net/mac80211/ieee80211_sta.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 /* TODO:
  15  * order BSS list by RSSI(?) ("quality of AP")
  16  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  17  *    SSID)
  18  */
  19 #include <linux/delay.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/if_arp.h>
  24 #include <linux/wireless.h>
  25 #include <linux/random.h>
  26 #include <linux/etherdevice.h>
  27 #include <net/iw_handler.h>
  28 #include <asm/types.h>
  29
  30 #include <net/mac80211.h>
  31 #include "ieee80211_i.h"
  32 #include "ieee80211_rate.h"
  33 #include "ieee80211_led.h"
  34
  35 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  36 #define IEEE80211_AUTH_MAX_TRIES 3
  37 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  38 #define IEEE80211_ASSOC_MAX_TRIES 3
  39 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  40 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  41 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  42 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  43 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  44 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
  45
  46 #define IEEE80211_PROBE_DELAY (HZ / 33)
  47 #define IEEE80211_CHANNEL_TIME (HZ / 33)
  48 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
  49 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
  50 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  51 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  52
  53 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  54
  55
  56 #define IEEE80211_FC(type, stype) cpu_to_le16(type | stype)
  57
  58 #define ERP_INFO_USE_PROTECTION BIT(1)
  59
  60 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
  61                                      u8 *ssid, size_t ssid_len);
  62 static struct ieee80211_sta_bss *
  63 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
  64                      u8 *ssid, u8 ssid_len);
  65 static void ieee80211_rx_bss_put(struct net_device *dev,
  66                                  struct ieee80211_sta_bss *bss);
  67 static int ieee80211_sta_find_ibss(struct net_device *dev,
  68                                    struct ieee80211_if_sta *ifsta);
  69 static int ieee80211_sta_wep_configured(struct net_device *dev);
  70 static int ieee80211_sta_start_scan(struct net_device *dev,
  71                                     u8 *ssid, size_t ssid_len);
  72 static int ieee80211_sta_config_auth(struct net_device *dev,
  73                                      struct ieee80211_if_sta *ifsta);
  74
  75
  76 /* Parsed Information Elements */
  77 struct ieee802_11_elems {
  78         /* pointers to IEs */
  79         u8 *ssid;
  80         u8 *supp_rates;
  81         u8 *fh_params;
  82         u8 *ds_params;
  83         u8 *cf_params;
  84         u8 *tim;
  85         u8 *ibss_params;
  86         u8 *challenge;
  87         u8 *wpa;
  88         u8 *rsn;
  89         u8 *erp_info;
  90         u8 *ext_supp_rates;
  91         u8 *wmm_info;
  92         u8 *wmm_param;
  93
  94         /* length of them, respectively */
  95         u8 ssid_len;
  96         u8 supp_rates_len;
  97         u8 fh_params_len;
  98         u8 ds_params_len;
  99         u8 cf_params_len;
 100         u8 tim_len;
 101         u8 ibss_params_len;
 102         u8 challenge_len;
 103         u8 wpa_len;
 104         u8 rsn_len;
 105         u8 erp_info_len;
 106         u8 ext_supp_rates_len;
 107         u8 wmm_info_len;
 108         u8 wmm_param_len;
 109 };
 110
 111 enum ParseRes { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 };
 112
 113 static enum ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
 114                                             struct ieee802_11_elems *elems)
 115 {
 116         size_t left = len;
 117         u8 *pos = start;
 118         int unknown = 0;
 119
 120         memset(elems, 0, sizeof(*elems));
 121
 122         while (left >= 2) {
 123                 u8 id, elen;
 124
 125                 id = *pos++;
 126                 elen = *pos++;
 127                 left -= 2;
 128
 129                 if (elen > left) {
 130 #if 0
 131                         if (net_ratelimit())
 132                                 printk(KERN_DEBUG "IEEE 802.11 element parse "
 133                                        "failed (id=%d elen=%d left=%d)\n",
 134                                        id, elen, left);
 135 #endif
 136                         return ParseFailed;
 137                 }
 138
 139                 switch (id) {
 140                 case WLAN_EID_SSID:
 141                         elems->ssid = pos;
 142                         elems->ssid_len = elen;
 143                         break;
 144                 case WLAN_EID_SUPP_RATES:
 145                         elems->supp_rates = pos;
 146                         elems->supp_rates_len = elen;
 147                         break;
 148                 case WLAN_EID_FH_PARAMS:
 149                         elems->fh_params = pos;
 150                         elems->fh_params_len = elen;
 151                         break;
 152                 case WLAN_EID_DS_PARAMS:
 153                         elems->ds_params = pos;
 154                         elems->ds_params_len = elen;
 155                         break;
 156                 case WLAN_EID_CF_PARAMS:
 157                         elems->cf_params = pos;
 158                         elems->cf_params_len = elen;
 159                         break;
 160                 case WLAN_EID_TIM:
 161                         elems->tim = pos;
 162                         elems->tim_len = elen;
 163                         break;
 164                 case WLAN_EID_IBSS_PARAMS:
 165                         elems->ibss_params = pos;
 166                         elems->ibss_params_len = elen;
 167                         break;
 168                 case WLAN_EID_CHALLENGE:
 169                         elems->challenge = pos;
 170                         elems->challenge_len = elen;
 171                         break;
 172                 case WLAN_EID_WPA:
 173                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 174                             pos[2] == 0xf2) {
 175                                 /* Microsoft OUI (00:50:F2) */
 176                                 if (pos[3] == 1) {
 177                                         /* OUI Type 1 - WPA IE */
 178                                         elems->wpa = pos;
 179                                         elems->wpa_len = elen;
 180                                 } else if (elen >= 5 && pos[3] == 2) {
 181                                         if (pos[4] == 0) {
 182                                                 elems->wmm_info = pos;
 183                                                 elems->wmm_info_len = elen;
 184                                         } else if (pos[4] == 1) {
 185                                                 elems->wmm_param = pos;
 186                                                 elems->wmm_param_len = elen;
 187                                         }
 188                                 }
 189                         }
 190                         break;
 191                 case WLAN_EID_RSN:
 192                         elems->rsn = pos;
 193                         elems->rsn_len = elen;
 194                         break;
 195                 case WLAN_EID_ERP_INFO:
 196                         elems->erp_info = pos;
 197                         elems->erp_info_len = elen;
 198                         break;
 199                 case WLAN_EID_EXT_SUPP_RATES:
 200                         elems->ext_supp_rates = pos;
 201                         elems->ext_supp_rates_len = elen;
 202                         break;
 203                 default:
 204 #if 0
 205                         printk(KERN_DEBUG "IEEE 802.11 element parse ignored "
 206                                       "unknown element (id=%d elen=%d)\n",
 207                                       id, elen);
 208 #endif
 209                         unknown++;
 210                         break;
 211                 }
 212
 213                 left -= elen;
 214                 pos += elen;
 215         }
 216
 217         /* Do not trigger error if left == 1 as Apple Airport base stations
 218          * send AssocResps that are one spurious byte too long. */
 219
 220         return unknown ? ParseUnknown : ParseOK;
 221 }
 222
 223
 224
 225
 226 static int ecw2cw(int ecw)
 227 {
 228         int cw = 1;
 229         while (ecw > 0) {
 230                 cw <<= 1;
 231                 ecw--;
 232         }
 233         return cw - 1;
 234 }
 235
 236 static void ieee80211_sta_wmm_params(struct net_device *dev,
 237                                      struct ieee80211_if_sta *ifsta,
 238                                      u8 *wmm_param, size_t wmm_param_len)
 239 {
 240         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 241         struct ieee80211_tx_queue_params params;
 242         size_t left;
 243         int count;
 244         u8 *pos;
 245
 246         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 247                 return;
 248         count = wmm_param[6] & 0x0f;
 249         if (count == ifsta->wmm_last_param_set)
 250                 return;
 251         ifsta->wmm_last_param_set = count;
 252
 253         pos = wmm_param + 8;
 254         left = wmm_param_len - 8;
 255
 256         memset(&params, 0, sizeof(params));
 257
 258         if (!local->ops->conf_tx)
 259                 return;
 260
 261         local->wmm_acm = 0;
 262         for (; left >= 4; left -= 4, pos += 4) {
 263                 int aci = (pos[0] >> 5) & 0x03;
 264                 int acm = (pos[0] >> 4) & 0x01;
 265                 int queue;
 266
 267                 switch (aci) {
 268                 case 1:
 269                         queue = IEEE80211_TX_QUEUE_DATA3;
 270                         if (acm) {
 271                                 local->wmm_acm |= BIT(0) | BIT(3);
 272                         }
 273                         break;
 274                 case 2:
 275                         queue = IEEE80211_TX_QUEUE_DATA1;
 276                         if (acm) {
 277                                 local->wmm_acm |= BIT(4) | BIT(5);
 278                         }
 279                         break;
 280                 case 3:
 281                         queue = IEEE80211_TX_QUEUE_DATA0;
 282                         if (acm) {
 283                                 local->wmm_acm |= BIT(6) | BIT(7);
 284                         }
 285                         break;
 286                 case 0:
 287                 default:
 288                         queue = IEEE80211_TX_QUEUE_DATA2;
 289                         if (acm) {
 290                                 local->wmm_acm |= BIT(1) | BIT(2);
 291                         }
 292                         break;
 293                 }
 294
 295                 params.aifs = pos[0] & 0x0f;
 296                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 297                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 298                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 299                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 300                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 301                        "cWmin=%d cWmax=%d burst=%d\n",
 302                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
 303                        params.cw_max, params.burst_time);
 304                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 305                  * AC for now) */
 306                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 307                         printk(KERN_DEBUG "%s: failed to set TX queue "
 308                                "parameters for queue %d\n", dev->name, queue);
 309                 }
 310         }
 311 }
 312
 313
 314 static void ieee80211_handle_erp_ie(struct net_device *dev, u8 erp_value)
 315 {
 316         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 317         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 318         int use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 319         int preamble_mode = (erp_value & WLAN_ERP_BARKER_PREAMBLE) != 0;
 320         u8 changes = 0;
 321         DECLARE_MAC_BUF(mac);
 322
 323         if (use_protection != !!(sdata->flags & IEEE80211_SDATA_USE_PROTECTION)) {
 324                 if (net_ratelimit()) {
 325                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 326                                "%s)\n",
 327                                dev->name,
 328                                use_protection ? "enabled" : "disabled",
 329                                print_mac(mac, ifsta->bssid));
 330                 }
 331                 if (use_protection)
 332                         sdata->flags |= IEEE80211_SDATA_USE_PROTECTION;
 333                 else
 334                         sdata->flags &= ~IEEE80211_SDATA_USE_PROTECTION;
 335                 changes |= IEEE80211_ERP_CHANGE_PROTECTION;
 336         }
 337
 338         if (preamble_mode != !(sdata->flags & IEEE80211_SDATA_SHORT_PREAMBLE)) {
 339                 if (net_ratelimit()) {
 340                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 341                                " (BSSID=%s)\n",
 342                                dev->name,
 343                                (preamble_mode == WLAN_ERP_PREAMBLE_SHORT) ?
 344                                         "short" : "long",
 345                                print_mac(mac, ifsta->bssid));
 346                 }
 347                 if (preamble_mode)
 348                         sdata->flags &= ~IEEE80211_SDATA_SHORT_PREAMBLE;
 349                 else
 350                         sdata->flags |= IEEE80211_SDATA_SHORT_PREAMBLE;
 351                 changes |= IEEE80211_ERP_CHANGE_PREAMBLE;
 352         }
 353
 354         if (changes)
 355                 ieee80211_erp_info_change_notify(dev, changes);
 356 }
 357
 358
 359 static void ieee80211_sta_send_associnfo(struct net_device *dev,
 360                                          struct ieee80211_if_sta *ifsta)
 361 {
 362         char *buf;
 363         size_t len;
 364         int i;
 365         union iwreq_data wrqu;
 366
 367         if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
 368                 return;
 369
 370         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
 371                                 ifsta->assocresp_ies_len), GFP_KERNEL);
 372         if (!buf)
 373                 return;
 374
 375         len = sprintf(buf, "ASSOCINFO(");
 376         if (ifsta->assocreq_ies) {
 377                 len += sprintf(buf + len, "ReqIEs=");
 378                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
 379                         len += sprintf(buf + len, "%02x",
 380                                        ifsta->assocreq_ies[i]);
 381                 }
 382         }
 383         if (ifsta->assocresp_ies) {
 384                 if (ifsta->assocreq_ies)
 385                         len += sprintf(buf + len, " ");
 386                 len += sprintf(buf + len, "RespIEs=");
 387                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 388                         len += sprintf(buf + len, "%02x",
 389                                        ifsta->assocresp_ies[i]);
 390                 }
 391         }
 392         len += sprintf(buf + len, ")");
 393
 394         if (len > IW_CUSTOM_MAX) {
 395                 len = sprintf(buf, "ASSOCRESPIE=");
 396                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 397                         len += sprintf(buf + len, "%02x",
 398                                        ifsta->assocresp_ies[i]);
 399                 }
 400         }
 401
 402         memset(&wrqu, 0, sizeof(wrqu));
 403         wrqu.data.length = len;
 404         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 405
 406         kfree(buf);
 407 }
 408
 409
 410 static void ieee80211_set_associated(struct net_device *dev,
 411                                      struct ieee80211_if_sta *ifsta,
 412                                      bool assoc)
 413 {
 414         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 415         union iwreq_data wrqu;
 416
 417         if (!!(ifsta->flags & IEEE80211_STA_ASSOCIATED) == assoc)
 418                 return;
 419
 420         if (assoc) {
 421                 struct ieee80211_sub_if_data *sdata;
 422                 struct ieee80211_sta_bss *bss;
 423
 424                 ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 425
 426                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 427                 if (sdata->type != IEEE80211_IF_TYPE_STA)
 428                         return;
 429
 430                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
 431                                            local->hw.conf.channel,
 432                                            ifsta->ssid, ifsta->ssid_len);
 433                 if (bss) {
 434                         if (bss->has_erp_value)
 435                                 ieee80211_handle_erp_ie(dev, bss->erp_value);
 436                         ieee80211_rx_bss_put(dev, bss);
 437                 }
 438
 439                 netif_carrier_on(dev);
 440                 ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 441                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 442                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 443                 ieee80211_sta_send_associnfo(dev, ifsta);
 444         } else {
 445                 ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
 446
 447                 netif_carrier_off(dev);
 448                 ieee80211_reset_erp_info(dev);
 449                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 450         }
 451         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 452         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 453         ifsta->last_probe = jiffies;
 454         ieee80211_led_assoc(local, assoc);
 455 }
 456
 457 static void ieee80211_set_disassoc(struct net_device *dev,
 458                                    struct ieee80211_if_sta *ifsta, int deauth)
 459 {
 460         if (deauth)
 461                 ifsta->auth_tries = 0;
 462         ifsta->assoc_tries = 0;
 463         ieee80211_set_associated(dev, ifsta, 0);
 464 }
 465
 466 static void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
 467                              int encrypt)
 468 {
 469         struct ieee80211_sub_if_data *sdata;
 470         struct ieee80211_tx_packet_data *pkt_data;
 471
 472         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 473         skb->dev = sdata->local->mdev;
 474         skb_set_mac_header(skb, 0);
 475         skb_set_network_header(skb, 0);
 476         skb_set_transport_header(skb, 0);
 477
 478         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
 479         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
 480         pkt_data->ifindex = sdata->dev->ifindex;
 481         if (!encrypt)
 482                 pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
 483
 484         dev_queue_xmit(skb);
 485 }
 486
 487
 488 static void ieee80211_send_auth(struct net_device *dev,
 489                                 struct ieee80211_if_sta *ifsta,
 490                                 int transaction, u8 *extra, size_t extra_len,
 491                                 int encrypt)
 492 {
 493         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 494         struct sk_buff *skb;
 495         struct ieee80211_mgmt *mgmt;
 496
 497         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 498                             sizeof(*mgmt) + 6 + extra_len);
 499         if (!skb) {
 500                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 501                        "frame\n", dev->name);
 502                 return;
 503         }
 504         skb_reserve(skb, local->hw.extra_tx_headroom);
 505
 506         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 507         memset(mgmt, 0, 24 + 6);
 508         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 509                                            IEEE80211_STYPE_AUTH);
 510         if (encrypt)
 511                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 512         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 513         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 514         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 515         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 516         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 517         ifsta->auth_transaction = transaction + 1;
 518         mgmt->u.auth.status_code = cpu_to_le16(0);
 519         if (extra)
 520                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 521
 522         ieee80211_sta_tx(dev, skb, encrypt);
 523 }
 524
 525
 526 static void ieee80211_authenticate(struct net_device *dev,
 527                                    struct ieee80211_if_sta *ifsta)
 528 {
 529         DECLARE_MAC_BUF(mac);
 530
 531         ifsta->auth_tries++;
 532         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 533                 printk(KERN_DEBUG "%s: authentication with AP %s"
 534                        " timed out\n",
 535                        dev->name, print_mac(mac, ifsta->bssid));
 536                 ifsta->state = IEEE80211_DISABLED;
 537                 return;
 538         }
 539
 540         ifsta->state = IEEE80211_AUTHENTICATE;
 541         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
 542                dev->name, print_mac(mac, ifsta->bssid));
 543
 544         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
 545
 546         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 547 }
 548
 549
 550 static void ieee80211_send_assoc(struct net_device *dev,
 551                                  struct ieee80211_if_sta *ifsta)
 552 {
 553         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 554         struct ieee80211_hw_mode *mode;
 555         struct sk_buff *skb;
 556         struct ieee80211_mgmt *mgmt;
 557         u8 *pos, *ies;
 558         int i, len;
 559         u16 capab;
 560         struct ieee80211_sta_bss *bss;
 561         int wmm = 0;
 562
 563         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 564                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 565                             ifsta->ssid_len);
 566         if (!skb) {
 567                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 568                        "frame\n", dev->name);
 569                 return;
 570         }
 571         skb_reserve(skb, local->hw.extra_tx_headroom);
 572
 573         mode = local->oper_hw_mode;
 574         capab = ifsta->capab;
 575         if (mode->mode == MODE_IEEE80211G) {
 576                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 577                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 578         }
 579         bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
 580                                    ifsta->ssid, ifsta->ssid_len);
 581         if (bss) {
 582                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 583                         capab |= WLAN_CAPABILITY_PRIVACY;
 584                 if (bss->wmm_ie) {
 585                         wmm = 1;
 586                 }
 587                 ieee80211_rx_bss_put(dev, bss);
 588         }
 589
 590         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 591         memset(mgmt, 0, 24);
 592         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 593         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 594         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 595
 596         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 597                 skb_put(skb, 10);
 598                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 599                                                    IEEE80211_STYPE_REASSOC_REQ);
 600                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 601                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
 602                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 603                        ETH_ALEN);
 604         } else {
 605                 skb_put(skb, 4);
 606                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 607                                                    IEEE80211_STYPE_ASSOC_REQ);
 608                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 609                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
 610         }
 611
 612         /* SSID */
 613         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 614         *pos++ = WLAN_EID_SSID;
 615         *pos++ = ifsta->ssid_len;
 616         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 617
 618         len = mode->num_rates;
 619         if (len > 8)
 620                 len = 8;
 621         pos = skb_put(skb, len + 2);
 622         *pos++ = WLAN_EID_SUPP_RATES;
 623         *pos++ = len;
 624         for (i = 0; i < len; i++) {
 625                 int rate = mode->rates[i].rate;
 626                 *pos++ = (u8) (rate / 5);
 627         }
 628
 629         if (mode->num_rates > len) {
 630                 pos = skb_put(skb, mode->num_rates - len + 2);
 631                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 632                 *pos++ = mode->num_rates - len;
 633                 for (i = len; i < mode->num_rates; i++) {
 634                         int rate = mode->rates[i].rate;
 635                         *pos++ = (u8) (rate / 5);
 636                 }
 637         }
 638
 639         if (ifsta->extra_ie) {
 640                 pos = skb_put(skb, ifsta->extra_ie_len);
 641                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 642         }
 643
 644         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 645                 pos = skb_put(skb, 9);
 646                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 647                 *pos++ = 7; /* len */
 648                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 649                 *pos++ = 0x50;
 650                 *pos++ = 0xf2;
 651                 *pos++ = 2; /* WME */
 652                 *pos++ = 0; /* WME info */
 653                 *pos++ = 1; /* WME ver */
 654                 *pos++ = 0;
 655         }
 656
 657         kfree(ifsta->assocreq_ies);
 658         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 659         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 660         if (ifsta->assocreq_ies)
 661                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 662
 663         ieee80211_sta_tx(dev, skb, 0);
 664 }
 665
 666
 667 static void ieee80211_send_deauth(struct net_device *dev,
 668                                   struct ieee80211_if_sta *ifsta, u16 reason)
 669 {
 670         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 671         struct sk_buff *skb;
 672         struct ieee80211_mgmt *mgmt;
 673
 674         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 675         if (!skb) {
 676                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 677                        "frame\n", dev->name);
 678                 return;
 679         }
 680         skb_reserve(skb, local->hw.extra_tx_headroom);
 681
 682         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 683         memset(mgmt, 0, 24);
 684         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 685         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 686         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 687         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 688                                            IEEE80211_STYPE_DEAUTH);
 689         skb_put(skb, 2);
 690         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 691
 692         ieee80211_sta_tx(dev, skb, 0);
 693 }
 694
 695
 696 static void ieee80211_send_disassoc(struct net_device *dev,
 697                                     struct ieee80211_if_sta *ifsta, u16 reason)
 698 {
 699         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 700         struct sk_buff *skb;
 701         struct ieee80211_mgmt *mgmt;
 702
 703         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 704         if (!skb) {
 705                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 706                        "frame\n", dev->name);
 707                 return;
 708         }
 709         skb_reserve(skb, local->hw.extra_tx_headroom);
 710
 711         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 712         memset(mgmt, 0, 24);
 713         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 714         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 715         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 716         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 717                                            IEEE80211_STYPE_DISASSOC);
 718         skb_put(skb, 2);
 719         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 720
 721         ieee80211_sta_tx(dev, skb, 0);
 722 }
 723
 724
 725 static int ieee80211_privacy_mismatch(struct net_device *dev,
 726                                       struct ieee80211_if_sta *ifsta)
 727 {
 728         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 729         struct ieee80211_sta_bss *bss;
 730         int res = 0;
 731
 732         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL) ||
 733             ifsta->key_management_enabled)
 734                 return 0;
 735
 736         bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
 737                                    ifsta->ssid, ifsta->ssid_len);
 738         if (!bss)
 739                 return 0;
 740
 741         if (ieee80211_sta_wep_configured(dev) !=
 742             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 743                 res = 1;
 744
 745         ieee80211_rx_bss_put(dev, bss);
 746
 747         return res;
 748 }
 749
 750
 751 static void ieee80211_associate(struct net_device *dev,
 752                                 struct ieee80211_if_sta *ifsta)
 753 {
 754         DECLARE_MAC_BUF(mac);
 755
 756         ifsta->assoc_tries++;
 757         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 758                 printk(KERN_DEBUG "%s: association with AP %s"
 759                        " timed out\n",
 760                        dev->name, print_mac(mac, ifsta->bssid));
 761                 ifsta->state = IEEE80211_DISABLED;
 762                 return;
 763         }
 764
 765         ifsta->state = IEEE80211_ASSOCIATE;
 766         printk(KERN_DEBUG "%s: associate with AP %s\n",
 767                dev->name, print_mac(mac, ifsta->bssid));
 768         if (ieee80211_privacy_mismatch(dev, ifsta)) {
 769                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 770                        "mixed-cell disabled - abort association\n", dev->name);
 771                 ifsta->state = IEEE80211_DISABLED;
 772                 return;
 773         }
 774
 775         ieee80211_send_assoc(dev, ifsta);
 776
 777         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 778 }
 779
 780
 781 static void ieee80211_associated(struct net_device *dev,
 782                                  struct ieee80211_if_sta *ifsta)
 783 {
 784         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 785         struct sta_info *sta;
 786         int disassoc;
 787         DECLARE_MAC_BUF(mac);
 788
 789         /* TODO: start monitoring current AP signal quality and number of
 790          * missed beacons. Scan other channels every now and then and search
 791          * for better APs. */
 792         /* TODO: remove expired BSSes */
 793
 794         ifsta->state = IEEE80211_ASSOCIATED;
 795
 796         sta = sta_info_get(local, ifsta->bssid);
 797         if (!sta) {
 798                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
 799                        dev->name, print_mac(mac, ifsta->bssid));
 800                 disassoc = 1;
 801         } else {
 802                 disassoc = 0;
 803                 if (time_after(jiffies,
 804                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 805                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
 806                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 807                                        "current AP %s - assume out of "
 808                                        "range\n",
 809                                        dev->name, print_mac(mac, ifsta->bssid));
 810                                 disassoc = 1;
 811                                 sta_info_free(sta);
 812                         } else
 813                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 814                                                          local->scan_ssid,
 815                                                          local->scan_ssid_len);
 816                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
 817                 } else {
 818                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 819                         if (time_after(jiffies, ifsta->last_probe +
 820                                        IEEE80211_PROBE_INTERVAL)) {
 821                                 ifsta->last_probe = jiffies;
 822                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 823                                                          ifsta->ssid,
 824                                                          ifsta->ssid_len);
 825                         }
 826                 }
 827                 sta_info_put(sta);
 828         }
 829         if (disassoc) {
 830                 union iwreq_data wrqu;
 831                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 832                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 833                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 834                 mod_timer(&ifsta->timer, jiffies +
 835                                       IEEE80211_MONITORING_INTERVAL + 30 * HZ);
 836         } else {
 837                 mod_timer(&ifsta->timer, jiffies +
 838                                       IEEE80211_MONITORING_INTERVAL);
 839         }
 840 }
 841
 842
 843 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 844                                      u8 *ssid, size_t ssid_len)
 845 {
 846         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 847         struct ieee80211_hw_mode *mode;
 848         struct sk_buff *skb;
 849         struct ieee80211_mgmt *mgmt;
 850         u8 *pos, *supp_rates, *esupp_rates = NULL;
 851         int i;
 852
 853         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 854         if (!skb) {
 855                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 856                        "request\n", dev->name);
 857                 return;
 858         }
 859         skb_reserve(skb, local->hw.extra_tx_headroom);
 860
 861         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 862         memset(mgmt, 0, 24);
 863         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 864                                            IEEE80211_STYPE_PROBE_REQ);
 865         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 866         if (dst) {
 867                 memcpy(mgmt->da, dst, ETH_ALEN);
 868                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 869         } else {
 870                 memset(mgmt->da, 0xff, ETH_ALEN);
 871                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 872         }
 873         pos = skb_put(skb, 2 + ssid_len);
 874         *pos++ = WLAN_EID_SSID;
 875         *pos++ = ssid_len;
 876         memcpy(pos, ssid, ssid_len);
 877
 878         supp_rates = skb_put(skb, 2);
 879         supp_rates[0] = WLAN_EID_SUPP_RATES;
 880         supp_rates[1] = 0;
 881         mode = local->oper_hw_mode;
 882         for (i = 0; i < mode->num_rates; i++) {
 883                 struct ieee80211_rate *rate = &mode->rates[i];
 884                 if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
 885                         continue;
 886                 if (esupp_rates) {
 887                         pos = skb_put(skb, 1);
 888                         esupp_rates[1]++;
 889                 } else if (supp_rates[1] == 8) {
 890                         esupp_rates = skb_put(skb, 3);
 891                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 892                         esupp_rates[1] = 1;
 893                         pos = &esupp_rates[2];
 894                 } else {
 895                         pos = skb_put(skb, 1);
 896                         supp_rates[1]++;
 897                 }
 898                 *pos = rate->rate / 5;
 899         }
 900
 901         ieee80211_sta_tx(dev, skb, 0);
 902 }
 903
 904
 905 static int ieee80211_sta_wep_configured(struct net_device *dev)
 906 {
 907         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 908         if (!sdata || !sdata->default_key ||
 909             sdata->default_key->conf.alg != ALG_WEP)
 910                 return 0;
 911         return 1;
 912 }
 913
 914
 915 static void ieee80211_auth_completed(struct net_device *dev,
 916                                      struct ieee80211_if_sta *ifsta)
 917 {
 918         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
 919         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
 920         ieee80211_associate(dev, ifsta);
 921 }
 922
 923
 924 static void ieee80211_auth_challenge(struct net_device *dev,
 925                                      struct ieee80211_if_sta *ifsta,
 926                                      struct ieee80211_mgmt *mgmt,
 927                                      size_t len)
 928 {
 929         u8 *pos;
 930         struct ieee802_11_elems elems;
 931
 932         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
 933         pos = mgmt->u.auth.variable;
 934         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
 935             == ParseFailed) {
 936                 printk(KERN_DEBUG "%s: failed to parse Auth(challenge)\n",
 937                        dev->name);
 938                 return;
 939         }
 940         if (!elems.challenge) {
 941                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
 942                        "frame\n", dev->name);
 943                 return;
 944         }
 945         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
 946                             elems.challenge_len + 2, 1);
 947 }
 948
 949
 950 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
 951                                    struct ieee80211_if_sta *ifsta,
 952                                    struct ieee80211_mgmt *mgmt,
 953                                    size_t len)
 954 {
 955         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 956         u16 auth_alg, auth_transaction, status_code;
 957         DECLARE_MAC_BUF(mac);
 958
 959         if (ifsta->state != IEEE80211_AUTHENTICATE &&
 960             sdata->type != IEEE80211_IF_TYPE_IBSS) {
 961                 printk(KERN_DEBUG "%s: authentication frame received from "
 962                        "%s, but not in authenticate state - ignored\n",
 963                        dev->name, print_mac(mac, mgmt->sa));
 964                 return;
 965         }
 966
 967         if (len < 24 + 6) {
 968                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
 969                        "received from %s - ignored\n",
 970                        dev->name, len, print_mac(mac, mgmt->sa));
 971                 return;
 972         }
 973
 974         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
 975             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
 976                 printk(KERN_DEBUG "%s: authentication frame received from "
 977                        "unknown AP (SA=%s BSSID=%s) - "
 978                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
 979                        print_mac(mac, mgmt->bssid));
 980                 return;
 981         }
 982
 983         if (sdata->type != IEEE80211_IF_TYPE_IBSS &&
 984             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 985                 printk(KERN_DEBUG "%s: authentication frame received from "
 986                        "unknown BSSID (SA=%s BSSID=%s) - "
 987                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
 988                        print_mac(mac, mgmt->bssid));
 989                 return;
 990         }
 991
 992         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
 993         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 994         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 995
 996         printk(KERN_DEBUG "%s: RX authentication from %s (alg=%d "
 997                "transaction=%d status=%d)\n",
 998                dev->name, print_mac(mac, mgmt->sa), auth_alg,
 999                auth_transaction, status_code);
1000
1001         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
1002                 /* IEEE 802.11 standard does not require authentication in IBSS
1003                  * networks and most implementations do not seem to use it.
1004                  * However, try to reply to authentication attempts if someone
1005                  * has actually implemented this.
1006                  * TODO: Could implement shared key authentication. */
1007                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
1008                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
1009                                "frame (alg=%d transaction=%d)\n",
1010                                dev->name, auth_alg, auth_transaction);
1011                         return;
1012                 }
1013                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
1014         }
1015
1016         if (auth_alg != ifsta->auth_alg ||
1017             auth_transaction != ifsta->auth_transaction) {
1018                 printk(KERN_DEBUG "%s: unexpected authentication frame "
1019                        "(alg=%d transaction=%d)\n",
1020                        dev->name, auth_alg, auth_transaction);
1021                 return;
1022         }
1023
1024         if (status_code != WLAN_STATUS_SUCCESS) {
1025                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
1026                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
1027                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1028                         u8 algs[3];
1029                         const int num_algs = ARRAY_SIZE(algs);
1030                         int i, pos;
1031                         algs[0] = algs[1] = algs[2] = 0xff;
1032                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1033                                 algs[0] = WLAN_AUTH_OPEN;
1034                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1035                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1036                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1037                                 algs[2] = WLAN_AUTH_LEAP;
1038                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1039                                 pos = 0;
1040                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1041                                 pos = 1;
1042                         else
1043                                 pos = 2;
1044                         for (i = 0; i < num_algs; i++) {
1045                                 pos++;
1046                                 if (pos >= num_algs)
1047                                         pos = 0;
1048                                 if (algs[pos] == ifsta->auth_alg ||
1049                                     algs[pos] == 0xff)
1050                                         continue;
1051                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1052                                     !ieee80211_sta_wep_configured(dev))
1053                                         continue;
1054                                 ifsta->auth_alg = algs[pos];
1055                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
1056                                        "next try\n",
1057                                        dev->name, ifsta->auth_alg);
1058                                 break;
1059                         }
1060                 }
1061                 return;
1062         }
1063
1064         switch (ifsta->auth_alg) {
1065         case WLAN_AUTH_OPEN:
1066         case WLAN_AUTH_LEAP:
1067                 ieee80211_auth_completed(dev, ifsta);
1068                 break;
1069         case WLAN_AUTH_SHARED_KEY:
1070                 if (ifsta->auth_transaction == 4)
1071                         ieee80211_auth_completed(dev, ifsta);
1072                 else
1073                         ieee80211_auth_challenge(dev, ifsta, mgmt, len);
1074                 break;
1075         }
1076 }
1077
1078
1079 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
1080                                      struct ieee80211_if_sta *ifsta,
1081                                      struct ieee80211_mgmt *mgmt,
1082                                      size_t len)
1083 {
1084         u16 reason_code;
1085         DECLARE_MAC_BUF(mac);
1086
1087         if (len < 24 + 2) {
1088                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
1089                        "received from %s - ignored\n",
1090                        dev->name, len, print_mac(mac, mgmt->sa));
1091                 return;
1092         }
1093
1094         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1095                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1096                        "unknown AP (SA=%s BSSID=%s) - "
1097                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1098                        print_mac(mac, mgmt->bssid));
1099                 return;
1100         }
1101
1102         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1103
1104         printk(KERN_DEBUG "%s: RX deauthentication from %s"
1105                " (reason=%d)\n",
1106                dev->name, print_mac(mac, mgmt->sa), reason_code);
1107
1108         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED) {
1109                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1110         }
1111
1112         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1113             ifsta->state == IEEE80211_ASSOCIATE ||
1114             ifsta->state == IEEE80211_ASSOCIATED) {
1115                 ifsta->state = IEEE80211_AUTHENTICATE;
1116                 mod_timer(&ifsta->timer, jiffies +
1117                                       IEEE80211_RETRY_AUTH_INTERVAL);
1118         }
1119
1120         ieee80211_set_disassoc(dev, ifsta, 1);
1121         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1122 }
1123
1124
1125 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1126                                        struct ieee80211_if_sta *ifsta,
1127                                        struct ieee80211_mgmt *mgmt,
1128                                        size_t len)
1129 {
1130         u16 reason_code;
1131         DECLARE_MAC_BUF(mac);
1132
1133         if (len < 24 + 2) {
1134                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1135                        "received from %s - ignored\n",
1136                        dev->name, len, print_mac(mac, mgmt->sa));
1137                 return;
1138         }
1139
1140         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1141                 printk(KERN_DEBUG "%s: disassociation frame received from "
1142                        "unknown AP (SA=%s BSSID=%s) - "
1143                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1144                        print_mac(mac, mgmt->bssid));
1145                 return;
1146         }
1147
1148         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1149
1150         printk(KERN_DEBUG "%s: RX disassociation from %s"
1151                " (reason=%d)\n",
1152                dev->name, print_mac(mac, mgmt->sa), reason_code);
1153
1154         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1155                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1156
1157         if (ifsta->state == IEEE80211_ASSOCIATED) {
1158                 ifsta->state = IEEE80211_ASSOCIATE;
1159                 mod_timer(&ifsta->timer, jiffies +
1160                                       IEEE80211_RETRY_AUTH_INTERVAL);
1161         }
1162
1163         ieee80211_set_disassoc(dev, ifsta, 0);
1164 }
1165
1166
1167 static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
1168                                          struct ieee80211_if_sta *ifsta,
1169                                          struct ieee80211_mgmt *mgmt,
1170                                          size_t len,
1171                                          int reassoc)
1172 {
1173         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1174         struct ieee80211_hw_mode *mode;
1175         struct sta_info *sta;
1176         u32 rates;
1177         u16 capab_info, status_code, aid;
1178         struct ieee802_11_elems elems;
1179         u8 *pos;
1180         int i, j;
1181         DECLARE_MAC_BUF(mac);
1182
1183         /* AssocResp and ReassocResp have identical structure, so process both
1184          * of them in this function. */
1185
1186         if (ifsta->state != IEEE80211_ASSOCIATE) {
1187                 printk(KERN_DEBUG "%s: association frame received from "
1188                        "%s, but not in associate state - ignored\n",
1189                        dev->name, print_mac(mac, mgmt->sa));
1190                 return;
1191         }
1192
1193         if (len < 24 + 6) {
1194                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1195                        "received from %s - ignored\n",
1196                        dev->name, len, print_mac(mac, mgmt->sa));
1197                 return;
1198         }
1199
1200         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1201                 printk(KERN_DEBUG "%s: association frame received from "
1202                        "unknown AP (SA=%s BSSID=%s) - "
1203                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1204                        print_mac(mac, mgmt->bssid));
1205                 return;
1206         }
1207
1208         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1209         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1210         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1211
1212         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
1213                "status=%d aid=%d)\n",
1214                dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
1215                capab_info, status_code, aid & ~(BIT(15) | BIT(14)));
1216
1217         if (status_code != WLAN_STATUS_SUCCESS) {
1218                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1219                        dev->name, status_code);
1220                 /* if this was a reassociation, ensure we try a "full"
1221                  * association next time. This works around some broken APs
1222                  * which do not correctly reject reassociation requests. */
1223                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1224                 return;
1225         }
1226
1227         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1228                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1229                        "set\n", dev->name, aid);
1230         aid &= ~(BIT(15) | BIT(14));
1231
1232         pos = mgmt->u.assoc_resp.variable;
1233         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1234             == ParseFailed) {
1235                 printk(KERN_DEBUG "%s: failed to parse AssocResp\n",
1236                        dev->name);
1237                 return;
1238         }
1239
1240         if (!elems.supp_rates) {
1241                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1242                        dev->name);
1243                 return;
1244         }
1245
1246         /* it probably doesn't, but if the frame includes an ERP value then
1247          * update our stored copy */
1248         if (elems.erp_info && elems.erp_info_len >= 1) {
1249                 struct ieee80211_sta_bss *bss
1250                         = ieee80211_rx_bss_get(dev, ifsta->bssid,
1251                                                local->hw.conf.channel,
1252                                                ifsta->ssid, ifsta->ssid_len);
1253                 if (bss) {
1254                         bss->erp_value = elems.erp_info[0];
1255                         bss->has_erp_value = 1;
1256                         ieee80211_rx_bss_put(dev, bss);
1257                 }
1258         }
1259
1260         printk(KERN_DEBUG "%s: associated\n", dev->name);
1261         ifsta->aid = aid;
1262         ifsta->ap_capab = capab_info;
1263
1264         kfree(ifsta->assocresp_ies);
1265         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1266         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1267         if (ifsta->assocresp_ies)
1268                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1269
1270         ieee80211_set_associated(dev, ifsta, 1);
1271
1272         /* Add STA entry for the AP */
1273         sta = sta_info_get(local, ifsta->bssid);
1274         if (!sta) {
1275                 struct ieee80211_sta_bss *bss;
1276                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
1277                 if (!sta) {
1278                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
1279                                " AP\n", dev->name);
1280                         return;
1281                 }
1282                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
1283                                            local->hw.conf.channel,
1284                                            ifsta->ssid, ifsta->ssid_len);
1285                 if (bss) {
1286                         sta->last_rssi = bss->rssi;
1287                         sta->last_signal = bss->signal;
1288                         sta->last_noise = bss->noise;
1289                         ieee80211_rx_bss_put(dev, bss);
1290                 }
1291         }
1292
1293         sta->dev = dev;
1294         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP;
1295
1296         rates = 0;
1297         mode = local->oper_hw_mode;
1298         for (i = 0; i < elems.supp_rates_len; i++) {
1299                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1300                 for (j = 0; j < mode->num_rates; j++)
1301                         if (mode->rates[j].rate == rate)
1302                                 rates |= BIT(j);
1303         }
1304         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1305                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1306                 for (j = 0; j < mode->num_rates; j++)
1307                         if (mode->rates[j].rate == rate)
1308                                 rates |= BIT(j);
1309         }
1310         sta->supp_rates = rates;
1311
1312         rate_control_rate_init(sta, local);
1313
1314         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1315                 sta->flags |= WLAN_STA_WME;
1316                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1317                                          elems.wmm_param_len);
1318         }
1319
1320
1321         sta_info_put(sta);
1322
1323         ieee80211_associated(dev, ifsta);
1324 }
1325
1326
1327 /* Caller must hold local->sta_bss_lock */
1328 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
1329                                         struct ieee80211_sta_bss *bss)
1330 {
1331         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1332         bss->hnext = local->sta_bss_hash[STA_HASH(bss->bssid)];
1333         local->sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1334 }
1335
1336
1337 /* Caller must hold local->sta_bss_lock */
1338 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
1339                                         struct ieee80211_sta_bss *bss)
1340 {
1341         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1342         struct ieee80211_sta_bss *b, *prev = NULL;
1343         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
1344         while (b) {
1345                 if (b == bss) {
1346                         if (!prev)
1347                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
1348                                         bss->hnext;
1349                         else
1350                                 prev->hnext = bss->hnext;
1351                         break;
1352                 }
1353                 prev = b;
1354                 b = b->hnext;
1355         }
1356 }
1357
1358
1359 static struct ieee80211_sta_bss *
1360 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
1361                      u8 *ssid, u8 ssid_len)
1362 {
1363         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1364         struct ieee80211_sta_bss *bss;
1365
1366         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
1367         if (!bss)
1368                 return NULL;
1369         atomic_inc(&bss->users);
1370         atomic_inc(&bss->users);
1371         memcpy(bss->bssid, bssid, ETH_ALEN);
1372         bss->channel = channel;
1373         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
1374                 memcpy(bss->ssid, ssid, ssid_len);
1375                 bss->ssid_len = ssid_len;
1376         }
1377
1378         spin_lock_bh(&local->sta_bss_lock);
1379         /* TODO: order by RSSI? */
1380         list_add_tail(&bss->list, &local->sta_bss_list);
1381         __ieee80211_rx_bss_hash_add(dev, bss);
1382         spin_unlock_bh(&local->sta_bss_lock);
1383         return bss;
1384 }
1385
1386
1387 static struct ieee80211_sta_bss *
1388 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
1389                      u8 *ssid, u8 ssid_len)
1390 {
1391         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1392         struct ieee80211_sta_bss *bss;
1393
1394         spin_lock_bh(&local->sta_bss_lock);
1395         bss = local->sta_bss_hash[STA_HASH(bssid)];
1396         while (bss) {
1397                 if (!memcmp(bss->bssid, bssid, ETH_ALEN) &&
1398                     bss->channel == channel &&
1399                     bss->ssid_len == ssid_len &&
1400                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
1401                         atomic_inc(&bss->users);
1402                         break;
1403                 }
1404                 bss = bss->hnext;
1405         }
1406         spin_unlock_bh(&local->sta_bss_lock);
1407         return bss;
1408 }
1409
1410
1411 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
1412 {
1413         kfree(bss->wpa_ie);
1414         kfree(bss->rsn_ie);
1415         kfree(bss->wmm_ie);
1416         kfree(bss);
1417 }
1418
1419
1420 static void ieee80211_rx_bss_put(struct net_device *dev,
1421                                  struct ieee80211_sta_bss *bss)
1422 {
1423         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1424         if (!atomic_dec_and_test(&bss->users))
1425                 return;
1426
1427         spin_lock_bh(&local->sta_bss_lock);
1428         __ieee80211_rx_bss_hash_del(dev, bss);
1429         list_del(&bss->list);
1430         spin_unlock_bh(&local->sta_bss_lock);
1431         ieee80211_rx_bss_free(bss);
1432 }
1433
1434
1435 void ieee80211_rx_bss_list_init(struct net_device *dev)
1436 {
1437         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1438         spin_lock_init(&local->sta_bss_lock);
1439         INIT_LIST_HEAD(&local->sta_bss_list);
1440 }
1441
1442
1443 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
1444 {
1445         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1446         struct ieee80211_sta_bss *bss, *tmp;
1447
1448         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
1449                 ieee80211_rx_bss_put(dev, bss);
1450 }
1451
1452
1453 static void ieee80211_rx_bss_info(struct net_device *dev,
1454                                   struct ieee80211_mgmt *mgmt,
1455                                   size_t len,
1456                                   struct ieee80211_rx_status *rx_status,
1457                                   int beacon)
1458 {
1459         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1460         struct ieee802_11_elems elems;
1461         size_t baselen;
1462         int channel, invalid = 0, clen;
1463         struct ieee80211_sta_bss *bss;
1464         struct sta_info *sta;
1465         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1466         u64 timestamp;
1467         DECLARE_MAC_BUF(mac);
1468         DECLARE_MAC_BUF(mac2);
1469
1470         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
1471                 return; /* ignore ProbeResp to foreign address */
1472
1473 #if 0
1474         printk(KERN_DEBUG "%s: RX %s from %s to %s\n",
1475                dev->name, beacon ? "Beacon" : "Probe Response",
1476                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da));
1477 #endif
1478
1479         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1480         if (baselen > len)
1481                 return;
1482
1483         timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
1484
1485         if (sdata->type == IEEE80211_IF_TYPE_IBSS && beacon &&
1486             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
1487 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1488                 static unsigned long last_tsf_debug = 0;
1489                 u64 tsf;
1490                 if (local->ops->get_tsf)
1491                         tsf = local->ops->get_tsf(local_to_hw(local));
1492                 else
1493                         tsf = -1LLU;
1494                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1495                         printk(KERN_DEBUG "RX beacon SA=%s BSSID="
1496                                "%s TSF=0x%llx BCN=0x%llx diff=%lld "
1497                                "@%lu\n",
1498                                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->bssid),
1499                                (unsigned long long)tsf,
1500                                (unsigned long long)timestamp,
1501                                (unsigned long long)(tsf - timestamp),
1502                                jiffies);
1503                         last_tsf_debug = jiffies;
1504                 }
1505 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1506         }
1507
1508         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1509                                    &elems) == ParseFailed)
1510                 invalid = 1;
1511
1512         if (sdata->type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
1513             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
1514             (sta = sta_info_get(local, mgmt->sa))) {
1515                 struct ieee80211_hw_mode *mode;
1516                 struct ieee80211_rate *rates;
1517                 size_t num_rates;
1518                 u32 supp_rates, prev_rates;
1519                 int i, j;
1520
1521                 mode = local->sta_scanning ?
1522                        local->scan_hw_mode : local->oper_hw_mode;
1523                 rates = mode->rates;
1524                 num_rates = mode->num_rates;
1525
1526                 supp_rates = 0;
1527                 for (i = 0; i < elems.supp_rates_len +
1528                              elems.ext_supp_rates_len; i++) {
1529                         u8 rate = 0;
1530                         int own_rate;
1531                         if (i < elems.supp_rates_len)
1532                                 rate = elems.supp_rates[i];
1533                         else if (elems.ext_supp_rates)
1534                                 rate = elems.ext_supp_rates
1535                                         [i - elems.supp_rates_len];
1536                         own_rate = 5 * (rate & 0x7f);
1537                         for (j = 0; j < num_rates; j++)
1538                                 if (rates[j].rate == own_rate)
1539                                         supp_rates |= BIT(j);
1540                 }
1541
1542                 prev_rates = sta->supp_rates;
1543                 sta->supp_rates &= supp_rates;
1544                 if (sta->supp_rates == 0) {
1545                         /* No matching rates - this should not really happen.
1546                          * Make sure that at least one rate is marked
1547                          * supported to avoid issues with TX rate ctrl. */
1548                         sta->supp_rates = sdata->u.sta.supp_rates_bits;
1549                 }
1550                 if (sta->supp_rates != prev_rates) {
1551                         printk(KERN_DEBUG "%s: updated supp_rates set for "
1552                                "%s based on beacon info (0x%x & 0x%x -> "
1553                                "0x%x)\n",
1554                                dev->name, print_mac(mac, sta->addr), prev_rates,
1555                                supp_rates, sta->supp_rates);
1556                 }
1557                 sta_info_put(sta);
1558         }
1559
1560         if (!elems.ssid)
1561                 return;
1562
1563         if (elems.ds_params && elems.ds_params_len == 1)
1564                 channel = elems.ds_params[0];
1565         else
1566                 channel = rx_status->channel;
1567
1568         bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel,
1569                                    elems.ssid, elems.ssid_len);
1570         if (!bss) {
1571                 bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel,
1572                                            elems.ssid, elems.ssid_len);
1573                 if (!bss)
1574                         return;
1575         } else {
1576 #if 0
1577                 /* TODO: order by RSSI? */
1578                 spin_lock_bh(&local->sta_bss_lock);
1579                 list_move_tail(&bss->list, &local->sta_bss_list);
1580                 spin_unlock_bh(&local->sta_bss_lock);
1581 #endif
1582         }
1583
1584         if (bss->probe_resp && beacon) {
1585                 /* Do not allow beacon to override data from Probe Response. */
1586                 ieee80211_rx_bss_put(dev, bss);
1587                 return;
1588         }
1589
1590         /* save the ERP value so that it is available at association time */
1591         if (elems.erp_info && elems.erp_info_len >= 1) {
1592                 bss->erp_value = elems.erp_info[0];
1593                 bss->has_erp_value = 1;
1594         }
1595
1596         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
1597         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
1598
1599         bss->supp_rates_len = 0;
1600         if (elems.supp_rates) {
1601                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1602                 if (clen > elems.supp_rates_len)
1603                         clen = elems.supp_rates_len;
1604                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
1605                        clen);
1606                 bss->supp_rates_len += clen;
1607         }
1608         if (elems.ext_supp_rates) {
1609                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1610                 if (clen > elems.ext_supp_rates_len)
1611                         clen = elems.ext_supp_rates_len;
1612                 memcpy(&bss->supp_rates[bss->supp_rates_len],
1613                        elems.ext_supp_rates, clen);
1614                 bss->supp_rates_len += clen;
1615         }
1616
1617         if (elems.wpa &&
1618             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
1619              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1620                 kfree(bss->wpa_ie);
1621                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
1622                 if (bss->wpa_ie) {
1623                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
1624                         bss->wpa_ie_len = elems.wpa_len + 2;
1625                 } else
1626                         bss->wpa_ie_len = 0;
1627         } else if (!elems.wpa && bss->wpa_ie) {
1628                 kfree(bss->wpa_ie);
1629                 bss->wpa_ie = NULL;
1630                 bss->wpa_ie_len = 0;
1631         }
1632
1633         if (elems.rsn &&
1634             (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
1635              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1636                 kfree(bss->rsn_ie);
1637                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
1638                 if (bss->rsn_ie) {
1639                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
1640                         bss->rsn_ie_len = elems.rsn_len + 2;
1641                 } else
1642                         bss->rsn_ie_len = 0;
1643         } else if (!elems.rsn && bss->rsn_ie) {
1644                 kfree(bss->rsn_ie);
1645                 bss->rsn_ie = NULL;
1646                 bss->rsn_ie_len = 0;
1647         }
1648
1649         if (elems.wmm_param &&
1650             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
1651              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1652                 kfree(bss->wmm_ie);
1653                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
1654                 if (bss->wmm_ie) {
1655                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
1656                                elems.wmm_param_len + 2);
1657                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1658                 } else
1659                         bss->wmm_ie_len = 0;
1660         } else if (!elems.wmm_param && bss->wmm_ie) {
1661                 kfree(bss->wmm_ie);
1662                 bss->wmm_ie = NULL;
1663                 bss->wmm_ie_len = 0;
1664         }
1665
1666
1667         bss->hw_mode = rx_status->phymode;
1668         bss->freq = rx_status->freq;
1669         if (channel != rx_status->channel &&
1670             (bss->hw_mode == MODE_IEEE80211G ||
1671              bss->hw_mode == MODE_IEEE80211B) &&
1672             channel >= 1 && channel <= 14) {
1673                 static const int freq_list[] = {
1674                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1675                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1676                 };
1677                 /* IEEE 802.11g/b mode can receive packets from neighboring
1678                  * channels, so map the channel into frequency. */
1679                 bss->freq = freq_list[channel - 1];
1680         }
1681         bss->timestamp = timestamp;
1682         bss->last_update = jiffies;
1683         bss->rssi = rx_status->ssi;
1684         bss->signal = rx_status->signal;
1685         bss->noise = rx_status->noise;
1686         if (!beacon)
1687                 bss->probe_resp++;
1688         ieee80211_rx_bss_put(dev, bss);
1689 }
1690
1691
1692 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
1693                                          struct ieee80211_mgmt *mgmt,
1694                                          size_t len,
1695                                          struct ieee80211_rx_status *rx_status)
1696 {
1697         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
1698 }
1699
1700
1701 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
1702                                      struct ieee80211_mgmt *mgmt,
1703                                      size_t len,
1704                                      struct ieee80211_rx_status *rx_status)
1705 {
1706         struct ieee80211_sub_if_data *sdata;
1707         struct ieee80211_if_sta *ifsta;
1708         size_t baselen;
1709         struct ieee802_11_elems elems;
1710
1711         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
1712
1713         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1714         if (sdata->type != IEEE80211_IF_TYPE_STA)
1715                 return;
1716         ifsta = &sdata->u.sta;
1717
1718         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
1719             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1720                 return;
1721
1722         /* Process beacon from the current BSS */
1723         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1724         if (baselen > len)
1725                 return;
1726
1727         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1728                                    &elems) == ParseFailed)
1729                 return;
1730
1731         if (elems.erp_info && elems.erp_info_len >= 1)
1732                 ieee80211_handle_erp_ie(dev, elems.erp_info[0]);
1733
1734         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1735                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1736                                          elems.wmm_param_len);
1737         }
1738 }
1739
1740
1741 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
1742                                         struct ieee80211_if_sta *ifsta,
1743                                         struct ieee80211_mgmt *mgmt,
1744                                         size_t len,
1745                                         struct ieee80211_rx_status *rx_status)
1746 {
1747         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1748         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1749         int tx_last_beacon;
1750         struct sk_buff *skb;
1751         struct ieee80211_mgmt *resp;
1752         u8 *pos, *end;
1753         DECLARE_MAC_BUF(mac);
1754 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1755         DECLARE_MAC_BUF(mac2);
1756         DECLARE_MAC_BUF(mac3);
1757 #endif
1758
1759         if (sdata->type != IEEE80211_IF_TYPE_IBSS ||
1760             ifsta->state != IEEE80211_IBSS_JOINED ||
1761             len < 24 + 2 || !ifsta->probe_resp)
1762                 return;
1763
1764         if (local->ops->tx_last_beacon)
1765                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
1766         else
1767                 tx_last_beacon = 1;
1768
1769 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1770         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
1771                "%s (tx_last_beacon=%d)\n",
1772                dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
1773                print_mac(mac3, mgmt->bssid), tx_last_beacon);
1774 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1775
1776         if (!tx_last_beacon)
1777                 return;
1778
1779         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
1780             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1781                 return;
1782
1783         end = ((u8 *) mgmt) + len;
1784         pos = mgmt->u.probe_req.variable;
1785         if (pos[0] != WLAN_EID_SSID ||
1786             pos + 2 + pos[1] > end) {
1787                 if (net_ratelimit()) {
1788                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
1789                                "from %s\n",
1790                                dev->name, print_mac(mac, mgmt->sa));
1791                 }
1792                 return;
1793         }
1794         if (pos[1] != 0 &&
1795             (pos[1] != ifsta->ssid_len ||
1796              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
1797                 /* Ignore ProbeReq for foreign SSID */
1798                 return;
1799         }
1800
1801         /* Reply with ProbeResp */
1802         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
1803         if (!skb)
1804                 return;
1805
1806         resp = (struct ieee80211_mgmt *) skb->data;
1807         memcpy(resp->da, mgmt->sa, ETH_ALEN);
1808 #ifdef CONFIG_MAC80211_IBSS_DEBUG
1809         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
1810                dev->name, print_mac(mac, resp->da));
1811 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
1812         ieee80211_sta_tx(dev, skb, 0);
1813 }
1814
1815
1816 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
1817                            struct ieee80211_rx_status *rx_status)
1818 {
1819         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1820         struct ieee80211_sub_if_data *sdata;
1821         struct ieee80211_if_sta *ifsta;
1822         struct ieee80211_mgmt *mgmt;
1823         u16 fc;
1824
1825         if (skb->len < 24)
1826                 goto fail;
1827
1828         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1829         ifsta = &sdata->u.sta;
1830
1831         mgmt = (struct ieee80211_mgmt *) skb->data;
1832         fc = le16_to_cpu(mgmt->frame_control);
1833
1834         switch (fc & IEEE80211_FCTL_STYPE) {
1835         case IEEE80211_STYPE_PROBE_REQ:
1836         case IEEE80211_STYPE_PROBE_RESP:
1837         case IEEE80211_STYPE_BEACON:
1838                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
1839         case IEEE80211_STYPE_AUTH:
1840         case IEEE80211_STYPE_ASSOC_RESP:
1841         case IEEE80211_STYPE_REASSOC_RESP:
1842         case IEEE80211_STYPE_DEAUTH:
1843         case IEEE80211_STYPE_DISASSOC:
1844                 skb_queue_tail(&ifsta->skb_queue, skb);
1845                 queue_work(local->hw.workqueue, &ifsta->work);
1846                 return;
1847         default:
1848                 printk(KERN_DEBUG "%s: received unknown management frame - "
1849                        "stype=%d\n", dev->name,
1850                        (fc & IEEE80211_FCTL_STYPE) >> 4);
1851                 break;
1852         }
1853
1854  fail:
1855         kfree_skb(skb);
1856 }
1857
1858
1859 static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
1860                                          struct sk_buff *skb)
1861 {
1862         struct ieee80211_rx_status *rx_status;
1863         struct ieee80211_sub_if_data *sdata;
1864         struct ieee80211_if_sta *ifsta;
1865         struct ieee80211_mgmt *mgmt;
1866         u16 fc;
1867
1868         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1869         ifsta = &sdata->u.sta;
1870
1871         rx_status = (struct ieee80211_rx_status *) skb->cb;
1872         mgmt = (struct ieee80211_mgmt *) skb->data;
1873         fc = le16_to_cpu(mgmt->frame_control);
1874
1875         switch (fc & IEEE80211_FCTL_STYPE) {
1876         case IEEE80211_STYPE_PROBE_REQ:
1877                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
1878                                             rx_status);
1879                 break;
1880         case IEEE80211_STYPE_PROBE_RESP:
1881                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
1882                 break;
1883         case IEEE80211_STYPE_BEACON:
1884                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
1885                 break;
1886         case IEEE80211_STYPE_AUTH:
1887                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
1888                 break;
1889         case IEEE80211_STYPE_ASSOC_RESP:
1890                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 0);
1891                 break;
1892         case IEEE80211_STYPE_REASSOC_RESP:
1893                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len, 1);
1894                 break;
1895         case IEEE80211_STYPE_DEAUTH:
1896                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
1897                 break;
1898         case IEEE80211_STYPE_DISASSOC:
1899                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
1900                 break;
1901         }
1902
1903         kfree_skb(skb);
1904 }
1905
1906
1907 void ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
1908                            struct ieee80211_rx_status *rx_status)
1909 {
1910         struct ieee80211_mgmt *mgmt;
1911         u16 fc;
1912
1913         if (skb->len < 24) {
1914                 dev_kfree_skb(skb);
1915                 return;
1916         }
1917
1918         mgmt = (struct ieee80211_mgmt *) skb->data;
1919         fc = le16_to_cpu(mgmt->frame_control);
1920
1921         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1922                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
1923                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
1924                                                      skb->len, rx_status);
1925                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
1926                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
1927                                                  rx_status);
1928                 }
1929         }
1930
1931         dev_kfree_skb(skb);
1932 }
1933
1934
1935 static int ieee80211_sta_active_ibss(struct net_device *dev)
1936 {
1937         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1938         int active = 0;
1939         struct sta_info *sta;
1940
1941         read_lock_bh(&local->sta_lock);
1942         list_for_each_entry(sta, &local->sta_list, list) {
1943                 if (sta->dev == dev &&
1944                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1945                                jiffies)) {
1946                         active++;
1947                         break;
1948                 }
1949         }
1950         read_unlock_bh(&local->sta_lock);
1951
1952         return active;
1953 }
1954
1955
1956 static void ieee80211_sta_expire(struct net_device *dev)
1957 {
1958         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1959         struct sta_info *sta, *tmp;
1960         LIST_HEAD(tmp_list);
1961         DECLARE_MAC_BUF(mac);
1962
1963         write_lock_bh(&local->sta_lock);
1964         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
1965                 if (time_after(jiffies, sta->last_rx +
1966                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1967                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
1968                                dev->name, print_mac(mac, sta->addr));
1969                         __sta_info_get(sta);
1970                         sta_info_remove(sta);
1971                         list_add(&sta->list, &tmp_list);
1972                 }
1973         write_unlock_bh(&local->sta_lock);
1974
1975         list_for_each_entry_safe(sta, tmp, &tmp_list, list) {
1976                 sta_info_free(sta);
1977                 sta_info_put(sta);
1978         }
1979 }
1980
1981
1982 static void ieee80211_sta_merge_ibss(struct net_device *dev,
1983                                      struct ieee80211_if_sta *ifsta)
1984 {
1985         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
1986
1987         ieee80211_sta_expire(dev);
1988         if (ieee80211_sta_active_ibss(dev))
1989                 return;
1990
1991         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
1992                "IBSS networks with same SSID (merge)\n", dev->name);
1993         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
1994 }
1995
1996
1997 void ieee80211_sta_timer(unsigned long data)
1998 {
1999         struct ieee80211_sub_if_data *sdata =
2000                 (struct ieee80211_sub_if_data *) data;
2001         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2002         struct ieee80211_local *local = wdev_priv(&sdata->wdev);
2003
2004         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2005         queue_work(local->hw.workqueue, &ifsta->work);
2006 }
2007
2008
2009 void ieee80211_sta_work(struct work_struct *work)
2010 {
2011         struct ieee80211_sub_if_data *sdata =
2012                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
2013         struct net_device *dev = sdata->dev;
2014         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2015         struct ieee80211_if_sta *ifsta;
2016         struct sk_buff *skb;
2017
2018         if (!netif_running(dev))
2019                 return;
2020
2021         if (local->sta_scanning)
2022                 return;
2023
2024         if (sdata->type != IEEE80211_IF_TYPE_STA &&
2025             sdata->type != IEEE80211_IF_TYPE_IBSS) {
2026                 printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
2027                        "(type=%d)\n", dev->name, sdata->type);
2028                 return;
2029         }
2030         ifsta = &sdata->u.sta;
2031
2032         while ((skb = skb_dequeue(&ifsta->skb_queue)))
2033                 ieee80211_sta_rx_queued_mgmt(dev, skb);
2034
2035         if (ifsta->state != IEEE80211_AUTHENTICATE &&
2036             ifsta->state != IEEE80211_ASSOCIATE &&
2037             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
2038                 ieee80211_sta_start_scan(dev, NULL, 0);
2039                 return;
2040         }
2041
2042         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
2043                 if (ieee80211_sta_config_auth(dev, ifsta))
2044                         return;
2045                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2046         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
2047                 return;
2048
2049         switch (ifsta->state) {
2050         case IEEE80211_DISABLED:
2051                 break;
2052         case IEEE80211_AUTHENTICATE:
2053                 ieee80211_authenticate(dev, ifsta);
2054                 break;
2055         case IEEE80211_ASSOCIATE:
2056                 ieee80211_associate(dev, ifsta);
2057                 break;
2058         case IEEE80211_ASSOCIATED:
2059                 ieee80211_associated(dev, ifsta);
2060                 break;
2061         case IEEE80211_IBSS_SEARCH:
2062                 ieee80211_sta_find_ibss(dev, ifsta);
2063                 break;
2064         case IEEE80211_IBSS_JOINED:
2065                 ieee80211_sta_merge_ibss(dev, ifsta);
2066                 break;
2067         default:
2068                 printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
2069                        ifsta->state);
2070                 break;
2071         }
2072
2073         if (ieee80211_privacy_mismatch(dev, ifsta)) {
2074                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
2075                        "mixed-cell disabled - disassociate\n", dev->name);
2076
2077                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
2078                 ieee80211_set_disassoc(dev, ifsta, 0);
2079         }
2080 }
2081
2082
2083 static void ieee80211_sta_reset_auth(struct net_device *dev,
2084                                      struct ieee80211_if_sta *ifsta)
2085 {
2086         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2087
2088         if (local->ops->reset_tsf) {
2089                 /* Reset own TSF to allow time synchronization work. */
2090                 local->ops->reset_tsf(local_to_hw(local));
2091         }
2092
2093         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
2094
2095
2096         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
2097                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2098         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2099                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
2100         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
2101                 ifsta->auth_alg = WLAN_AUTH_LEAP;
2102         else
2103                 ifsta->auth_alg = WLAN_AUTH_OPEN;
2104         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
2105                ifsta->auth_alg);
2106         ifsta->auth_transaction = -1;
2107         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
2108         ifsta->auth_tries = ifsta->assoc_tries = 0;
2109         netif_carrier_off(dev);
2110 }
2111
2112
2113 void ieee80211_sta_req_auth(struct net_device *dev,
2114                             struct ieee80211_if_sta *ifsta)
2115 {
2116         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2117         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2118
2119         if (sdata->type != IEEE80211_IF_TYPE_STA)
2120                 return;
2121
2122         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
2123                                 IEEE80211_STA_AUTO_BSSID_SEL)) &&
2124             (ifsta->flags & (IEEE80211_STA_SSID_SET |
2125                                 IEEE80211_STA_AUTO_SSID_SEL))) {
2126                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2127                 queue_work(local->hw.workqueue, &ifsta->work);
2128         }
2129 }
2130
2131 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
2132                                     const char *ssid, int ssid_len)
2133 {
2134         int tmp, hidden_ssid;
2135
2136         if (!memcmp(ifsta->ssid, ssid, ssid_len))
2137                 return 1;
2138
2139         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
2140                 return 0;
2141
2142         hidden_ssid = 1;
2143         tmp = ssid_len;
2144         while (tmp--) {
2145                 if (ssid[tmp] != '\0') {
2146                         hidden_ssid = 0;
2147                         break;
2148                 }
2149         }
2150
2151         if (hidden_ssid && ifsta->ssid_len == ssid_len)
2152                 return 1;
2153
2154         if (ssid_len == 1 && ssid[0] == ' ')
2155                 return 1;
2156
2157         return 0;
2158 }
2159
2160 static int ieee80211_sta_config_auth(struct net_device *dev,
2161                                      struct ieee80211_if_sta *ifsta)
2162 {
2163         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2164         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2165         struct ieee80211_sta_bss *bss, *selected = NULL;
2166         int top_rssi = 0, freq;
2167
2168         if (!(ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
2169             IEEE80211_STA_AUTO_BSSID_SEL | IEEE80211_STA_AUTO_CHANNEL_SEL))) {
2170                 ifsta->state = IEEE80211_AUTHENTICATE;
2171                 ieee80211_sta_reset_auth(dev, ifsta);
2172                 return 0;
2173         }
2174
2175         spin_lock_bh(&local->sta_bss_lock);
2176         freq = local->oper_channel->freq;
2177         list_for_each_entry(bss, &local->sta_bss_list, list) {
2178                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
2179                         continue;
2180
2181                 if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
2182                     !!sdata->default_key)
2183                         continue;
2184
2185                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
2186                     bss->freq != freq)
2187                         continue;
2188
2189                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
2190                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
2191                         continue;
2192
2193                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
2194                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
2195                         continue;
2196
2197                 if (!selected || top_rssi < bss->rssi) {
2198                         selected = bss;
2199                         top_rssi = bss->rssi;
2200                 }
2201         }
2202         if (selected)
2203                 atomic_inc(&selected->users);
2204         spin_unlock_bh(&local->sta_bss_lock);
2205
2206         if (selected) {
2207                 ieee80211_set_channel(local, -1, selected->freq);
2208                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
2209                         ieee80211_sta_set_ssid(dev, selected->ssid,
2210                                                selected->ssid_len);
2211                 ieee80211_sta_set_bssid(dev, selected->bssid);
2212                 ieee80211_rx_bss_put(dev, selected);
2213                 ifsta->state = IEEE80211_AUTHENTICATE;
2214                 ieee80211_sta_reset_auth(dev, ifsta);
2215                 return 0;
2216         } else {
2217                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
2218                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
2219                                 ieee80211_sta_start_scan(dev, NULL, 0);
2220                         else
2221                                 ieee80211_sta_start_scan(dev, ifsta->ssid,
2222                                                          ifsta->ssid_len);
2223                         ifsta->state = IEEE80211_AUTHENTICATE;
2224                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
2225                 } else
2226                         ifsta->state = IEEE80211_DISABLED;
2227         }
2228         return -1;
2229 }
2230
2231 static int ieee80211_sta_join_ibss(struct net_device *dev,
2232                                    struct ieee80211_if_sta *ifsta,
2233                                    struct ieee80211_sta_bss *bss)
2234 {
2235         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2236         int res, rates, i, j;
2237         struct sk_buff *skb;
2238         struct ieee80211_mgmt *mgmt;
2239         struct ieee80211_tx_control control;
2240         struct ieee80211_rate *rate;
2241         struct ieee80211_hw_mode *mode;
2242         struct rate_control_extra extra;
2243         u8 *pos;
2244         struct ieee80211_sub_if_data *sdata;
2245
2246         /* Remove possible STA entries from other IBSS networks. */
2247         sta_info_flush(local, NULL);
2248
2249         if (local->ops->reset_tsf) {
2250                 /* Reset own TSF to allow time synchronization work. */
2251                 local->ops->reset_tsf(local_to_hw(local));
2252         }
2253         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2254         res = ieee80211_if_config(dev);
2255         if (res)
2256                 return res;
2257
2258         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2259
2260         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2261         sdata->drop_unencrypted = bss->capability &
2262                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2263
2264         res = ieee80211_set_channel(local, -1, bss->freq);
2265
2266         if (!(local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)) {
2267                 printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
2268                        "(%d MHz)\n", dev->name, local->hw.conf.channel,
2269                        local->hw.conf.freq);
2270                 return -1;
2271         }
2272
2273         /* Set beacon template based on scan results */
2274         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2275         do {
2276                 if (!skb)
2277                         break;
2278
2279                 skb_reserve(skb, local->hw.extra_tx_headroom);
2280
2281                 mgmt = (struct ieee80211_mgmt *)
2282                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2283                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2284                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2285                                                    IEEE80211_STYPE_BEACON);
2286                 memset(mgmt->da, 0xff, ETH_ALEN);
2287                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2288                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2289                 mgmt->u.beacon.beacon_int =
2290                         cpu_to_le16(local->hw.conf.beacon_int);
2291                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2292
2293                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2294                 *pos++ = WLAN_EID_SSID;
2295                 *pos++ = ifsta->ssid_len;
2296                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2297
2298                 rates = bss->supp_rates_len;
2299                 if (rates > 8)
2300                         rates = 8;
2301                 pos = skb_put(skb, 2 + rates);
2302                 *pos++ = WLAN_EID_SUPP_RATES;
2303                 *pos++ = rates;
2304                 memcpy(pos, bss->supp_rates, rates);
2305
2306                 pos = skb_put(skb, 2 + 1);
2307                 *pos++ = WLAN_EID_DS_PARAMS;
2308                 *pos++ = 1;
2309                 *pos++ = bss->channel;
2310
2311                 pos = skb_put(skb, 2 + 2);
2312                 *pos++ = WLAN_EID_IBSS_PARAMS;
2313                 *pos++ = 2;
2314                 /* FIX: set ATIM window based on scan results */
2315                 *pos++ = 0;
2316                 *pos++ = 0;
2317
2318                 if (bss->supp_rates_len > 8) {
2319                         rates = bss->supp_rates_len - 8;
2320                         pos = skb_put(skb, 2 + rates);
2321                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2322                         *pos++ = rates;
2323                         memcpy(pos, &bss->supp_rates[8], rates);
2324                 }
2325
2326                 memset(&control, 0, sizeof(control));
2327                 memset(&extra, 0, sizeof(extra));
2328                 extra.mode = local->oper_hw_mode;
2329                 rate = rate_control_get_rate(local, dev, skb, &extra);
2330                 if (!rate) {
2331                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2332                                "for IBSS beacon\n", dev->name);
2333                         break;
2334                 }
2335                 control.tx_rate =
2336                         ((sdata->flags & IEEE80211_SDATA_SHORT_PREAMBLE) &&
2337                         (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2338                         rate->val2 : rate->val;
2339                 control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
2340                 control.power_level = local->hw.conf.power_level;
2341                 control.flags |= IEEE80211_TXCTL_NO_ACK;
2342                 control.retry_limit = 1;
2343
2344                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2345                 if (ifsta->probe_resp) {
2346                         mgmt = (struct ieee80211_mgmt *)
2347                                 ifsta->probe_resp->data;
2348                         mgmt->frame_control =
2349                                 IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2350                                              IEEE80211_STYPE_PROBE_RESP);
2351                 } else {
2352                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2353                                "template for IBSS\n", dev->name);
2354                 }
2355
2356                 if (local->ops->beacon_update &&
2357                     local->ops->beacon_update(local_to_hw(local),
2358                                              skb, &control) == 0) {
2359                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2360                                "template based on scan results\n", dev->name);
2361                         skb = NULL;
2362                 }
2363
2364                 rates = 0;
2365                 mode = local->oper_hw_mode;
2366                 for (i = 0; i < bss->supp_rates_len; i++) {
2367                         int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2368                         for (j = 0; j < mode->num_rates; j++)
2369                                 if (mode->rates[j].rate == bitrate)
2370                                         rates |= BIT(j);
2371                 }
2372                 ifsta->supp_rates_bits = rates;
2373         } while (0);
2374
2375         if (skb) {
2376                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2377                        "template\n", dev->name);
2378                 dev_kfree_skb(skb);
2379         }
2380
2381         ifsta->state = IEEE80211_IBSS_JOINED;
2382         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2383
2384         ieee80211_rx_bss_put(dev, bss);
2385
2386         return res;
2387 }
2388
2389
2390 static int ieee80211_sta_create_ibss(struct net_device *dev,
2391                                      struct ieee80211_if_sta *ifsta)
2392 {
2393         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2394         struct ieee80211_sta_bss *bss;
2395         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2396         struct ieee80211_hw_mode *mode;
2397         u8 bssid[ETH_ALEN], *pos;
2398         int i;
2399         DECLARE_MAC_BUF(mac);
2400
2401 #if 0
2402         /* Easier testing, use fixed BSSID. */
2403         memset(bssid, 0xfe, ETH_ALEN);
2404 #else
2405         /* Generate random, not broadcast, locally administered BSSID. Mix in
2406          * own MAC address to make sure that devices that do not have proper
2407          * random number generator get different BSSID. */
2408         get_random_bytes(bssid, ETH_ALEN);
2409         for (i = 0; i < ETH_ALEN; i++)
2410                 bssid[i] ^= dev->dev_addr[i];
2411         bssid[0] &= ~0x01;
2412         bssid[0] |= 0x02;
2413 #endif
2414
2415         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
2416                dev->name, print_mac(mac, bssid));
2417
2418         bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel,
2419                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
2420         if (!bss)
2421                 return -ENOMEM;
2422
2423         mode = local->oper_hw_mode;
2424
2425         if (local->hw.conf.beacon_int == 0)
2426                 local->hw.conf.beacon_int = 100;
2427         bss->beacon_int = local->hw.conf.beacon_int;
2428         bss->hw_mode = local->hw.conf.phymode;
2429         bss->freq = local->hw.conf.freq;
2430         bss->last_update = jiffies;
2431         bss->capability = WLAN_CAPABILITY_IBSS;
2432         if (sdata->default_key) {
2433                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
2434         } else
2435                 sdata->drop_unencrypted = 0;
2436         bss->supp_rates_len = mode->num_rates;
2437         pos = bss->supp_rates;
2438         for (i = 0; i < mode->num_rates; i++) {
2439                 int rate = mode->rates[i].rate;
2440                 *pos++ = (u8) (rate / 5);
2441         }
2442
2443         return ieee80211_sta_join_ibss(dev, ifsta, bss);
2444 }
2445
2446
2447 static int ieee80211_sta_find_ibss(struct net_device *dev,
2448                                    struct ieee80211_if_sta *ifsta)
2449 {
2450         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2451         struct ieee80211_sta_bss *bss;
2452         int found = 0;
2453         u8 bssid[ETH_ALEN];
2454         int active_ibss;
2455         DECLARE_MAC_BUF(mac);
2456         DECLARE_MAC_BUF(mac2);
2457
2458         if (ifsta->ssid_len == 0)
2459                 return -EINVAL;
2460
2461         active_ibss = ieee80211_sta_active_ibss(dev);
2462 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2463         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2464                dev->name, active_ibss);
2465 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2466         spin_lock_bh(&local->sta_bss_lock);
2467         list_for_each_entry(bss, &local->sta_bss_list, list) {
2468                 if (ifsta->ssid_len != bss->ssid_len ||
2469                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2470                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2471                         continue;
2472 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2473                 printk(KERN_DEBUG "   bssid=%s found\n",
2474                        print_mac(mac, bss->bssid));
2475 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2476                 memcpy(bssid, bss->bssid, ETH_ALEN);
2477                 found = 1;
2478                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2479                         break;
2480         }
2481         spin_unlock_bh(&local->sta_bss_lock);
2482
2483 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2484         printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
2485                "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
2486 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2487         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
2488             (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel,
2489                                         ifsta->ssid, ifsta->ssid_len))) {
2490                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
2491                        " based on configured SSID\n",
2492                        dev->name, print_mac(mac, bssid));
2493                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
2494         }
2495 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2496         printk(KERN_DEBUG "   did not try to join ibss\n");
2497 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2498
2499         /* Selected IBSS not found in current scan results - try to scan */
2500         if (ifsta->state == IEEE80211_IBSS_JOINED &&
2501             !ieee80211_sta_active_ibss(dev)) {
2502                 mod_timer(&ifsta->timer, jiffies +
2503                                       IEEE80211_IBSS_MERGE_INTERVAL);
2504         } else if (time_after(jiffies, local->last_scan_completed +
2505                               IEEE80211_SCAN_INTERVAL)) {
2506                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
2507                        "join\n", dev->name);
2508                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
2509                                               ifsta->ssid_len);
2510         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
2511                 int interval = IEEE80211_SCAN_INTERVAL;
2512
2513                 if (time_after(jiffies, ifsta->ibss_join_req +
2514                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2515                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
2516                             local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)
2517                                 return ieee80211_sta_create_ibss(dev, ifsta);
2518                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
2519                                 printk(KERN_DEBUG "%s: IBSS not allowed on the"
2520                                        " configured channel %d (%d MHz)\n",
2521                                        dev->name, local->hw.conf.channel,
2522                                        local->hw.conf.freq);
2523                         }
2524
2525                         /* No IBSS found - decrease scan interval and continue
2526                          * scanning. */
2527                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2528                 }
2529
2530                 ifsta->state = IEEE80211_IBSS_SEARCH;
2531                 mod_timer(&ifsta->timer, jiffies + interval);
2532                 return 0;
2533         }
2534
2535         return 0;
2536 }
2537
2538
2539 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
2540 {
2541         struct ieee80211_sub_if_data *sdata;
2542         struct ieee80211_if_sta *ifsta;
2543         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2544
2545         if (len > IEEE80211_MAX_SSID_LEN)
2546                 return -EINVAL;
2547
2548         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2549          * not defined. */
2550         if (local->ops->conf_tx) {
2551                 struct ieee80211_tx_queue_params qparam;
2552                 int i;
2553
2554                 memset(&qparam, 0, sizeof(qparam));
2555                 /* TODO: are these ok defaults for all hw_modes? */
2556                 qparam.aifs = 2;
2557                 qparam.cw_min =
2558                         local->hw.conf.phymode == MODE_IEEE80211B ? 31 : 15;
2559                 qparam.cw_max = 1023;
2560                 qparam.burst_time = 0;
2561                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2562                 {
2563                         local->ops->conf_tx(local_to_hw(local),
2564                                            i + IEEE80211_TX_QUEUE_DATA0,
2565                                            &qparam);
2566                 }
2567                 /* IBSS uses different parameters for Beacon sending */
2568                 qparam.cw_min++;
2569                 qparam.cw_min *= 2;
2570                 qparam.cw_min--;
2571                 local->ops->conf_tx(local_to_hw(local),
2572                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
2573         }
2574
2575         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2576         ifsta = &sdata->u.sta;
2577
2578         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
2579                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
2580         memcpy(ifsta->ssid, ssid, len);
2581         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
2582         ifsta->ssid_len = len;
2583
2584         if (len)
2585                 ifsta->flags |= IEEE80211_STA_SSID_SET;
2586         else
2587                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
2588         if (sdata->type == IEEE80211_IF_TYPE_IBSS &&
2589             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
2590                 ifsta->ibss_join_req = jiffies;
2591                 ifsta->state = IEEE80211_IBSS_SEARCH;
2592                 return ieee80211_sta_find_ibss(dev, ifsta);
2593         }
2594         return 0;
2595 }
2596
2597
2598 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
2599 {
2600         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2601         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2602         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
2603         *len = ifsta->ssid_len;
2604         return 0;
2605 }
2606
2607
2608 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
2609 {
2610         struct ieee80211_sub_if_data *sdata;
2611         struct ieee80211_if_sta *ifsta;
2612         int res;
2613
2614         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2615         ifsta = &sdata->u.sta;
2616
2617         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
2618                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
2619                 res = ieee80211_if_config(dev);
2620                 if (res) {
2621                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
2622                                "the low-level driver\n", dev->name);
2623                         return res;
2624                 }
2625         }
2626
2627         if (is_valid_ether_addr(bssid))
2628                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
2629         else
2630                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
2631
2632         return 0;
2633 }
2634
2635
2636 static void ieee80211_send_nullfunc(struct ieee80211_local *local,
2637                                     struct ieee80211_sub_if_data *sdata,
2638                                     int powersave)
2639 {
2640         struct sk_buff *skb;
2641         struct ieee80211_hdr *nullfunc;
2642         u16 fc;
2643
2644         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
2645         if (!skb) {
2646                 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
2647                        "frame\n", sdata->dev->name);
2648                 return;
2649         }
2650         skb_reserve(skb, local->hw.extra_tx_headroom);
2651
2652         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
2653         memset(nullfunc, 0, 24);
2654         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
2655              IEEE80211_FCTL_TODS;
2656         if (powersave)
2657                 fc |= IEEE80211_FCTL_PM;
2658         nullfunc->frame_control = cpu_to_le16(fc);
2659         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
2660         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
2661         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
2662
2663         ieee80211_sta_tx(sdata->dev, skb, 0);
2664 }
2665
2666
2667 void ieee80211_scan_completed(struct ieee80211_hw *hw)
2668 {
2669         struct ieee80211_local *local = hw_to_local(hw);
2670         struct net_device *dev = local->scan_dev;
2671         struct ieee80211_sub_if_data *sdata;
2672         union iwreq_data wrqu;
2673
2674         local->last_scan_completed = jiffies;
2675         wmb();
2676         local->sta_scanning = 0;
2677
2678         if (ieee80211_hw_config(local))
2679                 printk(KERN_DEBUG "%s: failed to restore operational"
2680                        "channel after scan\n", dev->name);
2681
2682
2683         netif_tx_lock_bh(local->mdev);
2684         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
2685         local->ops->configure_filter(local_to_hw(local),
2686                                      FIF_BCN_PRBRESP_PROMISC,
2687                                      &local->filter_flags,
2688                                      local->mdev->mc_count,
2689                                      local->mdev->mc_list);
2690
2691         netif_tx_unlock_bh(local->mdev);
2692
2693         memset(&wrqu, 0, sizeof(wrqu));
2694         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2695
2696         rcu_read_lock();
2697         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2698
2699                 /* No need to wake the master device. */
2700                 if (sdata->dev == local->mdev)
2701                         continue;
2702
2703                 if (sdata->type == IEEE80211_IF_TYPE_STA) {
2704                         if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
2705                                 ieee80211_send_nullfunc(local, sdata, 0);
2706                         ieee80211_sta_timer((unsigned long)sdata);
2707                 }
2708
2709                 netif_wake_queue(sdata->dev);
2710         }
2711         rcu_read_unlock();
2712
2713         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2714         if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
2715                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2716                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
2717                     (!ifsta->state == IEEE80211_IBSS_JOINED &&
2718                     !ieee80211_sta_active_ibss(dev)))
2719                         ieee80211_sta_find_ibss(dev, ifsta);
2720         }
2721 }
2722 EXPORT_SYMBOL(ieee80211_scan_completed);
2723
2724 void ieee80211_sta_scan_work(struct work_struct *work)
2725 {
2726         struct ieee80211_local *local =
2727                 container_of(work, struct ieee80211_local, scan_work.work);
2728         struct net_device *dev = local->scan_dev;
2729         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2730         struct ieee80211_hw_mode *mode;
2731         struct ieee80211_channel *chan;
2732         int skip;
2733         unsigned long next_delay = 0;
2734
2735         if (!local->sta_scanning)
2736                 return;
2737
2738         switch (local->scan_state) {
2739         case SCAN_SET_CHANNEL:
2740                 mode = local->scan_hw_mode;
2741                 if (local->scan_hw_mode->list.next == &local->modes_list &&
2742                     local->scan_channel_idx >= mode->num_channels) {
2743                         ieee80211_scan_completed(local_to_hw(local));
2744                         return;
2745                 }
2746                 skip = !(local->enabled_modes & (1 << mode->mode));
2747                 chan = &mode->channels[local->scan_channel_idx];
2748                 if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
2749                     (sdata->type == IEEE80211_IF_TYPE_IBSS &&
2750                      !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
2751                     (local->hw_modes & local->enabled_modes &
2752                      (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
2753                         skip = 1;
2754
2755                 if (!skip) {
2756 #if 0
2757                         printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
2758                                dev->name, chan->chan, chan->freq);
2759 #endif
2760
2761                         local->scan_channel = chan;
2762                         if (ieee80211_hw_config(local)) {
2763                                 printk(KERN_DEBUG "%s: failed to set channel "
2764                                        "%d (%d MHz) for scan\n", dev->name,
2765                                        chan->chan, chan->freq);
2766                                 skip = 1;
2767                         }
2768                 }
2769
2770                 local->scan_channel_idx++;
2771                 if (local->scan_channel_idx >= local->scan_hw_mode->num_channels) {
2772                         if (local->scan_hw_mode->list.next != &local->modes_list) {
2773                                 local->scan_hw_mode = list_entry(local->scan_hw_mode->list.next,
2774                                                                  struct ieee80211_hw_mode,
2775                                                                  list);
2776                                 local->scan_channel_idx = 0;
2777                         }
2778                 }
2779
2780                 if (skip)
2781                         break;
2782
2783                 next_delay = IEEE80211_PROBE_DELAY +
2784                              usecs_to_jiffies(local->hw.channel_change_time);
2785                 local->scan_state = SCAN_SEND_PROBE;
2786                 break;
2787         case SCAN_SEND_PROBE:
2788                 if (local->scan_channel->flag & IEEE80211_CHAN_W_ACTIVE_SCAN) {
2789                         ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
2790                                                  local->scan_ssid_len);
2791                         next_delay = IEEE80211_CHANNEL_TIME;
2792                 } else
2793                         next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
2794                 local->scan_state = SCAN_SET_CHANNEL;
2795                 break;
2796         }
2797
2798         if (local->sta_scanning)
2799                 queue_delayed_work(local->hw.workqueue, &local->scan_work,
2800                                    next_delay);
2801 }
2802
2803
2804 static int ieee80211_sta_start_scan(struct net_device *dev,
2805                                     u8 *ssid, size_t ssid_len)
2806 {
2807         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2808         struct ieee80211_sub_if_data *sdata;
2809
2810         if (ssid_len > IEEE80211_MAX_SSID_LEN)
2811                 return -EINVAL;
2812
2813         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2814          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2815          * BSSID: MACAddress
2816          * SSID
2817          * ScanType: ACTIVE, PASSIVE
2818          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2819          *    a Probe frame during active scanning
2820          * ChannelList
2821          * MinChannelTime (>= ProbeDelay), in TU
2822          * MaxChannelTime: (>= MinChannelTime), in TU
2823          */
2824
2825          /* MLME-SCAN.confirm
2826           * BSSDescriptionSet
2827           * ResultCode: SUCCESS, INVALID_PARAMETERS
2828          */
2829
2830         if (local->sta_scanning) {
2831                 if (local->scan_dev == dev)
2832                         return 0;
2833                 return -EBUSY;
2834         }
2835
2836         if (local->ops->hw_scan) {
2837                 int rc = local->ops->hw_scan(local_to_hw(local),
2838                                             ssid, ssid_len);
2839                 if (!rc) {
2840                         local->sta_scanning = 1;
2841                         local->scan_dev = dev;
2842                 }
2843                 return rc;
2844         }
2845
2846         local->sta_scanning = 1;
2847
2848         rcu_read_lock();
2849         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2850
2851                 /* Don't stop the master interface, otherwise we can't transmit
2852                  * probes! */
2853                 if (sdata->dev == local->mdev)
2854                         continue;
2855
2856                 netif_stop_queue(sdata->dev);
2857                 if (sdata->type == IEEE80211_IF_TYPE_STA &&
2858                     (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
2859                         ieee80211_send_nullfunc(local, sdata, 1);
2860         }
2861         rcu_read_unlock();
2862
2863         if (ssid) {
2864                 local->scan_ssid_len = ssid_len;
2865                 memcpy(local->scan_ssid, ssid, ssid_len);
2866         } else
2867                 local->scan_ssid_len = 0;
2868         local->scan_state = SCAN_SET_CHANNEL;
2869         local->scan_hw_mode = list_entry(local->modes_list.next,
2870                                          struct ieee80211_hw_mode,
2871                                          list);
2872         local->scan_channel_idx = 0;
2873         local->scan_dev = dev;
2874
2875         netif_tx_lock_bh(local->mdev);
2876         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
2877         local->ops->configure_filter(local_to_hw(local),
2878                                      FIF_BCN_PRBRESP_PROMISC,
2879                                      &local->filter_flags,
2880                                      local->mdev->mc_count,
2881                                      local->mdev->mc_list);
2882         netif_tx_unlock_bh(local->mdev);
2883
2884         /* TODO: start scan as soon as all nullfunc frames are ACKed */
2885         queue_delayed_work(local->hw.workqueue, &local->scan_work,
2886                            IEEE80211_CHANNEL_TIME);
2887
2888         return 0;
2889 }
2890
2891
2892 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
2893 {
2894         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2895         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2896         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2897
2898         if (sdata->type != IEEE80211_IF_TYPE_STA)
2899                 return ieee80211_sta_start_scan(dev, ssid, ssid_len);
2900
2901         if (local->sta_scanning) {
2902                 if (local->scan_dev == dev)
2903                         return 0;
2904                 return -EBUSY;
2905         }
2906
2907         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
2908         queue_work(local->hw.workqueue, &ifsta->work);
2909         return 0;
2910 }
2911
2912 static char *
2913 ieee80211_sta_scan_result(struct net_device *dev,
2914                           struct ieee80211_sta_bss *bss,
2915                           char *current_ev, char *end_buf)
2916 {
2917         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2918         struct iw_event iwe;
2919
2920         if (time_after(jiffies,
2921                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
2922                 return current_ev;
2923
2924         if (!(local->enabled_modes & (1 << bss->hw_mode)))
2925                 return current_ev;
2926
2927         if (local->scan_flags & IEEE80211_SCAN_WPA_ONLY &&
2928             !bss->wpa_ie && !bss->rsn_ie)
2929                 return current_ev;
2930
2931         if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID &&
2932             (local->scan_ssid_len != bss->ssid_len ||
2933              memcmp(local->scan_ssid, bss->ssid, bss->ssid_len) != 0))
2934                 return current_ev;
2935
2936         memset(&iwe, 0, sizeof(iwe));
2937         iwe.cmd = SIOCGIWAP;
2938         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2939         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
2940         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2941                                           IW_EV_ADDR_LEN);
2942
2943         memset(&iwe, 0, sizeof(iwe));
2944         iwe.cmd = SIOCGIWESSID;
2945         iwe.u.data.length = bss->ssid_len;
2946         iwe.u.data.flags = 1;
2947         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2948                                           bss->ssid);
2949
2950         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
2951                 memset(&iwe, 0, sizeof(iwe));
2952                 iwe.cmd = SIOCGIWMODE;
2953                 if (bss->capability & WLAN_CAPABILITY_ESS)
2954                         iwe.u.mode = IW_MODE_MASTER;
2955                 else
2956                         iwe.u.mode = IW_MODE_ADHOC;
2957                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2958                                                   IW_EV_UINT_LEN);
2959         }
2960
2961         memset(&iwe, 0, sizeof(iwe));
2962         iwe.cmd = SIOCGIWFREQ;
2963         iwe.u.freq.m = bss->channel;
2964         iwe.u.freq.e = 0;
2965         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2966                                           IW_EV_FREQ_LEN);
2967         iwe.u.freq.m = bss->freq * 100000;
2968         iwe.u.freq.e = 1;
2969         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2970                                           IW_EV_FREQ_LEN);
2971
2972         memset(&iwe, 0, sizeof(iwe));
2973         iwe.cmd = IWEVQUAL;
2974         iwe.u.qual.qual = bss->signal;
2975         iwe.u.qual.level = bss->rssi;
2976         iwe.u.qual.noise = bss->noise;
2977         iwe.u.qual.updated = local->wstats_flags;
2978         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2979                                           IW_EV_QUAL_LEN);
2980
2981         memset(&iwe, 0, sizeof(iwe));
2982         iwe.cmd = SIOCGIWENCODE;
2983         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
2984                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2985         else
2986                 iwe.u.data.flags = IW_ENCODE_DISABLED;
2987         iwe.u.data.length = 0;
2988         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
2989
2990         if (bss && bss->wpa_ie) {
2991                 memset(&iwe, 0, sizeof(iwe));
2992                 iwe.cmd = IWEVGENIE;
2993                 iwe.u.data.length = bss->wpa_ie_len;
2994                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2995                                                   bss->wpa_ie);
2996         }
2997
2998         if (bss && bss->rsn_ie) {
2999                 memset(&iwe, 0, sizeof(iwe));
3000                 iwe.cmd = IWEVGENIE;
3001                 iwe.u.data.length = bss->rsn_ie_len;
3002                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3003                                                   bss->rsn_ie);
3004         }
3005
3006         if (bss && bss->supp_rates_len > 0) {
3007                 /* display all supported rates in readable format */
3008                 char *p = current_ev + IW_EV_LCP_LEN;
3009                 int i;
3010
3011                 memset(&iwe, 0, sizeof(iwe));
3012                 iwe.cmd = SIOCGIWRATE;
3013                 /* Those two flags are ignored... */
3014                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3015
3016                 for (i = 0; i < bss->supp_rates_len; i++) {
3017                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
3018                                                         0x7f) * 500000);
3019                         p = iwe_stream_add_value(current_ev, p,
3020                                         end_buf, &iwe, IW_EV_PARAM_LEN);
3021                 }
3022                 current_ev = p;
3023         }
3024
3025         if (bss) {
3026                 char *buf;
3027                 buf = kmalloc(30, GFP_ATOMIC);
3028                 if (buf) {
3029                         memset(&iwe, 0, sizeof(iwe));
3030                         iwe.cmd = IWEVCUSTOM;
3031                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
3032                         iwe.u.data.length = strlen(buf);
3033                         current_ev = iwe_stream_add_point(current_ev, end_buf,
3034                                                           &iwe, buf);
3035                         kfree(buf);
3036                 }
3037         }
3038
3039         do {
3040                 char *buf;
3041
3042                 if (!(local->scan_flags & IEEE80211_SCAN_EXTRA_INFO))
3043                         break;
3044
3045                 buf = kmalloc(100, GFP_ATOMIC);
3046                 if (!buf)
3047                         break;
3048
3049                 memset(&iwe, 0, sizeof(iwe));
3050                 iwe.cmd = IWEVCUSTOM;
3051                 sprintf(buf, "bcn_int=%d", bss->beacon_int);
3052                 iwe.u.data.length = strlen(buf);
3053                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3054                                                   buf);
3055
3056                 memset(&iwe, 0, sizeof(iwe));
3057                 iwe.cmd = IWEVCUSTOM;
3058                 sprintf(buf, "capab=0x%04x", bss->capability);
3059                 iwe.u.data.length = strlen(buf);
3060                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3061                                                   buf);
3062
3063                 kfree(buf);
3064                 break;
3065         } while (0);
3066
3067         return current_ev;
3068 }
3069
3070
3071 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
3072 {
3073         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3074         char *current_ev = buf;
3075         char *end_buf = buf + len;
3076         struct ieee80211_sta_bss *bss;
3077
3078         spin_lock_bh(&local->sta_bss_lock);
3079         list_for_each_entry(bss, &local->sta_bss_list, list) {
3080                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3081                         spin_unlock_bh(&local->sta_bss_lock);
3082                         return -E2BIG;
3083                 }
3084                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
3085                                                        end_buf);
3086         }
3087         spin_unlock_bh(&local->sta_bss_lock);
3088         return current_ev - buf;
3089 }
3090
3091
3092 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
3093 {
3094         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3095         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3096         kfree(ifsta->extra_ie);
3097         if (len == 0) {
3098                 ifsta->extra_ie = NULL;
3099                 ifsta->extra_ie_len = 0;
3100                 return 0;
3101         }
3102         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3103         if (!ifsta->extra_ie) {
3104                 ifsta->extra_ie_len = 0;
3105                 return -ENOMEM;
3106         }
3107         memcpy(ifsta->extra_ie, ie, len);
3108         ifsta->extra_ie_len = len;
3109         return 0;
3110 }
3111
3112
3113 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
3114                                          struct sk_buff *skb, u8 *bssid,
3115                                          u8 *addr)
3116 {
3117         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3118         struct sta_info *sta;
3119         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3120         DECLARE_MAC_BUF(mac);
3121
3122         /* TODO: Could consider removing the least recently used entry and
3123          * allow new one to be added. */
3124         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3125                 if (net_ratelimit()) {
3126                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3127                                "entry %s\n", dev->name, print_mac(mac, addr));
3128                 }
3129                 return NULL;
3130         }
3131
3132         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
3133                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
3134
3135         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
3136         if (!sta)
3137                 return NULL;
3138
3139         sta->supp_rates = sdata->u.sta.supp_rates_bits;
3140
3141         rate_control_rate_init(sta, local);
3142
3143         return sta; /* caller will call sta_info_put() */
3144 }
3145
3146
3147 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
3148 {
3149         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3150         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3151
3152         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
3153                dev->name, reason);
3154
3155         if (sdata->type != IEEE80211_IF_TYPE_STA &&
3156             sdata->type != IEEE80211_IF_TYPE_IBSS)
3157                 return -EINVAL;
3158
3159         ieee80211_send_deauth(dev, ifsta, reason);
3160         ieee80211_set_disassoc(dev, ifsta, 1);
3161         return 0;
3162 }
3163
3164
3165 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
3166 {
3167         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3168         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3169
3170         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
3171                dev->name, reason);
3172
3173         if (sdata->type != IEEE80211_IF_TYPE_STA)
3174                 return -EINVAL;
3175
3176         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
3177                 return -1;
3178
3179         ieee80211_send_disassoc(dev, ifsta, reason);
3180         ieee80211_set_disassoc(dev, ifsta, 0);
3181         return 0;
3182 }