos++ = WLAN_EID_DS_PARAMS;
1817                         *pos++ = 1;
1818                         *pos++ = ieee80211_frequency_to_channel(bss->freq);
1819                 }
1820
1821                 pos = skb_put(skb, 2 + 2);
1822                 *pos++ = WLAN_EID_IBSS_PARAMS;
1823                 *pos++ = 2;
1824                 /* FIX: set ATIM window based on scan results */
1825                 *pos++ = 0;
1826                 *pos++ = 0;
1827
1828                 if (bss->supp_rates_len > 8) {
1829                         rates = bss->supp_rates_len - 8;
1830                         pos = skb_put(skb, 2 + rates);
1831                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
1832                         *pos++ = rates;
1833                         memcpy(pos, &bss->supp_rates[8], rates);
1834                 }
1835
1836                 ifsta->probe_resp = skb;
1837
1838                 ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
1839         }
1840
1841         rates = 0;
1842         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1843         for (i = 0; i < bss->supp_rates_len; i++) {
1844                 int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
1845                 for (j = 0; j < sband->n_bitrates; j++)
1846                         if (sband->bitrates[j].bitrate == bitrate)
1847                                 rates |= BIT(j);
1848         }
1849         ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
1850
1851         ieee80211_sta_def_wmm_params(sdata, bss);
1852
1853         ifsta->state = IEEE80211_STA_MLME_IBSS_JOINED;
1854         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
1855
1856         memset(&wrqu, 0, sizeof(wrqu));
1857         memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
1858         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
1859
1860         return res;
1861 }
1862
1863 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
1864                             struct ieee802_11_elems *elems,
1865                             enum ieee80211_band band)
1866 {
1867         struct ieee80211_supported_band *sband;
1868         struct ieee80211_rate *bitrates;
1869         size_t num_rates;
1870         u64 supp_rates;
1871         int i, j;
1872         sband = local->hw.wiphy->bands[band];
1873
1874         if (!sband) {
1875                 WARN_ON(1);
1876                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1877         }
1878
1879         bitrates = sband->bitrates;
1880         num_rates = sband->n_bitrates;
1881         supp_rates = 0;
1882         for (i = 0; i < elems->supp_rates_len +
1883                      elems->ext_supp_rates_len; i++) {
1884                 u8 rate = 0;
1885                 int own_rate;
1886                 if (i < elems->supp_rates_len)
1887                         rate = elems->supp_rates[i];
1888                 else if (elems->ext_supp_rates)
1889                         rate = elems->ext_supp_rates
1890                                 [i - elems->supp_rates_len];
1891                 own_rate = 5 * (rate & 0x7f);
1892                 for (j = 0; j < num_rates; j++)
1893                         if (bitrates[j].bitrate == own_rate)
1894                                 supp_rates |= BIT(j);
1895         }
1896         return supp_rates;
1897 }
1898
1899 static u64 ieee80211_sta_get_mandatory_rates(struct ieee80211_local *local,
1900                                         enum ieee80211_band band)
1901 {
1902         struct ieee80211_supported_band *sband;
1903         struct ieee80211_rate *bitrates;
1904         u64 mandatory_rates;
1905         enum ieee80211_rate_flags mandatory_flag;
1906         int i;
1907
1908         sband = local->hw.wiphy->bands[band];
1909         if (!sband) {
1910                 WARN_ON(1);
1911                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1912         }
1913
1914         if (band == IEEE80211_BAND_2GHZ)
1915                 mandatory_flag = IEEE80211_RATE_MANDATORY_B;
1916         else
1917                 mandatory_flag = IEEE80211_RATE_MANDATORY_A;
1918
1919         bitrates = sband->bitrates;
1920         mandatory_rates = 0;
1921         for (i = 0; i < sband->n_bitrates; i++)
1922                 if (bitrates[i].flags & mandatory_flag)
1923                         mandatory_rates |= BIT(i);
1924         return mandatory_rates;
1925 }
1926
1927 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
1928                                   struct ieee80211_mgmt *mgmt,
1929                                   size_t len,
1930                                   struct ieee80211_rx_status *rx_status,
1931                                   struct ieee802_11_elems *elems,
1932                                   bool beacon)
1933 {
1934         struct ieee80211_local *local = sdata->local;
1935         int freq;
1936         struct ieee80211_sta_bss *bss;
1937         struct sta_info *sta;
1938         struct ieee80211_channel *channel;
1939         u64 beacon_timestamp, rx_timestamp;
1940         u64 supp_rates = 0;
1941         enum ieee80211_band band = rx_status->band;
1942         DECLARE_MAC_BUF(mac);
1943         DECLARE_MAC_BUF(mac2);
1944
1945         if (elems->ds_params && elems->ds_params_len == 1)
1946                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
1947         else
1948                 freq = rx_status->freq;
1949
1950         channel = ieee80211_get_channel(local->hw.wiphy, freq);
1951
1952         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
1953                 return;
1954
1955         if (ieee80211_vif_is_mesh(&sdata->vif) && elems->mesh_id &&
1956             elems->mesh_config && mesh_matches_local(elems, sdata)) {
1957                 supp_rates = ieee80211_sta_get_rates(local, elems, band);
1958
1959                 mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
1960                                       mesh_peer_accepts_plinks(elems));
1961         }
1962
1963         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems->supp_rates &&
1964             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
1965                 supp_rates = ieee80211_sta_get_rates(local, elems, band);
1966
1967                 rcu_read_lock();
1968
1969                 sta = sta_info_get(local, mgmt->sa);
1970                 if (sta) {
1971                         u64 prev_rates;
1972
1973                         prev_rates = sta->supp_rates[band];
1974                         /* make sure mandatory rates are always added */
1975                         sta->supp_rates[band] = supp_rates |
1976                                 ieee80211_sta_get_mandatory_rates(local, band);
1977
1978 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1979                         if (sta->supp_rates[band] != prev_rates)
1980                                 printk(KERN_DEBUG "%s: updated supp_rates set "
1981                                     "for %s based on beacon info (0x%llx | "
1982                                     "0x%llx -> 0x%llx)\n",
1983                                     sdata->dev->name, print_mac(mac, sta->addr),
1984                                     (unsigned long long) prev_rates,
1985                                     (unsigned long long) supp_rates,
1986                                     (unsigned long long) sta->supp_rates[band]);
1987 #endif
1988                 } else {
1989                         ieee80211_ibss_add_sta(sdata, NULL, mgmt->bssid,
1990                                                mgmt->sa, supp_rates);
1991                 }
1992
1993                 rcu_read_unlock();
1994         }
1995
1996         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
1997                                         freq, beacon);
1998         if (!bss)
1999                 return;
2000
2001         /* was just updated in ieee80211_bss_info_update */
2002         beacon_timestamp = bss->timestamp;
2003
2004         /*
2005          * In STA mode, the remaining parameters should not be overridden
2006          * by beacons because they're not necessarily accurate there.
2007          */
2008         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
2009             bss->last_probe_resp && beacon) {
2010                 ieee80211_rx_bss_put(local, bss);
2011                 return;
2012         }
2013
2014         /* check if we need to merge IBSS */
2015         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
2016             bss->capability & WLAN_CAPABILITY_IBSS &&
2017             bss->freq == local->oper_channel->center_freq &&
2018             elems->ssid_len == sdata->u.sta.ssid_len &&
2019             memcmp(elems->ssid, sdata->u.sta.ssid,
2020                                 sdata->u.sta.ssid_len) == 0) {
2021                 if (rx_status->flag & RX_FLAG_TSFT) {
2022                         /* in order for correct IBSS merging we need mactime
2023                          *
2024                          * since mactime is defined as the time the first data
2025                          * symbol of the frame hits the PHY, and the timestamp
2026                          * of the beacon is defined as "the time that the data
2027                          * symbol containing the first bit of the timestamp is
2028                          * transmitted to the PHY plus the transmitting STA’s
2029                          * delays through its local PHY from the MAC-PHY
2030                          * interface to its interface with the WM"
2031                          * (802.11 11.1.2) - equals the time this bit arrives at
2032                          * the receiver - we have to take into account the
2033                          * offset between the two.
2034                          * e.g: at 1 MBit that means mactime is 192 usec earlier
2035                          * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
2036                          */
2037                         int rate = local->hw.wiphy->bands[band]->
2038                                         bitrates[rx_status->rate_idx].bitrate;
2039                         rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
2040                 } else if (local && local->ops && local->ops->get_tsf)
2041                         /* second best option: get current TSF */
2042                         rx_timestamp = local->ops->get_tsf(local_to_hw(local));
2043                 else
2044                         /* can't merge without knowing the TSF */
2045                         rx_timestamp = -1LLU;
2046 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2047                 printk(KERN_DEBUG "RX beacon SA=%s BSSID="
2048                        "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
2049                        print_mac(mac, mgmt->sa),
2050                        print_mac(mac2, mgmt->bssid),
2051                        (unsigned long long)rx_timestamp,
2052                        (unsigned long long)beacon_timestamp,
2053                        (unsigned long long)(rx_timestamp - beacon_timestamp),
2054                        jiffies);
2055 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2056                 if (beacon_timestamp > rx_timestamp) {
2057 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2058                         printk(KERN_DEBUG "%s: beacon TSF higher than "
2059                                "local TSF - IBSS merge with BSSID %s\n",
2060                                sdata->dev->name, print_mac(mac, mgmt->bssid));
2061 #endif
2062                         ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
2063                         ieee80211_ibss_add_sta(sdata, NULL,
2064                                                mgmt->bssid, mgmt->sa,
2065                                                supp_rates);
2066                 }
2067         }
2068
2069         ieee80211_rx_bss_put(local, bss);
2070 }
2071
2072
2073 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2074                                          struct ieee80211_mgmt *mgmt,
2075                                          size_t len,
2076                                          struct ieee80211_rx_status *rx_status)
2077 {
2078         size_t baselen;
2079         struct ieee802_11_elems elems;
2080         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2081
2082         if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
2083                 return; /* ignore ProbeResp to foreign address */
2084
2085         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2086         if (baselen > len)
2087                 return;
2088
2089         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2090                                 &elems);
2091
2092         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
2093
2094         /* direct probe may be part of the association flow */
2095         if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
2096                                                         &ifsta->request)) {
2097                 printk(KERN_DEBUG "%s direct probe responded\n",
2098                        sdata->dev->name);
2099                 ieee80211_authenticate(sdata, ifsta);
2100         }
2101 }
2102
2103
2104 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2105                                      struct ieee80211_mgmt *mgmt,
2106                                      size_t len,
2107                                      struct ieee80211_rx_status *rx_status)
2108 {
2109         struct ieee80211_if_sta *ifsta;
2110         size_t baselen;
2111         struct ieee802_11_elems elems;
2112         struct ieee80211_local *local = sdata->local;
2113         struct ieee80211_conf *conf = &local->hw.conf;
2114         u32 changed = 0;
2115
2116         /* Process beacon from the current BSS */
2117         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2118         if (baselen > len)
2119                 return;
2120
2121         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2122
2123         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
2124
2125         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2126                 return;
2127         ifsta = &sdata->u.sta;
2128
2129         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
2130             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
2131                 return;
2132
2133         ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
2134                                  elems.wmm_param_len);
2135
2136         if (elems.erp_info && elems.erp_info_len >= 1)
2137                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
2138         else {
2139                 u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
2140                 changed |= ieee80211_handle_protect_preamb(sdata, false,
2141                                 (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
2142         }
2143
2144         if (elems.ht_cap_elem && elems.ht_info_elem &&
2145             elems.wmm_param && conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
2146                 struct ieee80211_ht_bss_info bss_info;
2147
2148                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2149                                 (struct ieee80211_ht_addt_info *)
2150                                 elems.ht_info_elem, &bss_info);
2151                 changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf,
2152                                                &bss_info);
2153         }
2154
2155         ieee80211_bss_info_change_notify(sdata, changed);
2156 }
2157
2158
2159 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
2160                                         struct ieee80211_if_sta *ifsta,
2161                                         struct ieee80211_mgmt *mgmt,
2162                                         size_t len,
2163                                         struct ieee80211_rx_status *rx_status)
2164 {
2165         struct ieee80211_local *local = sdata->local;
2166         int tx_last_beacon;
2167         struct sk_buff *skb;
2168         struct ieee80211_mgmt *resp;
2169         u8 *pos, *end;
2170         DECLARE_MAC_BUF(mac);
2171 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2172         DECLARE_MAC_BUF(mac2);
2173         DECLARE_MAC_BUF(mac3);
2174 #endif
2175
2176         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS ||
2177             ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
2178             len < 24 + 2 || !ifsta->probe_resp)
2179                 return;
2180
2181         if (local->ops->tx_last_beacon)
2182                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
2183         else
2184                 tx_last_beacon = 1;
2185
2186 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2187         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
2188                "%s (tx_last_beacon=%d)\n",
2189                sdata->dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
2190                print_mac(mac3, mgmt->bssid), tx_last_beacon);
2191 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2192
2193         if (!tx_last_beacon)
2194                 return;
2195
2196         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
2197             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2198                 return;
2199
2200         end = ((u8 *) mgmt) + len;
2201         pos = mgmt->u.probe_req.variable;
2202         if (pos[0] != WLAN_EID_SSID ||
2203             pos + 2 + pos[1] > end) {
2204 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2205                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
2206                        "from %s\n",
2207                        sdata->dev->name, print_mac(mac, mgmt->sa));
2208 #endif
2209                 return;
2210         }
2211         if (pos[1] != 0 &&
2212             (pos[1] != ifsta->ssid_len ||
2213              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
2214                 /* Ignore ProbeReq for foreign SSID */
2215                 return;
2216         }
2217
2218         /* Reply with ProbeResp */
2219         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
2220         if (!skb)
2221                 return;
2222
2223         resp = (struct ieee80211_mgmt *) skb->data;
2224         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2225 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2226         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
2227                sdata->dev->name, print_mac(mac, resp->da));
2228 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2229         ieee80211_sta_tx(sdata, skb, 0);
2230 }
2231
2232 static void ieee80211_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
2233                                      struct ieee80211_if_sta *ifsta,
2234                                      struct ieee80211_mgmt *mgmt,
2235                                      size_t len,
2236                                      struct ieee80211_rx_status *rx_status)
2237 {
2238         struct ieee80211_local *local = sdata->local;
2239
2240         /* all categories we currently handle have action_code */
2241         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2242                 return;
2243
2244         switch (mgmt->u.action.category) {
2245         case WLAN_CATEGORY_SPECTRUM_MGMT:
2246                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
2247                         break;
2248                 switch (mgmt->u.action.u.measurement.action_code) {
2249                 case WLAN_ACTION_SPCT_MSR_REQ:
2250                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2251                                    sizeof(mgmt->u.action.u.measurement)))
2252                                 break;
2253                         ieee80211_sta_process_measurement_req(sdata, mgmt, len);
2254                         break;
2255                 }
2256                 break;
2257         case WLAN_CATEGORY_BACK:
2258                 switch (mgmt->u.action.u.addba_req.action_code) {
2259                 case WLAN_ACTION_ADDBA_REQ:
2260                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2261                                    sizeof(mgmt->u.action.u.addba_req)))
2262                                 break;
2263                         ieee80211_sta_process_addba_request(local, mgmt, len);
2264                         break;
2265                 case WLAN_ACTION_ADDBA_RESP:
2266                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2267                                    sizeof(mgmt->u.action.u.addba_resp)))
2268                                 break;
2269                         ieee80211_sta_process_addba_resp(local, mgmt, len);
2270                         break;
2271                 case WLAN_ACTION_DELBA:
2272                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2273                                    sizeof(mgmt->u.action.u.delba)))
2274                                 break;
2275                         ieee80211_sta_process_delba(sdata, mgmt, len);
2276                         break;
2277                 }
2278                 break;
2279         case PLINK_CATEGORY:
2280                 if (ieee80211_vif_is_mesh(&sdata->vif))
2281                         mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
2282                 break;
2283         case MESH_PATH_SEL_CATEGORY:
2284                 if (ieee80211_vif_is_mesh(&sdata->vif))
2285                         mesh_rx_path_sel_frame(sdata, mgmt, len);
2286                 break;
2287         }
2288 }
2289
2290 void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
2291                            struct ieee80211_rx_status *rx_status)
2292 {
2293         struct ieee80211_local *local = sdata->local;
2294         struct ieee80211_if_sta *ifsta;
2295         struct ieee80211_mgmt *mgmt;
2296         u16 fc;
2297
2298         if (skb->len < 24)
2299                 goto fail;
2300
2301         ifsta = &sdata->u.sta;
2302
2303         mgmt = (struct ieee80211_mgmt *) skb->data;
2304         fc = le16_to_cpu(mgmt->frame_control);
2305
2306         switch (fc & IEEE80211_FCTL_STYPE) {
2307         case IEEE80211_STYPE_PROBE_REQ:
2308         case IEEE80211_STYPE_PROBE_RESP:
2309         case IEEE80211_STYPE_BEACON:
2310         case IEEE80211_STYPE_ACTION:
2311                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
2312         case IEEE80211_STYPE_AUTH:
2313         case IEEE80211_STYPE_ASSOC_RESP:
2314         case IEEE80211_STYPE_REASSOC_RESP:
2315         case IEEE80211_STYPE_DEAUTH:
2316         case IEEE80211_STYPE_DISASSOC:
2317                 skb_queue_tail(&ifsta->skb_queue, skb);
2318                 queue_work(local->hw.workqueue, &ifsta->work);
2319                 return;
2320         }
2321
2322  fail:
2323         kfree_skb(skb);
2324 }
2325
2326 static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
2327                                          struct sk_buff *skb)
2328 {
2329         struct ieee80211_rx_status *rx_status;
2330         struct ieee80211_if_sta *ifsta;
2331         struct ieee80211_mgmt *mgmt;
2332         u16 fc;
2333
2334         ifsta = &sdata->u.sta;
2335
2336         rx_status = (struct ieee80211_rx_status *) skb->cb;
2337         mgmt = (struct ieee80211_mgmt *) skb->data;
2338         fc = le16_to_cpu(mgmt->frame_control);
2339
2340         switch (fc & IEEE80211_FCTL_STYPE) {
2341         case IEEE80211_STYPE_PROBE_REQ:
2342                 ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt, skb->len,
2343                                             rx_status);
2344                 break;
2345         case IEEE80211_STYPE_PROBE_RESP:
2346                 ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len, rx_status);
2347                 break;
2348         case IEEE80211_STYPE_BEACON:
2349                 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
2350                 break;
2351         case IEEE80211_STYPE_AUTH:
2352                 ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
2353                 break;
2354         case IEEE80211_STYPE_ASSOC_RESP:
2355                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
2356                 break;
2357         case IEEE80211_STYPE_REASSOC_RESP:
2358                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
2359                 break;
2360         case IEEE80211_STYPE_DEAUTH:
2361                 ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
2362                 break;
2363         case IEEE80211_STYPE_DISASSOC:
2364                 ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt, skb->len);
2365                 break;
2366         case IEEE80211_STYPE_ACTION:
2367                 ieee80211_rx_mgmt_action(sdata, ifsta, mgmt, skb->len, rx_status);
2368                 break;
2369         }
2370
2371         kfree_skb(skb);
2372 }
2373
2374
2375 static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
2376 {
2377         struct ieee80211_local *local = sdata->local;
2378         int active = 0;
2379         struct sta_info *sta;
2380
2381         rcu_read_lock();
2382
2383         list_for_each_entry_rcu(sta, &local->sta_list, list) {
2384                 if (sta->sdata == sdata &&
2385                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2386                                jiffies)) {
2387                         active++;
2388                         break;
2389                 }
2390         }
2391
2392         rcu_read_unlock();
2393
2394         return active;
2395 }
2396
2397
2398 static void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata, unsigned long exp_time)
2399 {
2400         struct ieee80211_local *local = sdata->local;
2401         struct sta_info *sta, *tmp;
2402         LIST_HEAD(tmp_list);
2403         DECLARE_MAC_BUF(mac);
2404         unsigned long flags;
2405
2406         spin_lock_irqsave(&local->sta_lock, flags);
2407         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
2408                 if (time_after(jiffies, sta->last_rx + exp_time)) {
2409 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2410                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
2411                                sdata->dev->name, print_mac(mac, sta->addr));
2412 #endif
2413                         __sta_info_unlink(&sta);
2414                         if (sta)
2415                                 list_add(&sta->list, &tmp_list);
2416                 }
2417         spin_unlock_irqrestore(&local->sta_lock, flags);
2418
2419         list_for_each_entry_safe(sta, tmp, &tmp_list, list)
2420                 sta_info_destroy(sta);
2421 }
2422
2423
2424 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata,
2425                                      struct ieee80211_if_sta *ifsta)
2426 {
2427         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2428
2429         ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
2430         if (ieee80211_sta_active_ibss(sdata))
2431                 return;
2432
2433         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
2434                "IBSS networks with same SSID (merge)\n", sdata->dev->name);
2435         ieee80211_sta_req_scan(sdata, ifsta->ssid, ifsta->ssid_len);
2436 }
2437
2438
2439 #ifdef CONFIG_MAC80211_MESH
2440 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
2441                            struct ieee80211_if_sta *ifsta)
2442 {
2443         bool free_plinks;
2444
2445         ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
2446         mesh_path_expire(sdata);
2447
2448         free_plinks = mesh_plink_availables(sdata);
2449         if (free_plinks != sdata->u.sta.accepting_plinks)
2450                 ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
2451
2452         mod_timer(&ifsta->timer, jiffies +
2453                         IEEE80211_MESH_HOUSEKEEPING_INTERVAL);
2454 }
2455
2456
2457 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
2458 {
2459         struct ieee80211_if_sta *ifsta;
2460         ifsta = &sdata->u.sta;
2461         ifsta->state = IEEE80211_STA_MLME_MESH_UP;
2462         ieee80211_sta_timer((unsigned long)sdata);
2463         ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
2464 }
2465 #endif
2466
2467
2468 void ieee80211_sta_timer(unsigned long data)
2469 {
2470         struct ieee80211_sub_if_data *sdata =
2471                 (struct ieee80211_sub_if_data *) data;
2472         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2473         struct ieee80211_local *local = sdata->local;
2474
2475         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2476         queue_work(local->hw.workqueue, &ifsta->work);
2477 }
2478
2479 static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
2480                                      struct ieee80211_if_sta *ifsta)
2481 {
2482         struct ieee80211_local *local = sdata->local;
2483
2484         if (local->ops->reset_tsf) {
2485                 /* Reset own TSF to allow time synchronization work. */
2486                 local->ops->reset_tsf(local_to_hw(local));
2487         }
2488
2489         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
2490
2491
2492         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
2493                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2494         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2495                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
2496         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
2497                 ifsta->auth_alg = WLAN_AUTH_LEAP;
2498         else
2499                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2500         ifsta->auth_transaction = -1;
2501         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
2502         ifsta->assoc_scan_tries = 0;
2503         ifsta->direct_probe_tries = 0;
2504         ifsta->auth_tries = 0;
2505         ifsta->assoc_tries = 0;
2506         netif_tx_stop_all_queues(sdata->dev);
2507         netif_carrier_off(sdata->dev);
2508 }
2509
2510
2511 void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
2512                             struct ieee80211_if_sta *ifsta)
2513 {
2514         struct ieee80211_local *local = sdata->local;
2515
2516         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2517                 return;
2518
2519         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
2520                              IEEE80211_STA_AUTO_BSSID_SEL)) &&
2521             (ifsta->flags & (IEEE80211_STA_SSID_SET |
2522                              IEEE80211_STA_AUTO_SSID_SEL))) {
2523
2524                 if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED)
2525                         ieee80211_set_disassoc(sdata, ifsta, true, true,
2526                                                WLAN_REASON_DEAUTH_LEAVING);
2527
2528                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2529                 queue_work(local->hw.workqueue, &ifsta->work);
2530         }
2531 }
2532
2533 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
2534                                     const char *ssid, int ssid_len)
2535 {
2536         int tmp, hidden_ssid;
2537
2538         if (ssid_len == ifsta->ssid_len &&
2539             !memcmp(ifsta->ssid, ssid, ssid_len))
2540                 return 1;
2541
2542         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
2543                 return 0;
2544
2545         hidden_ssid = 1;
2546         tmp = ssid_len;
2547         while (tmp--) {
2548                 if (ssid[tmp] != '\0') {
2549                         hidden_ssid = 0;
2550                         break;
2551                 }
2552         }
2553
2554         if (hidden_ssid && ifsta->ssid_len == ssid_len)
2555                 return 1;
2556
2557         if (ssid_len == 1 && ssid[0] == ' ')
2558                 return 1;
2559
2560         return 0;
2561 }
2562
2563 static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
2564                                      struct ieee80211_if_sta *ifsta)
2565 {
2566         struct ieee80211_local *local = sdata->local;
2567         struct ieee80211_sta_bss *bss;
2568         struct ieee80211_supported_band *sband;
2569         u8 bssid[ETH_ALEN], *pos;
2570         int i;
2571         int ret;
2572         DECLARE_MAC_BUF(mac);
2573
2574 #if 0
2575         /* Easier testing, use fixed BSSID. */
2576         memset(bssid, 0xfe, ETH_ALEN);
2577 #else
2578         /* Generate random, not broadcast, locally administered BSSID. Mix in
2579          * own MAC address to make sure that devices that do not have proper
2580          * random number generator get different BSSID. */
2581         get_random_bytes(bssid, ETH_ALEN);
2582         for (i = 0; i < ETH_ALEN; i++)
2583                 bssid[i] ^= sdata->dev->dev_addr[i];
2584         bssid[0] &= ~0x01;
2585         bssid[0] |= 0x02;
2586 #endif
2587
2588         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
2589                sdata->dev->name, print_mac(mac, bssid));
2590
2591         bss = ieee80211_rx_bss_add(local, bssid,
2592                                    local->hw.conf.channel->center_freq,
2593                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
2594         if (!bss)
2595                 return -ENOMEM;
2596
2597         bss->band = local->hw.conf.channel->band;
2598         sband = local->hw.wiphy->bands[bss->band];
2599
2600         if (local->hw.conf.beacon_int == 0)
2601                 local->hw.conf.beacon_int = 100;
2602         bss->beacon_int = local->hw.conf.beacon_int;
2603         bss->last_update = jiffies;
2604         bss->capability = WLAN_CAPABILITY_IBSS;
2605
2606         if (sdata->default_key)
2607                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
2608         else
2609                 sdata->drop_unencrypted = 0;
2610
2611         bss->supp_rates_len = sband->n_bitrates;
2612         pos = bss->supp_rates;
2613         for (i = 0; i < sband->n_bitrates; i++) {
2614                 int rate = sband->bitrates[i].bitrate;
2615                 *pos++ = (u8) (rate / 5);
2616         }
2617
2618         ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
2619         ieee80211_rx_bss_put(local, bss);
2620         return ret;
2621 }
2622
2623
2624 static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
2625                                    struct ieee80211_if_sta *ifsta)
2626 {
2627         struct ieee80211_local *local = sdata->local;
2628         struct ieee80211_sta_bss *bss;
2629         int found = 0;
2630         u8 bssid[ETH_ALEN];
2631         int active_ibss;
2632         DECLARE_MAC_BUF(mac);
2633         DECLARE_MAC_BUF(mac2);
2634
2635         if (ifsta->ssid_len == 0)
2636                 return -EINVAL;
2637
2638         active_ibss = ieee80211_sta_active_ibss(sdata);
2639 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2640         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2641                sdata->dev->name, active_ibss);
2642 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2643         spin_lock_bh(&local->sta_bss_lock);
2644         list_for_each_entry(bss, &local->sta_bss_list, list) {
2645                 if (ifsta->ssid_len != bss->ssid_len ||
2646                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2647                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2648                         continue;
2649 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2650                 printk(KERN_DEBUG "   bssid=%s found\n",
2651                        print_mac(mac, bss->bssid));
2652 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2653                 memcpy(bssid, bss->bssid, ETH_ALEN);
2654                 found = 1;
2655                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2656                         break;
2657         }
2658         spin_unlock_bh(&local->sta_bss_lock);
2659
2660 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2661         if (found)
2662                 printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
2663                        "%s\n", print_mac(mac, bssid),
2664                        print_mac(mac2, ifsta->bssid));
2665 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2666
2667         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
2668                 int ret;
2669                 int search_freq;
2670
2671                 if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
2672                         search_freq = bss->freq;
2673                 else
2674                         search_freq = local->hw.conf.channel->center_freq;
2675
2676                 bss = ieee80211_rx_bss_get(local, bssid, search_freq,
2677                                            ifsta->ssid, ifsta->ssid_len);
2678                 if (!bss)
2679                         goto dont_join;
2680
2681                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
2682                        " based on configured SSID\n",
2683                        sdata->dev->name, print_mac(mac, bssid));
2684                 ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
2685                 ieee80211_rx_bss_put(local, bss);
2686                 return ret;
2687         }
2688
2689 dont_join:
2690 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2691         printk(KERN_DEBUG "   did not try to join ibss\n");
2692 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2693
2694         /* Selected IBSS not found in current scan results - try to scan */
2695         if (ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED &&
2696             !ieee80211_sta_active_ibss(sdata)) {
2697                 mod_timer(&ifsta->timer, jiffies +
2698                                       IEEE80211_IBSS_MERGE_INTERVAL);
2699         } else if (time_after(jiffies, local->last_scan_completed +
2700                               IEEE80211_SCAN_INTERVAL)) {
2701                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
2702                        "join\n", sdata->dev->name);
2703                 return ieee80211_sta_req_scan(sdata, ifsta->ssid,
2704                                               ifsta->ssid_len);
2705         } else if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED) {
2706                 int interval = IEEE80211_SCAN_INTERVAL;
2707
2708                 if (time_after(jiffies, ifsta->ibss_join_req +
2709                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2710                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
2711                             (!(local->oper_channel->flags &
2712                                         IEEE80211_CHAN_NO_IBSS)))
2713                                 return ieee80211_sta_create_ibss(sdata, ifsta);
2714                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
2715                                 printk(KERN_DEBUG "%s: IBSS not allowed on"
2716                                        " %d MHz\n", sdata->dev->name,
2717                                        local->hw.conf.channel->center_freq);
2718                         }
2719
2720                         /* No IBSS found - decrease scan interval and continue
2721                          * scanning. */
2722                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2723                 }
2724
2725                 ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
2726                 mod_timer(&ifsta->timer, jiffies + interval);
2727                 return 0;
2728         }
2729
2730         return 0;
2731 }
2732
2733
2734 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
2735 {
2736         struct ieee80211_if_sta *ifsta;
2737         int res;
2738
2739         if (len > IEEE80211_MAX_SSID_LEN)
2740                 return -EINVAL;
2741
2742         ifsta = &sdata->u.sta;
2743
2744         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
2745                 memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
2746                 memcpy(ifsta->ssid, ssid, len);
2747                 ifsta->ssid_len = len;
2748                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
2749
2750                 res = 0;
2751                 /*
2752                  * Hack! MLME code needs to be cleaned up to have different
2753                  * entry points for configuration and internal selection change
2754                  */
2755                 if (netif_running(sdata->dev))
2756                         res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
2757                 if (res) {
2758                         printk(KERN_DEBUG "%s: Failed to config new SSID to "
2759                                "the low-level driver\n", sdata->dev->name);
2760                         return res;
2761                 }
2762         }
2763
2764         if (len)
2765                 ifsta->flags |= IEEE80211_STA_SSID_SET;
2766         else
2767                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
2768
2769         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
2770             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
2771                 ifsta->ibss_join_req = jiffies;
2772                 ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
2773                 return ieee80211_sta_find_ibss(sdata, ifsta);
2774         }
2775
2776         return 0;
2777 }
2778
2779
2780 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
2781 {
2782         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2783         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
2784         *len = ifsta->ssid_len;
2785         return 0;
2786 }
2787
2788
2789 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
2790 {
2791         struct ieee80211_if_sta *ifsta;
2792         int res;
2793
2794         ifsta = &sdata->u.sta;
2795
2796         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
2797                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
2798                 res = 0;
2799                 /*
2800                  * Hack! See also ieee80211_sta_set_ssid.
2801                  */
2802                 if (netif_running(sdata->dev))
2803                         res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
2804                 if (res) {
2805                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
2806                                "the low-level driver\n", sdata->dev->name);
2807                         return res;
2808                 }
2809         }
2810
2811         if (is_valid_ether_addr(bssid))
2812                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
2813         else
2814                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
2815
2816         return 0;
2817 }
2818
2819
2820 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata, char *ie, size_t len)
2821 {
2822         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2823
2824         kfree(ifsta->extra_ie);
2825         if (len == 0) {
2826                 ifsta->extra_ie = NULL;
2827                 ifsta->extra_ie_len = 0;
2828                 return 0;
2829         }
2830         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
2831         if (!ifsta->extra_ie) {
2832                 ifsta->extra_ie_len = 0;
2833                 return -ENOMEM;
2834         }
2835         memcpy(ifsta->extra_ie, ie, len);
2836         ifsta->extra_ie_len = len;
2837         return 0;
2838 }
2839
2840
2841 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
2842                                         struct sk_buff *skb, u8 *bssid,
2843                                         u8 *addr, u64 supp_rates)
2844 {
2845         struct ieee80211_local *local = sdata->local;
2846         struct sta_info *sta;
2847         DECLARE_MAC_BUF(mac);
2848         int band = local->hw.conf.channel->band;
2849
2850         /* TODO: Could consider removing the least recently used entry and
2851          * allow new one to be added. */
2852         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2853                 if (net_ratelimit()) {
2854                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
2855                                "entry %s\n", sdata->dev->name, print_mac(mac, addr));
2856                 }
2857                 return NULL;
2858         }
2859
2860         if (compare_ether_addr(bssid, sdata->u.sta.bssid))
2861                 return NULL;
2862
2863 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2864         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
2865                wiphy_name(local->hw.wiphy), print_mac(mac, addr), sdata->dev->name);
2866 #endif
2867
2868         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
2869         if (!sta)
2870                 return NULL;
2871
2872         set_sta_flags(sta, WLAN_STA_AUTHORIZED);
2873
2874         /* make sure mandatory rates are always added */
2875         sta->supp_rates[band] = supp_rates |
2876                         ieee80211_sta_get_mandatory_rates(local, band);
2877
2878         rate_control_rate_init(sta, local);
2879
2880         if (sta_info_insert(sta))
2881                 return NULL;
2882
2883         return sta;
2884 }
2885
2886
2887 static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
2888                                      struct ieee80211_if_sta *ifsta)
2889 {
2890         struct ieee80211_local *local = sdata->local;
2891         struct ieee80211_sta_bss *bss, *selected = NULL;
2892         int top_rssi = 0, freq;
2893
2894         spin_lock_bh(&local->sta_bss_lock);
2895         freq = local->oper_channel->center_freq;
2896         list_for_each_entry(bss, &local->sta_bss_list, list) {
2897                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
2898                         continue;
2899
2900                 if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
2901                         IEEE80211_STA_AUTO_BSSID_SEL |
2902                         IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
2903                     (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
2904                      !!sdata->default_key))
2905                         continue;
2906
2907                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
2908                     bss->freq != freq)
2909                         continue;
2910
2911                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
2912                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
2913                         continue;
2914
2915                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
2916                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
2917                         continue;
2918
2919                 if (!selected || top_rssi < bss->signal) {
2920                         selected = bss;
2921                         top_rssi = bss->signal;
2922                 }
2923         }
2924         if (selected)
2925                 atomic_inc(&selected->users);
2926         spin_unlock_bh(&local->sta_bss_lock);
2927
2928         if (selected) {
2929                 ieee80211_set_freq(sdata, selected->freq);
2930                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
2931                         ieee80211_sta_set_ssid(sdata, selected->ssid,
2932                                                selected->ssid_len);
2933                 ieee80211_sta_set_bssid(sdata, selected->bssid);
2934                 ieee80211_sta_def_wmm_params(sdata, selected);
2935
2936                 /* Send out direct probe if no probe resp was received or
2937                  * the one we have is outdated
2938                  */
2939                 if (!selected->last_probe_resp ||
2940                     time_after(jiffies, selected->last_probe_resp
2941                                         + IEEE80211_SCAN_RESULT_EXPIRE))
2942                         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
2943                 else
2944                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
2945
2946                 ieee80211_rx_bss_put(local, selected);
2947                 ieee80211_sta_reset_auth(sdata, ifsta);
2948                 return 0;
2949         } else {
2950                 if (ifsta->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
2951                         ifsta->assoc_scan_tries++;
2952                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
2953                                 ieee80211_sta_start_scan(sdata, NULL, 0);
2954                         else
2955                                 ieee80211_sta_start_scan(sdata, ifsta->ssid,
2956                                                          ifsta->ssid_len);
2957                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
2958                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2959                 } else
2960                         ifsta->state = IEEE80211_STA_MLME_DISABLED;
2961         }
2962         return -1;
2963 }
2964
2965
2966 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
2967 {
2968         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2969
2970         printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
2971                sdata->dev->name, reason);
2972
2973         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
2974             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
2975                 return -EINVAL;
2976
2977         ieee80211_set_disassoc(sdata, ifsta, true, true, reason);
2978         return 0;
2979 }
2980
2981
2982 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
2983 {
2984         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2985
2986         printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
2987                sdata->dev->name, reason);
2988
2989         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2990                 return -EINVAL;
2991
2992         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
2993                 return -1;
2994
2995         ieee80211_set_disassoc(sdata, ifsta, false, true, reason);
2996         return 0;
2997 }
2998
2999 void ieee80211_notify_mac(struct ieee80211_hw *hw,
3000                           enum ieee80211_notification_types  notif_type)
3001 {
3002         struct ieee80211_local *local = hw_to_local(hw);
3003         struct ieee80211_sub_if_data *sdata;
3004
3005         switch (notif_type) {
3006         case IEEE80211_NOTIFY_RE_ASSOC:
3007                 rcu_read_lock();
3008                 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3009                         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3010                                 continue;
3011
3012                         ieee80211_sta_req_auth(sdata, &sdata->u.sta);
3013                 }
3014                 rcu_read_unlock();
3015                 break;
3016         }
3017 }
3018 EXPORT_SYMBOL(ieee80211_notify_mac);
3019
3020 void ieee80211_sta_work(struct work_struct *work)
3021 {
3022         struct ieee80211_sub_if_data *sdata =
3023                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
3024         struct ieee80211_local *local = sdata->local;
3025         struct ieee80211_if_sta *ifsta;
3026         struct sk_buff *skb;
3027
3028         if (!netif_running(sdata->dev))
3029                 return;
3030
3031         if (local->sta_sw_scanning || local->sta_hw_scanning)
3032                 return;
3033
3034         if (WARN_ON(sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3035                     sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
3036                     sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
3037                 return;
3038         ifsta = &sdata->u.sta;
3039
3040         while ((skb = skb_dequeue(&ifsta->skb_queue)))
3041                 ieee80211_sta_rx_queued_mgmt(sdata, skb);
3042
3043 #ifdef CONFIG_MAC80211_MESH
3044         if (ifsta->preq_queue_len &&
3045             time_after(jiffies,
3046                        ifsta->last_preq + msecs_to_jiffies(ifsta->mshcfg.dot11MeshHWMPpreqMinInterval)))
3047                 mesh_path_start_discovery(sdata);
3048 #endif
3049
3050         if (ifsta->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
3051             ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
3052             ifsta->state != IEEE80211_STA_MLME_ASSOCIATE &&
3053             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
3054                 ieee80211_sta_start_scan(sdata, ifsta->scan_ssid, ifsta->scan_ssid_len);
3055                 return;
3056         }
3057
3058         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
3059                 if (ieee80211_sta_config_auth(sdata, ifsta))
3060                         return;
3061                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
3062         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
3063                 return;
3064
3065         switch (ifsta->state) {
3066         case IEEE80211_STA_MLME_DISABLED:
3067                 break;
3068         case IEEE80211_STA_MLME_DIRECT_PROBE:
3069                 ieee80211_direct_probe(sdata, ifsta);
3070                 break;
3071         case IEEE80211_STA_MLME_AUTHENTICATE:
3072                 ieee80211_authenticate(sdata, ifsta);
3073                 break;
3074         case IEEE80211_STA_MLME_ASSOCIATE:
3075                 ieee80211_associate(sdata, ifsta);
3076                 break;
3077         case IEEE80211_STA_MLME_ASSOCIATED:
3078                 ieee80211_associated(sdata, ifsta);
3079                 break;
3080         case IEEE80211_STA_MLME_IBSS_SEARCH:
3081                 ieee80211_sta_find_ibss(sdata, ifsta);
3082                 break;
3083         case IEEE80211_STA_MLME_IBSS_JOINED:
3084                 ieee80211_sta_merge_ibss(sdata, ifsta);
3085                 break;
3086 #ifdef CONFIG_MAC80211_MESH
3087         case IEEE80211_STA_MLME_MESH_UP:
3088                 ieee80211_mesh_housekeeping(sdata, ifsta);
3089                 break;
3090 #endif
3091         default:
3092                 WARN_ON(1);
3093                 break;
3094         }
3095
3096         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
3097                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
3098                        "mixed-cell disabled - disassociate\n", sdata->dev->name);
3099
3100                 ieee80211_set_disassoc(sdata, ifsta, false, true,
3101                                         WLAN_REASON_UNSPECIFIED);
3102         }
3103 }
3104
3105 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3106 {
3107         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
3108         struct ieee80211_if_sta *ifsta;
3109
3110         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
3111                 ifsta = &sdata->u.sta;
3112                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
3113                     (!(ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED) &&
3114                     !ieee80211_sta_active_ibss(sdata)))
3115                         ieee80211_sta_find_ibss(sdata, ifsta);
3116         }
3117 }