package/d80211/src/ieee80211.c

   1 /*
   2  * Copyright 2002-2005, Instant802 Networks, Inc.
   3  * Copyright 2005-2006, Devicescape Software, Inc.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  */
   9
  10 #include <net/d80211.h>
  11 #include <linux/module.h>
  12 #include <linux/init.h>
  13 #include <linux/netdevice.h>
  14 #include <linux/types.h>
  15 #include <linux/slab.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/etherdevice.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/wireless.h>
  20 #include <linux/rtnetlink.h>
  21 #include <net/iw_handler.h>
  22 #include <linux/compiler.h>
  23 #include <linux/bitmap.h>
  24
  25 #include "ieee80211_common.h"
  26 #include "ieee80211_i.h"
  27 #include "ieee80211_rate.h"
  28 #include "wep.h"
  29 #include "wpa.h"
  30 #include "tkip.h"
  31 #include "wme.h"
  32 #include "aes_ccm.h"
  33 #include "ieee80211_led.h"
  34
  35 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
  36 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
  37 static unsigned char rfc1042_header[] =
  38 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
  39 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
  40 static unsigned char bridge_tunnel_header[] =
  41 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
  42 /* No encapsulation header if EtherType < 0x600 (=length) */
  43
  44 static unsigned char eapol_header[] =
  45 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x88, 0x8e };
  46
  47
  48 static u8 * ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len);
  49
  50 static int ieee80211_mgmt_start_xmit(struct sk_buff *skb,
  51                                      struct net_device *dev);
  52
  53 struct ieee80211_key_conf *
  54 ieee80211_key_data2conf(struct ieee80211_local *local,
  55                         struct ieee80211_key *data)
  56 {
  57         struct ieee80211_key_conf *conf;
  58
  59         conf = kmalloc(sizeof(*conf) + data->keylen, GFP_ATOMIC);
  60         if (!conf)
  61                 return NULL;
  62
  63         conf->hw_key_idx = data->hw_key_idx;
  64         conf->alg = data->alg;
  65         conf->keylen = data->keylen;
  66         conf->flags = 0;
  67         if (data->force_sw_encrypt)
  68                 conf->flags |= IEEE80211_KEY_FORCE_SW_ENCRYPT;
  69         conf->keyidx = data->keyidx;
  70         if (data->default_tx_key)
  71                 conf->flags |= IEEE80211_KEY_DEFAULT_TX_KEY;
  72         if (local->default_wep_only)
  73                 conf->flags |= IEEE80211_KEY_DEFAULT_WEP_ONLY;
  74         memcpy(conf->key, data->key, data->keylen);
  75
  76         return conf;
  77 }
  78
  79 struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
  80                                           int idx, size_t key_len, gfp_t flags)
  81 {
  82         struct ieee80211_key *key;
  83         int res;
  84
  85         key = kzalloc(sizeof(struct ieee80211_key) + key_len, flags);
  86         if (!key)
  87                 return NULL;
  88         if (sdata)
  89                 res = kobject_set_name(&key->kobj, "%d", idx);
  90         else
  91                 res = kobject_set_name(&key->kobj, "key");
  92         if (res) {
  93                 kfree(key);
  94                 return NULL;
  95         }
  96         ieee80211_key_sysfs_set_kset(key, sdata ? &sdata->key_kset : NULL);
  97         kobject_init(&key->kobj);
  98         return key;
  99 }
 100
 101 void ieee80211_key_free(struct ieee80211_key *key)
 102 {
 103         if (key)
 104                 kobject_put(&key->kobj);
 105 }
 106
 107 void ieee80211_key_release(struct kobject *kobj)
 108 {
 109         struct ieee80211_key *key;
 110
 111         key = container_of(kobj, struct ieee80211_key, kobj);
 112         if (key->alg == ALG_CCMP)
 113                 ieee80211_aes_key_free(key->u.ccmp.tfm);
 114         kfree(key);
 115 }
 116
 117 static int rate_list_match(int *rate_list, int rate)
 118 {
 119         int i;
 120
 121         if (!rate_list)
 122                 return 0;
 123
 124         for (i = 0; rate_list[i] >= 0; i++)
 125                 if (rate_list[i] == rate)
 126                         return 1;
 127
 128         return 0;
 129 }
 130
 131
 132 void ieee80211_prepare_rates(struct ieee80211_local *local)
 133 {
 134         int i;
 135
 136         for (i = 0; i < local->num_curr_rates; i++) {
 137                 struct ieee80211_rate *rate = &local->curr_rates[i];
 138
 139                 rate->flags &= ~(IEEE80211_RATE_SUPPORTED |
 140                                  IEEE80211_RATE_BASIC);
 141
 142                 if (local->supp_rates[local->hw.conf.phymode]) {
 143                         if (!rate_list_match(local->supp_rates
 144                                              [local->hw.conf.phymode],
 145                                              rate->rate))
 146                                 continue;
 147                 }
 148
 149                 rate->flags |= IEEE80211_RATE_SUPPORTED;
 150
 151                 /* Use configured basic rate set if it is available. If not,
 152                  * use defaults that are sane for most cases. */
 153                 if (local->basic_rates[local->hw.conf.phymode]) {
 154                         if (rate_list_match(local->basic_rates
 155                                             [local->hw.conf.phymode],
 156                                             rate->rate))
 157                                 rate->flags |= IEEE80211_RATE_BASIC;
 158                 } else switch (local->hw.conf.phymode) {
 159                 case MODE_IEEE80211A:
 160                         if (rate->rate == 60 || rate->rate == 120 ||
 161                             rate->rate == 240)
 162                                 rate->flags |= IEEE80211_RATE_BASIC;
 163                         break;
 164                 case MODE_IEEE80211B:
 165                         if (rate->rate == 10 || rate->rate == 20)
 166                                 rate->flags |= IEEE80211_RATE_BASIC;
 167                         break;
 168                 case MODE_ATHEROS_TURBO:
 169                         if (rate->rate == 120 || rate->rate == 240 ||
 170                             rate->rate == 480)
 171                                 rate->flags |= IEEE80211_RATE_BASIC;
 172                         break;
 173                 case MODE_IEEE80211G:
 174                         if (rate->rate == 10 || rate->rate == 20 ||
 175                             rate->rate == 55 || rate->rate == 110)
 176                                 rate->flags |= IEEE80211_RATE_BASIC;
 177                         break;
 178                 }
 179
 180                 /* Set ERP and MANDATORY flags based on phymode */
 181                 switch (local->hw.conf.phymode) {
 182                 case MODE_IEEE80211A:
 183                         if (rate->rate == 60 || rate->rate == 120 ||
 184                             rate->rate == 240)
 185                                 rate->flags |= IEEE80211_RATE_MANDATORY;
 186                         break;
 187                 case MODE_IEEE80211B:
 188                         if (rate->rate == 10)
 189                                 rate->flags |= IEEE80211_RATE_MANDATORY;
 190                         break;
 191                 case MODE_ATHEROS_TURBO:
 192                         break;
 193                 case MODE_IEEE80211G:
 194                         if (rate->rate == 10 || rate->rate == 20 ||
 195                             rate->rate == 55 || rate->rate == 110 ||
 196                             rate->rate == 60 || rate->rate == 120 ||
 197                             rate->rate == 240)
 198                                 rate->flags |= IEEE80211_RATE_MANDATORY;
 199                         if (rate->rate != 10 && rate->rate != 20 &&
 200                             rate->rate != 55 && rate->rate != 110)
 201                                 rate->flags |= IEEE80211_RATE_ERP;
 202                         break;
 203                 }
 204         }
 205 }
 206
 207
 208 static void ieee80211_key_threshold_notify(struct net_device *dev,
 209                                            struct ieee80211_key *key,
 210                                            struct sta_info *sta)
 211 {
 212         struct ieee80211_local *local = dev->ieee80211_ptr;
 213         struct sk_buff *skb;
 214         struct ieee80211_msg_key_notification *msg;
 215
 216         /* if no one will get it anyway, don't even allocate it.
 217          * unlikely because this is only relevant for APs
 218          * where the device must be open... */
 219         if (unlikely(!local->apdev))
 220                 return;
 221
 222         skb = dev_alloc_skb(sizeof(struct ieee80211_frame_info) +
 223                             sizeof(struct ieee80211_msg_key_notification));
 224         if (!skb)
 225                 return;
 226
 227         skb_reserve(skb, sizeof(struct ieee80211_frame_info));
 228         msg = (struct ieee80211_msg_key_notification *)
 229                 skb_put(skb, sizeof(struct ieee80211_msg_key_notification));
 230         msg->tx_rx_count = key->tx_rx_count;
 231         memcpy(msg->ifname, dev->name, IFNAMSIZ);
 232         if (sta)
 233                 memcpy(msg->addr, sta->addr, ETH_ALEN);
 234         else
 235                 memset(msg->addr, 0xff, ETH_ALEN);
 236
 237         key->tx_rx_count = 0;
 238
 239         ieee80211_rx_mgmt(local, skb, NULL,
 240                           ieee80211_msg_key_threshold_notification);
 241 }
 242
 243
 244 int ieee80211_get_hdrlen(u16 fc)
 245 {
 246         int hdrlen = 24;
 247
 248         switch (fc & IEEE80211_FCTL_FTYPE) {
 249         case IEEE80211_FTYPE_DATA:
 250                 if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
 251                         hdrlen = 30; /* Addr4 */
 252                 if (fc & IEEE80211_STYPE_QOS_DATA)
 253                         hdrlen += 2; /* QoS Control Field */
 254                 break;
 255         case IEEE80211_FTYPE_CTL:
 256                 switch (fc & IEEE80211_FCTL_STYPE) {
 257                 case IEEE80211_STYPE_CTS:
 258                 case IEEE80211_STYPE_ACK:
 259                         hdrlen = 10;
 260                         break;
 261                 default:
 262                         hdrlen = 16;
 263                         break;
 264                 }
 265                 break;
 266         }
 267
 268         return hdrlen;
 269 }
 270 EXPORT_SYMBOL(ieee80211_get_hdrlen);
 271
 272 int ieee80211_get_hdrlen_from_skb(struct sk_buff *skb)
 273 {
 274         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 275         int hdrlen;
 276
 277         if (unlikely(skb->len < 10))
 278                 return 0;
 279         hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
 280         if (unlikely(hdrlen > skb->len))
 281                 return 0;
 282         return hdrlen;
 283 }
 284 EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
 285
 286 #ifdef CONFIG_D80211_LOWTX_FRAME_DUMP
 287 static void ieee80211_dump_frame(const char *ifname, const char *title,
 288                                  struct sk_buff *skb)
 289 {
 290         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 291         u16 fc;
 292         int hdrlen;
 293
 294         printk(KERN_DEBUG "%s: %s (len=%d)", ifname, title, skb->len);
 295         if (skb->len < 4) {
 296                 printk("\n");
 297                 return;
 298         }
 299
 300         fc = le16_to_cpu(hdr->frame_control);
 301         hdrlen = ieee80211_get_hdrlen(fc);
 302         if (hdrlen > skb->len)
 303                 hdrlen = skb->len;
 304         if (hdrlen >= 4)
 305                 printk(" FC=0x%04x DUR=0x%04x",
 306                        fc, le16_to_cpu(hdr->duration_id));
 307         if (hdrlen >= 10)
 308                 printk(" A1=" MAC_FMT, MAC_ARG(hdr->addr1));
 309         if (hdrlen >= 16)
 310                 printk(" A2=" MAC_FMT, MAC_ARG(hdr->addr2));
 311         if (hdrlen >= 24)
 312                 printk(" A3=" MAC_FMT, MAC_ARG(hdr->addr3));
 313         if (hdrlen >= 30)
 314                 printk(" A4=" MAC_FMT, MAC_ARG(hdr->addr4));
 315         printk("\n");
 316 }
 317 #else /* CONFIG_D80211_LOWTX_FRAME_DUMP */
 318 static inline void ieee80211_dump_frame(const char *ifname, const char *title,
 319                                         struct sk_buff *skb)
 320 {
 321 }
 322 #endif /* CONFIG_D80211_LOWTX_FRAME_DUMP */
 323
 324
 325 static int ieee80211_is_eapol(struct sk_buff *skb)
 326 {
 327         struct ieee80211_hdr *hdr;
 328         u16 fc;
 329         int hdrlen;
 330
 331         if (unlikely(skb->len < 10))
 332                 return 0;
 333
 334         hdr = (struct ieee80211_hdr *) skb->data;
 335         fc = le16_to_cpu(hdr->frame_control);
 336
 337         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
 338                 return 0;
 339
 340         hdrlen = ieee80211_get_hdrlen(fc);
 341
 342         if (unlikely(skb->len >= hdrlen + sizeof(eapol_header) &&
 343                      memcmp(skb->data + hdrlen, eapol_header,
 344                             sizeof(eapol_header)) == 0))
 345                 return 1;
 346
 347         return 0;
 348 }
 349
 350
 351 static ieee80211_txrx_result
 352 ieee80211_tx_h_rate_ctrl(struct ieee80211_txrx_data *tx)
 353 {
 354         struct rate_control_extra extra;
 355
 356         memset(&extra, 0, sizeof(extra));
 357         extra.mgmt_data = tx->sdata &&
 358                 tx->sdata->type == IEEE80211_IF_TYPE_MGMT;
 359         extra.ethertype = tx->ethertype;
 360         extra.startidx  = 0;
 361         extra.endidx    = tx->local->num_curr_rates;
 362
 363         tx->u.tx.rate = rate_control_get_rate(tx->local, tx->dev, tx->skb,
 364                                               &extra);
 365         if (unlikely(extra.probe != NULL)) {
 366                 tx->u.tx.control->flags |= IEEE80211_TXCTL_RATE_CTRL_PROBE;
 367                 tx->u.tx.probe_last_frag = 1;
 368                 tx->u.tx.control->alt_retry_rate = tx->u.tx.rate->val;
 369                 tx->u.tx.rate = extra.probe;
 370         } else {
 371                 tx->u.tx.control->alt_retry_rate = -1;
 372         }
 373         if (!tx->u.tx.rate)
 374                 return TXRX_DROP;
 375         if (tx->local->hw.conf.phymode == MODE_IEEE80211G &&
 376             tx->local->cts_protect_erp_frames && tx->fragmented &&
 377             extra.nonerp) {
 378                 tx->u.tx.last_frag_rate = tx->u.tx.rate;
 379                 tx->u.tx.last_frag_rateidx = extra.rateidx;
 380                 tx->u.tx.probe_last_frag = extra.probe ? 1 : 0;
 381
 382                 tx->u.tx.rate = extra.nonerp;
 383                 tx->u.tx.control->rateidx = extra.nonerp_idx;
 384                 tx->u.tx.control->flags &= ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
 385         } else {
 386                 tx->u.tx.last_frag_rate = tx->u.tx.rate;
 387                 tx->u.tx.last_frag_rateidx = extra.rateidx;
 388                 tx->u.tx.control->rateidx = extra.rateidx;
 389         }
 390         tx->u.tx.control->tx_rate = tx->u.tx.rate->val;
 391         if ((tx->u.tx.rate->flags & IEEE80211_RATE_PREAMBLE2) &&
 392             tx->local->short_preamble &&
 393             (!tx->sta || (tx->sta->flags & WLAN_STA_SHORT_PREAMBLE))) {
 394                 tx->u.tx.short_preamble = 1;
 395                 tx->u.tx.control->tx_rate = tx->u.tx.rate->val2;
 396         }
 397
 398         return TXRX_CONTINUE;
 399 }
 400
 401
 402 static ieee80211_txrx_result
 403 ieee80211_tx_h_select_key(struct ieee80211_txrx_data *tx)
 404 {
 405         if (tx->sta)
 406                 tx->u.tx.control->key_idx = tx->sta->key_idx_compression;
 407         else
 408                 tx->u.tx.control->key_idx = HW_KEY_IDX_INVALID;
 409
 410         if (unlikely(tx->u.tx.control->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT))
 411                 tx->key = NULL;
 412         else if (tx->sta && tx->sta->key)
 413                 tx->key = tx->sta->key;
 414         else if (tx->sdata->default_key)
 415                 tx->key = tx->sdata->default_key;
 416         else if (tx->sdata->drop_unencrypted &&
 417                  !(tx->sdata->eapol && ieee80211_is_eapol(tx->skb))) {
 418                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
 419                 return TXRX_DROP;
 420         } else
 421                 tx->key = NULL;
 422
 423         if (tx->key) {
 424                 tx->key->tx_rx_count++;
 425                 if (unlikely(tx->local->key_tx_rx_threshold &&
 426                              tx->key->tx_rx_count >
 427                              tx->local->key_tx_rx_threshold)) {
 428                         ieee80211_key_threshold_notify(tx->dev, tx->key,
 429                                                        tx->sta);
 430                 }
 431         }
 432
 433         return TXRX_CONTINUE;
 434 }
 435
 436
 437 static ieee80211_txrx_result
 438 ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
 439 {
 440         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
 441         size_t hdrlen, per_fragm, num_fragm, payload_len, left;
 442         struct sk_buff **frags, *first, *frag;
 443         int i;
 444         u8 *pos;
 445         int frag_threshold = tx->local->fragmentation_threshold;
 446
 447         if (!tx->fragmented)
 448                 return TXRX_CONTINUE;
 449
 450         first = tx->skb;
 451
 452         hdrlen = ieee80211_get_hdrlen(tx->fc);
 453         payload_len = first->len - hdrlen;
 454         per_fragm = frag_threshold - hdrlen - FCS_LEN;
 455         num_fragm = (payload_len + per_fragm - 1) / per_fragm;
 456
 457         frags = kzalloc(num_fragm * sizeof(struct sk_buff *), GFP_ATOMIC);
 458         if (!frags)
 459                 goto fail;
 460
 461         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
 462         pos = first->data + hdrlen + per_fragm;
 463         left = payload_len - per_fragm;
 464         for (i = 0; i < num_fragm - 1; i++) {
 465                 struct ieee80211_hdr *fhdr;
 466                 size_t copylen;
 467
 468                 if (left <= 0)
 469                         goto fail;
 470
 471                 /* reserve enough extra head and tail room for possible
 472                  * encryption */
 473 #define IEEE80211_ENCRYPT_HEADROOM 8
 474 #define IEEE80211_ENCRYPT_TAILROOM 12
 475                 frag = frags[i] =
 476                         dev_alloc_skb(frag_threshold +
 477                                       IEEE80211_ENCRYPT_HEADROOM +
 478                                       IEEE80211_ENCRYPT_TAILROOM);
 479                 if (!frag)
 480                         goto fail;
 481                 /* Make sure that all fragments use the same priority so
 482                  * that they end up using the same TX queue */
 483                 frag->priority = first->priority;
 484                 skb_reserve(frag, IEEE80211_ENCRYPT_HEADROOM);
 485                 fhdr = (struct ieee80211_hdr *) skb_put(frag, hdrlen);
 486                 memcpy(fhdr, first->data, hdrlen);
 487                 if (i == num_fragm - 2)
 488                         fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
 489                 fhdr->seq_ctrl = cpu_to_le16(i + 1);
 490                 copylen = left > per_fragm ? per_fragm : left;
 491                 memcpy(skb_put(frag, copylen), pos, copylen);
 492
 493                 pos += copylen;
 494                 left -= copylen;
 495         }
 496         skb_trim(first, hdrlen + per_fragm);
 497
 498         tx->u.tx.num_extra_frag = num_fragm - 1;
 499         tx->u.tx.extra_frag = frags;
 500
 501         return TXRX_CONTINUE;
 502
 503  fail:
 504         printk(KERN_DEBUG "%s: failed to fragment frame\n", tx->dev->name);
 505         if (frags) {
 506                 for (i = 0; i < num_fragm - 1; i++)
 507                         if (frags[i])
 508                                 dev_kfree_skb(frags[i]);
 509                 kfree(frags);
 510         }
 511         I802_DEBUG_INC(tx->local->tx_handlers_drop_fragment);
 512         return TXRX_DROP;
 513 }
 514
 515
 516 static int wep_encrypt_skb(struct ieee80211_txrx_data *tx, struct sk_buff *skb)
 517 {
 518         if (tx->key->force_sw_encrypt) {
 519                 if (ieee80211_wep_encrypt(tx->local, skb, tx->key))
 520                         return -1;
 521         } else {
 522                 tx->u.tx.control->key_idx = tx->key->hw_key_idx;
 523                 if (tx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) {
 524                         if (ieee80211_wep_add_iv(tx->local, skb, tx->key) ==
 525                             NULL)
 526                                 return -1;
 527                 }
 528         }
 529         return 0;
 530 }
 531
 532
 533 void ieee80211_tx_set_iswep(struct ieee80211_txrx_data *tx)
 534 {
 535         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
 536
 537         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 538         if (tx->u.tx.extra_frag) {
 539                 struct ieee80211_hdr *fhdr;
 540                 int i;
 541                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
 542                         fhdr = (struct ieee80211_hdr *)
 543                                 tx->u.tx.extra_frag[i]->data;
 544                         fhdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 545                 }
 546         }
 547 }
 548
 549
 550 static ieee80211_txrx_result
 551 ieee80211_tx_h_wep_encrypt(struct ieee80211_txrx_data *tx)
 552 {
 553         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
 554         u16 fc;
 555
 556         fc = le16_to_cpu(hdr->frame_control);
 557
 558         if (!tx->key || tx->key->alg != ALG_WEP ||
 559             ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
 560              ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
 561               (fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)))
 562                 return TXRX_CONTINUE;
 563
 564         tx->u.tx.control->iv_len = WEP_IV_LEN;
 565         tx->u.tx.control->icv_len = WEP_ICV_LEN;
 566         ieee80211_tx_set_iswep(tx);
 567
 568         if (wep_encrypt_skb(tx, tx->skb) < 0) {
 569                 I802_DEBUG_INC(tx->local->tx_handlers_drop_wep);
 570                 return TXRX_DROP;
 571         }
 572
 573         if (tx->u.tx.extra_frag) {
 574                 int i;
 575                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
 576                         if (wep_encrypt_skb(tx, tx->u.tx.extra_frag[i]) < 0) {
 577                                 I802_DEBUG_INC(tx->local->
 578                                                tx_handlers_drop_wep);
 579                                 return TXRX_DROP;
 580                         }
 581                 }
 582         }
 583
 584         return TXRX_CONTINUE;
 585 }
 586
 587
 588 static inline int ceiling_div(int dividend, int divisor)
 589 {
 590         return ((dividend + divisor - 1) / divisor);
 591 }
 592
 593
 594 static int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
 595                                     int rate, int erp, int short_preamble)
 596 {
 597         int dur;
 598
 599         /* calculate duration (in microseconds, rounded up to next higher
 600          * integer if it includes a fractional microsecond) to send frame of
 601          * len bytes (does not include FCS) at the given rate. Duration will
 602          * also include SIFS.
 603          *
 604          * rate is in 100 kbps, so divident is multiplied by 10 in the
 605          * ceiling_div() operations.
 606          */
 607
 608         if (local->hw.conf.phymode == MODE_IEEE80211A || erp ||
 609             local->hw.conf.phymode == MODE_ATHEROS_TURBO) {
 610                 /*
 611                  * OFDM:
 612                  *
 613                  * N_DBPS = DATARATE x 4
 614                  * N_SYM = Ceiling((16+8xLENGTH+6) / N_DBPS)
 615                  *      (16 = SIGNAL time, 6 = tail bits)
 616                  * TXTIME = T_PREAMBLE + T_SIGNAL + T_SYM x N_SYM + Signal Ext
 617                  *
 618                  * T_SYM = 4 usec
 619                  * 802.11a - 17.5.2: aSIFSTime = 16 usec
 620                  * 802.11g - 19.8.4: aSIFSTime = 10 usec +
 621                  *      signal ext = 6 usec
 622                  */
 623                 /* FIX: Atheros Turbo may have different (shorter) duration? */
 624                 dur = 16; /* SIFS + signal ext */
 625                 dur += 16; /* 17.3.2.3: T_PREAMBLE = 16 usec */
 626                 dur += 4; /* 17.3.2.3: T_SIGNAL = 4 usec */
 627                 dur += 4 * ceiling_div((16 + 8 * (len + 4) + 6) * 10,
 628                                        4 * rate); /* T_SYM x N_SYM */
 629         } else {
 630                 /*
 631                  * 802.11b or 802.11g with 802.11b compatibility:
 632                  * 18.3.4: TXTIME = PreambleLength + PLCPHeaderTime +
 633                  * Ceiling(((LENGTH+PBCC)x8)/DATARATE). PBCC=0.
 634                  *
 635                  * 802.11 (DS): 15.3.3, 802.11b: 18.3.4
 636                  * aSIFSTime = 10 usec
 637                  * aPreambleLength = 144 usec or 72 usec with short preamble
 638                  * aPLCPHeaderLength = 48 usec or 24 usec with short preamble
 639                  */
 640                 dur = 10; /* aSIFSTime = 10 usec */
 641                 dur += short_preamble ? (72 + 24) : (144 + 48);
 642
 643                 dur += ceiling_div(8 * (len + 4) * 10, rate);
 644         }
 645
 646         return dur;
 647 }
 648
 649
 650 static u16 ieee80211_duration(struct ieee80211_txrx_data *tx, int group_addr,
 651                               int next_frag_len)
 652 {
 653         int rate, mrate, erp, dur, i;
 654         struct ieee80211_rate *txrate = tx->u.tx.rate;
 655         struct ieee80211_local *local = tx->local;
 656
 657         erp = txrate->flags & IEEE80211_RATE_ERP;
 658
 659         /*
 660          * data and mgmt (except PS Poll):
 661          * - during CFP: 32768
 662          * - during contention period:
 663          *   if addr1 is group address: 0
 664          *   if more fragments = 0 and addr1 is individual address: time to
 665          *      transmit one ACK plus SIFS
 666          *   if more fragments = 1 and addr1 is individual address: time to
 667          *      transmit next fragment plus 2 x ACK plus 3 x SIFS
 668          *
 669          * IEEE 802.11, 9.6:
 670          * - control response frame (CTS or ACK) shall be transmitted using the
 671          *   same rate as the immediately previous frame in the frame exchange
 672          *   sequence, if this rate belongs to the PHY mandatory rates, or else
 673          *   at the highest possible rate belonging to the PHY rates in the
 674          *   BSSBasicRateSet
 675          */
 676
 677         if ((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL) {
 678                 /* TODO: These control frames are not currently sent by
 679                  * 80211.o, but should they be implemented, this function
 680                  * needs to be updated to support duration field calculation.
 681                  *
 682                  * RTS: time needed to transmit pending data/mgmt frame plus
 683                  *    one CTS frame plus one ACK frame plus 3 x SIFS
 684                  * CTS: duration of immediately previous RTS minus time
 685                  *    required to transmit CTS and its SIFS
 686                  * ACK: 0 if immediately previous directed data/mgmt had
 687                  *    more=0, with more=1 duration in ACK frame is duration
 688                  *    from previous frame minus time needed to transmit ACK
 689                  *    and its SIFS
 690                  * PS Poll: BIT(15) | BIT(14) | aid
 691                  */
 692                 return 0;
 693         }
 694
 695         /* data/mgmt */
 696         if (0 /* FIX: data/mgmt during CFP */)
 697                 return 32768;
 698
 699         if (group_addr) /* Group address as the destination - no ACK */
 700                 return 0;
 701
 702         /* Individual destination address:
 703          * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
 704          * CTS and ACK frames shall be transmitted using the highest rate in
 705          * basic rate set that is less than or equal to the rate of the
 706          * immediately previous frame and that is using the same modulation
 707          * (CCK or OFDM). If no basic rate set matches with these requirements,
 708          * the highest mandatory rate of the PHY that is less than or equal to
 709          * the rate of the previous frame is used.
 710          * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
 711          */
 712         rate = -1;
 713         mrate = 10; /* use 1 Mbps if everything fails */
 714         for (i = 0; i < local->num_curr_rates; i++) {
 715                 struct ieee80211_rate *r = &local->curr_rates[i];
 716                 if (r->rate > txrate->rate)
 717                         break;
 718
 719                 if (IEEE80211_RATE_MODULATION(txrate->flags) !=
 720                     IEEE80211_RATE_MODULATION(r->flags))
 721                         continue;
 722
 723                 if (r->flags & IEEE80211_RATE_BASIC)
 724                         rate = r->rate;
 725                 else if (r->flags & IEEE80211_RATE_MANDATORY)
 726                         mrate = r->rate;
 727         }
 728         if (rate == -1) {
 729                 /* No matching basic rate found; use highest suitable mandatory
 730                  * PHY rate */
 731                 rate = mrate;
 732         }
 733
 734         /* Time needed to transmit ACK
 735          * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
 736          * to closest integer */
 737
 738         dur = ieee80211_frame_duration(local, 10, rate, erp,
 739                                        local->short_preamble);
 740
 741         if (next_frag_len) {
 742                 /* Frame is fragmented: duration increases with time needed to
 743                  * transmit next fragment plus ACK and 2 x SIFS. */
 744                 dur *= 2; /* ACK + SIFS */
 745                 /* next fragment */
 746                 dur += ieee80211_frame_duration(local, next_frag_len,
 747                                                 txrate->rate, erp,
 748                                                 local->short_preamble);
 749         }
 750
 751         return dur;
 752 }
 753
 754
 755 static ieee80211_txrx_result
 756 ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
 757 {
 758         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
 759         u16 dur;
 760         struct ieee80211_tx_control *control = tx->u.tx.control;
 761
 762         if (!is_multicast_ether_addr(hdr->addr1)) {
 763                 if (tx->skb->len + FCS_LEN > tx->local->rts_threshold &&
 764                     tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD) {
 765                         control->flags |= IEEE80211_TXCTL_USE_RTS_CTS;
 766                         control->retry_limit =
 767                                 tx->local->long_retry_limit;
 768                 } else {
 769                         control->retry_limit =
 770                                 tx->local->short_retry_limit;
 771                 }
 772         } else {
 773                 control->retry_limit = 1;
 774         }
 775
 776         if (tx->fragmented) {
 777                 /* Do not use multiple retry rates when sending fragmented
 778                  * frames.
 779                  * TODO: The last fragment could still use multiple retry
 780                  * rates. */
 781                 control->alt_retry_rate = -1;
 782         }
 783
 784         /* Use CTS protection for unicast frames sent using extended rates if
 785          * there are associated non-ERP stations and RTS/CTS is not configured
 786          * for the frame. */
 787         if (tx->local->hw.conf.phymode == MODE_IEEE80211G &&
 788             (tx->u.tx.rate->flags & IEEE80211_RATE_ERP) &&
 789             tx->u.tx.unicast &&
 790             tx->local->cts_protect_erp_frames &&
 791             !(control->flags & IEEE80211_TXCTL_USE_RTS_CTS))
 792                 control->flags |= IEEE80211_TXCTL_USE_CTS_PROTECT;
 793
 794         /* Setup duration field for the first fragment of the frame. Duration
 795          * for remaining fragments will be updated when they are being sent
 796          * to low-level driver in ieee80211_tx(). */
 797         dur = ieee80211_duration(tx, is_multicast_ether_addr(hdr->addr1),
 798                                  tx->fragmented ? tx->u.tx.extra_frag[0]->len :
 799                                  0);
 800         hdr->duration_id = cpu_to_le16(dur);
 801
 802         if ((control->flags & IEEE80211_TXCTL_USE_RTS_CTS) ||
 803             (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)) {
 804                 struct ieee80211_rate *rate;
 805                 int erp = tx->u.tx.rate->flags & IEEE80211_RATE_ERP;
 806
 807                 /* Do not use multiple retry rates when using RTS/CTS */
 808                 control->alt_retry_rate = -1;
 809
 810                 /* Use min(data rate, max base rate) as CTS/RTS rate */
 811                 rate = tx->u.tx.rate;
 812                 while (rate > tx->local->curr_rates &&
 813                        !(rate->flags & IEEE80211_RATE_BASIC))
 814                         rate--;
 815
 816                 if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS)
 817                         dur += ieee80211_frame_duration(tx->local, 10,
 818                                                         rate->rate, erp,
 819                                                         tx->local->
 820                                                         short_preamble);
 821                 dur += ieee80211_frame_duration(tx->local, tx->skb->len,
 822                                                 tx->u.tx.rate->rate, erp,
 823                                                 tx->u.tx.short_preamble);
 824                 control->rts_cts_duration = dur;
 825                 control->rts_cts_rate = rate->val;
 826         }
 827
 828         if (tx->sta) {
 829                 tx->sta->tx_packets++;
 830                 tx->sta->tx_fragments++;
 831                 tx->sta->tx_bytes += tx->skb->len;
 832                 if (tx->u.tx.extra_frag) {
 833                         int i;
 834                         tx->sta->tx_fragments += tx->u.tx.num_extra_frag;
 835                         for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
 836                                 tx->sta->tx_bytes +=
 837                                         tx->u.tx.extra_frag[i]->len;
 838                         }
 839                 }
 840         }
 841         tx->local->scan.txrx_count++;
 842
 843         return TXRX_CONTINUE;
 844 }
 845
 846
 847 static ieee80211_txrx_result
 848 ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
 849 {
 850 #ifdef CONFIG_D80211_VERBOSE_DEBUG
 851         struct sk_buff *skb = tx->skb;
 852         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 853 #endif /* CONFIG_D80211_VERBOSE_DEBUG */
 854         u32 sta_flags;
 855
 856         if (unlikely(tx->local->sta_scanning != 0) &&
 857             ((tx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
 858              (tx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PROBE_REQ))
 859                 return TXRX_DROP;
 860
 861         if (tx->u.tx.ps_buffered)
 862                 return TXRX_CONTINUE;
 863
 864         sta_flags = tx->sta ? tx->sta->flags : 0;
 865
 866         if (likely(tx->u.tx.unicast)) {
 867                 if (unlikely(!(sta_flags & WLAN_STA_ASSOC) &&
 868                              tx->sdata->type != IEEE80211_IF_TYPE_IBSS &&
 869                              (tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)) {
 870 #ifdef CONFIG_D80211_VERBOSE_DEBUG
 871                         printk(KERN_DEBUG "%s: dropped data frame to not "
 872                                "associated station " MAC_FMT "\n",
 873                                tx->dev->name, MAC_ARG(hdr->addr1));
 874 #endif /* CONFIG_D80211_VERBOSE_DEBUG */
 875                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
 876                         return TXRX_DROP;
 877                 }
 878         } else {
 879                 if (unlikely((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
 880                              tx->local->num_sta == 0 &&
 881                              !tx->local->allow_broadcast_always &&
 882                              tx->sdata->type != IEEE80211_IF_TYPE_IBSS)) {
 883                         /*
 884                          * No associated STAs - no need to send multicast
 885                          * frames.
 886                          */
 887                         return TXRX_DROP;
 888                 }
 889                 return TXRX_CONTINUE;
 890         }
 891
 892         if (unlikely(!tx->u.tx.mgmt_interface && tx->sdata->ieee802_1x &&
 893                      !(sta_flags & WLAN_STA_AUTHORIZED))) {
 894 #ifdef CONFIG_D80211_DEBUG
 895                 struct ieee80211_hdr *hdr =
 896                         (struct ieee80211_hdr *) tx->skb->data;
 897                 printk(KERN_DEBUG "%s: dropped frame to " MAC_FMT
 898                        " (unauthorized port)\n", tx->dev->name,
 899                        MAC_ARG(hdr->addr1));
 900 #endif
 901                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unauth_port);
 902                 return TXRX_DROP;
 903         }
 904
 905         return TXRX_CONTINUE;
 906 }
 907
 908
 909 /* This function is called whenever the AP is about to exceed the maximum limit
 910  * of buffered frames for power saving STAs. This situation should not really
 911  * happen often during normal operation, so dropping the oldest buffered packet
 912  * from each queue should be OK to make some room for new frames. */
 913 static void purge_old_ps_buffers(struct ieee80211_local *local)
 914 {
 915         int total = 0, purged = 0;
 916         struct sk_buff *skb;
 917         struct ieee80211_sub_if_data *sdata;
 918         struct sta_info *sta;
 919
 920         spin_lock_bh(&local->sub_if_lock);
 921         list_for_each_entry(sdata, &local->sub_if_list, list) {
 922                 struct ieee80211_if_ap *ap;
 923                 if (sdata->dev == local->mdev ||
 924                     sdata->type != IEEE80211_IF_TYPE_AP)
 925                         continue;
 926                 ap = &sdata->u.ap;
 927                 skb = skb_dequeue(&ap->ps_bc_buf);
 928                 if (skb) {
 929                         purged++;
 930                         dev_kfree_skb(skb);
 931                 }
 932                 total += skb_queue_len(&ap->ps_bc_buf);
 933         }
 934         spin_unlock_bh(&local->sub_if_lock);
 935
 936         spin_lock_bh(&local->sta_lock);
 937         list_for_each_entry(sta, &local->sta_list, list) {
 938                 skb = skb_dequeue(&sta->ps_tx_buf);
 939                 if (skb) {
 940                         purged++;
 941                         dev_kfree_skb(skb);
 942                 }
 943                 total += skb_queue_len(&sta->ps_tx_buf);
 944         }
 945         spin_unlock_bh(&local->sta_lock);
 946
 947         local->total_ps_buffered = total;
 948         printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
 949                local->mdev->name, purged);
 950 }
 951
 952
 953 static inline ieee80211_txrx_result
 954 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_txrx_data *tx)
 955 {
 956         /* broadcast/multicast frame */
 957         /* If any of the associated stations is in power save mode,
 958          * the frame is buffered to be sent after DTIM beacon frame */
 959         if ((tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) &&
 960             tx->sdata->type != IEEE80211_IF_TYPE_WDS &&
 961             tx->sdata->bss && atomic_read(&tx->sdata->bss->num_sta_ps) &&
 962             !(tx->fc & IEEE80211_FCTL_ORDER)) {
 963                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
 964                         purge_old_ps_buffers(tx->local);
 965                 if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
 966                     AP_MAX_BC_BUFFER) {
 967                         if (net_ratelimit()) {
 968                                 printk(KERN_DEBUG "%s: BC TX buffer full - "
 969                                        "dropping the oldest frame\n",
 970                                        tx->dev->name);
 971                         }
 972                         dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
 973                 } else
 974                         tx->local->total_ps_buffered++;
 975                 skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
 976                 return TXRX_QUEUED;
 977         }
 978
 979         return TXRX_CONTINUE;
 980 }
 981
 982
 983 static inline ieee80211_txrx_result
 984 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
 985 {
 986         struct sta_info *sta = tx->sta;
 987
 988         if (unlikely(!sta ||
 989                      ((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
 990                       (tx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP)))
 991                 return TXRX_CONTINUE;
 992
 993         if (unlikely((sta->flags & WLAN_STA_PS) && !sta->pspoll)) {
 994                 struct ieee80211_tx_packet_data *pkt_data;
 995 #ifdef CONFIG_D80211_VERBOSE_PS_DEBUG
 996                 printk(KERN_DEBUG "STA " MAC_FMT " aid %d: PS buffer (entries "
 997                        "before %d)\n",
 998                        MAC_ARG(sta->addr), sta->aid,
 999                        skb_queue_len(&sta->ps_tx_buf));
1000 #endif /* CONFIG_D80211_VERBOSE_PS_DEBUG */
1001                 sta->flags |= WLAN_STA_TIM;
1002                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
1003                         purge_old_ps_buffers(tx->local);
1004                 if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
1005                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
1006                         if (net_ratelimit()) {
1007                                 printk(KERN_DEBUG "%s: STA " MAC_FMT " TX "
1008                                        "buffer full - dropping oldest frame\n",
1009                                        tx->dev->name, MAC_ARG(sta->addr));
1010                         }
1011                         dev_kfree_skb(old);
1012                 } else
1013                         tx->local->total_ps_buffered++;
1014                 /* Queue frame to be sent after STA sends an PS Poll frame */
1015                 if (skb_queue_empty(&sta->ps_tx_buf)) {
1016                         if (tx->local->ops->set_tim)
1017                                 tx->local->ops->set_tim(local_to_hw(tx->local),
1018                                                        sta->aid, 1);
1019                         if (tx->sdata->bss)
1020                                 bss_tim_set(tx->local, tx->sdata->bss, sta->aid);
1021                 }
1022                 pkt_data = (struct ieee80211_tx_packet_data *)tx->skb->cb;
1023                 pkt_data->jiffies = jiffies;
1024                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
1025                 return TXRX_QUEUED;
1026         }
1027 #ifdef CONFIG_D80211_VERBOSE_PS_DEBUG
1028         else if (unlikely(sta->flags & WLAN_STA_PS)) {
1029                 printk(KERN_DEBUG "%s: STA " MAC_FMT " in PS mode, but pspoll "
1030                        "set -> send frame\n", tx->dev->name,
1031                        MAC_ARG(sta->addr));
1032         }
1033 #endif /* CONFIG_D80211_VERBOSE_PS_DEBUG */
1034         sta->pspoll = 0;
1035
1036         return TXRX_CONTINUE;
1037 }
1038
1039
1040 static ieee80211_txrx_result
1041 ieee80211_tx_h_ps_buf(struct ieee80211_txrx_data *tx)
1042 {
1043         if (unlikely(tx->u.tx.ps_buffered))
1044                 return TXRX_CONTINUE;
1045
1046         if (tx->u.tx.unicast)
1047                 return ieee80211_tx_h_unicast_ps_buf(tx);
1048         else
1049                 return ieee80211_tx_h_multicast_ps_buf(tx);
1050 }
1051
1052
1053 static void inline
1054 __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
1055                        struct sk_buff *skb,
1056                        struct net_device *dev,
1057                        struct ieee80211_tx_control *control)
1058 {
1059         struct ieee80211_local *local = dev->ieee80211_ptr;
1060         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1061         int hdrlen;
1062
1063         memset(tx, 0, sizeof(*tx));
1064         tx->skb = skb;
1065         tx->dev = dev; /* use original interface */
1066         tx->local = local;
1067         tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1068         tx->sta = sta_info_get(local, hdr->addr1);
1069         tx->fc = le16_to_cpu(hdr->frame_control);
1070         control->power_level = local->hw.conf.power_level;
1071         tx->u.tx.control = control;
1072         tx->u.tx.unicast = !is_multicast_ether_addr(hdr->addr1);
1073         if (is_multicast_ether_addr(hdr->addr1))
1074                 control->flags |= IEEE80211_TXCTL_NO_ACK;
1075         else
1076                 control->flags &= ~IEEE80211_TXCTL_NO_ACK;
1077         tx->fragmented = local->fragmentation_threshold <
1078                 IEEE80211_MAX_FRAG_THRESHOLD && tx->u.tx.unicast &&
1079                 skb->len + FCS_LEN > local->fragmentation_threshold &&
1080                 (!local->ops->set_frag_threshold);
1081         if (!tx->sta)
1082                 control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
1083         else if (tx->sta->clear_dst_mask) {
1084                 control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
1085                 tx->sta->clear_dst_mask = 0;
1086         }
1087         control->antenna_sel = local->hw.conf.antenna_sel;
1088         if (local->sta_antenna_sel != STA_ANTENNA_SEL_AUTO && tx->sta)
1089                 control->antenna_sel = tx->sta->antenna_sel;
1090         hdrlen = ieee80211_get_hdrlen(tx->fc);
1091         if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
1092                 u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
1093                 tx->ethertype = (pos[0] << 8) | pos[1];
1094         }
1095         control->flags |= IEEE80211_TXCTL_FIRST_FRAGMENT;
1096
1097 }
1098
1099 static int inline is_ieee80211_device(struct net_device *dev,
1100                                       struct net_device *master)
1101 {
1102         return (dev->ieee80211_ptr == master->ieee80211_ptr);
1103 }
1104
1105 /* Device in tx->dev has a reference added; use dev_put(tx->dev) when
1106  * finished with it. */
1107 static void inline ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
1108                                         struct sk_buff *skb,
1109                                         struct net_device *mdev,
1110                                         struct ieee80211_tx_control *control)
1111 {
1112         struct ieee80211_tx_packet_data *pkt_data;
1113         struct net_device *dev;
1114
1115         pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
1116         dev = dev_get_by_index(pkt_data->ifindex);
1117         if (unlikely(dev && !is_ieee80211_device(dev, mdev))) {
1118                 dev_put(dev);
1119                 dev = NULL;
1120         }
1121         if (unlikely(!dev)) {
1122                 printk(KERN_WARNING "%s: NULL ifindex in pkt_data\n",
1123                        mdev->name);
1124                 dev = mdev;
1125                 dev_hold(dev);
1126         }
1127         __ieee80211_tx_prepare(tx, skb, dev, control);
1128 }
1129
1130 static inline int __ieee80211_queue_stopped(struct ieee80211_local *local,
1131                                             int queue)
1132 {
1133         return test_bit(IEEE80211_LINK_STATE_XOFF, &local->state[queue]);
1134 }
1135
1136 static inline int __ieee80211_queue_pending(struct ieee80211_local *local,
1137                                             int queue)
1138 {
1139         return test_bit(IEEE80211_LINK_STATE_PENDING, &local->state[queue]);
1140 }
1141
1142 #define IEEE80211_TX_OK         0
1143 #define IEEE80211_TX_AGAIN      1
1144 #define IEEE80211_TX_FRAG_AGAIN 2
1145
1146 static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
1147                           struct ieee80211_txrx_data *tx)
1148 {
1149         struct ieee80211_tx_control *control = tx->u.tx.control;
1150         int ret, i;
1151
1152         if (skb) {
1153                 ieee80211_dump_frame(local->mdev->name, "TX to low-level driver", skb);
1154                 ret = local->ops->tx(local_to_hw(local), skb, control);
1155                 if (ret)
1156                         return IEEE80211_TX_AGAIN;
1157                 ieee80211_led_tx(local, 1);
1158         }
1159         if (tx->u.tx.extra_frag) {
1160                 control->flags &= ~(IEEE80211_TXCTL_USE_RTS_CTS |
1161                                     IEEE80211_TXCTL_USE_CTS_PROTECT |
1162                                     IEEE80211_TXCTL_CLEAR_DST_MASK |
1163                                     IEEE80211_TXCTL_FIRST_FRAGMENT);
1164                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
1165                         if (!tx->u.tx.extra_frag[i])
1166                                 continue;
1167                         if (__ieee80211_queue_stopped(local, control->queue))
1168                                 return IEEE80211_TX_FRAG_AGAIN;
1169                         if (i == tx->u.tx.num_extra_frag) {
1170                                 control->tx_rate = tx->u.tx.last_frag_hwrate;
1171                                 control->rateidx = tx->u.tx.last_frag_rateidx;
1172                                 if (tx->u.tx.probe_last_frag)
1173                                         control->flags |=
1174                                                 IEEE80211_TXCTL_RATE_CTRL_PROBE;
1175                                 else
1176                                         control->flags &=
1177                                                 ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
1178                         }
1179
1180                         ieee80211_dump_frame(local->mdev->name,
1181                                              "TX to low-level driver", skb);
1182                         ret = local->ops->tx(local_to_hw(local),
1183                                             tx->u.tx.extra_frag[i],
1184                                             control);
1185                         if (ret)
1186                                 return IEEE80211_TX_FRAG_AGAIN;
1187                         ieee80211_led_tx(local, 1);
1188                         tx->u.tx.extra_frag[i] = NULL;
1189                 }
1190                 kfree(tx->u.tx.extra_frag);
1191                 tx->u.tx.extra_frag = NULL;
1192         }
1193         return IEEE80211_TX_OK;
1194 }
1195
1196 static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
1197                         struct ieee80211_tx_control *control, int mgmt)
1198 {
1199         struct ieee80211_local *local = dev->ieee80211_ptr;
1200         struct sta_info *sta;
1201         ieee80211_tx_handler *handler;
1202         struct ieee80211_txrx_data tx;
1203         ieee80211_txrx_result res = TXRX_DROP;
1204         int ret, i;
1205
1206         WARN_ON(__ieee80211_queue_pending(local, control->queue));
1207
1208         if (unlikely(skb->len < 10)) {
1209                 dev_kfree_skb(skb);
1210                 return 0;
1211         }
1212
1213         __ieee80211_tx_prepare(&tx, skb, dev, control);
1214         sta = tx.sta;
1215         tx.u.tx.mgmt_interface = mgmt;
1216
1217         for (handler = local->tx_handlers; *handler != NULL; handler++) {
1218                 res = (*handler)(&tx);
1219                 if (res != TXRX_CONTINUE)
1220                         break;
1221         }
1222
1223         skb = tx.skb; /* handlers are allowed to change skb */
1224
1225         if (sta)
1226                 sta_info_put(sta);
1227
1228         if (unlikely(res == TXRX_DROP)) {
1229                 I802_DEBUG_INC(local->tx_handlers_drop);
1230                 goto drop;
1231         }
1232
1233         if (unlikely(res == TXRX_QUEUED)) {
1234                 I802_DEBUG_INC(local->tx_handlers_queued);
1235                 return 0;
1236         }
1237
1238         if (tx.u.tx.extra_frag) {
1239                 for (i = 0; i < tx.u.tx.num_extra_frag; i++) {
1240                         int next_len, dur;
1241                         struct ieee80211_hdr *hdr =
1242                                 (struct ieee80211_hdr *)
1243                                 tx.u.tx.extra_frag[i]->data;
1244
1245                         if (i + 1 < tx.u.tx.num_extra_frag) {
1246                                 next_len = tx.u.tx.extra_frag[i + 1]->len;
1247                         } else {
1248                                 next_len = 0;
1249                                 tx.u.tx.rate = tx.u.tx.last_frag_rate;
1250                                 tx.u.tx.last_frag_hwrate = tx.u.tx.rate->val;
1251                         }
1252                         dur = ieee80211_duration(&tx, 0, next_len);
1253                         hdr->duration_id = cpu_to_le16(dur);
1254                 }
1255         }
1256
1257 retry:
1258         ret = __ieee80211_tx(local, skb, &tx);
1259         if (ret) {
1260                 struct ieee80211_tx_stored_packet *store =
1261                         &local->pending_packet[control->queue];
1262
1263                 if (ret == IEEE80211_TX_FRAG_AGAIN)
1264                         skb = NULL;
1265                 set_bit(IEEE80211_LINK_STATE_PENDING,
1266                         &local->state[control->queue]);
1267                 smp_mb();
1268                 /* When the driver gets out of buffers during sending of
1269                  * fragments and calls ieee80211_stop_queue, there is
1270                  * a small window between IEEE80211_LINK_STATE_XOFF and
1271                  * IEEE80211_LINK_STATE_PENDING flags are set. If a buffer
1272                  * gets available in that window (i.e. driver calls
1273                  * ieee80211_wake_queue), we would end up with ieee80211_tx
1274                  * called with IEEE80211_LINK_STATE_PENDING. Prevent this by
1275                  * continuing transmitting here when that situation is
1276                  * possible to have happened. */
1277                 if (!__ieee80211_queue_stopped(local, control->queue)) {
1278                         clear_bit(IEEE80211_LINK_STATE_PENDING,
1279                                   &local->state[control->queue]);
1280                         goto retry;
1281                 }
1282                 memcpy(&store->control, control,
1283                        sizeof(struct ieee80211_tx_control));
1284                 store->skb = skb;
1285                 store->extra_frag = tx.u.tx.extra_frag;
1286                 store->num_extra_frag = tx.u.tx.num_extra_frag;
1287                 store->last_frag_hwrate = tx.u.tx.last_frag_hwrate;
1288                 store->last_frag_rateidx = tx.u.tx.last_frag_rateidx;
1289                 store->last_frag_rate_ctrl_probe = tx.u.tx.probe_last_frag;
1290         }
1291         return 0;
1292
1293  drop:
1294         if (skb)
1295                 dev_kfree_skb(skb);
1296         for (i = 0; i < tx.u.tx.num_extra_frag; i++)
1297                 if (tx.u.tx.extra_frag[i])
1298                         dev_kfree_skb(tx.u.tx.extra_frag[i]);
1299         kfree(tx.u.tx.extra_frag);
1300         return 0;
1301 }
1302
1303 static void ieee80211_tx_pending(unsigned long data)
1304 {
1305         struct ieee80211_local *local = (struct ieee80211_local *)data;
1306         struct net_device *dev = local->mdev;
1307         struct ieee80211_tx_stored_packet *store;
1308         struct ieee80211_txrx_data tx;
1309         int i, ret, reschedule = 0;
1310
1311         netif_tx_lock_bh(dev);
1312         for (i = 0; i < local->hw.queues; i++) {
1313                 if (__ieee80211_queue_stopped(local, i))
1314                         continue;
1315                 if (!__ieee80211_queue_pending(local, i)) {
1316                         reschedule = 1;
1317                         continue;
1318                 }
1319                 store = &local->pending_packet[i];
1320                 tx.u.tx.control = &store->control;
1321                 tx.u.tx.extra_frag = store->extra_frag;
1322                 tx.u.tx.num_extra_frag = store->num_extra_frag;
1323                 tx.u.tx.last_frag_hwrate = store->last_frag_hwrate;
1324                 tx.u.tx.last_frag_rateidx = store->last_frag_rateidx;
1325                 tx.u.tx.probe_last_frag = store->last_frag_rate_ctrl_probe;
1326                 ret = __ieee80211_tx(local, store->skb, &tx);
1327                 if (ret) {
1328                         if (ret == IEEE80211_TX_FRAG_AGAIN)
1329                                 store->skb = NULL;
1330                 } else {
1331                         clear_bit(IEEE80211_LINK_STATE_PENDING,
1332                                   &local->state[i]);
1333                         reschedule = 1;
1334                 }
1335         }
1336         netif_tx_unlock_bh(dev);
1337         if (reschedule)
1338                 netif_schedule(dev);
1339 }
1340
1341 static void ieee80211_clear_tx_pending(struct ieee80211_local *local)
1342 {
1343         int i, j;
1344         struct ieee80211_tx_stored_packet *store;
1345
1346         for (i = 0; i < local->hw.queues; i++) {
1347                 if (!__ieee80211_queue_pending(local, i))
1348                         continue;
1349                 store = &local->pending_packet[i];
1350                 kfree_skb(store->skb);
1351                 for (j = 0; j < store->num_extra_frag; j++)
1352                         kfree_skb(store->extra_frag[j]);
1353                 kfree(store->extra_frag);
1354                 clear_bit(IEEE80211_LINK_STATE_PENDING, &local->state[i]);
1355         }
1356 }
1357
1358 static int ieee80211_master_start_xmit(struct sk_buff *skb,
1359                                        struct net_device *dev)
1360 {
1361         struct ieee80211_tx_control control;
1362         struct ieee80211_tx_packet_data *pkt_data;
1363         struct net_device *odev = NULL;
1364         struct ieee80211_sub_if_data *osdata;
1365         int ret;
1366
1367         /*
1368          * copy control out of the skb so other people can use skb->cb
1369          */
1370         pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
1371         memset(&control, 0, sizeof(struct ieee80211_tx_control));
1372
1373         if (pkt_data->ifindex)
1374                 odev = dev_get_by_index(pkt_data->ifindex);
1375         if (unlikely(odev && !is_ieee80211_device(odev, dev))) {
1376                 dev_put(odev);
1377                 odev = NULL;
1378         }
1379         if (unlikely(!odev)) {
1380 #ifdef CONFIG_D80211_VERBOSE_DEBUG
1381                 printk(KERN_DEBUG "%s: Discarded packet with nonexistent "
1382                        "originating device\n", dev->name);
1383 #endif
1384                 dev_kfree_skb(skb);
1385                 return 0;
1386         }
1387         osdata = IEEE80211_DEV_TO_SUB_IF(odev);
1388
1389         control.ifindex = odev->ifindex;
1390         control.type = osdata->type;
1391         if (pkt_data->req_tx_status)
1392                 control.flags |= IEEE80211_TXCTL_REQ_TX_STATUS;
1393         if (pkt_data->do_not_encrypt)
1394                 control.flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
1395         if (pkt_data->requeue)
1396                 control.flags |= IEEE80211_TXCTL_REQUEUE;
1397         control.queue = pkt_data->queue;
1398
1399         ret = ieee80211_tx(odev, skb, &control,
1400                            control.type == IEEE80211_IF_TYPE_MGMT);
1401         dev_put(odev);
1402
1403         return ret;
1404 }
1405
1406
1407 /**
1408  * ieee80211_subif_start_xmit - netif start_xmit function for Ethernet-type
1409  * subinterfaces (wlan#, WDS, and VLAN interfaces)
1410  * @skb: packet to be sent
1411  * @dev: incoming interface
1412  *
1413  * Returns: 0 on success (and frees skb in this case) or 1 on failure (skb will
1414  * not be freed, and caller is responsible for either retrying later or freeing
1415  * skb).
1416  *
1417  * This function takes in an Ethernet header and encapsulates it with suitable
1418  * IEEE 802.11 header based on which interface the packet is coming in. The
1419  * encapsulated packet will then be passed to master interface, wlan#.11, for
1420  * transmission (through low-level driver).
1421  */
1422 static int ieee80211_subif_start_xmit(struct sk_buff *skb,
1423                                       struct net_device *dev)
1424 {
1425         struct ieee80211_local *local = dev->ieee80211_ptr;
1426         struct ieee80211_tx_packet_data *pkt_data;
1427         struct ieee80211_sub_if_data *sdata;
1428         int ret = 1, head_need;
1429         u16 ethertype, hdrlen, fc;
1430         struct ieee80211_hdr hdr;
1431         u8 *encaps_data;
1432         int encaps_len, skip_header_bytes;
1433         int nh_pos, h_pos, no_encrypt = 0;
1434         struct sta_info *sta;
1435
1436         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1437         if (unlikely(skb->len < ETH_HLEN)) {
1438                 printk(KERN_DEBUG "%s: short skb (len=%d)\n",
1439                        dev->name, skb->len);
1440                 ret = 0;
1441                 goto fail;
1442         }
1443
1444         nh_pos = skb->nh.raw - skb->data;
1445         h_pos = skb->h.raw - skb->data;
1446
1447         /* convert Ethernet header to proper 802.11 header (based on
1448          * operation mode) */
1449         ethertype = (skb->data[12] << 8) | skb->data[13];
1450         /* TODO: handling for 802.1x authorized/unauthorized port */
1451         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
1452
1453         if (likely(sdata->type == IEEE80211_IF_TYPE_AP ||
1454                    sdata->type == IEEE80211_IF_TYPE_VLAN)) {
1455                 fc |= IEEE80211_FCTL_FROMDS;
1456                 /* DA BSSID SA */
1457                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
1458                 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
1459                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
1460                 hdrlen = 24;
1461         } else if (sdata->type == IEEE80211_IF_TYPE_WDS) {
1462                 fc |= IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS;
1463                 /* RA TA DA SA */
1464                 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
1465                 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
1466                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
1467                 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
1468                 hdrlen = 30;
1469         } else if (sdata->type == IEEE80211_IF_TYPE_STA) {
1470                 fc |= IEEE80211_FCTL_TODS;
1471                 /* BSSID SA DA */
1472                 memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN);
1473                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
1474                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
1475                 hdrlen = 24;
1476         } else if (sdata->type == IEEE80211_IF_TYPE_IBSS) {
1477                 /* DA SA BSSID */
1478                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
1479                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
1480                 memcpy(hdr.addr3, sdata->u.sta.bssid, ETH_ALEN);
1481                 hdrlen = 24;
1482         } else {
1483                 ret = 0;
1484                 goto fail;
1485         }
1486
1487         /* receiver is QoS enabled, use a QoS type frame */
1488         sta = sta_info_get(local, hdr.addr1);
1489         if (sta) {
1490                 if (sta->flags & WLAN_STA_WME) {
1491                         fc |= IEEE80211_STYPE_QOS_DATA;
1492                         hdrlen += 2;
1493                 }
1494                 sta_info_put(sta);
1495         }
1496
1497         hdr.frame_control = cpu_to_le16(fc);
1498         hdr.duration_id = 0;
1499         hdr.seq_ctrl = 0;
1500
1501         skip_header_bytes = ETH_HLEN;
1502         if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
1503                 encaps_data = bridge_tunnel_header;
1504                 encaps_len = sizeof(bridge_tunnel_header);
1505                 skip_header_bytes -= 2;
1506         } else if (ethertype >= 0x600) {
1507                 encaps_data = rfc1042_header;
1508                 encaps_len = sizeof(rfc1042_header);
1509                 skip_header_bytes -= 2;
1510         } else {
1511                 encaps_data = NULL;
1512                 encaps_len = 0;
1513         }
1514
1515         skb_pull(skb, skip_header_bytes);
1516         nh_pos -= skip_header_bytes;
1517         h_pos -= skip_header_bytes;
1518
1519         /* TODO: implement support for fragments so that there is no need to
1520          * reallocate and copy payload; it might be enough to support one
1521          * extra fragment that would be copied in the beginning of the frame
1522          * data.. anyway, it would be nice to include this into skb structure
1523          * somehow
1524          *
1525          * There are few options for this:
1526          * use skb->cb as an extra space for 802.11 header
1527          * allocate new buffer if not enough headroom
1528          * make sure that there is enough headroom in every skb by increasing
1529          * build in headroom in __dev_alloc_skb() (linux/skbuff.h) and
1530          * alloc_skb() (net/core/skbuff.c)
1531          */
1532         head_need = hdrlen + encaps_len + local->hw.extra_tx_headroom;
1533         head_need -= skb_headroom(skb);
1534
1535         /* We are going to modify skb data, so make a copy of it if happens to
1536          * be cloned. This could happen, e.g., with Linux bridge code passing
1537          * us broadcast frames. */
1538
1539         if (head_need > 0 || skb_cloned(skb)) {
1540 #if 0
1541                 printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
1542                        "of headroom\n", dev->name, head_need);
1543 #endif
1544
1545                 if (skb_cloned(skb))
1546                         I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
1547                 else
1548                         I802_DEBUG_INC(local->tx_expand_skb_head);
1549                 /* Since we have to reallocate the buffer, make sure that there
1550                  * is enough room for possible WEP IV/ICV and TKIP (8 bytes
1551                  * before payload and 12 after). */
1552                 if (pskb_expand_head(skb, (head_need > 0 ? head_need + 8 : 8),
1553                                      12, GFP_ATOMIC)) {
1554                         printk(KERN_DEBUG "%s: failed to reallocate TX buffer"
1555                                "\n", dev->name);
1556                         goto fail;
1557                 }
1558         }
1559
1560         if (encaps_data) {
1561                 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
1562                 nh_pos += encaps_len;
1563                 h_pos += encaps_len;
1564         }
1565         memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
1566         nh_pos += hdrlen;
1567         h_pos += hdrlen;
1568
1569         pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
1570         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
1571         pkt_data->ifindex = sdata->dev->ifindex;
1572         pkt_data->mgmt_iface = (sdata->type == IEEE80211_IF_TYPE_MGMT);
1573         pkt_data->do_not_encrypt = no_encrypt;
1574
1575         skb->dev = local->mdev;
1576         sdata->stats.tx_packets++;
1577         sdata->stats.tx_bytes += skb->len;
1578
1579         /* Update skb pointers to various headers since this modified frame
1580          * is going to go through Linux networking code that may potentially
1581          * need things like pointer to IP header. */
1582         skb->mac.raw = skb->data;
1583         skb->nh.raw = skb->data + nh_pos;
1584         skb->h.raw = skb->data + h_pos;
1585
1586         dev_queue_xmit(skb);
1587
1588         return 0;
1589
1590  fail:
1591         if (!ret)
1592                 dev_kfree_skb(skb);
1593
1594         return ret;
1595 }
1596
1597
1598 /*
1599  * This is the transmit routine for the 802.11 type interfaces
1600  * called by upper layers of the linux networking
1601  * stack when it has a frame to transmit
1602  */
1603 static int
1604 ieee80211_mgmt_start_xmit(struct sk_buff *skb, struct net_device *dev)
1605 {
1606         struct ieee80211_sub_if_data *sdata;
1607         struct ieee80211_tx_packet_data *pkt_data;
1608         struct ieee80211_hdr *hdr;
1609         u16 fc;
1610
1611         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1612
1613         if (skb->len < 10) {
1614                 dev_kfree_skb(skb);
1615                 return 0;
1616         }
1617
1618         hdr = (struct ieee80211_hdr *) skb->data;
1619         fc = le16_to_cpu(hdr->frame_control);
1620
1621         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
1622         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
1623         pkt_data->ifindex = sdata->dev->ifindex;
1624         pkt_data->mgmt_iface = (sdata->type == IEEE80211_IF_TYPE_MGMT);
1625
1626         skb->priority = 20; /* use hardcoded priority for mgmt TX queue */
1627         skb->dev = sdata->local->mdev;
1628
1629         /*
1630          * We're using the protocol field of the the frame control header
1631          * to request TX callback for hostapd. BIT(1) is checked.
1632          */
1633         if ((fc & BIT(1)) == BIT(1)) {
1634                 pkt_data->req_tx_status = 1;
1635                 fc &= ~BIT(1);
1636                 hdr->frame_control = cpu_to_le16(fc);
1637         }
1638
1639         pkt_data->do_not_encrypt = !(fc & IEEE80211_FCTL_PROTECTED);
1640
1641         sdata->stats.tx_packets++;
1642         sdata->stats.tx_bytes += skb->len;
1643
1644         dev_queue_xmit(skb);
1645
1646         return 0;
1647 }
1648
1649
1650 static void ieee80211_beacon_add_tim(struct ieee80211_local *local,
1651                                      struct ieee80211_if_ap *bss,
1652                                      struct sk_buff *skb)
1653 {
1654         u8 *pos, *tim;
1655         int aid0 = 0;
1656         int i, have_bits = 0, n1, n2;
1657
1658         /* Generate bitmap for TIM only if there are any STAs in power save
1659          * mode. */
1660         spin_lock_bh(&local->sta_lock);
1661         if (atomic_read(&bss->num_sta_ps) > 0)
1662                 /* in the hope that this is faster than
1663                  * checking byte-for-byte */
1664                 have_bits = !bitmap_empty((unsigned long*)bss->tim,
1665                                           IEEE80211_MAX_AID+1);
1666
1667         if (bss->dtim_count == 0)
1668                 bss->dtim_count = bss->dtim_period - 1;
1669         else
1670                 bss->dtim_count--;
1671
1672         tim = pos = (u8 *) skb_put(skb, 6);
1673         *pos++ = WLAN_EID_TIM;
1674         *pos++ = 4;
1675         *pos++ = bss->dtim_count;
1676         *pos++ = bss->dtim_period;
1677
1678         if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
1679                 aid0 = 1;
1680
1681         if (have_bits) {
1682                 /* Find largest even number N1 so that bits numbered 1 through
1683                  * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
1684                  * (N2 + 1) x 8 through 2007 are 0. */
1685                 n1 = 0;
1686                 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
1687                         if (bss->tim[i]) {
1688                                 n1 = i & 0xfe;
1689                                 break;
1690                         }
1691                 }
1692                 n2 = n1;
1693                 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
1694                         if (bss->tim[i]) {
1695                                 n2 = i;
1696                                 break;
1697                         }
1698                 }
1699
1700                 /* Bitmap control */
1701                 *pos++ = n1 | aid0;
1702                 /* Part Virt Bitmap */
1703                 memcpy(pos, bss->tim + n1, n2 - n1 + 1);
1704
1705                 tim[1] = n2 - n1 + 4;
1706                 skb_put(skb, n2 - n1);
1707         } else {
1708                 *pos++ = aid0; /* Bitmap control */
1709                 *pos++ = 0; /* Part Virt Bitmap */
1710         }
1711         spin_unlock_bh(&local->sta_lock);
1712 }
1713
1714
1715 struct sk_buff * ieee80211_beacon_get(struct ieee80211_hw *hw, int if_id,
1716                                       struct ieee80211_tx_control *control)
1717 {
1718         struct ieee80211_local *local = hw_to_local(hw);
1719         struct sk_buff *skb;
1720         struct net_device *bdev;
1721         struct ieee80211_sub_if_data *sdata = NULL;
1722         struct ieee80211_if_ap *ap = NULL;
1723         struct ieee80211_rate *rate;
1724         struct rate_control_extra extra;
1725         u8 *b_head, *b_tail;
1726         int bh_len, bt_len;
1727
1728         bdev = dev_get_by_index(if_id);
1729         if (bdev) {
1730                 sdata = IEEE80211_DEV_TO_SUB_IF(bdev);
1731                 ap = &sdata->u.ap;
1732                 dev_put(bdev);
1733         }
1734
1735         if (!ap || sdata->type != IEEE80211_IF_TYPE_AP ||
1736             !ap->beacon_head) {
1737 #ifdef CONFIG_D80211_VERBOSE_DEBUG
1738                 if (net_ratelimit())
1739                         printk(KERN_DEBUG "no beacon data avail for idx=%d "
1740                                "(%s)\n", if_id, bdev ? bdev->name : "N/A");
1741 #endif /* CONFIG_D80211_VERBOSE_DEBUG */
1742                 return NULL;
1743         }
1744
1745         /* Assume we are generating the normal beacon locally */
1746         b_head = ap->beacon_head;
1747         b_tail = ap->beacon_tail;
1748         bh_len = ap->beacon_head_len;
1749         bt_len = ap->beacon_tail_len;
1750
1751         skb = dev_alloc_skb(bh_len + bt_len + 256 /* maximum TIM len */);
1752         if (!skb)
1753                 return NULL;
1754
1755         memcpy(skb_put(skb, bh_len), b_head, bh_len);
1756
1757         ieee80211_beacon_add_tim(local, ap, skb);
1758
1759         if (b_tail) {
1760                 memcpy(skb_put(skb, bt_len), b_tail, bt_len);
1761         }
1762
1763         if (control) {
1764                 memset(&extra, 0, sizeof(extra));
1765                 extra.endidx = local->num_curr_rates;
1766
1767                 rate = rate_control_get_rate(local, local->mdev, skb, &extra);
1768                 if (!rate) {
1769                         if (net_ratelimit()) {
1770                                 printk(KERN_DEBUG "%s: ieee80211_beacon_get: no rate "
1771                                        "found\n", local->mdev->name);
1772                         }
1773                         dev_kfree_skb(skb);
1774                         return NULL;
1775                 }
1776
1777                 control->tx_rate = (local->short_preamble &&
1778                                     (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
1779                         rate->val2 : rate->val;
1780                 control->antenna_sel = local->hw.conf.antenna_sel;
1781                 control->power_level = local->hw.conf.power_level;
1782                 control->flags |= IEEE80211_TXCTL_NO_ACK;
1783                 control->retry_limit = 1;
1784                 control->rts_cts_duration = 0;
1785                 control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
1786         }
1787
1788         ap->num_beacons++;
1789         return skb;
1790 }
1791 EXPORT_SYMBOL(ieee80211_beacon_get);
1792
1793 struct sk_buff *
1794 ieee80211_get_buffered_bc(struct ieee80211_hw *hw, int if_id,
1795                           struct ieee80211_tx_control *control)
1796 {
1797         struct ieee80211_local *local = hw_to_local(hw);
1798         struct sk_buff *skb;
1799         struct sta_info *sta;
1800         ieee80211_tx_handler *handler;
1801         struct ieee80211_txrx_data tx;
1802         ieee80211_txrx_result res = TXRX_DROP;
1803         struct net_device *bdev;
1804         struct ieee80211_sub_if_data *sdata;
1805         struct ieee80211_if_ap *bss = NULL;
1806
1807         bdev = dev_get_by_index(if_id);
1808         if (bdev) {
1809                 sdata = IEEE80211_DEV_TO_SUB_IF(bdev);
1810                 bss = &sdata->u.ap;
1811                 dev_put(bdev);
1812         }
1813         if (!bss || sdata->type != IEEE80211_IF_TYPE_AP || !bss->beacon_head)
1814                 return NULL;
1815
1816         if (bss->dtim_count != 0)
1817                 return NULL; /* send buffered bc/mc only after DTIM beacon */
1818         skb = skb_dequeue(&bss->ps_bc_buf);
1819         memset(control, 0, sizeof(*control));
1820         if (!skb)
1821                 return NULL;
1822         local->total_ps_buffered--;
1823
1824         if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
1825                 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1826                 /* more buffered multicast/broadcast frames ==> set MoreData
1827                  * flag in IEEE 802.11 header to inform PS STAs */
1828                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1829         }
1830
1831         ieee80211_tx_prepare(&tx, skb, local->mdev, control);
1832         sta = tx.sta;
1833         tx.u.tx.ps_buffered = 1;
1834
1835         for (handler = local->tx_handlers; *handler != NULL; handler++) {
1836                 res = (*handler)(&tx);
1837                 if (res == TXRX_DROP || res == TXRX_QUEUED)
1838                         break;
1839         }
1840         dev_put(tx.dev);
1841         skb = tx.skb; /* handlers are allowed to change skb */
1842
1843         if (res == TXRX_DROP) {
1844                 I802_DEBUG_INC(local->tx_handlers_drop);
1845                 dev_kfree_skb(skb);
1846                 skb = NULL;
1847         } else if (res == TXRX_QUEUED) {
1848                 I802_DEBUG_INC(local->tx_handlers_queued);
1849                 skb = NULL;
1850         }
1851
1852         if (sta)
1853                 sta_info_put(sta);
1854
1855         return skb;
1856 }
1857 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
1858
1859 static int __ieee80211_if_config(struct net_device *dev,
1860                                  struct sk_buff *beacon)
1861 {
1862         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1863         struct ieee80211_local *local = dev->ieee80211_ptr;
1864         struct ieee80211_if_conf conf;
1865
1866         if (!local->ops->config_interface || !netif_running(dev))
1867                 return 0;
1868
1869         memset(&conf, 0, sizeof(conf));
1870         conf.type = sdata->type;
1871         if (sdata->type == IEEE80211_IF_TYPE_STA ||
1872             sdata->type == IEEE80211_IF_TYPE_IBSS) {
1873                 conf.bssid = sdata->u.sta.bssid;
1874                 conf.ssid = sdata->u.sta.ssid;
1875                 conf.ssid_len = sdata->u.sta.ssid_len;
1876                 conf.generic_elem = sdata->u.sta.extra_ie;
1877                 conf.generic_elem_len = sdata->u.sta.extra_ie_len;
1878         } else if (sdata->type == IEEE80211_IF_TYPE_AP) {
1879                 conf.ssid = sdata->u.ap.ssid;
1880                 conf.ssid_len = sdata->u.ap.ssid_len;
1881                 conf.generic_elem = sdata->u.ap.generic_elem;
1882                 conf.generic_elem_len = sdata->u.ap.generic_elem_len;
1883                 conf.beacon = beacon;
1884         }
1885         return local->ops->config_interface(local_to_hw(local),
1886                                            dev->ifindex, &conf);
1887 }
1888
1889 int ieee80211_if_config(struct net_device *dev)
1890 {
1891         return __ieee80211_if_config(dev, NULL);
1892 }
1893
1894 int ieee80211_if_config_beacon(struct net_device *dev)
1895 {
1896         struct ieee80211_local *local = dev->ieee80211_ptr;
1897         struct sk_buff *skb;
1898
1899         if (!(local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
1900                 return 0;
1901         skb = ieee80211_beacon_get(local_to_hw(local), dev->ifindex, NULL);
1902         if (!skb)
1903                 return -ENOMEM;
1904         return __ieee80211_if_config(dev, skb);
1905 }
1906
1907 int ieee80211_hw_config(struct ieee80211_local *local)
1908 {
1909         struct ieee80211_hw_mode *mode;
1910         int ret = 0;
1911
1912 #ifdef CONFIG_D80211_VERBOSE_DEBUG
1913         printk(KERN_DEBUG "HW CONFIG: channel=%d freq=%d "
1914                "phymode=%d\n", local->hw.conf.channel, local->hw.conf.freq,
1915                local->hw.conf.phymode);
1916 #endif /* CONFIG_D80211_VERBOSE_DEBUG */
1917
1918         if (local->ops->config)
1919                 ret = local->ops->config(local_to_hw(local), &local->hw.conf);
1920
1921         list_for_each_entry(mode, &local->modes_list, list) {
1922                 if (mode->mode == local->hw.conf.phymode) {
1923                         if (local->curr_rates != mode->rates)
1924                                 rate_control_clear(local);
1925                         local->curr_rates = mode->rates;
1926                         local->num_curr_rates = mode->num_rates;
1927                         ieee80211_prepare_rates(local);
1928                         break;
1929                 }
1930         }
1931
1932         return ret;
1933 }
1934
1935
1936 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
1937 {
1938         /* FIX: what would be proper limits for MTU?
1939          * This interface uses 802.3 frames. */
1940         if (new_mtu < 256 || new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6) {
1941                 printk(KERN_WARNING "%s: invalid MTU %d\n",
1942                        dev->name, new_mtu);
1943                 return -EINVAL;
1944         }
1945
1946 #ifdef CONFIG_D80211_VERBOSE_DEBUG
1947         printk(KERN_DEBUG "%s: setting MTU %d\n", dev->name, new_mtu);
1948 #endif /* CONFIG_D80211_VERBOSE_DEBUG */
1949         dev->mtu = new_mtu;
1950         return 0;
1951 }
1952
1953
1954 static int ieee80211_change_mtu_apdev(struct net_device *dev, int new_mtu)
1955 {
1956         /* FIX: what would be proper limits for MTU?
1957          * This interface uses 802.11 frames. */
1958         if (new_mtu < 256 || new_mtu > IEEE80211_MAX_DATA_LEN) {
1959                 printk(KERN_WARNING "%s: invalid MTU %d\n",
1960                        dev->name, new_mtu);
1961                 return -EINVAL;
1962         }
1963
1964 #ifdef CONFIG_D80211_VERBOSE_DEBUG
1965         printk(KERN_DEBUG "%s: setting MTU %d\n", dev->name, new_mtu);
1966 #endif /* CONFIG_D80211_VERBOSE_DEBUG */
1967         dev->mtu = new_mtu;
1968         return 0;
1969 }
1970
1971
1972 static void ieee80211_tx_timeout(struct net_device *dev)
1973 {
1974         struct ieee80211_local *local = dev->ieee80211_ptr;
1975
1976         printk(KERN_WARNING "%s: resetting interface.\n", dev->name);
1977
1978         if (local->ops->reset(local_to_hw(local)))
1979                 printk(KERN_ERR "%s: failed to reset interface.\n", dev->name);
1980         else
1981                 netif_wake_queue(dev);
1982 }
1983
1984
1985 static int ieee80211_set_mac_address(struct net_device *dev, void *addr)
1986 {
1987         struct sockaddr *a = addr;
1988
1989         if (netif_running(dev))
1990                 return -EBUSY;
1991
1992         memcpy(dev->dev_addr, a->sa_data, ETH_ALEN);
1993         return 0;
1994 }
1995
1996 static void ieee80211_set_multicast_list(struct net_device *dev)
1997 {
1998         struct ieee80211_local *local = dev->ieee80211_ptr;
1999         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2000         unsigned short flags;
2001
2002         if (((dev->flags & IFF_ALLMULTI) != 0) ^ (sdata->allmulti != 0)) {
2003                 if (sdata->allmulti) {
2004                         sdata->allmulti = 0;
2005                         local->iff_allmultis--;
2006                 } else {
2007                         sdata->allmulti = 1;
2008                         local->iff_allmultis++;
2009                 }
2010         }
2011         if (((dev->flags & IFF_PROMISC) != 0) ^ (sdata->promisc != 0)) {
2012                 if (sdata->promisc) {
2013                         sdata->promisc = 0;
2014                         local->iff_promiscs--;
2015                 } else {
2016                         sdata->promisc = 1;
2017                         local->iff_promiscs++;
2018                 }
2019         }
2020         if (dev->mc_count != sdata->mc_count) {
2021                 local->mc_count = local->mc_count - sdata->mc_count +
2022                                   dev->mc_count;
2023                 sdata->mc_count = dev->mc_count;
2024         }
2025         if (local->ops->set_multicast_list) {
2026                 flags = local->mdev->flags;
2027                 if (local->iff_allmultis)
2028                         flags |= IFF_ALLMULTI;
2029                 if (local->iff_promiscs)
2030                         flags |= IFF_PROMISC;
2031                 local->ops->set_multicast_list(local_to_hw(local), flags,
2032                                               local->mc_count);
2033         }
2034 }
2035
2036 struct dev_mc_list *ieee80211_get_mc_list_item(struct ieee80211_hw *hw,
2037                                                struct dev_mc_list *prev,
2038                                                void **ptr)
2039 {
2040         struct ieee80211_local *local = hw_to_local(hw);
2041         struct ieee80211_sub_if_data *sdata = *ptr;
2042         struct dev_mc_list *mc;
2043
2044         if (!prev) {
2045                 WARN_ON(sdata);
2046                 sdata = NULL;
2047         }
2048         if (!prev || !prev->next) {
2049                 if (sdata)
2050                         sdata = list_entry(sdata->list.next,
2051                                            struct ieee80211_sub_if_data, list);
2052                 else
2053                         sdata = list_entry(local->sub_if_list.next,
2054                                            struct ieee80211_sub_if_data, list);
2055                 if (&sdata->list != &local->sub_if_list)
2056                         mc = sdata->dev->mc_list;
2057                 else
2058                         mc = NULL;
2059         } else
2060                 mc = prev->next;
2061
2062         *ptr = sdata;
2063         return mc;
2064 }
2065 EXPORT_SYMBOL(ieee80211_get_mc_list_item);
2066
2067 static struct net_device_stats *ieee80211_get_stats(struct net_device *dev)
2068 {
2069         struct ieee80211_sub_if_data *sdata;
2070         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2071         return &(sdata->stats);
2072 }
2073
2074 void ieee80211_if_shutdown(struct net_device *dev)
2075 {
2076         struct ieee80211_local *local = dev->ieee80211_ptr;
2077         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2078
2079         ASSERT_RTNL();
2080         switch (sdata->type) {
2081         case IEEE80211_IF_TYPE_STA:
2082         case IEEE80211_IF_TYPE_IBSS:
2083                 sdata->u.sta.state = IEEE80211_DISABLED;
2084                 cancel_delayed_work(&sdata->u.sta.work);
2085                 if (!local->ops->hw_scan &&
2086                     local->scan_dev == sdata->dev) {
2087                         local->sta_scanning = 0;
2088                         cancel_delayed_work(&local->scan_work);
2089                         flush_scheduled_work();
2090                         /* see comment in ieee80211_unregister_hw to
2091                          * understand why this works */
2092                         local->scan_dev = NULL;
2093                 } else
2094                         flush_scheduled_work();
2095                 break;
2096         }
2097 }
2098
2099 static inline int identical_mac_addr_allowed(int type1, int type2)
2100 {
2101         return (type1 == IEEE80211_IF_TYPE_MNTR ||
2102                 type2 == IEEE80211_IF_TYPE_MNTR ||
2103                 (type1 == IEEE80211_IF_TYPE_AP &&
2104                  type2 == IEEE80211_IF_TYPE_WDS) ||
2105                 (type1 == IEEE80211_IF_TYPE_WDS &&
2106                  (type2 == IEEE80211_IF_TYPE_WDS ||
2107                   type2 == IEEE80211_IF_TYPE_AP)) ||
2108                 (type1 == IEEE80211_IF_TYPE_AP &&
2109                  type2 == IEEE80211_IF_TYPE_VLAN) ||
2110                 (type1 == IEEE80211_IF_TYPE_VLAN &&
2111                  (type2 == IEEE80211_IF_TYPE_AP ||
2112                   type2 == IEEE80211_IF_TYPE_VLAN)));
2113 }
2114
2115 static int ieee80211_master_open(struct net_device *dev)
2116 {
2117         struct ieee80211_local *local = dev->ieee80211_ptr;
2118         struct ieee80211_sub_if_data *sdata;
2119         int res = -EOPNOTSUPP;
2120
2121         list_for_each_entry(sdata, &local->sub_if_list, list) {
2122                 if (sdata->dev != dev && netif_running(sdata->dev)) {
2123                         res = 0;
2124                         tasklet_enable(&local->tx_pending_tasklet);
2125                         break;
2126                 }
2127         }
2128         return res;
2129 }
2130
2131 static int ieee80211_master_stop(struct net_device *dev)
2132 {
2133         struct ieee80211_local *local = dev->ieee80211_ptr;
2134         struct ieee80211_sub_if_data *sdata;
2135
2136         tasklet_disable(&local->tx_pending_tasklet);
2137         list_for_each_entry(sdata, &local->sub_if_list, list) {
2138                 if (sdata->dev != dev && netif_running(sdata->dev))
2139                         return -EOPNOTSUPP;
2140         }
2141         return 0;
2142 }
2143
2144 static int ieee80211_mgmt_open(struct net_device *dev)
2145 {
2146         struct ieee80211_local *local = dev->ieee80211_ptr;
2147
2148         if (!netif_running(local->mdev))
2149                 return -EOPNOTSUPP;
2150         return 0;
2151 }
2152
2153 static int ieee80211_mgmt_stop(struct net_device *dev)
2154 {
2155         return 0;
2156 }
2157
2158 /* Check if running monitor interfaces should go to a "soft monitor" mode
2159  * and switch them if necessary. */
2160 static inline void ieee80211_start_soft_monitor(struct ieee80211_local *local)
2161 {
2162         struct ieee80211_if_init_conf conf;
2163
2164         if (local->open_count && local->open_count == local->monitors &&
2165             !(local->hw.flags & IEEE80211_HW_MONITOR_DURING_OPER) &&
2166             local->ops->remove_interface) {
2167                 conf.if_id = -1;
2168                 conf.type = IEEE80211_IF_TYPE_MNTR;
2169                 conf.mac_addr = NULL;
2170                 local->ops->remove_interface(local_to_hw(local), &conf);
2171         }
2172 }
2173
2174 /* Check if running monitor interfaces should go to a "hard monitor" mode
2175  * and switch them if necessary. */
2176 static void ieee80211_start_hard_monitor(struct ieee80211_local *local)
2177 {
2178         struct ieee80211_if_init_conf conf;
2179
2180         if (local->open_count && local->open_count == local->monitors &&
2181             !(local->hw.flags & IEEE80211_HW_MONITOR_DURING_OPER) &&
2182             local->ops->add_interface) {
2183                 conf.if_id = -1;
2184                 conf.type = IEEE80211_IF_TYPE_MNTR;
2185                 conf.mac_addr = NULL;
2186                 local->ops->add_interface(local_to_hw(local), &conf);
2187         }
2188 }
2189
2190 static int ieee80211_open(struct net_device *dev)
2191 {
2192         struct ieee80211_sub_if_data *sdata, *nsdata;
2193         struct ieee80211_local *local = dev->ieee80211_ptr;
2194         struct ieee80211_if_init_conf conf;
2195         int res;
2196
2197         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2198         list_for_each_entry(nsdata, &local->sub_if_list, list) {
2199                 struct net_device *ndev = nsdata->dev;
2200
2201                 if (ndev != dev && ndev != local->mdev &&
2202                     netif_running(ndev) &&
2203                     memcmp(dev->dev_addr, ndev->dev_addr, ETH_ALEN) == 0 &&
2204                     !identical_mac_addr_allowed(sdata->type, nsdata->type)) {
2205                         return -ENOTUNIQ;
2206                 }
2207         }
2208         if (sdata->type == IEEE80211_IF_TYPE_WDS &&
2209             memcmp(sdata->u.wds.remote_addr, "\0\0\0\0\0\0", ETH_ALEN) == 0)
2210                 return -ENOLINK;
2211
2212         if (sdata->type == IEEE80211_IF_TYPE_MNTR && local->open_count &&
2213             !(local->hw.flags & IEEE80211_HW_MONITOR_DURING_OPER)) {
2214                 /* run the interface in a "soft monitor" mode */
2215                 local->monitors++;
2216                 local->open_count++;
2217                 return 0;
2218         }
2219         ieee80211_start_soft_monitor(local);
2220
2221         if (local->ops->add_interface) {
2222                 conf.if_id = dev->ifindex;
2223                 conf.type = sdata->type;
2224                 conf.mac_addr = dev->dev_addr;
2225                 res = local->ops->add_interface(local_to_hw(local), &conf);
2226                 if (res) {
2227                         if (sdata->type == IEEE80211_IF_TYPE_MNTR)
2228                                 ieee80211_start_hard_monitor(local);
2229                         return res;
2230                 }
2231         } else {
2232                 if (sdata->type != IEEE80211_IF_TYPE_STA)
2233                         return -EOPNOTSUPP;
2234                 if (local->open_count > 0)
2235                         return -ENOBUFS;
2236         }
2237
2238         if (local->open_count == 0) {
2239                 res = 0;
2240                 if (local->ops->open)
2241                         res = local->ops->open(local_to_hw(local));
2242                 if (res == 0) {
2243                         res = dev_open(local->mdev);
2244                         if (res) {
2245                                 if (local->ops->stop)
2246                                         local->ops->stop(local_to_hw(local));
2247                         } else if (local->apdev)
2248                                 dev_open(local->apdev);
2249                 }
2250                 if (res) {
2251                         if (local->ops->remove_interface)
2252                                 local->ops->remove_interface(local_to_hw(local),
2253                                                             &conf);
2254                         return res;
2255                 }
2256                 ieee80211_init_scan(local);
2257         }
2258         local->open_count++;
2259
2260         if (sdata->type == IEEE80211_IF_TYPE_MNTR)
2261                 local->monitors++;
2262         else
2263                 ieee80211_if_config(dev);
2264
2265         netif_start_queue(dev);
2266         return 0;
2267 }
2268
2269
2270 static int ieee80211_stop(struct net_device *dev)
2271 {
2272         struct ieee80211_sub_if_data *sdata;
2273         struct ieee80211_local *local = dev->ieee80211_ptr;
2274
2275         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2276
2277         if (sdata->type == IEEE80211_IF_TYPE_MNTR &&
2278             local->open_count > 1 &&
2279             !(local->hw.flags & IEEE80211_HW_MONITOR_DURING_OPER)) {
2280                 /* remove "soft monitor" interface */
2281                 local->open_count--;
2282                 local->monitors--;
2283                 return 0;
2284         }
2285
2286         netif_stop_queue(dev);
2287
2288         if (sdata->type == IEEE80211_IF_TYPE_MNTR)
2289                 local->monitors--;
2290
2291         local->open_count--;
2292         if (local->open_count == 0) {
2293                 ieee80211_stop_scan(local);
2294                 dev_close(local->mdev);
2295                 if (local->apdev)
2296                         dev_close(local->apdev);
2297                 if (local->ops->stop)
2298                         local->ops->stop(local_to_hw(local));
2299         }
2300         if (local->ops->remove_interface) {
2301                 struct ieee80211_if_init_conf conf;
2302
2303                 conf.if_id = dev->ifindex;
2304                 conf.type = sdata->type;
2305                 conf.mac_addr = dev->dev_addr;
2306                 local->ops->remove_interface(local_to_hw(local), &conf);
2307         }
2308         ieee80211_if_shutdown(dev);
2309
2310         ieee80211_start_hard_monitor(local);
2311
2312         return 0;
2313 }
2314
2315
2316 static int header_parse_80211(struct sk_buff *skb, unsigned char *haddr)
2317 {
2318         memcpy(haddr, skb->mac.raw + 10, ETH_ALEN); /* addr2 */
2319         return ETH_ALEN;
2320 }
2321
2322 static inline int ieee80211_bssid_match(u8 *raddr, u8 *addr)
2323 {
2324         return memcmp(raddr, addr, ETH_ALEN) == 0 ||
2325                is_broadcast_ether_addr(raddr);
2326 }
2327
2328
2329 static ieee80211_txrx_result
2330 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
2331 {
2332         struct net_device *dev = rx->dev;
2333         struct ieee80211_local *local = rx->local;
2334         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
2335         u16 fc, hdrlen, ethertype;
2336         u8 *payload;
2337         u8 dst[ETH_ALEN];
2338         u8 src[ETH_ALEN];
2339         struct sk_buff *skb = rx->skb, *skb2;
2340         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2341
2342         fc = rx->fc;
2343         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
2344                 return TXRX_CONTINUE;
2345
2346         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
2347                 return TXRX_DROP;
2348
2349         hdrlen = ieee80211_get_hdrlen(fc);
2350
2351         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
2352          * header
2353          * IEEE 802.11 address fields:
2354          * ToDS FromDS Addr1 Addr2 Addr3 Addr4
2355          *   0     0   DA    SA    BSSID n/a
2356          *   0     1   DA    BSSID SA    n/a
2357          *   1     0   BSSID SA    DA    n/a
2358          *   1     1   RA    TA    DA    SA
2359          */
2360
2361         switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
2362         case IEEE80211_FCTL_TODS:
2363                 /* BSSID SA DA */
2364                 memcpy(dst, hdr->addr3, ETH_ALEN);
2365                 memcpy(src, hdr->addr2, ETH_ALEN);
2366
2367                 if (unlikely(sdata->type != IEEE80211_IF_TYPE_AP &&
2368                              sdata->type != IEEE80211_IF_TYPE_VLAN)) {
2369                         printk(KERN_DEBUG "%s: dropped ToDS frame (BSSID="
2370                                MAC_FMT " SA=" MAC_FMT " DA=" MAC_FMT ")\n",
2371                                dev->name, MAC_ARG(hdr->addr1),
2372                                MAC_ARG(hdr->addr2), MAC_ARG(hdr->addr3));
2373                         return TXRX_DROP;
2374                 }
2375                 break;
2376         case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
2377                 /* RA TA DA SA */
2378                 memcpy(dst, hdr->addr3, ETH_ALEN);
2379                 memcpy(src, hdr->addr4, ETH_ALEN);
2380
2381                 if (unlikely(sdata->type != IEEE80211_IF_TYPE_WDS)) {
2382                         printk(KERN_DEBUG "%s: dropped FromDS&ToDS frame (RA="
2383                                MAC_FMT " TA=" MAC_FMT " DA=" MAC_FMT " SA="
2384                                MAC_FMT ")\n",
2385                                rx->dev->name, MAC_ARG(hdr->addr1),
2386                                MAC_ARG(hdr->addr2), MAC_ARG(hdr->addr3),
2387                                MAC_ARG(hdr->addr4));
2388                         return TXRX_DROP;
2389                 }
2390                 break;
2391         case IEEE80211_FCTL_FROMDS:
2392                 /* DA BSSID SA */
2393                 memcpy(dst, hdr->addr1, ETH_ALEN);
2394                 memcpy(src, hdr->addr3, ETH_ALEN);
2395
2396                 if (sdata->type != IEEE80211_IF_TYPE_STA) {
2397                         return TXRX_DROP;
2398                 }
2399                 break;
2400         case 0:
2401                 /* DA SA BSSID */
2402                 memcpy(dst, hdr->addr1, ETH_ALEN);
2403                 memcpy(src, hdr->addr2, ETH_ALEN);
2404
2405                 if (sdata->type != IEEE80211_IF_TYPE_IBSS) {
2406                         if (net_ratelimit()) {
2407                                 printk(KERN_DEBUG "%s: dropped IBSS frame (DA="
2408                                        MAC_FMT " SA=" MAC_FMT " BSSID=" MAC_FMT
2409                                        ")\n",
2410                                        dev->name, MAC_ARG(hdr->addr1),
2411                                        MAC_ARG(hdr->addr2),
2412                                        MAC_ARG(hdr->addr3));
2413                         }
2414                         return TXRX_DROP;
2415                 }
2416                 break;
2417         }
2418
2419         payload = skb->data + hdrlen;
2420
2421         if (unlikely(skb->len - hdrlen < 8)) {
2422                 if (net_ratelimit()) {
2423                         printk(KERN_DEBUG "%s: RX too short data frame "
2424                                "payload\n", dev->name);
2425                 }
2426                 return TXRX_DROP;
2427         }
2428
2429         ethertype = (payload[6] << 8) | payload[7];
2430
2431         if (likely((memcmp(payload, rfc1042_header, 6) == 0 &&
2432                     ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
2433                    memcmp(payload, bridge_tunnel_header, 6) == 0)) {
2434                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
2435                  * replace EtherType */
2436                 skb_pull(skb, hdrlen + 6);
2437                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
2438                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
2439         } else {
2440                 struct ethhdr *ehdr;
2441                 __be16 len;
2442                 skb_pull(skb, hdrlen);
2443                 len = htons(skb->len);
2444                 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
2445                 memcpy(ehdr->h_dest, dst, ETH_ALEN);
2446                 memcpy(ehdr->h_source, src, ETH_ALEN);
2447                 ehdr->h_proto = len;
2448         }
2449         skb->dev = dev;
2450
2451         skb2 = NULL;
2452
2453         sdata->stats.rx_packets++;
2454         sdata->stats.rx_bytes += skb->len;
2455
2456         if (local->bridge_packets && (sdata->type == IEEE80211_IF_TYPE_AP
2457             || sdata->type == IEEE80211_IF_TYPE_VLAN) && rx->u.rx.ra_match) {
2458                 if (is_multicast_ether_addr(skb->data)) {
2459                         /* send multicast frames both to higher layers in
2460                          * local net stack and back to the wireless media */
2461                         skb2 = skb_copy(skb, GFP_ATOMIC);
2462                         if (!skb2)
2463                                 printk(KERN_DEBUG "%s: failed to clone "
2464                                        "multicast frame\n", dev->name);
2465                 } else {
2466                         struct sta_info *dsta;
2467                         dsta = sta_info_get(local, skb->data);
2468                         if (dsta && !dsta->dev) {
2469                                 printk(KERN_DEBUG "Station with null dev "
2470                                        "structure!\n");
2471                         } else if (dsta && dsta->dev == dev) {
2472                                 /* Destination station is associated to this
2473                                  * AP, so send the frame directly to it and
2474                                  * do not pass the frame to local net stack.
2475                                  */
2476                                 skb2 = skb;
2477                                 skb = NULL;
2478                         }
2479                         if (dsta)
2480                                 sta_info_put(dsta);
2481                 }
2482         }
2483
2484         if (skb) {
2485                 /* deliver to local stack */
2486                 skb->protocol = eth_type_trans(skb, dev);
2487                 memset(skb->cb, 0, sizeof(skb->cb));
2488                 netif_rx(skb);
2489         }
2490
2491         if (skb2) {
2492                 /* send to wireless media */
2493                 skb2->protocol = __constant_htons(ETH_P_802_3);
2494                 skb2->mac.raw = skb2->nh.raw = skb2->data;
2495                 dev_queue_xmit(skb2);
2496         }
2497
2498         return TXRX_QUEUED;
2499 }
2500
2501
2502 static struct ieee80211_rate *
2503 ieee80211_get_rate(struct ieee80211_local *local, int phymode, int hw_rate)
2504 {
2505         struct ieee80211_hw_mode *mode;
2506         int r;
2507
2508         list_for_each_entry(mode, &local->modes_list, list) {
2509                 if (mode->mode != phymode)
2510                         continue;
2511                 for (r = 0; r < mode->num_rates; r++) {
2512                         struct ieee80211_rate *rate = &mode->rates[r];
2513                         if (rate->val == hw_rate ||
2514                             (rate->flags & IEEE80211_RATE_PREAMBLE2 &&
2515                              rate->val2 == hw_rate))
2516                                 return rate;
2517                 }
2518         }
2519
2520         return NULL;
2521 }
2522
2523 void
2524 ieee80211_fill_frame_info(struct ieee80211_local *local,
2525                           struct ieee80211_frame_info *fi,
2526                           struct ieee80211_rx_status *status)
2527 {
2528         if (status) {
2529                 struct timespec ts;
2530                 struct ieee80211_rate *rate;
2531
2532                 jiffies_to_timespec(status->hosttime, &ts);
2533                 fi->hosttime = cpu_to_be64((u64) ts.tv_sec * 1000000 +
2534                                            ts.tv_nsec / 1000);
2535                 fi->mactime = cpu_to_be64(status->mactime);
2536                 switch (status->phymode) {
2537                 case MODE_IEEE80211A:
2538                         fi->phytype = htonl(ieee80211_phytype_ofdm_dot11_a);
2539                         break;
2540                 case MODE_IEEE80211B:
2541                         fi->phytype = htonl(ieee80211_phytype_dsss_dot11_b);
2542                         break;
2543                 case MODE_IEEE80211G:
2544                         fi->phytype = htonl(ieee80211_phytype_pbcc_dot11_g);
2545                         break;
2546                 case MODE_ATHEROS_TURBO:
2547                         fi->phytype =
2548                                 htonl(ieee80211_phytype_dsss_dot11_turbo);
2549                         break;
2550                 default:
2551                         fi->phytype = 0xAAAAAAAA;
2552                         break;
2553                 }
2554                 fi->channel = htonl(status->channel);
2555                 rate = ieee80211_get_rate(local, status->phymode,
2556                                           status->rate);
2557                 if (rate) {
2558                         fi->datarate = htonl(rate->rate);
2559                         if (rate->flags & IEEE80211_RATE_PREAMBLE2) {
2560                                 if (status->rate == rate->val)
2561                                         fi->preamble = htonl(2); /* long */
2562                                 else if (status->rate == rate->val2)
2563                                         fi->preamble = htonl(1); /* short */
2564                         } else
2565                                 fi->preamble = htonl(0);
2566                 } else {
2567                         fi->datarate = htonl(0);
2568                         fi->preamble = htonl(0);
2569                 }
2570
2571                 fi->antenna = htonl(status->antenna);
2572                 fi->priority = 0xffffffff; /* no clue */
2573                 fi->ssi_type = htonl(ieee80211_ssi_raw);
2574                 fi->ssi_signal = htonl(status->ssi);
2575                 fi->ssi_noise = 0x00000000;
2576                 fi->encoding = 0;
2577         } else {
2578                 /* clear everything because we really don't know.
2579                  * the msg_type field isn't present on monitor frames
2580                  * so we don't know whether it will be present or not,
2581                  * but it's ok to not clear it since it'll be assigned
2582                  * anyway */
2583                 memset(fi, 0, sizeof(*fi) - sizeof(fi->msg_type));
2584
2585                 fi->ssi_type = htonl(ieee80211_ssi_none);
2586         }
2587         fi->version = htonl(IEEE80211_FI_VERSION);
2588         fi->length = cpu_to_be32(sizeof(*fi) - sizeof(fi->msg_type));
2589 }
2590
2591 /* this routine is actually not just for this, but also
2592  * for pushing fake 'management' frames into userspace.
2593  * it shall be replaced by a netlink-based system. */
2594 void
2595 ieee80211_rx_mgmt(struct ieee80211_local *local, struct sk_buff *skb,
2596                   struct ieee80211_rx_status *status, u32 msg_type)
2597 {
2598         struct ieee80211_frame_info *fi;
2599         const size_t hlen = sizeof(struct ieee80211_frame_info);
2600         struct ieee80211_sub_if_data *sdata;
2601
2602         skb->dev = local->apdev;
2603
2604         sdata = IEEE80211_DEV_TO_SUB_IF(local->apdev);
2605
2606         if (skb_headroom(skb) < hlen) {
2607                 I802_DEBUG_INC(local->rx_expand_skb_head);
2608                 if (pskb_expand_head(skb, hlen, 0, GFP_ATOMIC)) {
2609                         dev_kfree_skb(skb);
2610                         return;
2611                 }
2612         }
2613
2614         fi = (struct ieee80211_frame_info *) skb_push(skb, hlen);
2615
2616         ieee80211_fill_frame_info(local, fi, status);
2617         fi->msg_type = htonl(msg_type);
2618
2619         sdata->stats.rx_packets++;
2620         sdata->stats.rx_bytes += skb->len;
2621
2622         skb->mac.raw = skb->data;
2623         skb->ip_summed = CHECKSUM_UNNECESSARY;
2624         skb->pkt_type = PACKET_OTHERHOST;
2625         skb->protocol = htons(ETH_P_802_2);
2626         memset(skb->cb, 0, sizeof(skb->cb));
2627         netif_rx(skb);
2628 }
2629
2630 void
2631 ieee80211_rx_monitor(struct net_device *dev, struct sk_buff *skb,
2632                      struct ieee80211_rx_status *status)
2633 {
2634         struct ieee80211_local *local = dev->ieee80211_ptr;
2635         struct ieee80211_frame_info *fi;
2636         struct ieee80211_sub_if_data *sdata;
2637         const size_t hlen = sizeof(struct ieee80211_frame_info)
2638                                 - sizeof(fi->msg_type);
2639
2640         skb->dev = dev;
2641
2642         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2643
2644         if (skb_headroom(skb) < hlen) {
2645                 I802_DEBUG_INC(local->rx_expand_skb_head);
2646                 if (pskb_expand_head(skb, hlen, 0, GFP_ATOMIC)) {
2647                         dev_kfree_skb(skb);
2648                         return;
2649                 }
2650         }
2651
2652         fi = (struct ieee80211_frame_info *) skb_push(skb, hlen);
2653
2654         ieee80211_fill_frame_info(local, fi, status);
2655         sdata->stats.rx_packets++;
2656         sdata->stats.rx_bytes += skb->len;
2657
2658         skb->mac.raw = skb->data;
2659         skb->ip_summed = CHECKSUM_UNNECESSARY;
2660         skb->pkt_type = PACKET_OTHERHOST;
2661         skb->protocol = htons(ETH_P_802_2);
2662         memset(skb->cb, 0, sizeof(skb->cb));
2663         netif_rx(skb);
2664 }
2665
2666 int ieee80211_radar_status(struct ieee80211_hw *hw, int channel,
2667                            int radar, int radar_type)
2668 {
2669         struct sk_buff *skb;
2670         struct ieee80211_radar_info *msg;
2671         struct ieee80211_local *local = hw_to_local(hw);
2672
2673         if (!local->apdev)
2674                 return 0;
2675
2676         skb = dev_alloc_skb(sizeof(struct ieee80211_frame_info) +
2677                             sizeof(struct ieee80211_radar_info));
2678
2679         if (!skb)
2680                 return -ENOMEM;
2681         skb_reserve(skb, sizeof(struct ieee80211_frame_info));
2682
2683         msg = (struct ieee80211_radar_info *)
2684                 skb_put(skb, sizeof(struct ieee80211_radar_info));
2685         msg->channel = channel;
2686         msg->radar = radar;
2687         msg->radar_type = radar_type;
2688
2689         ieee80211_rx_mgmt(local, skb, NULL, ieee80211_msg_radar);
2690         return 0;
2691 }
2692 EXPORT_SYMBOL(ieee80211_radar_status);
2693
2694 int ieee80211_set_aid_for_sta(struct ieee80211_hw *hw, u8 *peer_address,
2695                               u16 aid)
2696 {
2697         struct sk_buff *skb;
2698         struct ieee80211_msg_set_aid_for_sta *msg;
2699         struct ieee80211_local *local = hw_to_local(hw);
2700
2701         /* unlikely because if this event only happens for APs,
2702          * which require an open ap device. */
2703         if (unlikely(!local->apdev))
2704                 return 0;
2705
2706         skb = dev_alloc_skb(sizeof(struct ieee80211_frame_info) +
2707                             sizeof(struct ieee80211_msg_set_aid_for_sta));
2708
2709         if (!skb)
2710                 return -ENOMEM;
2711         skb_reserve(skb, sizeof(struct ieee80211_frame_info));
2712
2713         msg = (struct ieee80211_msg_set_aid_for_sta *)
2714                 skb_put(skb, sizeof(struct ieee80211_msg_set_aid_for_sta));
2715         memcpy(msg->sta_address, peer_address, ETH_ALEN);
2716         msg->aid = aid;
2717
2718         ieee80211_rx_mgmt(local, skb, NULL, ieee80211_msg_set_aid_for_sta);
2719         return 0;
2720 }
2721 EXPORT_SYMBOL(ieee80211_set_aid_for_sta);
2722
2723 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
2724 {
2725         struct ieee80211_sub_if_data *sdata;
2726         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
2727
2728         if (sdata->bss)
2729                 atomic_inc(&sdata->bss->num_sta_ps);
2730         sta->flags |= WLAN_STA_PS;
2731         sta->pspoll = 0;
2732 #ifdef CONFIG_D80211_VERBOSE_PS_DEBUG
2733         printk(KERN_DEBUG "%s: STA " MAC_FMT " aid %d enters power "
2734                "save mode\n", dev->name, MAC_ARG(sta->addr), sta->aid);
2735 #endif /* CONFIG_D80211_VERBOSE_PS_DEBUG */
2736 }
2737
2738
2739 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
2740 {
2741         struct ieee80211_local *local = dev->ieee80211_ptr;
2742         struct sk_buff *skb;
2743         int sent = 0;
2744         struct ieee80211_sub_if_data *sdata;
2745         struct ieee80211_tx_packet_data *pkt_data;
2746
2747         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
2748         if (sdata->bss)
2749                 atomic_dec(&sdata->bss->num_sta_ps);
2750         sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
2751         sta->pspoll = 0;
2752         if (!skb_queue_empty(&sta->ps_tx_buf)) {
2753                 if (local->ops->set_tim)
2754                         local->ops->set_tim(local_to_hw(local), sta->aid, 0);
2755                 if (sdata->bss)
2756                         bss_tim_clear(local, sdata->bss, sta->aid);
2757         }
2758 #ifdef CONFIG_D80211_VERBOSE_PS_DEBUG
2759         printk(KERN_DEBUG "%s: STA " MAC_FMT " aid %d exits power "
2760                "save mode\n", dev->name, MAC_ARG(sta->addr), sta->aid);
2761 #endif /* CONFIG_D80211_VERBOSE_PS_DEBUG */
2762         /* Send all buffered frames to the station */
2763         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
2764                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
2765                 sent++;
2766                 pkt_data->requeue = 1;
2767                 dev_queue_xmit(skb);
2768         }
2769         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
2770                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
2771                 local->total_ps_buffered--;
2772                 sent++;
2773 #ifdef CONFIG_D80211_VERBOSE_PS_DEBUG
2774                 printk(KERN_DEBUG "%s: STA " MAC_FMT " aid %d send PS frame "
2775                        "since STA not sleeping anymore\n", dev->name,
2776                        MAC_ARG(sta->addr), sta->aid);
2777 #endif /* CONFIG_D80211_VERBOSE_PS_DEBUG */
2778                 pkt_data->requeue = 1;
2779                 dev_queue_xmit(skb);
2780         }
2781
2782         return sent;
2783 }
2784
2785
2786 static ieee80211_txrx_result
2787 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
2788 {
2789         struct sk_buff *skb;
2790         int no_pending_pkts;
2791
2792         if (likely(!rx->sta ||
2793                    (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
2794                    (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
2795                    !rx->u.rx.ra_match))
2796                 return TXRX_CONTINUE;
2797
2798         skb = skb_dequeue(&rx->sta->tx_filtered);
2799         if (!skb) {
2800                 skb = skb_dequeue(&rx->sta->ps_tx_buf);
2801                 if (skb)
2802                         rx->local->total_ps_buffered--;
2803         }
2804         no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
2805                 skb_queue_empty(&rx->sta->ps_tx_buf);
2806
2807         if (skb) {
2808                 struct ieee80211_hdr *hdr =
2809                         (struct ieee80211_hdr *) skb->data;
2810
2811                 /* tell TX path to send one frame even though the STA may
2812                  * still remain is PS mode after this frame exchange */
2813                 rx->sta->pspoll = 1;
2814
2815 #ifdef CONFIG_D80211_VERBOSE_PS_DEBUG
2816                 printk(KERN_DEBUG "STA " MAC_FMT " aid %d: PS Poll (entries "
2817                        "after %d)\n",
2818                        MAC_ARG(rx->sta->addr), rx->sta->aid,
2819                        skb_queue_len(&rx->sta->ps_tx_buf));
2820 #endif /* CONFIG_D80211_VERBOSE_PS_DEBUG */
2821
2822                 /* Use MoreData flag to indicate whether there are more
2823                  * buffered frames for this STA */
2824                 if (no_pending_pkts) {
2825                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
2826                         rx->sta->flags &= ~WLAN_STA_TIM;
2827                 } else
2828                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
2829
2830                 dev_queue_xmit(skb);
2831
2832                 if (no_pending_pkts) {
2833                         if (rx->local->ops->set_tim)
2834                                 rx->local->ops->set_tim(local_to_hw(rx->local),
2835                                                        rx->sta->aid, 0);
2836                         if (rx->sdata->bss)
2837                                 bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
2838                 }
2839 #ifdef CONFIG_D80211_VERBOSE_PS_DEBUG
2840         } else if (!rx->u.rx.sent_ps_buffered) {
2841                 printk(KERN_DEBUG "%s: STA " MAC_FMT " sent PS Poll even "
2842                        "though there is no buffered frames for it\n",
2843                        rx->dev->name, MAC_ARG(rx->sta->addr));
2844 #endif /* CONFIG_D80211_VERBOSE_PS_DEBUG */
2845
2846         }
2847
2848         /* Free PS Poll skb here instead of returning TXRX_DROP that would
2849          * count as an dropped frame. */
2850         dev_kfree_skb(rx->skb);
2851
2852         return TXRX_QUEUED;
2853 }
2854
2855
2856 static inline struct ieee80211_fragment_entry *
2857 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
2858                          unsigned int frag, unsigned int seq, int rx_queue,
2859                          struct sk_buff **skb)
2860 {
2861         struct ieee80211_fragment_entry *entry;
2862         int idx;
2863
2864         idx = sdata->fragment_next;
2865         entry = &sdata->fragments[sdata->fragment_next++];
2866         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
2867                 sdata->fragment_next = 0;
2868
2869         if (!skb_queue_empty(&entry->skb_list)) {
2870 #ifdef CONFIG_D80211_DEBUG
2871                 struct ieee80211_hdr *hdr =
2872                         (struct ieee80211_hdr *) entry->skb_list.next->data;
2873                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
2874                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
2875                        "addr1=" MAC_FMT " addr2=" MAC_FMT "\n",
2876                        sdata->dev->name, idx,
2877                        jiffies - entry->first_frag_time, entry->seq,
2878                        entry->last_frag, MAC_ARG(hdr->addr1),
2879                        MAC_ARG(hdr->addr2));
2880 #endif /* CONFIG_D80211_DEBUG */
2881                 __skb_queue_purge(&entry->skb_list);
2882         }
2883
2884         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
2885         *skb = NULL;
2886         entry->first_frag_time = jiffies;
2887         entry->seq = seq;
2888         entry->rx_queue = rx_queue;
2889         entry->last_frag = frag;
2890         entry->ccmp = 0;
2891         entry->extra_len = 0;
2892
2893         return entry;
2894 }
2895
2896
2897 static inline struct ieee80211_fragment_entry *
2898 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
2899                           u16 fc, unsigned int frag, unsigned int seq,
2900                           int rx_queue, struct ieee80211_hdr *hdr)
2901 {
2902         struct ieee80211_fragment_entry *entry;
2903         int i, idx;
2904
2905         idx = sdata->fragment_next;
2906         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2907                 struct ieee80211_hdr *f_hdr;
2908                 u16 f_fc;
2909
2910                 idx--;
2911                 if (idx < 0)
2912                         idx = IEEE80211_FRAGMENT_MAX - 1;
2913
2914                 entry = &sdata->fragments[idx];
2915                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
2916                     entry->rx_queue != rx_queue ||
2917                     entry->last_frag + 1 != frag)
2918                         continue;
2919
2920                 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
2921                 f_fc = le16_to_cpu(f_hdr->frame_control);
2922
2923                 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
2924                     memcmp(hdr->addr1, f_hdr->addr1, ETH_ALEN) != 0 ||
2925                     memcmp(hdr->addr2, f_hdr->addr2, ETH_ALEN) != 0)
2926                         continue;
2927
2928                 if (entry->first_frag_time + 2 * HZ < jiffies) {
2929                         __skb_queue_purge(&entry->skb_list);
2930                         continue;
2931                 }
2932                 return entry;
2933         }
2934
2935         return NULL;
2936 }
2937
2938
2939 static ieee80211_txrx_result
2940 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
2941 {
2942         struct ieee80211_hdr *hdr;
2943         u16 sc;
2944         unsigned int frag, seq;
2945         struct ieee80211_fragment_entry *entry;
2946         struct sk_buff *skb;
2947
2948         hdr = (struct ieee80211_hdr *) rx->skb->data;
2949         sc = le16_to_cpu(hdr->seq_ctrl);
2950         frag = sc & IEEE80211_SCTL_FRAG;
2951
2952         if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
2953                    (rx->skb)->len < 24 ||
2954                    is_multicast_ether_addr(hdr->addr1))) {
2955                 /* not fragmented */
2956                 goto out;
2957         }
2958         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2959
2960         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2961
2962         if (frag == 0) {
2963                 /* This is the first fragment of a new frame. */
2964                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
2965                                                  rx->u.rx.queue, &(rx->skb));
2966                 if (rx->key && rx->key->alg == ALG_CCMP &&
2967                     (rx->fc & IEEE80211_FCTL_PROTECTED)) {
2968                         /* Store CCMP PN so that we can verify that the next
2969                          * fragment has a sequential PN value. */
2970                         entry->ccmp = 1;
2971                         memcpy(entry->last_pn,
2972                                rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
2973                                CCMP_PN_LEN);
2974                 }
2975                 return TXRX_QUEUED;
2976         }
2977
2978         /* This is a fragment for a frame that should already be pending in
2979          * fragment cache. Add this fragment to the end of the pending entry.
2980          */
2981         entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
2982                                           rx->u.rx.queue, hdr);
2983         if (!entry) {
2984                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2985                 return TXRX_DROP;
2986         }
2987
2988         /* Verify that MPDUs within one MSDU have sequential PN values.
2989          * (IEEE 802.11i, 8.3.3.4.5) */
2990         if (entry->ccmp) {
2991                 int i;
2992                 u8 pn[CCMP_PN_LEN], *rpn;
2993                 if (!rx->key || rx->key->alg != ALG_CCMP)
2994                         return TXRX_DROP;
2995                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
2996                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
2997                         pn[i]++;
2998                         if (pn[i])
2999                                 break;
3000                 }
3001                 rpn = rx->key->u.ccmp.rx_pn[rx->u.rx.queue];
3002                 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
3003                         printk(KERN_DEBUG "%s: defrag: CCMP PN not sequential"
3004                                " A2=" MAC_FMT " PN=%02x%02x%02x%02x%02x%02x "
3005                                "(expected %02x%02x%02x%02x%02x%02x)\n",
3006                                rx->dev->name, MAC_ARG(hdr->addr2),
3007                                rpn[0], rpn[1], rpn[2], rpn[3], rpn[4], rpn[5],
3008                                pn[0], pn[1], pn[2], pn[3], pn[4], pn[5]);
3009                         return TXRX_DROP;
3010                 }
3011                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
3012         }
3013
3014         skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
3015         __skb_queue_tail(&entry->skb_list, rx->skb);
3016         entry->last_frag = frag;
3017         entry->extra_len += rx->skb->len;
3018         if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
3019                 rx->skb = NULL;
3020                 return TXRX_QUEUED;
3021         }
3022
3023         rx->skb = __skb_dequeue(&entry->skb_list);
3024         if (skb_tailroom(rx->skb) < entry->extra_len) {
3025                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
3026                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
3027                                               GFP_ATOMIC))) {
3028                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
3029                         __skb_queue_purge(&entry->skb_list);
3030                         return TXRX_DROP;
3031                 }
3032         }
3033         while ((skb = __skb_dequeue(&entry->skb_list)))
3034                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
3035
3036         /* Complete frame has been reassembled - process it now */
3037         rx->fragmented = 1;
3038
3039  out:
3040         if (rx->sta)
3041                 rx->sta->rx_packets++;
3042         if (is_multicast_ether_addr(hdr->addr1))
3043                 rx->local->dot11MulticastReceivedFrameCount++;
3044         else
3045                 ieee80211_led_rx(rx->local);
3046         return TXRX_CONTINUE;
3047 }
3048
3049
3050 static ieee80211_txrx_result
3051 ieee80211_rx_h_monitor(struct ieee80211_txrx_data *rx)
3052 {
3053         if (rx->sdata->type == IEEE80211_IF_TYPE_MNTR) {
3054                 ieee80211_rx_monitor(rx->dev, rx->skb, rx->u.rx.status);
3055                 return TXRX_QUEUED;
3056         }
3057
3058         return TXRX_CONTINUE;
3059 }
3060
3061
3062 static ieee80211_txrx_result
3063 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
3064 {
3065         struct ieee80211_hdr *hdr;
3066         int always_sta_key;
3067         hdr = (struct ieee80211_hdr *) rx->skb->data;
3068
3069         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
3070         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
3071                 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
3072                              rx->sta->last_seq_ctrl[rx->u.rx.queue] ==
3073                              hdr->seq_ctrl)) {
3074                         if (rx->u.rx.ra_match) {
3075                                 rx->local->dot11FrameDuplicateCount++;
3076                                 rx->sta->num_duplicates++;
3077                         }
3078                         return TXRX_DROP;
3079                 } else
3080                         rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
3081         }
3082
3083         if ((rx->local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) &&
3084             rx->skb->len > FCS_LEN)
3085                 skb_trim(rx->skb, rx->skb->len - FCS_LEN);
3086
3087         if (unlikely(rx->skb->len < 16)) {
3088                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
3089                 return TXRX_DROP;
3090         }
3091
3092         if (!rx->u.rx.ra_match)
3093                 rx->skb->pkt_type = PACKET_OTHERHOST;
3094         else if (memcmp(rx->dev->dev_addr, hdr->addr1, ETH_ALEN) == 0)
3095                 rx->skb->pkt_type = PACKET_HOST;
3096         else if (is_multicast_ether_addr(hdr->addr1)) {
3097                 if (is_broadcast_ether_addr(hdr->addr1))
3098                         rx->skb->pkt_type = PACKET_BROADCAST;
3099                 else
3100                         rx->skb->pkt_type = PACKET_MULTICAST;
3101         } else
3102                 rx->skb->pkt_type = PACKET_OTHERHOST;
3103
3104         /* Drop disallowed frame classes based on STA auth/assoc state;
3105          * IEEE 802.11, Chap 5.5.
3106          *
3107          * 80211.o does filtering only based on association state, i.e., it
3108          * drops Class 3 frames from not associated stations. hostapd sends
3109          * deauth/disassoc frames when needed. In addition, hostapd is
3110          * responsible for filtering on both auth and assoc states.
3111          */
3112         if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
3113                       ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
3114                        (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
3115                      rx->sdata->type != IEEE80211_IF_TYPE_IBSS &&
3116                      (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) {
3117                 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
3118                      !(rx->fc & IEEE80211_FCTL_TODS) &&
3119                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
3120                     || !rx->u.rx.ra_match) {
3121                         /* Drop IBSS frames and frames for other hosts
3122                          * silently. */
3123                         return TXRX_DROP;
3124                 }
3125
3126                 if (!rx->local->apdev)
3127                         return TXRX_DROP;
3128
3129                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
3130                                   ieee80211_msg_sta_not_assoc);
3131                 return TXRX_QUEUED;
3132         }
3133
3134         if (rx->sdata->type == IEEE80211_IF_TYPE_STA)
3135                 always_sta_key = 0;
3136         else
3137                 always_sta_key = 1;
3138
3139         if (rx->sta && rx->sta->key && always_sta_key) {
3140                 rx->key = rx->sta->key;
3141         } else {
3142                 if (rx->sta && rx->sta->key)
3143                         rx->key = rx->sta->key;
3144                 else
3145                         rx->key = rx->sdata->default_key;
3146
3147                 if ((rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) &&
3148                     rx->fc & IEEE80211_FCTL_PROTECTED) {
3149                         int keyidx = ieee80211_wep_get_keyidx(rx->skb);
3150
3151                         if (keyidx >= 0 && keyidx < NUM_DEFAULT_KEYS &&
3152                             (!rx->sta || !rx->sta->key || keyidx > 0))
3153                                 rx->key = rx->sdata->keys[keyidx];
3154
3155                         if (!rx->key) {
3156                                 if (!rx->u.rx.ra_match)
3157                                         return TXRX_DROP;
3158                                 printk(KERN_DEBUG "%s: RX WEP frame with "
3159                                        "unknown keyidx %d (A1=" MAC_FMT " A2="
3160                                        MAC_FMT " A3=" MAC_FMT ")\n",
3161                                        rx->dev->name, keyidx,
3162                                        MAC_ARG(hdr->addr1),
3163                                        MAC_ARG(hdr->addr2),
3164                                        MAC_ARG(hdr->addr3));
3165                                 if (!rx->local->apdev)
3166                                         return TXRX_DROP;
3167                                 ieee80211_rx_mgmt(
3168                                         rx->local, rx->skb, rx->u.rx.status,
3169                                         ieee80211_msg_wep_frame_unknown_key);
3170                                 return TXRX_QUEUED;
3171                         }
3172                 }
3173         }
3174
3175         if (rx->fc & IEEE80211_FCTL_PROTECTED && rx->key && rx->u.rx.ra_match) {
3176                 rx->key->tx_rx_count++;
3177                 if (unlikely(rx->local->key_tx_rx_threshold &&
3178                              rx->key->tx_rx_count >
3179                              rx->local->key_tx_rx_threshold)) {
3180                         ieee80211_key_threshold_notify(rx->dev, rx->key,
3181                                                        rx->sta);
3182                 }
3183         }
3184
3185         return TXRX_CONTINUE;
3186 }
3187
3188
3189 static ieee80211_txrx_result
3190 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
3191 {
3192         struct sta_info *sta = rx->sta;
3193         struct net_device *dev = rx->dev;
3194         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
3195
3196         if (!sta)
3197                 return TXRX_CONTINUE;
3198
3199         /* Update last_rx only for IBSS packets which are for the current
3200          * BSSID to avoid keeping the current IBSS network alive in cases where
3201          * other STAs are using different BSSID. */
3202         if (rx->sdata->type == IEEE80211_IF_TYPE_IBSS) {
3203                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len);
3204                 if (memcmp(bssid, rx->sdata->u.sta.bssid, ETH_ALEN) == 0)
3205                         sta->last_rx = jiffies;
3206         } else
3207         if (!is_multicast_ether_addr(hdr->addr1) ||
3208             rx->sdata->type == IEEE80211_IF_TYPE_STA) {
3209                 /* Update last_rx only for unicast frames in order to prevent
3210                  * the Probe Request frames (the only broadcast frames from a
3211                  * STA in infrastructure mode) from keeping a connection alive.
3212                  */
3213                 sta->last_rx = jiffies;
3214         }
3215
3216         if (!rx->u.rx.ra_match)
3217                 return TXRX_CONTINUE;
3218
3219         sta->rx_fragments++;
3220         sta->rx_bytes += rx->skb->len;
3221         sta->last_rssi = rx->u.rx.status->ssi;
3222         sta->last_signal = rx->u.rx.status->signal;
3223         sta->last_noise = rx->u.rx.status->noise;
3224
3225         if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
3226                 /* Change STA power saving mode only in the end of a frame
3227                  * exchange sequence */
3228                 if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM))
3229                         rx->u.rx.sent_ps_buffered += ap_sta_ps_end(dev, sta);
3230                 else if (!(sta->flags & WLAN_STA_PS) &&
3231                          (rx->fc & IEEE80211_FCTL_PM))
3232                         ap_sta_ps_start(dev, sta);
3233         }
3234
3235         /* Drop data::nullfunc frames silently, since they are used only to
3236          * control station power saving mode. */
3237         if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
3238             (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
3239                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
3240                 /* Update counter and free packet here to avoid counting this
3241                  * as a dropped packed. */
3242                 sta->rx_packets++;
3243                 dev_kfree_skb(rx->skb);
3244                 return TXRX_QUEUED;
3245         }
3246
3247         return TXRX_CONTINUE;
3248 }
3249
3250
3251 static ieee80211_txrx_result
3252 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data *rx)
3253 {
3254         if (!rx->sta || !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
3255             (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
3256             !rx->key || rx->key->alg != ALG_WEP || !rx->u.rx.ra_match)
3257                 return TXRX_CONTINUE;
3258
3259         /* Check for weak IVs, if hwaccel did not remove IV from the frame */
3260         if ((rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) ||
3261             rx->key->force_sw_encrypt) {
3262                 u8 *iv = ieee80211_wep_is_weak_iv(rx->skb, rx->key);
3263                 if (iv) {
3264                         rx->sta->wep_weak_iv_count++;
3265                 }
3266         }
3267
3268         return TXRX_CONTINUE;
3269 }
3270
3271
3272 static ieee80211_txrx_result
3273 ieee80211_rx_h_wep_decrypt(struct ieee80211_txrx_data *rx)
3274 {
3275         /* If the device handles decryption totally, skip this test */
3276         if (rx->local->hw.flags & IEEE80211_HW_DEVICE_HIDES_WEP)
3277                 return TXRX_CONTINUE;
3278
3279         if ((rx->key && rx->key->alg != ALG_WEP) ||
3280             !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
3281             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
3282              ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
3283               (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)))
3284                 return TXRX_CONTINUE;
3285
3286         if (!rx->key) {
3287                 printk(KERN_DEBUG "%s: RX WEP frame, but no key set\n",
3288                        rx->dev->name);
3289                 return TXRX_DROP;
3290         }
3291
3292         if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED) ||
3293             rx->key->force_sw_encrypt) {
3294                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
3295                         printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
3296                                "failed\n", rx->dev->name);
3297                         return TXRX_DROP;
3298                 }
3299         } else if (rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) {
3300                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
3301                 /* remove ICV */
3302                 skb_trim(rx->skb, rx->skb->len - 4);
3303         }
3304
3305         return TXRX_CONTINUE;
3306 }
3307
3308
3309 static ieee80211_txrx_result
3310 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data *rx)
3311 {
3312         if (rx->sdata->eapol && ieee80211_is_eapol(rx->skb) &&
3313             rx->sdata->type != IEEE80211_IF_TYPE_STA && rx->u.rx.ra_match) {
3314                 /* Pass both encrypted and unencrypted EAPOL frames to user
3315                  * space for processing. */
3316                 if (!rx->local->apdev)
3317                         return TXRX_DROP;
3318                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
3319                                   ieee80211_msg_normal);
3320                 return TXRX_QUEUED;
3321         }
3322
3323         if (unlikely(rx->sdata->ieee802_1x &&
3324                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
3325                      (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
3326                      (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)) &&
3327                      !ieee80211_is_eapol(rx->skb))) {
3328 #ifdef CONFIG_D80211_DEBUG
3329                 struct ieee80211_hdr *hdr =
3330                         (struct ieee80211_hdr *) rx->skb->data;
3331                 printk(KERN_DEBUG "%s: dropped frame from " MAC_FMT
3332                        " (unauthorized port)\n", rx->dev->name,
3333                        MAC_ARG(hdr->addr2));
3334 #endif /* CONFIG_D80211_DEBUG */
3335                 return TXRX_DROP;
3336         }
3337
3338         return TXRX_CONTINUE;
3339 }
3340
3341
3342 static ieee80211_txrx_result
3343 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data *rx)
3344 {
3345         /*  If the device handles decryption totally, skip this test */
3346         if (rx->local->hw.flags & IEEE80211_HW_DEVICE_HIDES_WEP)
3347                 return TXRX_CONTINUE;
3348
3349         /* Drop unencrypted frames if key is set. */
3350         if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
3351                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
3352                      (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
3353                      (rx->key || rx->sdata->drop_unencrypted) &&
3354                      (rx->sdata->eapol == 0 ||
3355                       !ieee80211_is_eapol(rx->skb)))) {
3356                 printk(KERN_DEBUG "%s: RX non-WEP frame, but expected "
3357                        "encryption\n", rx->dev->name);
3358                 return TXRX_DROP;
3359         }
3360         return TXRX_CONTINUE;
3361 }
3362
3363
3364 static ieee80211_txrx_result
3365 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
3366 {
3367         struct ieee80211_sub_if_data *sdata;
3368
3369         if (!rx->u.rx.ra_match)
3370                 return TXRX_DROP;
3371
3372         sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
3373         if ((sdata->type == IEEE80211_IF_TYPE_STA ||
3374              sdata->type == IEEE80211_IF_TYPE_IBSS) &&
3375             !rx->local->user_space_mlme) {
3376                 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
3377         } else {
3378                 /* Management frames are sent to hostapd for processing */
3379                 if (!rx->local->apdev)
3380                         return TXRX_DROP;
3381                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
3382                                   ieee80211_msg_normal);
3383         }
3384         return TXRX_QUEUED;
3385 }
3386
3387
3388 static ieee80211_txrx_result
3389 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
3390 {
3391         struct ieee80211_local *local = rx->local;
3392         struct sk_buff *skb = rx->skb;
3393
3394         if (unlikely(local->sta_scanning != 0)) {
3395                 ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status);
3396                 return TXRX_QUEUED;
3397         }
3398
3399         if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
3400                 local->scan.txrx_count++;
3401         if (unlikely(local->scan.in_scan != 0 &&
3402                      rx->u.rx.status->freq == local->scan.freq)) {
3403                 struct ieee80211_hdr *hdr;
3404                 u16 fc;
3405
3406                 local->scan.rx_packets++;
3407
3408                 hdr = (struct ieee80211_hdr *) skb->data;
3409                 fc = le16_to_cpu(hdr->frame_control);
3410
3411                 if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
3412                     (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON &&
3413                     rx->dev == local->mdev) {
3414                         local->scan.rx_beacon++;
3415                         /* Need to trim FCS here because it is normally
3416                          * removed only after this passive scan handler. */
3417                         if ((rx->local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) &&
3418                             rx->skb->len > FCS_LEN)
3419                                 skb_trim(rx->skb, rx->skb->len - FCS_LEN);
3420
3421                         if (!rx->local->apdev)
3422                                 return TXRX_DROP;
3423                         ieee80211_rx_mgmt(rx->local, rx->skb,
3424                                           rx->u.rx.status,
3425                                           ieee80211_msg_passive_scan);
3426                         return TXRX_QUEUED;
3427                 } else {
3428                         I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
3429                         return TXRX_DROP;
3430                 }
3431         }
3432
3433         if (unlikely(rx->u.rx.in_scan)) {
3434                 /* scanning finished during invoking of handlers */
3435                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
3436                 return TXRX_DROP;
3437         }
3438
3439         return TXRX_CONTINUE;
3440 }
3441
3442
3443 static u8 * ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len)
3444 {
3445         u16 fc;
3446
3447         if (len < 24)
3448                 return NULL;
3449
3450         fc = le16_to_cpu(hdr->frame_control);
3451
3452         switch (fc & IEEE80211_FCTL_FTYPE) {
3453         case IEEE80211_FTYPE_DATA:
3454                 switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
3455                 case IEEE80211_FCTL_TODS:
3456                         return hdr->addr1;
3457                 case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
3458                         return NULL;
3459                 case IEEE80211_FCTL_FROMDS:
3460                         return hdr->addr2;
3461                 case 0:
3462                         return hdr->addr3;
3463                 }
3464                 break;
3465         case IEEE80211_FTYPE_MGMT:
3466                 return hdr->addr3;
3467         case IEEE80211_FTYPE_CTL:
3468                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)
3469                         return hdr->addr1;
3470                 else
3471                         return NULL;
3472         }
3473
3474         return NULL;
3475 }
3476
3477 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
3478                                             struct ieee80211_hdr *hdr,
3479                                             struct sta_info *sta,
3480                                             struct ieee80211_txrx_data *rx)
3481 {
3482         int keyidx, hdrlen;
3483
3484         hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
3485         if (rx->skb->len >= hdrlen + 4)
3486                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
3487         else
3488                 keyidx = -1;
3489
3490         /* TODO: verify that this is not triggered by fragmented
3491          * frames (hw does not verify MIC for them). */
3492         printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
3493                "failure from " MAC_FMT " to " MAC_FMT " keyidx=%d\n",
3494                dev->name, MAC_ARG(hdr->addr2), MAC_ARG(hdr->addr1), keyidx);
3495
3496         if (!sta) {
3497                 /* Some hardware versions seem to generate incorrect
3498                  * Michael MIC reports; ignore them to avoid triggering
3499                  * countermeasures. */
3500                 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
3501                        "error for unknown address " MAC_FMT "\n",
3502                        dev->name, MAC_ARG(hdr->addr2));
3503                 goto ignore;
3504         }
3505
3506         if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
3507                 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
3508                        "error for a frame with no ISWEP flag (src "
3509                        MAC_FMT ")\n", dev->name, MAC_ARG(hdr->addr2));
3510                 goto ignore;
3511         }
3512
3513         if ((rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) &&
3514             rx->sdata->type == IEEE80211_IF_TYPE_AP) {
3515                 int keyidx = ieee80211_wep_get_keyidx(rx->skb);
3516                 /* AP with Pairwise keys support should never receive Michael
3517                  * MIC errors for non-zero keyidx because these are reserved
3518                  * for group keys and only the AP is sending real multicast
3519                  * frames in BSS. */
3520                 if (keyidx) {
3521                         printk(KERN_DEBUG "%s: ignored Michael MIC error for "
3522                                "a frame with non-zero keyidx (%d) (src " MAC_FMT
3523                                ")\n", dev->name, keyidx, MAC_ARG(hdr->addr2));
3524                         goto ignore;
3525                 }
3526         }
3527
3528         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
3529             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
3530              (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
3531                 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
3532                        "error for a frame that cannot be encrypted "
3533                        "(fc=0x%04x) (src " MAC_FMT ")\n",
3534                        dev->name, rx->fc, MAC_ARG(hdr->addr2));
3535                 goto ignore;
3536         }
3537
3538         do {
3539                 union iwreq_data wrqu;
3540                 char *buf = kmalloc(128, GFP_ATOMIC);
3541                 if (!buf)
3542                         break;
3543
3544                 /* TODO: needed parameters: count, key type, TSC */
3545                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
3546                         "keyid=%d %scast addr=" MAC_FMT ")",
3547                         keyidx, hdr->addr1[0] & 0x01 ? "broad" : "uni",
3548                         MAC_ARG(hdr->addr2));
3549                 memset(&wrqu, 0, sizeof(wrqu));
3550                 wrqu.data.length = strlen(buf);
3551                 wireless_send_event(rx->dev, IWEVCUSTOM, &wrqu, buf);
3552                 kfree(buf);
3553         } while (0);
3554
3555         /* TODO: consider verifying the MIC error report with software
3556          * implementation if we get too many spurious reports from the
3557          * hardware. */
3558         if (!rx->local->apdev)
3559                 goto ignore;
3560         ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
3561                           ieee80211_msg_michael_mic_failure);
3562         return;
3563
3564  ignore:
3565         dev_kfree_skb(rx->skb);
3566         rx->skb = NULL;
3567 }
3568
3569 static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
3570                                 struct ieee80211_local *local,
3571                                 ieee80211_rx_handler *handlers,
3572                                 struct ieee80211_txrx_data *rx,
3573                                 struct sta_info *sta)
3574 {
3575         ieee80211_rx_handler *handler;
3576         ieee80211_txrx_result res = TXRX_DROP;
3577
3578         for (handler = handlers; *handler != NULL; handler++) {
3579                 res = (*handler)(rx);
3580                 if (res != TXRX_CONTINUE) {
3581                         if (res == TXRX_DROP) {
3582                                 I802_DEBUG_INC(local->rx_handlers_drop);
3583                                 if (sta)
3584                                         sta->rx_dropped++;
3585                         }
3586                         if (res == TXRX_QUEUED)
3587                                 I802_DEBUG_INC(local->rx_handlers_queued);
3588                         break;
3589                 }
3590         }
3591
3592         if (res == TXRX_DROP) {
3593                 dev_kfree_skb(rx->skb);
3594         }
3595         return res;
3596 }
3597
3598 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
3599                                                 ieee80211_rx_handler *handlers,
3600                                                 struct ieee80211_txrx_data *rx,
3601                                                 struct sta_info *sta)
3602 {
3603         if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
3604             TXRX_CONTINUE)
3605                 dev_kfree_skb(rx->skb);
3606 }
3607
3608 /*
3609  * This is the receive path handler. It is called by a low level driver when an
3610  * 802.11 MPDU is received from the hardware.
3611  */
3612 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
3613                     struct ieee80211_rx_status *status)
3614 {
3615         struct ieee80211_local *local = hw_to_local(hw);
3616         struct ieee80211_sub_if_data *sdata;
3617         struct sta_info *sta;
3618         struct ieee80211_hdr *hdr;
3619         struct ieee80211_txrx_data rx;
3620         u16 type;
3621         int multicast;
3622
3623         hdr = (struct ieee80211_hdr *) skb->data;
3624         memset(&rx, 0, sizeof(rx));
3625         rx.skb = skb;
3626         rx.local = local;
3627
3628         rx.u.rx.status = status;
3629         rx.fc = skb->len >= 2 ? le16_to_cpu(hdr->frame_control) : 0;
3630         type = rx.fc & IEEE80211_FCTL_FTYPE;
3631         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
3632                 local->dot11ReceivedFragmentCount++;
3633         multicast = is_multicast_ether_addr(hdr->addr1);
3634
3635         if (skb->len >= 16)
3636                 sta = rx.sta = sta_info_get(local, hdr->addr2);
3637         else
3638                 sta = rx.sta = NULL;
3639
3640         if (sta) {
3641                 rx.dev = sta->dev;
3642                 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
3643         }
3644
3645         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
3646                 ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
3647                 goto end;
3648         }
3649
3650         if (unlikely(local->sta_scanning || local->scan.in_scan))
3651                 rx.u.rx.in_scan = 1;
3652
3653         if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
3654                                            sta) != TXRX_CONTINUE)
3655                 goto end;
3656         skb = rx.skb;
3657
3658         if (sta && !sta->assoc_ap && !(sta->flags & WLAN_STA_WDS) &&
3659             !local->iff_promiscs && !multicast) {
3660                 rx.u.rx.ra_match = 1;
3661                 ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
3662                                              sta);
3663         } else {
3664                 struct ieee80211_sub_if_data *prev = NULL;
3665                 struct sk_buff *skb_new;
3666                 u8 *bssid = ieee80211_get_bssid(hdr, skb->len);
3667
3668                 list_for_each_entry(sdata, &local->sub_if_list, list) {
3669                         rx.u.rx.ra_match = 1;
3670                         switch (sdata->type) {
3671                         case IEEE80211_IF_TYPE_STA:
3672                                 if (!bssid)
3673                                         continue;
3674                                 if (!ieee80211_bssid_match(bssid,
3675                                                         sdata->u.sta.bssid)) {
3676                                         if (!rx.u.rx.in_scan)
3677                                                 continue;
3678                                         rx.u.rx.ra_match = 0;
3679                                 } else if (!multicast &&
3680                                            memcmp(sdata->dev->dev_addr,
3681                                                   hdr->addr1, ETH_ALEN) != 0) {
3682                                         if (!sdata->promisc)
3683                                                 continue;
3684                                         rx.u.rx.ra_match = 0;
3685                                 }
3686                                 break;
3687                         case IEEE80211_IF_TYPE_IBSS:
3688                                 if (!bssid)
3689                                         continue;
3690                                 if (!ieee80211_bssid_match(bssid,
3691                                                         sdata->u.sta.bssid)) {
3692                                         if (!rx.u.rx.in_scan)
3693                                                 continue;
3694                                         rx.u.rx.ra_match = 0;
3695                                 } else if (!multicast &&
3696                                            memcmp(sdata->dev->dev_addr,
3697                                                   hdr->addr1, ETH_ALEN) != 0) {
3698                                         if (!sdata->promisc)
3699                                                 continue;
3700                                         rx.u.rx.ra_match = 0;
3701                                 } else if (!sta)
3702                                         sta = rx.sta =
3703                                                 ieee80211_ibss_add_sta(local->mdev,
3704                                                                        skb, bssid,
3705                                                                        hdr->addr2);
3706                                                 /* FIXME: call with sdata->dev */
3707                                 break;
3708                         case IEEE80211_IF_TYPE_AP:
3709                                 if (!bssid) {
3710                                         if (memcmp(sdata->dev->dev_addr,
3711                                                    hdr->addr1, ETH_ALEN) != 0)
3712                                                 continue;
3713                                 } else if (!ieee80211_bssid_match(bssid,
3714                                                         sdata->dev->dev_addr)) {
3715                                         if (!rx.u.rx.in_scan)
3716                                                 continue;
3717                                         rx.u.rx.ra_match = 0;
3718                                 }
3719                                 if (sdata->dev == local->mdev &&
3720                                     !rx.u.rx.in_scan)
3721                                         /* do not receive anything via
3722                                          * master device when not scanning */
3723                                         continue;
3724                                 break;
3725                         case IEEE80211_IF_TYPE_WDS:
3726                                 if (bssid ||
3727                                     (rx.fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
3728                                         continue;
3729                                 if (memcmp(sdata->u.wds.remote_addr,
3730                                            hdr->addr2, ETH_ALEN) != 0)
3731                                         continue;
3732                                 break;
3733                         }
3734
3735                         if (prev) {
3736                                 skb_new = skb_copy(skb, GFP_ATOMIC);
3737                                 if (!skb_new) {
3738                                         if (net_ratelimit())
3739                                                 printk(KERN_DEBUG "%s: failed to copy "
3740                                                        "multicast frame for %s",
3741                                                        local->mdev->name, prev->dev->name);
3742                                         continue;
3743                                 }
3744                                 rx.skb = skb_new;
3745                                 rx.dev = prev->dev;
3746                                 rx.sdata = prev;
3747                                 ieee80211_invoke_rx_handlers(local,
3748                                                              local->rx_handlers,
3749                                                              &rx, sta);
3750                         }
3751                         prev = sdata;
3752                 }
3753                 if (prev) {
3754                         rx.skb = skb;
3755                         rx.dev = prev->dev;
3756                         rx.sdata = prev;
3757                         ieee80211_invoke_rx_handlers(local, local->rx_handlers,
3758                                                      &rx, sta);
3759                 } else
3760                         dev_kfree_skb(skb);
3761         }
3762
3763   end:
3764         if (sta)
3765                 sta_info_put(sta);
3766 }
3767 EXPORT_SYMBOL(__ieee80211_rx);
3768
3769 static ieee80211_txrx_result
3770 ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
3771 {
3772         struct ieee80211_local *local = tx->local;
3773         struct sk_buff *skb = tx->skb;
3774         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
3775         u32 load = 0, hdrtime;
3776
3777         /* TODO: this could be part of tx_status handling, so that the number
3778          * of retries would be known; TX rate should in that case be stored
3779          * somewhere with the packet */
3780
3781         /* Estimate total channel use caused by this frame */
3782
3783         /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
3784          * 1 usec = 1/8 * (1080 / 10) = 13.5 */
3785
3786         if (local->hw.conf.phymode == MODE_IEEE80211A ||
3787             local->hw.conf.phymode == MODE_ATHEROS_TURBO ||
3788             local->hw.conf.phymode == MODE_ATHEROS_TURBOG ||
3789             (local->hw.conf.phymode == MODE_IEEE80211G &&
3790              tx->u.tx.rate->flags & IEEE80211_RATE_ERP))
3791                 hdrtime = CHAN_UTIL_HDR_SHORT;
3792         else
3793                 hdrtime = CHAN_UTIL_HDR_LONG;
3794
3795         load = hdrtime;
3796         if (!is_multicast_ether_addr(hdr->addr1))
3797                 load += hdrtime;
3798
3799         if (tx->u.tx.control->flags & IEEE80211_TXCTL_USE_RTS_CTS)
3800                 load += 2 * hdrtime;
3801         else if (tx->u.tx.control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
3802                 load += hdrtime;
3803
3804         load += skb->len * tx->u.tx.rate->rate_inv;
3805
3806         if (tx->u.tx.extra_frag) {
3807                 int i;
3808                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
3809                         load += 2 * hdrtime;
3810                         load += tx->u.tx.extra_frag[i]->len *
3811                                 tx->u.tx.rate->rate;
3812                 }
3813         }
3814
3815         /* Divide channel_use by 8 to avoid wrapping around the counter */
3816         load >>= CHAN_UTIL_SHIFT;
3817         local->channel_use_raw += load;
3818         if (tx->sta)
3819                 tx->sta->channel_use_raw += load;
3820         tx->sdata->channel_use_raw += load;
3821
3822         return TXRX_CONTINUE;
3823 }
3824
3825
3826 static ieee80211_txrx_result
3827 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data *rx)
3828 {
3829         struct ieee80211_local *local = rx->local;
3830         struct sk_buff *skb = rx->skb;
3831         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
3832         u32 load = 0, hdrtime;
3833         struct ieee80211_rate *rate;
3834         int i;
3835
3836         /* Estimate total channel use caused by this frame */
3837
3838         if (unlikely(local->num_curr_rates < 0))
3839                 return TXRX_CONTINUE;
3840
3841         rate = &local->curr_rates[0];
3842         for (i = 0; i < local->num_curr_rates; i++) {
3843                 if (local->curr_rates[i].val == rx->u.rx.status->rate) {
3844                         rate = &local->curr_rates[i];
3845                         break;
3846                 }
3847         }
3848
3849         /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
3850          * 1 usec = 1/8 * (1080 / 10) = 13.5 */
3851
3852         if (local->hw.conf.phymode == MODE_IEEE80211A ||
3853             local->hw.conf.phymode == MODE_ATHEROS_TURBO ||
3854             local->hw.conf.phymode == MODE_ATHEROS_TURBOG ||
3855             (local->hw.conf.phymode == MODE_IEEE80211G &&
3856              rate->flags & IEEE80211_RATE_ERP))
3857                 hdrtime = CHAN_UTIL_HDR_SHORT;
3858         else
3859                 hdrtime = CHAN_UTIL_HDR_LONG;
3860
3861         load = hdrtime;
3862         if (!is_multicast_ether_addr(hdr->addr1))
3863                 load += hdrtime;
3864
3865         load += skb->len * rate->rate_inv;
3866
3867         /* Divide channel_use by 8 to avoid wrapping around the counter */
3868         load >>= CHAN_UTIL_SHIFT;
3869         local->channel_use_raw += load;
3870         if (rx->sta)
3871                 rx->sta->channel_use_raw += load;
3872         rx->u.rx.load = load;
3873
3874         return TXRX_CONTINUE;
3875 }
3876
3877 static ieee80211_txrx_result
3878 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
3879 {
3880         rx->sdata->channel_use_raw += rx->u.rx.load;
3881         return TXRX_CONTINUE;
3882 }
3883
3884 static void ieee80211_stat_refresh(unsigned long data)
3885 {
3886         struct ieee80211_local *local = (struct ieee80211_local *) data;
3887         struct sta_info *sta;
3888         struct ieee80211_sub_if_data *sdata;
3889
3890         if (!local->stat_time)
3891                 return;
3892
3893         /* go through all stations */
3894         spin_lock_bh(&local->sta_lock);
3895         list_for_each_entry(sta, &local->sta_list, list) {
3896                 sta->channel_use = (sta->channel_use_raw / local->stat_time) /
3897                         CHAN_UTIL_PER_10MS;
3898                 sta->channel_use_raw = 0;
3899         }
3900         spin_unlock_bh(&local->sta_lock);
3901
3902         /* go through all subinterfaces */
3903         list_for_each_entry(sdata, &local->sub_if_list, list) {
3904                 sdata->channel_use = (sdata->channel_use_raw /
3905                                       local->stat_time) / CHAN_UTIL_PER_10MS;
3906                 sdata->channel_use_raw = 0;
3907         }
3908
3909         /* hardware interface */
3910         local->channel_use = (local->channel_use_raw /
3911                               local->stat_time) / CHAN_UTIL_PER_10MS;
3912         local->channel_use_raw = 0;
3913
3914         local->stat_timer.expires = jiffies + HZ * local->stat_time / 100;
3915         add_timer(&local->stat_timer);
3916 }
3917
3918
3919 /* This is a version of the rx handler that can be called from hard irq
3920  * context. Post the skb on the queue and schedule the tasklet */
3921 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
3922                           struct ieee80211_rx_status *status)
3923 {
3924         struct ieee80211_rx_status *saved;
3925         struct ieee80211_local *local = hw_to_local(hw);
3926
3927         skb->dev = local->mdev;
3928         saved = kmalloc(sizeof(struct ieee80211_rx_status), GFP_ATOMIC);
3929         if (unlikely(!saved)) {
3930                 if (net_ratelimit())
3931                         printk(KERN_WARNING "%s: Not enough memory, "
3932                                "dropping packet", skb->dev->name);
3933                 /* should be dev_kfree_skb_irq, but due to this function being
3934                  * named _irqsafe instead of just _irq we can't be sure that
3935                  * people won't call it from non-irq contexts */
3936                 dev_kfree_skb_any(skb);
3937                 return;
3938         }
3939         memcpy(saved, status, sizeof(struct ieee80211_rx_status));
3940         /* copy pointer to saved status into skb->cb for use by tasklet */
3941         memcpy(skb->cb, &saved, sizeof(saved));
3942
3943         skb->pkt_type = ieee80211_rx_msg;
3944         skb_queue_tail(&local->skb_queue, skb);
3945         tasklet_schedule(&local->tasklet);
3946 }
3947 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
3948
3949 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
3950                                  struct sk_buff *skb,
3951                                  struct ieee80211_tx_status *status)
3952 {
3953         struct ieee80211_local *local = hw_to_local(hw);
3954         struct ieee80211_tx_status *saved;
3955         int tmp;
3956
3957         skb->dev = local->mdev;
3958         saved = kmalloc(sizeof(struct ieee80211_tx_status), GFP_ATOMIC);
3959         if (unlikely(!saved)) {
3960                 if (net_ratelimit())
3961                         printk(KERN_WARNING "%s: Not enough memory, "
3962                                "dropping tx status", skb->dev->name);
3963                 /* should be dev_kfree_skb_irq, but due to this function being
3964                  * named _irqsafe instead of just _irq we can't be sure that
3965                  * people won't call it from non-irq contexts */
3966                 dev_kfree_skb_any(skb);
3967                 return;
3968         }
3969         memcpy(saved, status, sizeof(struct ieee80211_tx_status));
3970         /* copy pointer to saved status into skb->cb for use by tasklet */
3971         memcpy(skb->cb, &saved, sizeof(saved));
3972
3973         skb->pkt_type = ieee80211_tx_status_msg;
3974         skb_queue_tail(status->control.flags & IEEE80211_TXCTL_REQ_TX_STATUS ?
3975                        &local->skb_queue : &local->skb_queue_unreliable, skb);
3976         tmp = skb_queue_len(&local->skb_queue) +
3977                 skb_queue_len(&local->skb_queue_unreliable);
3978         while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
3979                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
3980                 memcpy(&saved, skb->cb, sizeof(saved));
3981                 kfree(saved);
3982                 dev_kfree_skb_irq(skb);
3983                 tmp--;
3984                 I802_DEBUG_INC(local->tx_status_drop);
3985         }
3986         tasklet_schedule(&local->tasklet);
3987 }
3988 EXPORT_SYMBOL(ieee80211_tx_status_irqsafe);
3989
3990 static void ieee80211_tasklet_handler(unsigned long data)
3991 {
3992         struct ieee80211_local *local = (struct ieee80211_local *) data;
3993         struct sk_buff *skb;
3994         struct ieee80211_rx_status *rx_status;
3995         struct ieee80211_tx_status *tx_status;
3996
3997         while ((skb = skb_dequeue(&local->skb_queue)) ||
3998                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
3999                 switch (skb->pkt_type) {
4000                 case ieee80211_rx_msg:
4001                         /* get pointer to saved status out of skb->cb */
4002                         memcpy(&rx_status, skb->cb, sizeof(rx_status));
4003                         /* Clear skb->type in order to not confuse kernel
4004                          * netstack. */
4005                         skb->pkt_type = 0;
4006                         __ieee80211_rx(local_to_hw(local), skb, rx_status);
4007                         kfree(rx_status);
4008                         break;
4009                 case ieee80211_tx_status_msg:
4010                         /* get pointer to saved status out of skb->cb */
4011                         memcpy(&tx_status, skb->cb, sizeof(tx_status));
4012                         skb->pkt_type = 0;
4013                         ieee80211_tx_status(local_to_hw(local),
4014                                             skb, tx_status);
4015                         kfree(tx_status);
4016                         break;
4017                 default: /* should never get here! */
4018                         printk(KERN_ERR "%s: Unknown message type (%d)\n",
4019                                local->mdev->name, skb->pkt_type);
4020                         dev_kfree_skb(skb);
4021                         break;
4022                 }
4023         }
4024 }
4025
4026
4027 /* Remove added headers (e.g., QoS control), encryption header/MIC, etc. to
4028  * make a prepared TX frame (one that has been given to hw) to look like brand
4029  * new IEEE 802.11 frame that is ready to go through TX processing again.
4030  * Also, tx_packet_data in cb is restored from tx_control. */
4031 static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
4032                                       struct ieee80211_key *key,
4033                                       struct sk_buff *skb,
4034                                       struct ieee80211_tx_control *control)
4035 {
4036         int hdrlen, iv_len, mic_len;
4037         struct ieee80211_tx_packet_data *pkt_data;
4038
4039         pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
4040         pkt_data->ifindex = control->ifindex;
4041         pkt_data->mgmt_iface = (control->type == IEEE80211_IF_TYPE_MGMT);
4042         pkt_data->req_tx_status = !!(control->flags & IEEE80211_TXCTL_REQ_TX_STATUS);
4043         pkt_data->do_not_encrypt = !!(control->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT);
4044         pkt_data->requeue = !!(control->flags & IEEE80211_TXCTL_REQUEUE);
4045         pkt_data->queue = control->queue;
4046
4047         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
4048
4049         if (!key)
4050                 goto no_key;
4051
4052         switch (key->alg) {
4053         case ALG_WEP:
4054                 iv_len = WEP_IV_LEN;
4055                 mic_len = WEP_ICV_LEN;
4056                 break;
4057         case ALG_TKIP:
4058                 iv_len = TKIP_IV_LEN;
4059                 mic_len = TKIP_ICV_LEN;
4060                 break;
4061         case ALG_CCMP:
4062                 iv_len = CCMP_HDR_LEN;
4063                 mic_len = CCMP_MIC_LEN;
4064                 break;
4065         default:
4066                 goto no_key;
4067         }
4068
4069         if (skb->len >= mic_len && key->force_sw_encrypt)
4070                 skb_trim(skb, skb->len - mic_len);
4071         if (skb->len >= iv_len && skb->len > hdrlen) {
4072                 memmove(skb->data + iv_len, skb->data, hdrlen);
4073                 skb_pull(skb, iv_len);
4074         }
4075
4076 no_key:
4077         {
4078                 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
4079                 u16 fc = le16_to_cpu(hdr->frame_control);
4080                 if ((fc & 0x8C) == 0x88) /* QoS Control Field */ {
4081                         fc &= ~IEEE80211_STYPE_QOS_DATA;
4082                         hdr->frame_control = cpu_to_le16(fc);
4083                         memmove(skb->data + 2, skb->data, hdrlen - 2);
4084                         skb_pull(skb, 2);
4085                 }
4086         }
4087 }
4088
4089
4090 void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
4091                          struct ieee80211_tx_status *status)
4092 {
4093         struct sk_buff *skb2;
4094         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
4095         struct ieee80211_local *local = hw_to_local(hw);
4096         u16 frag, type;
4097         u32 msg_type;
4098
4099         if (!status) {
4100                 printk(KERN_ERR
4101                        "%s: ieee80211_tx_status called with NULL status\n",
4102                        local->mdev->name);
4103                 dev_kfree_skb(skb);
4104                 return;
4105         }
4106
4107         if (status->excessive_retries) {
4108                 struct sta_info *sta;
4109                 sta = sta_info_get(local, hdr->addr1);
4110                 if (sta) {
4111                         if (sta->flags & WLAN_STA_PS) {
4112                                 /* The STA is in power save mode, so assume
4113                                  * that this TX packet failed because of that.
4114                                  */
4115                                 status->excessive_retries = 0;
4116                                 status->flags |= IEEE80211_TX_STATUS_TX_FILTERED;
4117                         }
4118                         sta_info_put(sta);
4119                 }
4120         }
4121
4122         if (status->flags & IEEE80211_TX_STATUS_TX_FILTERED) {
4123                 struct sta_info *sta;
4124                 sta = sta_info_get(local, hdr->addr1);
4125                 if (sta) {
4126                         sta->tx_filtered_count++;
4127
4128                         /* Clear the TX filter mask for this STA when sending
4129                          * the next packet. If the STA went to power save mode,
4130                          * this will happen when it is waking up for the next
4131                          * time. */
4132                         sta->clear_dst_mask = 1;
4133
4134                         /* TODO: Is the WLAN_STA_PS flag always set here or is
4135                          * the race between RX and TX status causing some
4136                          * packets to be filtered out before 80211.o gets an
4137                          * update for PS status? This seems to be the case, so
4138                          * no changes are likely to be needed. */
4139                         if (sta->flags & WLAN_STA_PS &&
4140                             skb_queue_len(&sta->tx_filtered) <
4141                             STA_MAX_TX_BUFFER) {
4142                                 ieee80211_remove_tx_extra(local, sta->key,
4143                                                           skb,
4144                                                           &status->control);
4145                                 skb_queue_tail(&sta->tx_filtered, skb);
4146                         } else if (!(sta->flags & WLAN_STA_PS) &&
4147                                    !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
4148                                 /* Software retry the packet once */
4149                                 status->control.flags |= IEEE80211_TXCTL_REQUEUE;
4150                                 ieee80211_remove_tx_extra(local, sta->key,
4151                                                           skb,
4152                                                           &status->control);
4153                                 dev_queue_xmit(skb);
4154                         } else {
4155                                 if (net_ratelimit()) {
4156                                         printk(KERN_DEBUG "%s: dropped TX "
4157                                                "filtered frame queue_len=%d "
4158                                                "PS=%d @%lu\n",
4159                                                local->mdev->name,
4160                                                skb_queue_len(
4161                                                        &sta->tx_filtered),
4162                                                !!(sta->flags & WLAN_STA_PS),
4163                                                jiffies);
4164                                 }
4165                                 dev_kfree_skb(skb);
4166                         }
4167                         sta_info_put(sta);
4168                         return;
4169                 }
4170         } else {
4171                 /* FIXME: STUPID to call this with both local and local->mdev */
4172                 rate_control_tx_status(local, local->mdev, skb, status);
4173         }
4174
4175         ieee80211_led_tx(local, 0);
4176
4177         /* SNMP counters
4178          * Fragments are passed to low-level drivers as separate skbs, so these
4179          * are actually fragments, not frames. Update frame counters only for
4180          * the first fragment of the frame. */
4181
4182         frag = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
4183         type = le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_FTYPE;
4184
4185         if (status->flags & IEEE80211_TX_STATUS_ACK) {
4186                 if (frag == 0) {
4187                         local->dot11TransmittedFrameCount++;
4188                         if (is_multicast_ether_addr(hdr->addr1))
4189                                 local->dot11MulticastTransmittedFrameCount++;
4190                         if (status->retry_count > 0)
4191                                 local->dot11RetryCount++;
4192                         if (status->retry_count > 1)
4193                                 local->dot11MultipleRetryCount++;
4194                 }
4195
4196                 /* This counter shall be incremented for an acknowledged MPDU
4197                  * with an individual address in the address 1 field or an MPDU
4198                  * with a multicast address in the address 1 field of type Data
4199                  * or Management. */
4200                 if (!is_multicast_ether_addr(hdr->addr1) ||
4201                     type == IEEE80211_FTYPE_DATA ||
4202                     type == IEEE80211_FTYPE_MGMT)
4203                         local->dot11TransmittedFragmentCount++;
4204         } else {
4205                 if (frag == 0)
4206                         local->dot11FailedCount++;
4207         }
4208
4209         if (!(status->control.flags & IEEE80211_TXCTL_REQ_TX_STATUS)
4210             || unlikely(!local->apdev)) {
4211                 dev_kfree_skb(skb);
4212                 return;
4213         }
4214
4215         msg_type = (status->flags & IEEE80211_TX_STATUS_ACK) ?
4216                 ieee80211_msg_tx_callback_ack : ieee80211_msg_tx_callback_fail;
4217
4218         /* skb was the original skb used for TX. Clone it and give the clone
4219          * to netif_rx(). Free original skb. */
4220         skb2 = skb_copy(skb, GFP_ATOMIC);
4221         if (!skb2) {
4222                 dev_kfree_skb(skb);
4223                 return;
4224         }
4225         dev_kfree_skb(skb);
4226         skb = skb2;
4227
4228         /* Send frame to hostapd */
4229         ieee80211_rx_mgmt(local, skb, NULL, msg_type);
4230 }
4231 EXPORT_SYMBOL(ieee80211_tx_status);
4232
4233 /* TODO: implement register/unregister functions for adding TX/RX handlers
4234  * into ordered list */
4235
4236 /* rx_pre handlers don't have dev and sdata fields available in
4237  * ieee80211_txrx_data */
4238 static ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
4239 {
4240         ieee80211_rx_h_parse_qos,
4241         ieee80211_rx_h_load_stats,
4242         NULL
4243 };
4244
4245 static ieee80211_rx_handler ieee80211_rx_handlers[] =
4246 {
4247         ieee80211_rx_h_if_stats,
4248         ieee80211_rx_h_monitor,
4249         ieee80211_rx_h_passive_scan,
4250         ieee80211_rx_h_check,
4251         ieee80211_rx_h_sta_process,
4252         ieee80211_rx_h_ccmp_decrypt,
4253         ieee80211_rx_h_tkip_decrypt,
4254         ieee80211_rx_h_wep_weak_iv_detection,
4255         ieee80211_rx_h_wep_decrypt,
4256         ieee80211_rx_h_defragment,
4257         ieee80211_rx_h_ps_poll,
4258         ieee80211_rx_h_michael_mic_verify,
4259         /* this must be after decryption - so header is counted in MPDU mic
4260          * must be before pae and data, so QOS_DATA format frames
4261          * are not passed to user space by these functions
4262          */
4263         ieee80211_rx_h_remove_qos_control,
4264         ieee80211_rx_h_802_1x_pae,
4265         ieee80211_rx_h_drop_unencrypted,
4266         ieee80211_rx_h_data,
4267         ieee80211_rx_h_mgmt,
4268         NULL
4269 };
4270
4271 static ieee80211_tx_handler ieee80211_tx_handlers[] =
4272 {
4273         ieee80211_tx_h_check_assoc,
4274         ieee80211_tx_h_ps_buf,
4275         ieee80211_tx_h_select_key,
4276         ieee80211_tx_h_michael_mic_add,
4277         ieee80211_tx_h_fragment,
4278         ieee80211_tx_h_tkip_encrypt,
4279         ieee80211_tx_h_ccmp_encrypt,
4280         ieee80211_tx_h_wep_encrypt,
4281         ieee80211_tx_h_rate_ctrl,
4282         ieee80211_tx_h_misc,
4283         ieee80211_tx_h_load_stats,
4284         NULL
4285 };
4286
4287
4288 int ieee80211_if_update_wds(struct net_device *dev, u8 *remote_addr)
4289 {
4290         struct ieee80211_local *local = dev->ieee80211_ptr;
4291         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4292         struct sta_info *sta;
4293
4294         /* Remove STA entry for the old peer */
4295         sta = sta_info_get(local, sdata->u.wds.remote_addr);
4296         if (sta) {
4297                 sta_info_put(sta);
4298                 sta_info_free(sta, 0);
4299         } else {
4300                 printk(KERN_DEBUG "%s: could not find STA entry for WDS link "
4301                        "peer " MAC_FMT "\n",
4302                        dev->name, MAC_ARG(sdata->u.wds.remote_addr));
4303         }
4304
4305         /* Update WDS link data */
4306         memcpy(&sdata->u.wds.remote_addr, remote_addr, ETH_ALEN);
4307
4308         return 0;
4309 }
4310
4311 /* Must not be called for mdev and apdev */
4312 void ieee80211_if_setup(struct net_device *dev)
4313 {
4314         ether_setup(dev);
4315         dev->hard_start_xmit = ieee80211_subif_start_xmit;
4316         dev->wireless_handlers =
4317                 (struct iw_handler_def *) &ieee80211_iw_handler_def;
4318         dev->do_ioctl = ieee80211_ioctl;
4319         dev->set_mac_address = ieee80211_set_mac_address;
4320         dev->set_multicast_list = ieee80211_set_multicast_list;
4321         dev->change_mtu = ieee80211_change_mtu;
4322         dev->tx_timeout = ieee80211_tx_timeout;
4323         dev->get_stats = ieee80211_get_stats;
4324         dev->open = ieee80211_open;
4325         dev->stop = ieee80211_stop;
4326         dev->tx_queue_len = 0;
4327         dev->uninit = ieee80211_if_reinit;
4328         dev->destructor = ieee80211_if_free;
4329 }
4330
4331 void ieee80211_if_mgmt_setup(struct net_device *dev)
4332 {
4333         ether_setup(dev);
4334         dev->hard_start_xmit = ieee80211_mgmt_start_xmit;
4335         dev->change_mtu = ieee80211_change_mtu_apdev;
4336         dev->get_stats = ieee80211_get_stats;
4337         dev->open = ieee80211_mgmt_open;
4338         dev->stop = ieee80211_mgmt_stop;
4339         dev->type = ARPHRD_IEEE80211_PRISM;
4340         dev->hard_header_parse = header_parse_80211;
4341         dev->tx_queue_len = 0;
4342         dev->uninit = ieee80211_if_reinit;
4343         dev->destructor = ieee80211_if_free;
4344 }
4345
4346 int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
4347                                  const char *name)
4348 {
4349         struct rate_control_ref *ref, *old;
4350         int res;
4351
4352         ASSERT_RTNL();
4353         if (local->open_count || netif_running(local->mdev) ||
4354             (local->apdev && netif_running(local->apdev)))
4355                 return -EBUSY;
4356
4357         ref = rate_control_alloc(name, local);
4358         if (!ref) {
4359                 printk(KERN_WARNING "%s: Failed to select rate control "
4360                        "algorithm\n", local->mdev->name);
4361                 return -ENOENT;
4362         }
4363         res = rate_control_add_attrs(ref, &local->class_dev.kobj);
4364         if (res < 0) {
4365                 printk(KERN_DEBUG "%s: Failed to register sysfs attributes "
4366                        "for rate control\n", local->mdev->name);
4367                 rate_control_put(ref);
4368                 return res;
4369         }
4370
4371         old = local->rate_ctrl;
4372         local->rate_ctrl = ref;
4373         if (old) {
4374                 rate_control_remove_attrs(ref, &local->class_dev.kobj);
4375                 rate_control_put(old);
4376                 sta_info_flush(local, NULL);
4377         }
4378
4379         printk(KERN_DEBUG "%s: Selected rate control "
4380                "algorithm '%s'\n", local->mdev->name,
4381                ref->ops->name);
4382
4383
4384         return 0;
4385 }
4386
4387 static void rate_control_deinitialize(struct ieee80211_local *local)
4388 {
4389         struct rate_control_ref *ref;
4390
4391         ref = local->rate_ctrl;
4392         local->rate_ctrl = NULL;
4393         rate_control_remove_attrs(ref, &local->class_dev.kobj);
4394         rate_control_put(ref);
4395 }
4396
4397 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
4398                                         const struct ieee80211_ops *ops)
4399 {
4400         struct net_device *mdev;
4401         struct ieee80211_local *local;
4402         struct ieee80211_sub_if_data *sdata;
4403         int priv_size;
4404
4405         local = ieee80211_dev_alloc(GFP_KERNEL);
4406         if (!local)
4407                 return NULL;
4408
4409         local->ops = ops;
4410
4411         /* Ensure 32-byte alignment of our private data and hw private data.
4412          * Each net_device is followed by a sub_if_data which is used for
4413          * interface specific information.
4414          *
4415          * Sample memory map looks something like:
4416          *
4417          * 0000 *****************
4418          *      * net_dev       *
4419          * 0160 *****************
4420          *      * sub_if        *
4421          * 0b80 *****************
4422          *      * hw_priv       *
4423          * 1664 *****************
4424          */
4425         priv_size = ((sizeof(struct ieee80211_sub_if_data) +
4426                       NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST) +
4427                     priv_data_len;
4428         mdev = alloc_netdev(priv_size, "wmaster%d", ether_setup);
4429         if (!mdev) {
4430                 ieee80211_dev_free(local);
4431                 return NULL;
4432         }
4433
4434         mdev->ieee80211_ptr = local;
4435         local->hw.priv = (char *)mdev->priv +
4436                          ((sizeof(struct ieee80211_sub_if_data) +
4437                            NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST);
4438         local->hw.queues = 1; /* default */
4439
4440         local->mdev = mdev;
4441         local->rx_pre_handlers = ieee80211_rx_pre_handlers;
4442         local->rx_handlers = ieee80211_rx_handlers;
4443         local->tx_handlers = ieee80211_tx_handlers;
4444
4445         local->bridge_packets = 1;
4446
4447         local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
4448         local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
4449         local->short_retry_limit = 7;
4450         local->long_retry_limit = 4;
4451         local->hw.conf.radio_enabled = 1;
4452         local->rate_ctrl_num_up = RATE_CONTROL_NUM_UP;
4453         local->rate_ctrl_num_down = RATE_CONTROL_NUM_DOWN;
4454
4455         local->scan.in_scan = 0;
4456         local->enabled_modes = (unsigned int) -1;
4457
4458         init_timer(&local->scan.timer); /* clear it out */
4459
4460         INIT_LIST_HEAD(&local->modes_list);
4461
4462         spin_lock_init(&local->sub_if_lock);
4463         INIT_LIST_HEAD(&local->sub_if_list);
4464
4465         spin_lock_init(&local->generic_lock);
4466         INIT_DELAYED_WORK(&local->scan_work, ieee80211_sta_scan_work);
4467         init_timer(&local->stat_timer);
4468         local->stat_timer.function = ieee80211_stat_refresh;
4469         local->stat_timer.data = (unsigned long) local;
4470         ieee80211_rx_bss_list_init(mdev);
4471
4472         sta_info_init(local);
4473
4474         mdev->hard_start_xmit = ieee80211_master_start_xmit;
4475         mdev->wireless_handlers =
4476                 (struct iw_handler_def *) &ieee80211_iw_master_handler_def;
4477         mdev->do_ioctl = ieee80211_ioctl;
4478         mdev->change_mtu = ieee80211_change_mtu;
4479         mdev->tx_timeout = ieee80211_tx_timeout;
4480         mdev->get_stats = ieee80211_get_stats;
4481         mdev->open = ieee80211_master_open;
4482         mdev->stop = ieee80211_master_stop;
4483         mdev->type = ARPHRD_IEEE80211;
4484         mdev->hard_header_parse = header_parse_80211;
4485
4486         sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
4487         sdata->type = IEEE80211_IF_TYPE_AP;
4488         sdata->dev = mdev;
4489         sdata->local = local;
4490         sdata->u.ap.force_unicast_rateidx = -1;
4491         sdata->u.ap.max_ratectrl_rateidx = -1;
4492         ieee80211_if_sdata_init(sdata);
4493         list_add_tail(&sdata->list, &local->sub_if_list);
4494
4495         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
4496                      (unsigned long)local);
4497         tasklet_disable(&local->tx_pending_tasklet);
4498
4499         tasklet_init(&local->tasklet,
4500                      ieee80211_tasklet_handler,
4501                      (unsigned long) local);
4502         skb_queue_head_init(&local->skb_queue);
4503         skb_queue_head_init(&local->skb_queue_unreliable);
4504
4505         return local_to_hw(local);
4506 }
4507 EXPORT_SYMBOL(ieee80211_alloc_hw);
4508
4509 int ieee80211_register_hw(struct ieee80211_hw *hw)
4510 {
4511         struct ieee80211_local *local = hw_to_local(hw);
4512         struct net_device *sta_dev;
4513         int result;
4514
4515         result = ieee80211_dev_alloc_index(local);
4516         if (result < 0)
4517                 return -1;
4518
4519         local->class_dev.dev = local->hw.dev;
4520
4521         result = ieee80211_dev_sysfs_add(local);
4522         if (result < 0)
4523                 goto fail_sysfs;
4524
4525         local->hw.conf.beacon_int = 1000;
4526
4527         result = sta_info_start(local);
4528         if (result < 0)
4529                 goto fail_sta_info;
4530
4531         if (hw->flags & IEEE80211_HW_FRAGLIST)
4532                 local->mdev->features |= NETIF_F_FRAGLIST;
4533         rtnl_lock();
4534         result = dev_alloc_name(local->mdev, local->mdev->name);
4535         if (result < 0) {
4536                 rtnl_unlock();
4537                 goto fail_dev;
4538         }
4539
4540         memcpy(local->mdev->dev_addr, local->hw.perm_addr, ETH_ALEN);
4541         SET_NETDEV_DEV(local->mdev, local->hw.dev);
4542
4543         result = register_netdevice(local->mdev);
4544         if (result < 0) {
4545                 rtnl_unlock();
4546                 goto fail_dev;
4547         }
4548         result = sysfs_create_link(&local->class_dev.kobj,
4549                                    &local->mdev->class_dev.kobj,
4550                                    "master");
4551         if (result < 0) {
4552                 rtnl_unlock();
4553                 goto fail_masterlink;
4554         }
4555         result = ieee80211_sysfs_add_netdevice(local->mdev);
4556         if (result < 0) {
4557                 rtnl_unlock();
4558                 goto fail_if_sysfs;
4559         }
4560
4561         result = ieee80211_init_rate_ctrl_alg(local, NULL);
4562         rtnl_unlock();
4563         if (result < 0) {
4564                 printk(KERN_DEBUG "%s: Failed to initialize rate control "
4565                        "algorithm\n", local->mdev->name);
4566                 goto fail_rate;
4567         }
4568
4569         result = ieee80211_wep_init(local);
4570
4571         if (result < 0) {
4572                 printk(KERN_DEBUG "%s: Failed to initialize wep\n",
4573                        local->mdev->name);
4574                 goto fail_wep;
4575         }
4576
4577         /* TODO: add rtnl locking around device creation and qdisc install */
4578         ieee80211_install_qdisc(local->mdev);
4579
4580         /* add one default STA interface */
4581         rtnl_lock();
4582         result = ieee80211_if_add(local->mdev, "wlan%d", 1, &sta_dev);
4583         if (result == 0)
4584                 ieee80211_if_set_type(sta_dev, IEEE80211_IF_TYPE_STA);
4585
4586         local->reg_state = IEEE80211_DEV_REGISTERED;
4587         rtnl_unlock();
4588
4589         ieee80211_led_init(local);
4590
4591         return 0;
4592
4593 fail_wep:
4594         rate_control_deinitialize(local);
4595 fail_rate:
4596         ieee80211_sysfs_remove_netdevice(local->mdev);
4597 fail_if_sysfs:
4598         sysfs_remove_link(&local->class_dev.kobj, "master");
4599 fail_masterlink:
4600         unregister_netdev(local->mdev);
4601 fail_dev:
4602         sta_info_stop(local);
4603 fail_sta_info:
4604         ieee80211_dev_sysfs_del(local);
4605 fail_sysfs:
4606         ieee80211_dev_free_index(local);
4607         return result;
4608 }
4609 EXPORT_SYMBOL(ieee80211_register_hw);
4610
4611 int ieee80211_register_hwmode(struct ieee80211_hw *hw,
4612                               struct ieee80211_hw_mode *mode)
4613 {
4614         struct ieee80211_local *local = hw_to_local(hw);
4615         struct ieee80211_rate *rate;
4616         int i;
4617
4618         INIT_LIST_HEAD(&mode->list);
4619         list_add_tail(&mode->list, &local->modes_list);
4620
4621         local->hw_modes |= (1 << mode->mode);
4622         for (i = 0; i < mode->num_rates; i++) {
4623                 rate = &(mode->rates[i]);
4624                 rate->rate_inv = CHAN_UTIL_RATE_LCM / rate->rate;
4625         }
4626
4627         if (!local->curr_rates) {
4628                 /* Default to this mode */
4629                 local->hw.conf.phymode = mode->mode;
4630                 local->curr_rates = mode->rates;
4631                 local->num_curr_rates = mode->num_rates;
4632                 ieee80211_prepare_rates(local);
4633                 local->hw.conf.freq = mode->channels[0].freq;
4634                 local->hw.conf.channel = mode->channels[0].chan;
4635                 local->hw.conf.channel_val = mode->channels[0].val;
4636         }
4637
4638         ieee80211_init_client(local->mdev);
4639
4640         return 0;
4641 }
4642 EXPORT_SYMBOL(ieee80211_register_hwmode);
4643
4644 void ieee80211_unregister_hw(struct ieee80211_hw *hw)
4645 {
4646         struct ieee80211_local *local = hw_to_local(hw);
4647         struct ieee80211_sub_if_data *sdata, *tmp;
4648         int i;
4649
4650         tasklet_disable(&local->tasklet);
4651         /* TODO: skb_queue should be empty here, no need to do anything? */
4652
4653         rtnl_lock();
4654         local->reg_state = IEEE80211_DEV_UNREGISTERED;
4655         if (local->apdev)
4656                 ieee80211_if_del_mgmt(local);
4657
4658         sysfs_remove_link(&local->class_dev.kobj, "master");
4659
4660         list_for_each_entry_safe(sdata, tmp, &local->sub_if_list, list)
4661                 __ieee80211_if_del(local, sdata);
4662
4663         rtnl_unlock();
4664
4665         if (local->stat_time)
4666                 del_timer_sync(&local->stat_timer);
4667         if (!local->ops->hw_scan && local->scan_dev) {
4668                 local->sta_scanning = 0;
4669                 cancel_delayed_work(&local->scan_work);
4670                 flush_scheduled_work();
4671                 /* The scan_work is guaranteed not to be called at this
4672                  * point. It is not scheduled and not running now. It can be
4673                  * scheduled again only by sta_work (stopped by now) or under
4674                  * rtnl lock. */
4675         }
4676
4677         ieee80211_rx_bss_list_deinit(local->mdev);
4678         ieee80211_clear_tx_pending(local);
4679         sta_info_stop(local);
4680         rate_control_deinitialize(local);
4681         ieee80211_dev_sysfs_del(local);
4682
4683         for (i = 0; i < NUM_IEEE80211_MODES; i++) {
4684                 kfree(local->supp_rates[i]);
4685                 kfree(local->basic_rates[i]);
4686         }
4687
4688         if (skb_queue_len(&local->skb_queue)
4689                         || skb_queue_len(&local->skb_queue_unreliable))
4690                 printk(KERN_WARNING "%s: skb_queue not empty\n",
4691                        local->mdev->name);
4692         skb_queue_purge(&local->skb_queue);
4693         skb_queue_purge(&local->skb_queue_unreliable);
4694
4695         ieee80211_dev_free_index(local);
4696         ieee80211_wep_free(local);
4697         ieee80211_led_exit(local);
4698 }
4699 EXPORT_SYMBOL(ieee80211_unregister_hw);
4700
4701 void ieee80211_free_hw(struct ieee80211_hw *hw)
4702 {
4703         struct ieee80211_local *local = hw_to_local(hw);
4704
4705         ieee80211_if_free(local->mdev);
4706         ieee80211_dev_free(local);
4707 }
4708 EXPORT_SYMBOL(ieee80211_free_hw);
4709
4710 void ieee80211_release_hw(struct ieee80211_local *local)
4711 {
4712         kfree(local);
4713 }
4714
4715 /* Perform netif operations on all configured interfaces */
4716 int ieee80211_netif_oper(struct ieee80211_hw *hw, Netif_Oper op)
4717 {
4718         struct ieee80211_local *local = hw_to_local(hw);
4719         struct net_device *dev = local->mdev;
4720
4721         switch (op) {
4722         case NETIF_ATTACH:
4723                 netif_device_attach(dev);
4724                 break;
4725         case NETIF_DETACH:
4726                 netif_device_detach(dev);
4727                 break;
4728         case NETIF_START:
4729                 netif_start_queue(dev);
4730                 break;
4731         case NETIF_STOP:
4732                 break;
4733         case NETIF_WAKE:
4734                 if (local->scan.in_scan == 0) {
4735                         netif_wake_queue(dev);
4736 #if 1
4737                         if (/* FIX: 802.11 qdisc in use */ 1)
4738                                 __netif_schedule(dev);
4739 #endif
4740                 }
4741                 break;
4742         case NETIF_IS_STOPPED:
4743                 if (netif_queue_stopped(dev))
4744                         return 1;
4745                 break;
4746         case NETIF_UPDATE_TX_START:
4747                 dev->trans_start = jiffies;
4748                 break;
4749         }
4750
4751         return 0;
4752 }
4753 EXPORT_SYMBOL(ieee80211_netif_oper);
4754
4755 void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
4756 {
4757         struct ieee80211_local *local = hw_to_local(hw);
4758
4759         if (test_and_clear_bit(IEEE80211_LINK_STATE_XOFF,
4760                                &local->state[queue])) {
4761                 if (test_bit(IEEE80211_LINK_STATE_PENDING,
4762                              &local->state[queue]))
4763                         tasklet_schedule(&local->tx_pending_tasklet);
4764                 else
4765                         __netif_schedule(local->mdev);
4766         }
4767 }
4768 EXPORT_SYMBOL(ieee80211_wake_queue);
4769
4770 void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
4771 {
4772         struct ieee80211_local *local = hw_to_local(hw);
4773
4774         set_bit(IEEE80211_LINK_STATE_XOFF, &local->state[queue]);
4775 }
4776 EXPORT_SYMBOL(ieee80211_stop_queue);
4777
4778 void ieee80211_start_queues(struct ieee80211_hw *hw)
4779 {
4780         struct ieee80211_local *local = hw_to_local(hw);
4781         int i;
4782
4783         for (i = 0; i < local->hw.queues; i++)
4784                 clear_bit(IEEE80211_LINK_STATE_XOFF, &local->state[i]);
4785 }
4786 EXPORT_SYMBOL(ieee80211_start_queues);
4787
4788 void ieee80211_stop_queues(struct ieee80211_hw *hw)
4789 {
4790         struct ieee80211_local *local = hw_to_local(hw);
4791         int i;
4792
4793         for (i = 0; i < local->hw.queues; i++)
4794                 ieee80211_stop_queue(hw, i);
4795 }
4796 EXPORT_SYMBOL(ieee80211_stop_queues);
4797
4798 struct net_device_stats *ieee80211_dev_stats(struct net_device *dev)
4799 {
4800         struct ieee80211_sub_if_data *sdata;
4801         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4802         return &sdata->stats;
4803 }
4804
4805 static int __init ieee80211_init(void)
4806 {
4807         struct sk_buff *skb;
4808         int ret;
4809
4810         BUILD_BUG_ON(sizeof(struct ieee80211_tx_packet_data) > sizeof(skb->cb));
4811
4812         if ((ret = ieee80211_sysfs_init())) {
4813                 printk(KERN_WARNING "ieee80211_init: sysfs initialization "
4814                        "failed\n");
4815                 return ret;
4816         }
4817
4818         {
4819                 ret = ieee80211_wme_register();
4820                 if (ret) {
4821                         printk(KERN_DEBUG "ieee80211_init: failed to "
4822                                "initialize WME (err=%d)\n", ret);
4823                         ieee80211_sysfs_deinit();
4824                         return ret;
4825                 }
4826         }
4827
4828         return 0;
4829 }
4830
4831
4832 static void __exit ieee80211_exit(void)
4833 {
4834         ieee80211_wme_unregister();
4835         ieee80211_sysfs_deinit();
4836 }
4837
4838
4839 module_init(ieee80211_init);
4840 module_exit(ieee80211_exit);
4841
4842 MODULE_DESCRIPTION("IEEE 802.11 subsystem");
4843 MODULE_LICENSE("GPL");