target/linux/package/ieee80211-dscape/src/ieee80211_sta.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11
  12 /* TODO:
  13  * BSS table: use <BSSID,SSID> as the key to support multi-SSID APs
  14  * order BSS list by RSSI(?) ("quality of AP")
  15  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  16  *    SSID)
  17  */
  18 #include <linux/config.h>
  19 #include <linux/version.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/if_arp.h>
  24 #include <linux/wireless.h>
  25 #include <linux/random.h>
  26 #include <net/iw_handler.h>
  27 #include <asm/types.h>
  28 #include <asm/delay.h>
  29
  30 #include <net/ieee80211.h>
  31 #include <net/ieee80211_mgmt.h>
  32 #include "ieee80211_i.h"
  33 #include "rate_control.h"
  34 #include "hostapd_ioctl.h"
  35
  36 /* #define IEEE80211_IBSS_DEBUG */
  37
  38 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  39 #define IEEE80211_AUTH_MAX_TRIES 3
  40 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  41 #define IEEE80211_ASSOC_MAX_TRIES 3
  42 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  43 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  44 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  45 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  46 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  47 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
  48
  49 #define IEEE80211_PROBE_DELAY (HZ / 33)
  50 #define IEEE80211_CHANNEL_TIME (HZ / 33)
  51 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
  52 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
  53 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  54 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  55
  56 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  57
  58
  59 #define IEEE80211_FC(type, stype) cpu_to_le16((type << 2) | (stype << 4))
  60
  61 #define ERP_INFO_USE_PROTECTION BIT(1)
  62
  63 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
  64                                      u8 *ssid, size_t ssid_len);
  65 static struct ieee80211_sta_bss *
  66 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid);
  67 static void ieee80211_rx_bss_put(struct net_device *dev,
  68                                  struct ieee80211_sta_bss *bss);
  69 static int ieee80211_sta_find_ibss(struct net_device *dev,
  70                                    struct ieee80211_if_sta *ifsta);
  71 static int ieee80211_sta_wep_configured(struct net_device *dev);
  72
  73
  74 /* Parsed Information Elements */
  75 struct ieee802_11_elems {
  76         u8 *ssid;
  77         u8 ssid_len;
  78         u8 *supp_rates;
  79         u8 supp_rates_len;
  80         u8 *fh_params;
  81         u8 fh_params_len;
  82         u8 *ds_params;
  83         u8 ds_params_len;
  84         u8 *cf_params;
  85         u8 cf_params_len;
  86         u8 *tim;
  87         u8 tim_len;
  88         u8 *ibss_params;
  89         u8 ibss_params_len;
  90         u8 *challenge;
  91         u8 challenge_len;
  92         u8 *wpa;
  93         u8 wpa_len;
  94         u8 *rsn;
  95         u8 rsn_len;
  96         u8 *erp_info;
  97         u8 erp_info_len;
  98         u8 *ext_supp_rates;
  99         u8 ext_supp_rates_len;
 100         u8 *wmm_info;
 101         u8 wmm_info_len;
 102         u8 *wmm_param;
 103         u8 wmm_param_len;
 104 };
 105
 106 typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
 107
 108
 109 static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
 110                                        struct ieee802_11_elems *elems)
 111 {
 112         size_t left = len;
 113         u8 *pos = start;
 114         int unknown = 0;
 115
 116         memset(elems, 0, sizeof(*elems));
 117
 118         while (left >= 2) {
 119                 u8 id, elen;
 120
 121                 id = *pos++;
 122                 elen = *pos++;
 123                 left -= 2;
 124
 125                 if (elen > left) {
 126 #if 0
 127                         if (net_ratelimit())
 128                                 printk(KERN_DEBUG "IEEE 802.11 element parse "
 129                                        "failed (id=%d elen=%d left=%d)\n",
 130                                        id, elen, left);
 131 #endif
 132                         return ParseFailed;
 133                 }
 134
 135                 switch (id) {
 136                 case WLAN_EID_SSID:
 137                         elems->ssid = pos;
 138                         elems->ssid_len = elen;
 139                         break;
 140                 case WLAN_EID_SUPP_RATES:
 141                         elems->supp_rates = pos;
 142                         elems->supp_rates_len = elen;
 143                         break;
 144                 case WLAN_EID_FH_PARAMS:
 145                         elems->fh_params = pos;
 146                         elems->fh_params_len = elen;
 147                         break;
 148                 case WLAN_EID_DS_PARAMS:
 149                         elems->ds_params = pos;
 150                         elems->ds_params_len = elen;
 151                         break;
 152                 case WLAN_EID_CF_PARAMS:
 153                         elems->cf_params = pos;
 154                         elems->cf_params_len = elen;
 155                         break;
 156                 case WLAN_EID_TIM:
 157                         elems->tim = pos;
 158                         elems->tim_len = elen;
 159                         break;
 160                 case WLAN_EID_IBSS_PARAMS:
 161                         elems->ibss_params = pos;
 162                         elems->ibss_params_len = elen;
 163                         break;
 164                 case WLAN_EID_CHALLENGE:
 165                         elems->challenge = pos;
 166                         elems->challenge_len = elen;
 167                         break;
 168                 case WLAN_EID_WPA:
 169                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 170                             pos[2] == 0xf2) {
 171                                 /* Microsoft OUI (00:50:F2) */
 172                                 if (pos[3] == 1) {
 173                                         /* OUI Type 1 - WPA IE */
 174                                         elems->wpa = pos;
 175                                         elems->wpa_len = elen;
 176                                 } else if (elen >= 5 && pos[3] == 2) {
 177                                         if (pos[4] == 0) {
 178                                                 elems->wmm_info = pos;
 179                                                 elems->wmm_info_len = elen;
 180                                         } else if (pos[4] == 1) {
 181                                                 elems->wmm_param = pos;
 182                                                 elems->wmm_param_len = elen;
 183                                         }
 184                                 }
 185                         }
 186                         break;
 187                 case WLAN_EID_RSN:
 188                         elems->rsn = pos;
 189                         elems->rsn_len = elen;
 190                         break;
 191                 case WLAN_EID_ERP_INFO:
 192                         elems->erp_info = pos;
 193                         elems->erp_info_len = elen;
 194                         break;
 195                 case WLAN_EID_EXT_SUPP_RATES:
 196                         elems->ext_supp_rates = pos;
 197                         elems->ext_supp_rates_len = elen;
 198                         break;
 199                 default:
 200 #if 0
 201                         printk(KERN_DEBUG "IEEE 802.11 element parse ignored "
 202                                       "unknown element (id=%d elen=%d)\n",
 203                                       id, elen);
 204 #endif
 205                         unknown++;
 206                         break;
 207                 }
 208
 209                 left -= elen;
 210                 pos += elen;
 211         }
 212
 213         if (left)
 214                 return ParseFailed;
 215
 216         return unknown ? ParseUnknown : ParseOK;
 217 }
 218
 219
 220
 221
 222 static int ecw2cw(int ecw)
 223 {
 224         int cw = 1;
 225         while (ecw > 0) {
 226                 cw <<= 1;
 227                 ecw--;
 228         }
 229         return cw - 1;
 230 }
 231
 232
 233 static void ieee80211_sta_wmm_params(struct net_device *dev,
 234                                      struct ieee80211_if_sta *ifsta,
 235                                      u8 *wmm_param, size_t wmm_param_len)
 236 {
 237         struct ieee80211_local *local = dev->priv;
 238         struct ieee80211_tx_queue_params params;
 239         size_t left;
 240         int count;
 241         u8 *pos;
 242
 243         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 244                 return;
 245         count = wmm_param[6] & 0x0f;
 246         if (count == ifsta->wmm_last_param_set)
 247                 return;
 248         ifsta->wmm_last_param_set = count;
 249
 250         pos = wmm_param + 8;
 251         left = wmm_param_len - 8;
 252
 253         memset(&params, 0, sizeof(params));
 254
 255         if (local->hw->conf_tx == NULL)
 256                 return;
 257
 258         local->wmm_acm = 0;
 259         for (; left >= 4; left -= 4, pos += 4) {
 260                 int aci = (pos[0] >> 5) & 0x03;
 261                 int acm = (pos[0] >> 4) & 0x01;
 262                 int queue;
 263
 264                 switch (aci) {
 265                 case 1:
 266                         queue = IEEE80211_TX_QUEUE_DATA3;
 267                         if (acm) {
 268                                 local->wmm_acm |= BIT(1) | BIT(2);
 269                         }
 270                         break;
 271                 case 2:
 272                         queue = IEEE80211_TX_QUEUE_DATA1;
 273                         if (acm) {
 274                                 local->wmm_acm |= BIT(4) | BIT(5);
 275                         }
 276                         break;
 277                 case 3:
 278                         queue = IEEE80211_TX_QUEUE_DATA0;
 279                         if (acm) {
 280                                 local->wmm_acm |= BIT(6) | BIT(7);
 281                         }
 282                         break;
 283                 case 0:
 284                 default:
 285                         queue = IEEE80211_TX_QUEUE_DATA2;
 286                         if (acm) {
 287                                 local->wmm_acm |= BIT(0) | BIT(3);
 288                         }
 289                         break;
 290                 }
 291
 292                 params.aifs = pos[0] & 0x0f;
 293                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 294                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 295                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 296                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 297                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 298                        "cWmin=%d cWmax=%d burst=%d\n",
 299                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
 300                        params.cw_max, params.burst_time);
 301                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 302                  * AC for now) */
 303                 if (local->hw->conf_tx(local->mdev, queue, &params)) {
 304                         printk(KERN_DEBUG "%s: failed to set TX queue "
 305                                "parameters for queue %d\n", dev->name, queue);
 306                 }
 307         }
 308 }
 309
 310
 311 static void ieee80211_sta_send_associnfo(struct net_device *dev,
 312                                          struct ieee80211_if_sta *ifsta)
 313 {
 314         char *buf;
 315         size_t len;
 316         int i;
 317         union iwreq_data wrqu;
 318
 319         if (ifsta->assocreq_ies == NULL && ifsta->assocresp_ies == NULL)
 320                 return;
 321
 322         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
 323                                 ifsta->assocresp_ies_len), GFP_ATOMIC);
 324         if (buf == NULL)
 325                 return;
 326
 327         len = sprintf(buf, "ASSOCINFO(");
 328         if (ifsta->assocreq_ies) {
 329                 len += sprintf(buf + len, "ReqIEs=");
 330                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
 331                         len += sprintf(buf + len, "%02x",
 332                                        ifsta->assocreq_ies[i]);
 333                 }
 334         }
 335         if (ifsta->assocresp_ies) {
 336                 if (ifsta->assocreq_ies)
 337                         len += sprintf(buf + len, " ");
 338                 len += sprintf(buf + len, "RespIEs=");
 339                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 340                         len += sprintf(buf + len, "%02x",
 341                                        ifsta->assocresp_ies[i]);
 342                 }
 343         }
 344         len += sprintf(buf + len, ")");
 345
 346         if (len > IW_CUSTOM_MAX) {
 347                 len = sprintf(buf, "ASSOCRESPIE=");
 348                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 349                         len += sprintf(buf + len, "%02x",
 350                                        ifsta->assocresp_ies[i]);
 351                 }
 352         }
 353
 354         memset(&wrqu, 0, sizeof(wrqu));
 355         wrqu.data.length = len;
 356         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 357
 358         kfree(buf);
 359 }
 360
 361
 362 static void ieee80211_set_associated(struct net_device *dev,
 363                                      struct ieee80211_if_sta *ifsta, int assoc)
 364 {
 365         union iwreq_data wrqu;
 366
 367         if (ifsta->associated == assoc)
 368                 return;
 369
 370         ifsta->associated = assoc;
 371
 372         if (assoc) {
 373                 struct ieee80211_sub_if_data *sdata;
 374                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 375                 if (sdata->type != IEEE80211_SUB_IF_TYPE_STA)
 376                         return;
 377                 ifsta->prev_bssid_set = 1;
 378                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 379                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 380                 ieee80211_sta_send_associnfo(dev, ifsta);
 381         } else {
 382                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 383         }
 384         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 385         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 386         ifsta->last_probe = jiffies;
 387 }
 388
 389
 390 static void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
 391                              int encrypt, int probe_resp)
 392 {
 393         struct ieee80211_sub_if_data *sdata;
 394         struct ieee80211_tx_packet_data *pkt_data;
 395
 396         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 397         skb->dev = sdata->master;
 398         skb->mac.raw = skb->nh.raw = skb->h.raw = skb->data;
 399
 400         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
 401         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
 402         pkt_data->magic = IEEE80211_CB_MAGIC;
 403         pkt_data->sdata = sdata;
 404         pkt_data->control.do_not_encrypt = !encrypt;
 405         if (probe_resp)
 406                 pkt_data->control.pkt_type = PKT_PROBE_RESP;
 407
 408         dev_queue_xmit(skb);
 409 }
 410
 411
 412 static void ieee80211_send_auth(struct net_device *dev,
 413                                 struct ieee80211_if_sta *ifsta,
 414                                 int transaction, u8 *extra, size_t extra_len,
 415                                 int encrypt)
 416 {
 417         struct sk_buff *skb;
 418         struct ieee80211_mgmt *mgmt;
 419
 420         skb = dev_alloc_skb(sizeof(*mgmt) + 6 + extra_len);
 421         if (skb == NULL) {
 422                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 423                        "frame\n", dev->name);
 424                 return;
 425         }
 426
 427         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 428         memset(mgmt, 0, 24 + 6);
 429         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 430                                            WLAN_FC_STYPE_AUTH);
 431         if (encrypt)
 432                 mgmt->frame_control |= cpu_to_le16(WLAN_FC_ISWEP);
 433         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 434         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 435         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 436         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 437         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 438         ifsta->auth_transaction = transaction + 1;
 439         mgmt->u.auth.status_code = cpu_to_le16(0);
 440         if (extra)
 441                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 442
 443         ieee80211_sta_tx(dev, skb, encrypt, 0);
 444 }
 445
 446
 447 static void ieee80211_authenticate(struct net_device *dev,
 448                                    struct ieee80211_if_sta *ifsta)
 449 {
 450         ifsta->auth_tries++;
 451         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 452                 printk(KERN_DEBUG "%s: authentication with AP " MACSTR
 453                        " timed out\n",
 454                        dev->name, MAC2STR(ifsta->bssid));
 455                 return;
 456         }
 457
 458         ifsta->state = IEEE80211_AUTHENTICATE;
 459         printk(KERN_DEBUG "%s: authenticate with AP " MACSTR "\n",
 460                dev->name, MAC2STR(ifsta->bssid));
 461
 462         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
 463
 464         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 465 }
 466
 467
 468 static void ieee80211_send_assoc(struct net_device *dev,
 469                                  struct ieee80211_if_sta *ifsta)
 470 {
 471         struct ieee80211_local *local = dev->priv;
 472         struct sk_buff *skb;
 473         struct ieee80211_mgmt *mgmt;
 474         u8 *pos, *ies;
 475         int i, len;
 476         u16 capab;
 477         struct ieee80211_sta_bss *bss;
 478         int wmm = 0;
 479
 480         skb = dev_alloc_skb(sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 481                             ifsta->ssid_len);
 482         if (skb == NULL) {
 483                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 484                        "frame\n", dev->name);
 485                 return;
 486         }
 487
 488         capab = ifsta->capab;
 489         if (local->conf.phymode == MODE_IEEE80211G) {
 490                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 491                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 492         }
 493         bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 494         if (bss) {
 495                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 496                         capab |= WLAN_CAPABILITY_PRIVACY;
 497                 if (bss->wmm_ie) {
 498                         wmm = 1;
 499                 }
 500                 ieee80211_rx_bss_put(dev, bss);
 501         }
 502
 503         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 504         memset(mgmt, 0, 24);
 505         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 506         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 507         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 508
 509         if (ifsta->prev_bssid_set) {
 510                 skb_put(skb, 10);
 511                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 512                                                    WLAN_FC_STYPE_REASSOC_REQ);
 513                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 514                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
 515                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 516                        ETH_ALEN);
 517         } else {
 518                 skb_put(skb, 4);
 519                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 520                                                    WLAN_FC_STYPE_ASSOC_REQ);
 521                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 522                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
 523         }
 524
 525         /* SSID */
 526         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 527         *pos++ = WLAN_EID_SSID;
 528         *pos++ = ifsta->ssid_len;
 529         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 530
 531         len = local->num_curr_rates;
 532         if (len > 8)
 533                 len = 8;
 534         pos = skb_put(skb, len + 2);
 535         *pos++ = WLAN_EID_SUPP_RATES;
 536         *pos++ = len;
 537         for (i = 0; i < len; i++) {
 538                 int rate = local->curr_rates[i].rate;
 539                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
 540                         rate /= 2;
 541                 *pos++ = (u8) (rate / 5);
 542         }
 543
 544         if (local->num_curr_rates > len) {
 545                 pos = skb_put(skb, local->num_curr_rates - len + 2);
 546                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 547                 *pos++ = local->num_curr_rates - len;
 548                 for (i = len; i < local->num_curr_rates; i++) {
 549                         int rate = local->curr_rates[i].rate;
 550                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
 551                                 rate /= 2;
 552                         *pos++ = (u8) (rate / 5);
 553                 }
 554         }
 555
 556         if (ifsta->extra_ie) {
 557                 pos = skb_put(skb, ifsta->extra_ie_len);
 558                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 559         }
 560
 561         if (wmm && ifsta->wmm_enabled) {
 562                 pos = skb_put(skb, 9);
 563                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 564                 *pos++ = 7; /* len */
 565                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 566                 *pos++ = 0x50;
 567                 *pos++ = 0xf2;
 568                 *pos++ = 2; /* WME */
 569                 *pos++ = 0; /* WME info */
 570                 *pos++ = 1; /* WME ver */
 571                 *pos++ = 0;
 572         }
 573
 574         kfree(ifsta->assocreq_ies);
 575         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 576         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_ATOMIC);
 577         if (ifsta->assocreq_ies)
 578                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 579
 580         ieee80211_sta_tx(dev, skb, 0, 0);
 581 }
 582
 583
 584 static void ieee80211_send_deauth(struct net_device *dev,
 585                                   struct ieee80211_if_sta *ifsta, u16 reason)
 586 {
 587         struct sk_buff *skb;
 588         struct ieee80211_mgmt *mgmt;
 589
 590         skb = dev_alloc_skb(sizeof(*mgmt));
 591         if (skb == NULL) {
 592                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 593                        "frame\n", dev->name);
 594                 return;
 595         }
 596
 597         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 598         memset(mgmt, 0, 24);
 599         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 600         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 601         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 602         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 603                                            WLAN_FC_STYPE_DEAUTH);
 604         skb_put(skb, 2);
 605         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 606
 607         ieee80211_sta_tx(dev, skb, 0, 0);
 608 }
 609
 610
 611 static void ieee80211_send_disassoc(struct net_device *dev,
 612                                     struct ieee80211_if_sta *ifsta, u16 reason)
 613 {
 614         struct sk_buff *skb;
 615         struct ieee80211_mgmt *mgmt;
 616
 617         skb = dev_alloc_skb(sizeof(*mgmt));
 618         if (skb == NULL) {
 619                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 620                        "frame\n", dev->name);
 621                 return;
 622         }
 623
 624         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 625         memset(mgmt, 0, 24);
 626         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 627         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 628         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 629         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 630                                            WLAN_FC_STYPE_DISASSOC);
 631         skb_put(skb, 2);
 632         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 633
 634         ieee80211_sta_tx(dev, skb, 0, 0);
 635 }
 636
 637
 638 static int ieee80211_privacy_mismatch(struct net_device *dev,
 639                                       struct ieee80211_if_sta *ifsta)
 640 {
 641         struct ieee80211_sta_bss *bss;
 642         int res = 0;
 643
 644         if (ifsta == NULL || ifsta->mixed_cell ||
 645             ifsta->key_mgmt != IEEE80211_KEY_MGMT_NONE)
 646                 return 0;
 647
 648         bss = ieee80211_rx_bss_get(dev, ifsta->bssid);
 649         if (bss == NULL)
 650                 return 0;
 651
 652         if (ieee80211_sta_wep_configured(dev) !=
 653             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 654                 res = 1;
 655
 656         ieee80211_rx_bss_put(dev, bss);
 657
 658         return res;
 659 }
 660
 661
 662 static void ieee80211_associate(struct net_device *dev,
 663                                 struct ieee80211_if_sta *ifsta)
 664 {
 665         ifsta->assoc_tries++;
 666         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 667                 printk(KERN_DEBUG "%s: association with AP " MACSTR
 668                        " timed out\n",
 669                        dev->name, MAC2STR(ifsta->bssid));
 670                 return;
 671         }
 672
 673         ifsta->state = IEEE80211_ASSOCIATE;
 674         printk(KERN_DEBUG "%s: associate with AP " MACSTR "\n",
 675                dev->name, MAC2STR(ifsta->bssid));
 676         if (ieee80211_privacy_mismatch(dev, ifsta)) {
 677                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 678                        "mixed-cell disabled - abort association\n", dev->name);
 679                 return;
 680         }
 681
 682         ieee80211_send_assoc(dev, ifsta);
 683
 684         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 685 }
 686
 687
 688 static void ieee80211_associated(struct net_device *dev,
 689                                  struct ieee80211_if_sta *ifsta)
 690 {
 691         struct ieee80211_local *local = dev->priv;
 692         struct sta_info *sta;
 693         int disassoc;
 694
 695         /* TODO: start monitoring current AP signal quality and number of
 696          * missed beacons. Scan other channels every now and then and search
 697          * for better APs. */
 698         /* TODO: remove expired BSSes */
 699
 700         ifsta->state = IEEE80211_ASSOCIATED;
 701
 702         sta = sta_info_get(local, ifsta->bssid);
 703         if (sta == NULL) {
 704                 printk(KERN_DEBUG "%s: No STA entry for own AP " MACSTR "\n",
 705                        dev->name, MAC2STR(ifsta->bssid));
 706                 disassoc = 1;
 707         } else {
 708                 disassoc = 0;
 709                 if (time_after(jiffies,
 710                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 711                         if (ifsta->probereq_poll) {
 712                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 713                                        "current AP " MACSTR " - assume out of "
 714                                        "range\n",
 715                                        dev->name, MAC2STR(ifsta->bssid));
 716                                 disassoc = 1;
 717                         } else {
 718                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 719                                                          local->scan_ssid,
 720                                                          local->scan_ssid_len);
 721                                 ifsta->probereq_poll = 1;
 722                         }
 723                 } else {
 724                         ifsta->probereq_poll = 0;
 725                         if (time_after(jiffies, ifsta->last_probe +
 726                                        IEEE80211_PROBE_INTERVAL)) {
 727                                 ifsta->last_probe = jiffies;
 728                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 729                                                          ifsta->ssid,
 730                                                          ifsta->ssid_len);
 731                         }
 732                 }
 733                 sta_info_release(local, sta);
 734         }
 735         if (disassoc) {
 736                 union iwreq_data wrqu;
 737                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 738                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 739                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 740                 mod_timer(&ifsta->timer,
 741                           jiffies + IEEE80211_MONITORING_INTERVAL + 30 * HZ);
 742         } else {
 743                 mod_timer(&ifsta->timer,
 744                           jiffies + IEEE80211_MONITORING_INTERVAL);
 745         }
 746 }
 747
 748
 749 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 750                                      u8 *ssid, size_t ssid_len)
 751 {
 752         struct ieee80211_local *local = dev->priv;
 753         struct sk_buff *skb;
 754         struct ieee80211_mgmt *mgmt;
 755         u8 *pos, *supp_rates, *esupp_rates = NULL;
 756         int i;
 757
 758         skb = dev_alloc_skb(sizeof(*mgmt) + 200);
 759         if (skb == NULL) {
 760                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 761                        "request\n", dev->name);
 762                 return;
 763         }
 764
 765         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 766         memset(mgmt, 0, 24);
 767         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 768                                            WLAN_FC_STYPE_PROBE_REQ);
 769         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 770         if (dst) {
 771                 memcpy(mgmt->da, dst, ETH_ALEN);
 772                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 773         } else {
 774                 memset(mgmt->da, 0xff, ETH_ALEN);
 775                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 776         }
 777         pos = skb_put(skb, 2 + ssid_len);
 778         *pos++ = WLAN_EID_SSID;
 779         *pos++ = ssid_len;
 780         memcpy(pos, ssid, ssid_len);
 781
 782         supp_rates = skb_put(skb, 2);
 783         supp_rates[0] = WLAN_EID_SUPP_RATES;
 784         supp_rates[1] = 0;
 785         for (i = 0; i < local->num_curr_rates; i++) {
 786                 struct ieee80211_rate *rate = &local->curr_rates[i];
 787                 if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
 788                         continue;
 789                 if (esupp_rates) {
 790                         pos = skb_put(skb, 1);
 791                         esupp_rates[1]++;
 792                 } else if (supp_rates[1] == 8) {
 793                         esupp_rates = skb_put(skb, 3);
 794                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 795                         esupp_rates[1] = 1;
 796                         pos = &esupp_rates[2];
 797                 } else {
 798                         pos = skb_put(skb, 1);
 799                         supp_rates[1]++;
 800                 }
 801                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
 802                         *pos = rate->rate / 10;
 803                 else
 804                         *pos = rate->rate / 5;
 805         }
 806
 807         ieee80211_sta_tx(dev, skb, 0, 0);
 808 }
 809
 810
 811 static int ieee80211_sta_wep_configured(struct net_device *dev)
 812 {
 813         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 814         if (sdata == NULL || sdata->default_key == NULL ||
 815             sdata->default_key->alg != ALG_WEP)
 816                 return 0;
 817         return 1;
 818 }
 819
 820
 821 static void ieee80211_auth_completed(struct net_device *dev,
 822                                      struct ieee80211_if_sta *ifsta)
 823 {
 824         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
 825         ifsta->authenticated = 1;
 826         ieee80211_associate(dev, ifsta);
 827 }
 828
 829
 830 static void ieee80211_auth_challenge(struct net_device *dev,
 831                                      struct ieee80211_if_sta *ifsta,
 832                                      struct ieee80211_mgmt *mgmt,
 833                                      size_t len,
 834                                      struct ieee80211_rx_status *rx_status)
 835 {
 836         u8 *pos;
 837         struct ieee802_11_elems elems;
 838
 839         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
 840         pos = mgmt->u.auth.variable;
 841         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
 842             == ParseFailed) {
 843                 printk(KERN_DEBUG "%s: failed to parse Auth(challenge)\n",
 844                        dev->name);
 845                 return;
 846         }
 847         if (elems.challenge == NULL) {
 848                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
 849                        "frame\n", dev->name);
 850                 return;
 851         }
 852         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
 853                             elems.challenge_len + 2, 1);
 854 }
 855
 856
 857 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
 858                                    struct ieee80211_if_sta *ifsta,
 859                                    struct ieee80211_mgmt *mgmt,
 860                                    size_t len,
 861                                    struct ieee80211_rx_status *rx_status)
 862 {
 863         struct ieee80211_local *local = dev->priv;
 864         u16 auth_alg, auth_transaction, status_code;
 865
 866         if (ifsta->state != IEEE80211_AUTHENTICATE &&
 867             local->conf.mode != IW_MODE_ADHOC) {
 868                 printk(KERN_DEBUG "%s: authentication frame received from "
 869                        MACSTR ", but not in authenticate state - ignored\n",
 870                        dev->name, MAC2STR(mgmt->sa));
 871                 return;
 872         }
 873
 874         if (len < 24 + 6) {
 875                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
 876                        "received from " MACSTR " - ignored\n",
 877                        dev->name, len, MAC2STR(mgmt->sa));
 878                 return;
 879         }
 880
 881         if (local->conf.mode != IW_MODE_ADHOC &&
 882             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
 883                 printk(KERN_DEBUG "%s: authentication frame received from "
 884                        "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
 885                        "ignored\n", dev->name, MAC2STR(mgmt->sa),
 886                        MAC2STR(mgmt->bssid));
 887                 return;
 888         }
 889
 890         if (local->conf.mode == IW_MODE_ADHOC &&
 891             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 892                 printk(KERN_DEBUG "%s: authentication frame received from "
 893                        "unknown BSSID (SA=" MACSTR " BSSID=" MACSTR ") - "
 894                        "ignored\n", dev->name, MAC2STR(mgmt->sa),
 895                        MAC2STR(mgmt->bssid));
 896                 return;
 897         }
 898
 899         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
 900         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 901         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 902
 903         printk(KERN_DEBUG "%s: RX authentication from " MACSTR " (alg=%d "
 904                "transaction=%d status=%d)\n",
 905                dev->name, MAC2STR(mgmt->sa), auth_alg,
 906                auth_transaction, status_code);
 907
 908         if (local->conf.mode == IW_MODE_ADHOC) {
 909                 /* IEEE 802.11 standard does not require authentication in IBSS
 910                  * networks and most implementations do not seem to use it.
 911                  * However, try to reply to authentication attempts if someone
 912                  * has actually implemented this.
 913                  * TODO: Could implement shared key authentication. */
 914                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 915                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
 916                                "frame (alg=%d transaction=%d)\n",
 917                                dev->name, auth_alg, auth_transaction);
 918                         return;
 919                 }
 920                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
 921         }
 922
 923         if (auth_alg != ifsta->auth_alg ||
 924             auth_transaction != ifsta->auth_transaction) {
 925                 printk(KERN_DEBUG "%s: unexpected authentication frame "
 926                        "(alg=%d transaction=%d)\n",
 927                        dev->name, auth_alg, auth_transaction);
 928                 return;
 929         }
 930
 931         if (status_code != WLAN_STATUS_SUCCESS) {
 932                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
 933                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
 934                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
 935                         const int num_algs = 3;
 936                         u8 algs[num_algs];
 937                         int i, pos;
 938                         algs[0] = algs[1] = algs[2] = 0xff;
 939                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
 940                                 algs[0] = WLAN_AUTH_OPEN;
 941                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
 942                                 algs[1] = WLAN_AUTH_SHARED_KEY;
 943                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
 944                                 algs[2] = WLAN_AUTH_LEAP;
 945                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
 946                                 pos = 0;
 947                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
 948                                 pos = 1;
 949                         else
 950                                 pos = 2;
 951                         for (i = 0; i < num_algs; i++) {
 952                                 pos++;
 953                                 if (pos >= num_algs)
 954                                         pos = 0;
 955                                 if (algs[pos] == ifsta->auth_alg ||
 956                                     algs[pos] == 0xff)
 957                                         continue;
 958                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
 959                                     !ieee80211_sta_wep_configured(dev))
 960                                         continue;
 961                                 ifsta->auth_alg = algs[pos];
 962                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
 963                                        "next try\n",
 964                                        dev->name, ifsta->auth_alg);
 965                                 break;
 966                         }
 967                 }
 968                 return;
 969         }
 970
 971         switch (ifsta->auth_alg) {
 972         case WLAN_AUTH_OPEN:
 973         case WLAN_AUTH_LEAP:
 974                 ieee80211_auth_completed(dev, ifsta);
 975                 break;
 976         case WLAN_AUTH_SHARED_KEY:
 977                 if (ifsta->auth_transaction == 4)
 978                         ieee80211_auth_completed(dev, ifsta);
 979                 else
 980                         ieee80211_auth_challenge(dev, ifsta, mgmt, len,
 981                                                  rx_status);
 982                 break;
 983         }
 984 }
 985
 986
 987 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
 988                                      struct ieee80211_if_sta *ifsta,
 989                                      struct ieee80211_mgmt *mgmt,
 990                                      size_t len,
 991                                      struct ieee80211_rx_status *rx_status)
 992 {
 993         u16 reason_code;
 994
 995         if (len < 24 + 2) {
 996                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
 997                        "received from " MACSTR " - ignored\n",
 998                        dev->name, len, MAC2STR(mgmt->sa));
 999                 return;
1000         }
1001
1002         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1003                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1004                        "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1005                        "ignored\n", dev->name, MAC2STR(mgmt->sa),
1006                        MAC2STR(mgmt->bssid));
1007                 return;
1008         }
1009
1010         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1011
1012         printk(KERN_DEBUG "%s: RX deauthentication from " MACSTR
1013                " (reason=%d)\n",
1014                dev->name, MAC2STR(mgmt->sa), reason_code);
1015
1016         if (ifsta->authenticated) {
1017                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1018         }
1019
1020         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1021             ifsta->state == IEEE80211_ASSOCIATE ||
1022             ifsta->state == IEEE80211_ASSOCIATED) {
1023                 ifsta->state = IEEE80211_AUTHENTICATE;
1024                 mod_timer(&ifsta->timer,
1025                           jiffies + IEEE80211_RETRY_AUTH_INTERVAL);
1026         }
1027
1028         ieee80211_set_associated(dev, ifsta, 0);
1029         ifsta->authenticated = 0;
1030 }
1031
1032
1033 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1034                                        struct ieee80211_if_sta *ifsta,
1035                                        struct ieee80211_mgmt *mgmt,
1036                                        size_t len,
1037                                        struct ieee80211_rx_status *rx_status)
1038 {
1039         u16 reason_code;
1040
1041         if (len < 24 + 2) {
1042                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1043                        "received from " MACSTR " - ignored\n",
1044                        dev->name, len, MAC2STR(mgmt->sa));
1045                 return;
1046         }
1047
1048         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1049                 printk(KERN_DEBUG "%s: disassociation frame received from "
1050                        "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1051                        "ignored\n", dev->name, MAC2STR(mgmt->sa),
1052                        MAC2STR(mgmt->bssid));
1053                 return;
1054         }
1055
1056         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1057
1058         printk(KERN_DEBUG "%s: RX disassociation from " MACSTR
1059                " (reason=%d)\n",
1060                dev->name, MAC2STR(mgmt->sa), reason_code);
1061
1062         if (ifsta->associated)
1063                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1064
1065         if (ifsta->state == IEEE80211_ASSOCIATED) {
1066                 ifsta->state = IEEE80211_ASSOCIATE;
1067                 mod_timer(&ifsta->timer,
1068                           jiffies + IEEE80211_RETRY_AUTH_INTERVAL);
1069         }
1070
1071         ieee80211_set_associated(dev, ifsta, 0);
1072 }
1073
1074
1075 static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
1076                                          struct ieee80211_if_sta *ifsta,
1077                                          struct ieee80211_mgmt *mgmt,
1078                                          size_t len,
1079                                          struct ieee80211_rx_status *rx_status,
1080                                          int reassoc)
1081 {
1082         struct ieee80211_local *local = dev->priv;
1083         struct sta_info *sta;
1084         u32 rates;
1085         u16 capab_info, status_code, aid;
1086         struct ieee802_11_elems elems;
1087         u8 *pos;
1088         int i, j;
1089
1090         /* AssocResp and ReassocResp have identical structure, so process both
1091          * of them in this function. */
1092
1093         if (ifsta->state != IEEE80211_ASSOCIATE) {
1094                 printk(KERN_DEBUG "%s: association frame received from "
1095                        MACSTR ", but not in associate state - ignored\n",
1096                        dev->name, MAC2STR(mgmt->sa));
1097                 return;
1098         }
1099
1100         if (len < 24 + 6) {
1101                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1102                        "received from " MACSTR " - ignored\n",
1103                        dev->name, len, MAC2STR(mgmt->sa));
1104                 return;
1105         }
1106
1107         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1108                 printk(KERN_DEBUG "%s: association frame received from "
1109                        "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1110                        "ignored\n", dev->name, MAC2STR(mgmt->sa),
1111                        MAC2STR(mgmt->bssid));
1112                 return;
1113         }
1114
1115         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1116         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1117         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1118         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1119                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1120                        "set\n", dev->name, aid);
1121         aid &= ~(BIT(15) | BIT(14));
1122
1123         printk(KERN_DEBUG "%s: RX %sssocResp from " MACSTR " (capab=0x%x "
1124                "status=%d aid=%d)\n",
1125                dev->name, reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1126                capab_info, status_code, aid);
1127
1128         if (status_code != WLAN_STATUS_SUCCESS) {
1129                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1130                        dev->name, status_code);
1131                 return;
1132         }
1133
1134         pos = mgmt->u.assoc_resp.variable;
1135         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1136             == ParseFailed) {
1137                 printk(KERN_DEBUG "%s: failed to parse AssocResp\n",
1138                        dev->name);
1139                 return;
1140         }
1141
1142         if (elems.supp_rates == NULL) {
1143                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1144                        dev->name);
1145                 return;
1146         }
1147
1148         printk(KERN_DEBUG "%s: associated\n", dev->name);
1149         ifsta->aid = aid;
1150         ifsta->ap_capab = capab_info;
1151
1152         kfree(ifsta->assocresp_ies);
1153         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1154         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_ATOMIC);
1155         if (ifsta->assocresp_ies)
1156                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1157
1158         ieee80211_set_associated(dev, ifsta, 1);
1159
1160         /* Add STA entry for the AP */
1161         sta = sta_info_get(local, ifsta->bssid);
1162         if (sta == NULL) {
1163                 sta = sta_info_add(local, dev, ifsta->bssid);
1164                 if (sta == NULL) {
1165                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
1166                                " AP\n", dev->name);
1167                         return;
1168                 }
1169         }
1170
1171         sta->dev = dev;
1172         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
1173         sta->assoc_ap = 1;
1174
1175         rates = 0;
1176         for (i = 0; i < elems.supp_rates_len; i++) {
1177                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1178                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
1179                         rate *= 2;
1180                 for (j = 0; j < local->num_curr_rates; j++)
1181                         if (local->curr_rates[j].rate == rate)
1182                                 rates |= BIT(j);
1183         }
1184         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1185                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1186                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
1187                         rate *= 2;
1188                 for (j = 0; j < local->num_curr_rates; j++)
1189                         if (local->curr_rates[j].rate == rate)
1190                                 rates |= BIT(j);
1191         }
1192         sta->supp_rates = rates;
1193
1194         rate_control_rate_init(local, sta);
1195
1196         if (elems.wmm_param && ifsta->wmm_enabled) {
1197                 sta->flags |= WLAN_STA_WME;
1198                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1199                                          elems.wmm_param_len);
1200         }
1201
1202
1203         sta_info_release(local, sta);
1204
1205         ieee80211_associated(dev, ifsta);
1206 }
1207
1208
1209 /* Caller must hold local->sta_bss_lock */
1210 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
1211                                         struct ieee80211_sta_bss *bss)
1212 {
1213         struct ieee80211_local *local = dev->priv;
1214         bss->hnext = local->sta_bss_hash[STA_HASH(bss->bssid)];
1215         local->sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1216 }
1217
1218
1219 /* Caller must hold local->sta_bss_lock */
1220 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
1221                                         struct ieee80211_sta_bss *bss)
1222 {
1223         struct ieee80211_local *local = dev->priv;
1224         struct ieee80211_sta_bss *b, *prev = NULL;
1225         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
1226         while (b) {
1227                 if (b == bss) {
1228                         if (prev == NULL) {
1229                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
1230                                         bss->hnext;
1231                         } else {
1232                                 prev->hnext = bss->hnext;
1233                         }
1234                         break;
1235                 }
1236                 prev = b;
1237                 b = b->hnext;
1238         }
1239 }
1240
1241
1242 static struct ieee80211_sta_bss *
1243 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid)
1244 {
1245         struct ieee80211_local *local = dev->priv;
1246         struct ieee80211_sta_bss *bss;
1247
1248         bss = kmalloc(sizeof(*bss), GFP_ATOMIC);
1249         if (bss == NULL)
1250                 return NULL;
1251         memset(bss, 0, sizeof(*bss));
1252         atomic_inc(&bss->users);
1253         atomic_inc(&bss->users);
1254         memcpy(bss->bssid, bssid, ETH_ALEN);
1255
1256         spin_lock_bh(&local->sta_bss_lock);
1257         /* TODO: order by RSSI? */
1258         list_add_tail(&bss->list, &local->sta_bss_list);
1259         __ieee80211_rx_bss_hash_add(dev, bss);
1260         spin_unlock_bh(&local->sta_bss_lock);
1261         return bss;
1262 }
1263
1264
1265 static struct ieee80211_sta_bss *
1266 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid)
1267 {
1268         struct ieee80211_local *local = dev->priv;
1269         struct ieee80211_sta_bss *bss;
1270
1271         spin_lock_bh(&local->sta_bss_lock);
1272         bss = local->sta_bss_hash[STA_HASH(bssid)];
1273         while (bss) {
1274                 if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0) {
1275                         atomic_inc(&bss->users);
1276                         break;
1277                 }
1278                 bss = bss->hnext;
1279         }
1280         spin_unlock_bh(&local->sta_bss_lock);
1281         return bss;
1282 }
1283
1284
1285 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
1286 {
1287         kfree(bss->wpa_ie);
1288         kfree(bss->rsn_ie);
1289         kfree(bss->wmm_ie);
1290         kfree(bss);
1291 }
1292
1293
1294 static void ieee80211_rx_bss_put(struct net_device *dev,
1295                                  struct ieee80211_sta_bss *bss)
1296 {
1297         struct ieee80211_local *local = dev->priv;
1298         if (!atomic_dec_and_test(&bss->users))
1299                 return;
1300
1301         spin_lock_bh(&local->sta_bss_lock);
1302         __ieee80211_rx_bss_hash_del(dev, bss);
1303         list_del(&bss->list);
1304         spin_unlock_bh(&local->sta_bss_lock);
1305         ieee80211_rx_bss_free(bss);
1306 }
1307
1308
1309 void ieee80211_rx_bss_list_init(struct net_device *dev)
1310 {
1311         struct ieee80211_local *local = dev->priv;
1312         spin_lock_init(&local->sta_bss_lock);
1313         INIT_LIST_HEAD(&local->sta_bss_list);
1314 }
1315
1316
1317 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
1318 {
1319         struct ieee80211_local *local = dev->priv;
1320         struct ieee80211_sta_bss *bss;
1321         struct list_head *ptr;
1322
1323         for (;;) {
1324                 ptr = local->sta_bss_list.next;
1325                 if (!ptr || ptr == &local->sta_bss_list)
1326                         break;
1327                 bss = list_entry(ptr, struct ieee80211_sta_bss, list);
1328                 ieee80211_rx_bss_put(dev, bss);
1329         }
1330 }
1331
1332
1333 static void ieee80211_rx_bss_info(struct net_device *dev,
1334                                   struct ieee80211_mgmt *mgmt,
1335                                   size_t len,
1336                                   struct ieee80211_rx_status *rx_status,
1337                                   int beacon)
1338 {
1339         struct ieee80211_local *local = dev->priv;
1340         struct ieee802_11_elems elems;
1341         size_t baselen;
1342         int channel, invalid = 0, clen;
1343         struct ieee80211_sta_bss *bss;
1344         struct sta_info *sta;
1345         struct ieee80211_sub_if_data *sdata;
1346         u64 timestamp;
1347         u8 *pos;
1348
1349         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
1350                 return; /* ignore ProbeResp to foreign address */
1351
1352 #if 0
1353         printk(KERN_DEBUG "%s: RX %s from " MACSTR " to " MACSTR "\n",
1354                dev->name, beacon ? "Beacon" : "Probe Response",
1355                MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1356 #endif
1357
1358         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1359         if (baselen > len)
1360                 return;
1361
1362         pos = mgmt->u.beacon.timestamp;
1363         timestamp = ((u64) pos[7] << 56) | ((u64) pos[6] << 48) |
1364                 ((u64) pos[5] << 40) | ((u64) pos[4] << 32) |
1365                 ((u64) pos[3] << 24) | ((u64) pos[2] << 16) |
1366                 ((u64) pos[1] << 8) | ((u64) pos[0]);
1367
1368         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1369             memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1370 #ifdef IEEE80211_IBSS_DEBUG
1371                 static unsigned long last_tsf_debug = 0;
1372                 u64 tsf;
1373                 if (local->hw->get_tsf)
1374                         tsf = local->hw->get_tsf(local->mdev);
1375                 else
1376                         tsf = -1LLU;
1377                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1378                         printk(KERN_DEBUG "RX beacon SA=" MACSTR " BSSID="
1379                                MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1380                                "@%ld\n",
1381                                MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1382                                tsf, timestamp, tsf - timestamp, jiffies);
1383                         last_tsf_debug = jiffies;
1384                 }
1385 #endif /* IEEE80211_IBSS_DEBUG */
1386         }
1387
1388         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1389                                    &elems) == ParseFailed)
1390                 invalid = 1;
1391
1392         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1393             memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1394             (sta = sta_info_get(local, mgmt->sa)) &&
1395             (sdata = IEEE80211_DEV_TO_SUB_IF(dev)) &&
1396             sdata->type == IEEE80211_SUB_IF_TYPE_STA) {
1397                 struct ieee80211_rate *rates;
1398                 size_t num_rates;
1399                 u32 supp_rates, prev_rates;
1400                 int i, j, oper_mode;
1401
1402                 rates = local->curr_rates;
1403                 num_rates = local->num_curr_rates;
1404                 oper_mode = local->sta_scanning ? local->scan_oper_phymode :
1405                         local->conf.phymode;
1406                 for (i = 0; i < local->hw->num_modes; i++) {
1407                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1408                         if (oper_mode == mode->mode) {
1409                                 rates = mode->rates;
1410                                 num_rates = mode->num_rates;
1411                                 break;
1412                         }
1413                 }
1414
1415                 supp_rates = 0;
1416                 for (i = 0; i < elems.supp_rates_len +
1417                              elems.ext_supp_rates_len; i++) {
1418                         u8 rate = 0;
1419                         int own_rate;
1420                         if (i < elems.supp_rates_len)
1421                                 rate = elems.supp_rates[i];
1422                         else if (elems.ext_supp_rates)
1423                                 rate = elems.ext_supp_rates
1424                                         [i - elems.supp_rates_len];
1425                         own_rate = 5 * (rate & 0x7f);
1426                         if (oper_mode == MODE_ATHEROS_TURBO)
1427                                 own_rate *= 2;
1428                         for (j = 0; j < num_rates; j++)
1429                                 if (rates[j].rate == own_rate)
1430                                         supp_rates |= BIT(j);
1431                 }
1432
1433                 prev_rates = sta->supp_rates;
1434                 sta->supp_rates &= supp_rates;
1435                 if (sta->supp_rates == 0) {
1436                         /* No matching rates - this should not really happen.
1437                          * Make sure that at least one rate is marked
1438                          * supported to avoid issues with TX rate ctrl. */
1439
1440                         sta->supp_rates = sdata->u.sta.supp_rates_bits;
1441                 }
1442                 if (sta->supp_rates != prev_rates) {
1443                         printk(KERN_DEBUG "%s: updated supp_rates set for "
1444                                MACSTR " based on beacon info (0x%x & 0x%x -> "
1445                                "0x%x)\n",
1446                                dev->name, MAC2STR(sta->addr), prev_rates,
1447                                supp_rates, sta->supp_rates);
1448                 }
1449                 sta_info_release(local, sta);
1450         }
1451
1452         if (elems.ssid == NULL)
1453                 return;
1454
1455         if (elems.ds_params && elems.ds_params_len == 1)
1456                 channel = elems.ds_params[0];
1457         else
1458                 channel = rx_status->channel;
1459
1460         bss = ieee80211_rx_bss_get(dev, mgmt->bssid);
1461         if (bss == NULL) {
1462                 bss = ieee80211_rx_bss_add(dev, mgmt->bssid);
1463                 if (bss == NULL)
1464                         return;
1465         } else {
1466 #if 0
1467                 /* TODO: order by RSSI? */
1468                 spin_lock_bh(&local->sta_bss_lock);
1469                 list_move_tail(&bss->list, &local->sta_bss_list);
1470                 spin_unlock_bh(&local->sta_bss_lock);
1471 #endif
1472         }
1473
1474         if (bss->probe_resp && beacon) {
1475                 /* Do not allow beacon to override data from Probe Response. */
1476                 ieee80211_rx_bss_put(dev, bss);
1477                 return;
1478         }
1479
1480         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
1481         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
1482         if (elems.ssid && elems.ssid_len <= IEEE80211_MAX_SSID_LEN) {
1483                 memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1484                 bss->ssid_len = elems.ssid_len;
1485         }
1486
1487         bss->supp_rates_len = 0;
1488         if (elems.supp_rates) {
1489                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1490                 if (clen > elems.supp_rates_len)
1491                         clen = elems.supp_rates_len;
1492                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
1493                        clen);
1494                 bss->supp_rates_len += clen;
1495         }
1496         if (elems.ext_supp_rates) {
1497                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1498                 if (clen > elems.ext_supp_rates_len)
1499                         clen = elems.ext_supp_rates_len;
1500                 memcpy(&bss->supp_rates[bss->supp_rates_len],
1501                        elems.ext_supp_rates, clen);
1502                 bss->supp_rates_len += clen;
1503         }
1504
1505         if (elems.wpa &&
1506             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_len ||
1507              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1508                 kfree(bss->wpa_ie);
1509                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
1510                 if (bss->wpa_ie) {
1511                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
1512                         bss->wpa_ie_len = elems.wpa_len + 2;
1513                 } else
1514                         bss->wpa_ie_len = 0;
1515         } else if (!elems.wpa && bss->wpa_ie) {
1516                 kfree(bss->wpa_ie);
1517                 bss->wpa_ie = NULL;
1518                 bss->wpa_ie_len = 0;
1519         }
1520
1521         if (elems.rsn &&
1522             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_len ||
1523              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1524                 kfree(bss->rsn_ie);
1525                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
1526                 if (bss->rsn_ie) {
1527                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
1528                         bss->rsn_ie_len = elems.rsn_len + 2;
1529                 } else
1530                         bss->rsn_ie_len = 0;
1531         } else if (!elems.rsn && bss->rsn_ie) {
1532                 kfree(bss->rsn_ie);
1533                 bss->rsn_ie = NULL;
1534                 bss->rsn_ie_len = 0;
1535         }
1536
1537         if (elems.wmm_param &&
1538             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_param_len ||
1539              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1540                 kfree(bss->wmm_ie);
1541                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
1542                 if (bss->wmm_ie) {
1543                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
1544                                elems.wmm_param_len + 2);
1545                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1546                 } else
1547                         bss->wmm_ie_len = 0;
1548         } else if (!elems.wmm_param && bss->wmm_ie) {
1549                 kfree(bss->wmm_ie);
1550                 bss->wmm_ie = NULL;
1551                 bss->wmm_ie_len = 0;
1552         }
1553
1554
1555         bss->hw_mode = local->conf.phymode;
1556         bss->channel = channel;
1557         bss->freq = local->conf.freq;
1558         if (channel != local->conf.channel &&
1559             (local->conf.phymode == MODE_IEEE80211G ||
1560              local->conf.phymode == MODE_IEEE80211B) &&
1561             channel >= 1 && channel <= 14) {
1562                 static const int freq_list[] = {
1563                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1564                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1565                 };
1566                 /* IEEE 802.11g/b mode can receive packets from neighboring
1567                  * channels, so map the channel into frequency. */
1568                 bss->freq = freq_list[channel - 1];
1569         }
1570         bss->timestamp = timestamp;
1571         bss->last_update = jiffies;
1572         bss->rssi = rx_status->ssi;
1573         if (!beacon)
1574                 bss->probe_resp++;
1575         ieee80211_rx_bss_put(dev, bss);
1576 }
1577
1578
1579 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
1580                                          struct ieee80211_mgmt *mgmt,
1581                                          size_t len,
1582                                          struct ieee80211_rx_status *rx_status)
1583 {
1584         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
1585 }
1586
1587
1588 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
1589                                      struct ieee80211_mgmt *mgmt,
1590                                      size_t len,
1591                                      struct ieee80211_rx_status *rx_status)
1592 {
1593         struct ieee80211_local *local = dev->priv;
1594         struct ieee80211_sub_if_data *sdata;
1595         struct ieee80211_if_sta *ifsta;
1596         int use_protection;
1597         size_t baselen;
1598         struct ieee802_11_elems elems;
1599
1600         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
1601
1602         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1603         if (sdata->type != IEEE80211_SUB_IF_TYPE_STA)
1604                 return;
1605         ifsta = &sdata->u.sta;
1606
1607         if (!ifsta->associated ||
1608             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
1609                 return;
1610
1611         /* Process beacon from the current BSS */
1612         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1613         if (baselen > len)
1614                 return;
1615
1616         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1617                                    &elems) == ParseFailed)
1618                 return;
1619
1620         use_protection = 0;
1621         if (elems.erp_info && elems.erp_info_len >= 1) {
1622                 use_protection =
1623                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1624         }
1625
1626         if (use_protection != !!ifsta->use_protection) {
1627                 if (net_ratelimit()) {
1628                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
1629                                MACSTR ")\n",
1630                                dev->name,
1631                                use_protection ? "enabled" : "disabled",
1632                                MAC2STR(ifsta->bssid));
1633                 }
1634                 ifsta->use_protection = use_protection ? 1 : 0;
1635                 local->cts_protect_erp_frames = use_protection;
1636         }
1637
1638         if (elems.wmm_param && ifsta->wmm_enabled) {
1639                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1640                                          elems.wmm_param_len);
1641         }
1642 }
1643
1644
1645 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
1646                                         struct ieee80211_if_sta *ifsta,
1647                                         struct ieee80211_mgmt *mgmt,
1648                                         size_t len,
1649                                         struct ieee80211_rx_status *rx_status)
1650 {
1651         struct ieee80211_local *local = dev->priv;
1652         int tx_last_beacon;
1653         struct sk_buff *skb;
1654         struct ieee80211_mgmt *resp;
1655         u8 *pos, *end;
1656
1657         if (local->conf.mode != IW_MODE_ADHOC ||
1658             ifsta->state != IEEE80211_IBSS_JOINED ||
1659             len < 24 + 2 || ifsta->probe_resp == NULL)
1660                 return;
1661
1662         if (local->hw->tx_last_beacon)
1663                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1664         else
1665                 tx_last_beacon = 1;
1666
1667 #ifdef IEEE80211_IBSS_DEBUG
1668         printk(KERN_DEBUG "%s: RX ProbeReq SA=" MACSTR " DA=" MACSTR " BSSID="
1669                MACSTR " (tx_last_beacon=%d)\n",
1670                dev->name, MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1671                MAC2STR(mgmt->bssid), tx_last_beacon);
1672 #endif /* IEEE80211_IBSS_DEBUG */
1673
1674         if (!tx_last_beacon)
1675                 return;
1676
1677         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
1678             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1679                 return;
1680
1681         end = ((u8 *) mgmt) + len;
1682         pos = mgmt->u.probe_req.variable;
1683         if (pos[0] != WLAN_EID_SSID ||
1684             pos + 2 + pos[1] > end) {
1685                 if (net_ratelimit()) {
1686                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
1687                                "from " MACSTR "\n",
1688                                dev->name, MAC2STR(mgmt->sa));
1689                 }
1690                 return;
1691         }
1692         if (pos[1] != 0 &&
1693             (pos[1] != ifsta->ssid_len ||
1694              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
1695                 /* Ignore ProbeReq for foreign SSID */
1696                 return;
1697         }
1698
1699         /* Reply with ProbeResp */
1700         skb = skb_copy(ifsta->probe_resp, GFP_ATOMIC);
1701         if (skb == NULL)
1702                 return;
1703
1704         resp = (struct ieee80211_mgmt *) skb->data;
1705         memcpy(resp->da, mgmt->sa, ETH_ALEN);
1706 #ifdef IEEE80211_IBSS_DEBUG
1707         printk(KERN_DEBUG "%s: Sending ProbeResp to " MACSTR "\n",
1708                dev->name, MAC2STR(resp->da));
1709 #endif /* IEEE80211_IBSS_DEBUG */
1710         ieee80211_sta_tx(dev, skb, 0, 1);
1711 }
1712
1713
1714 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
1715                            struct ieee80211_rx_status *rx_status)
1716 {
1717         struct ieee80211_sub_if_data *sdata;
1718         struct ieee80211_if_sta *ifsta;
1719         struct ieee80211_mgmt *mgmt;
1720         u16 fc;
1721
1722         if (skb->len < 24)
1723                 goto fail;
1724
1725         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1726         if (sdata->type != IEEE80211_SUB_IF_TYPE_STA) {
1727                 printk(KERN_DEBUG "%s: ieee80211_sta_rx_mgmt: non-STA "
1728                        "interface (type=%d)\n", dev->name, sdata->type);
1729                 goto fail;
1730         }
1731         ifsta = &sdata->u.sta;
1732
1733         mgmt = (struct ieee80211_mgmt *) skb->data;
1734         fc = le16_to_cpu(mgmt->frame_control);
1735
1736         switch (WLAN_FC_GET_STYPE(fc)) {
1737         case WLAN_FC_STYPE_PROBE_REQ:
1738                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
1739                                             rx_status);
1740                 break;
1741         case WLAN_FC_STYPE_PROBE_RESP:
1742                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
1743                 break;
1744         case WLAN_FC_STYPE_BEACON:
1745                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
1746                 break;
1747         case WLAN_FC_STYPE_AUTH:
1748                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len, rx_status);
1749                 break;
1750         case WLAN_FC_STYPE_ASSOC_RESP:
1751                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len,
1752                                              rx_status, 0);
1753                 break;
1754         case WLAN_FC_STYPE_REASSOC_RESP:
1755                 ieee80211_rx_mgmt_assoc_resp(dev, ifsta, mgmt, skb->len,
1756                                              rx_status, 1);
1757                 break;
1758         case WLAN_FC_STYPE_DEAUTH:
1759                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len,
1760                                          rx_status);
1761                 break;
1762         case WLAN_FC_STYPE_DISASSOC:
1763                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len,
1764                                            rx_status);
1765                 break;
1766         default:
1767                 printk(KERN_DEBUG "%s: received unknown management frame - "
1768                        "stype=%d\n", dev->name, WLAN_FC_GET_STYPE(fc));
1769                 break;
1770         }
1771
1772  fail:
1773         dev_kfree_skb(skb);
1774 }
1775
1776
1777 void ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
1778                            struct ieee80211_rx_status *rx_status)
1779 {
1780         struct ieee80211_mgmt *mgmt;
1781         u16 fc;
1782
1783         if (skb->len < 24) {
1784                 dev_kfree_skb(skb);
1785                 return;
1786         }
1787
1788         mgmt = (struct ieee80211_mgmt *) skb->data;
1789         fc = le16_to_cpu(mgmt->frame_control);
1790
1791         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
1792                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
1793                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
1794                                                      skb->len, rx_status);
1795                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
1796                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
1797                                                  rx_status);
1798                 }
1799         }
1800
1801         dev_kfree_skb(skb);
1802 }
1803
1804
1805 static int ieee80211_sta_active_ibss(struct net_device *dev)
1806 {
1807         struct ieee80211_local *local = dev->priv;
1808         struct list_head *ptr;
1809         int active = 0;
1810         struct sta_info *sta;
1811
1812         spin_lock_bh(&local->sta_lock);
1813         list_for_each(ptr, &local->sta_list) {
1814                 sta = list_entry(ptr, struct sta_info, list);
1815                 if (sta->dev == dev &&
1816                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1817                                jiffies)) {
1818                         active++;
1819                         break;
1820                 }
1821         }
1822         spin_unlock_bh(&local->sta_lock);
1823
1824         return active;
1825 }
1826
1827
1828 static void ieee80211_sta_expire(struct net_device *dev)
1829 {
1830         struct ieee80211_local *local = dev->priv;
1831         struct list_head *ptr, *n;
1832         struct sta_info *sta;
1833
1834         spin_lock_bh(&local->sta_lock);
1835         list_for_each_safe(ptr, n, &local->sta_list) {
1836                 sta = list_entry(ptr, struct sta_info, list);
1837                 if (time_after(jiffies, sta->last_rx +
1838                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1839                         printk(KERN_DEBUG "%s: expiring inactive STA " MACSTR
1840                                "\n", dev->name, MAC2STR(sta->addr));
1841                         sta_info_free(local, sta, 1);
1842                 }
1843         }
1844         spin_unlock_bh(&local->sta_lock);
1845 }
1846
1847
1848 static void ieee80211_sta_merge_ibss(struct net_device *dev,
1849                                      struct ieee80211_if_sta *ifsta)
1850 {
1851         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
1852
1853         ieee80211_sta_expire(dev);
1854         if (ieee80211_sta_active_ibss(dev))
1855                 return;
1856
1857         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
1858                "IBSS networks with same SSID (merge)\n", dev->name);
1859         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
1860 }
1861
1862
1863 void ieee80211_sta_timer(unsigned long ptr)
1864 {
1865         struct net_device *dev;
1866         struct ieee80211_sub_if_data *sdata;
1867         struct ieee80211_if_sta *ifsta;
1868
1869         dev = (struct net_device *) ptr;
1870         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1871         if (sdata->type != IEEE80211_SUB_IF_TYPE_STA) {
1872                 printk(KERN_DEBUG "%s: ieee80211_sta_timer: non-STA interface "
1873                        "(type=%d)\n", dev->name, sdata->type);
1874                 return;
1875         }
1876         ifsta = &sdata->u.sta;
1877
1878         switch (ifsta->state) {
1879         case IEEE80211_DISABLED:
1880                 break;
1881         case IEEE80211_AUTHENTICATE:
1882                 ieee80211_authenticate(dev, ifsta);
1883                 break;
1884         case IEEE80211_ASSOCIATE:
1885                 ieee80211_associate(dev, ifsta);
1886                 break;
1887         case IEEE80211_ASSOCIATED:
1888                 ieee80211_associated(dev, ifsta);
1889                 break;
1890         case IEEE80211_IBSS_SEARCH:
1891                 ieee80211_sta_find_ibss(dev, ifsta);
1892                 break;
1893         case IEEE80211_IBSS_JOINED:
1894                 ieee80211_sta_merge_ibss(dev, ifsta);
1895                 break;
1896         default:
1897                 printk(KERN_DEBUG "ieee80211_sta_timer: Unknown state %d\n",
1898                        ifsta->state);
1899                 break;
1900         }
1901
1902         if (ieee80211_privacy_mismatch(dev, ifsta)) {
1903                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
1904                        "mixed-cell disabled - disassociate\n", dev->name);
1905
1906                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
1907                 ieee80211_set_associated(dev, ifsta, 0);
1908         }
1909 }
1910
1911
1912 static void ieee80211_sta_new_auth(struct net_device *dev,
1913                                    struct ieee80211_if_sta *ifsta)
1914 {
1915         struct ieee80211_local *local = dev->priv;
1916
1917         if (local->conf.mode != IW_MODE_INFRA)
1918                 return;
1919
1920         if (local->hw->reset_tsf) {
1921                 /* Reset own TSF to allow time synchronization work. */
1922                 local->hw->reset_tsf(local->mdev);
1923         }
1924
1925         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
1926
1927
1928         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1929                 ifsta->auth_alg = WLAN_AUTH_OPEN;
1930         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1931                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
1932         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1933                 ifsta->auth_alg = WLAN_AUTH_LEAP;
1934         else
1935                 ifsta->auth_alg = WLAN_AUTH_OPEN;
1936         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
1937                ifsta->auth_alg);
1938         ifsta->auth_transaction = -1;
1939         ifsta->auth_tries = ifsta->assoc_tries = 0;
1940         ieee80211_authenticate(dev, ifsta);
1941 }
1942
1943
1944 static int ieee80211_ibss_allowed(struct ieee80211_local *local)
1945 {
1946         int m, c;
1947
1948         for (m = 0; m < local->hw->num_modes; m++) {
1949                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
1950                 if (mode->mode != local->conf.phymode)
1951                         continue;
1952                 for (c = 0; c < mode->num_channels; c++) {
1953                         struct ieee80211_channel *chan = &mode->channels[c];
1954                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
1955                             chan->chan == local->conf.channel) {
1956                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
1957                                         return 1;
1958                                 break;
1959                         }
1960                 }
1961         }
1962
1963         return 0;
1964 }
1965
1966
1967 extern int ieee80211_ioctl_siwfreq(struct net_device *dev,
1968                                    struct iw_request_info *info,
1969                                    struct iw_freq *freq, char *extra);
1970
1971 static int ieee80211_sta_join_ibss(struct net_device *dev,
1972                                    struct ieee80211_if_sta *ifsta,
1973                                    struct ieee80211_sta_bss *bss)
1974 {
1975         struct ieee80211_local *local = dev->priv;
1976         struct iw_freq rq;
1977         int res, rates, i, j;
1978         struct sk_buff *skb;
1979         struct ieee80211_mgmt *mgmt;
1980         struct ieee80211_tx_control control;
1981         struct ieee80211_rate *rate;
1982         struct rate_control_extra extra;
1983         u8 *pos;
1984         struct ieee80211_sub_if_data *sdata;
1985
1986         /* Remove possible STA entries from other IBSS networks. */
1987         sta_info_flush(local, NULL);
1988
1989         if (local->hw->reset_tsf) {
1990                 /* Reset own TSF to allow time synchronization work. */
1991                 local->hw->reset_tsf(local->mdev);
1992         }
1993         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
1994         memcpy(local->bssid, bss->bssid, ETH_ALEN);
1995         memcpy(local->conf.client_bssid, bss->bssid, ETH_ALEN);
1996
1997         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
1998
1999         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2000         sdata->drop_unencrypted = bss->capability &
2001                 cpu_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2002
2003         memset(&rq, 0, sizeof(rq));
2004         rq.m = bss->freq * 100000;
2005         rq.e = 1;
2006         res = ieee80211_ioctl_siwfreq(dev, NULL, &rq, NULL);
2007
2008         if (!ieee80211_ibss_allowed(local)) {
2009                 printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
2010                        "(%d MHz)\n", dev->name, local->conf.channel,
2011                        local->conf.freq);
2012                 return -1;
2013         }
2014
2015         /* Set beacon template based on scan results */
2016         skb = dev_alloc_skb(400);
2017         do {
2018                 if (skb == NULL)
2019                         break;
2020
2021                 mgmt = (struct ieee80211_mgmt *)
2022                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2023                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2024                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2025                                                    WLAN_FC_STYPE_BEACON);
2026                 memset(mgmt->da, 0xff, ETH_ALEN);
2027                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2028                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2029                 mgmt->u.beacon.beacon_int =
2030                         cpu_to_le16(local->conf.beacon_int);
2031                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2032
2033                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2034                 *pos++ = WLAN_EID_SSID;
2035                 *pos++ = ifsta->ssid_len;
2036                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2037
2038                 rates = bss->supp_rates_len;
2039                 if (rates > 8)
2040                         rates = 8;
2041                 pos = skb_put(skb, 2 + rates);
2042                 *pos++ = WLAN_EID_SUPP_RATES;
2043                 *pos++ = rates;
2044                 memcpy(pos, bss->supp_rates, rates);
2045
2046                 pos = skb_put(skb, 2 + 1);
2047                 *pos++ = WLAN_EID_DS_PARAMS;
2048                 *pos++ = 1;
2049                 *pos++ = bss->channel;
2050
2051                 pos = skb_put(skb, 2 + 2);
2052                 *pos++ = WLAN_EID_IBSS_PARAMS;
2053                 *pos++ = 2;
2054                 /* FIX: set ATIM window based on scan results */
2055                 *pos++ = 0;
2056                 *pos++ = 0;
2057
2058                 if (bss->supp_rates_len > 8) {
2059                         rates = bss->supp_rates_len - 8;
2060                         pos = skb_put(skb, 2 + rates);
2061                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2062                         *pos++ = rates;
2063                         memcpy(pos, &bss->supp_rates[8], rates);
2064                 }
2065
2066                 memset(&control, 0, sizeof(control));
2067                 control.pkt_type = PKT_PROBE_RESP;
2068                 memset(&extra, 0, sizeof(extra));
2069                 extra.endidx = local->num_curr_rates;
2070                 rate = rate_control_get_rate(dev, skb, &extra);
2071                 if (rate == NULL) {
2072                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2073                                "for IBSS beacon\n", dev->name);
2074                         break;
2075                 }
2076                 control.tx_rate = (local->short_preamble &&
2077                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2078                         rate->val2 : rate->val;
2079                 control.antenna_sel = local->conf.antenna_sel;
2080                 control.power_level = local->conf.power_level;
2081                 control.no_ack = 1;
2082                 control.retry_limit = 1;
2083                 control.rts_cts_duration = 0;
2084
2085                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2086                 if (ifsta->probe_resp) {
2087                         mgmt = (struct ieee80211_mgmt *)
2088                                 ifsta->probe_resp->data;
2089                         mgmt->frame_control =
2090                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2091                                              WLAN_FC_STYPE_PROBE_RESP);
2092                 } else {
2093                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2094                                "template for IBSS\n", dev->name);
2095                 }
2096
2097                 if (local->hw->beacon_update &&
2098                     local->hw->beacon_update(dev, skb, &control) == 0) {
2099                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2100                                "template based on scan results\n", dev->name);
2101                         skb = NULL;
2102                 }
2103
2104                 rates = 0;
2105                 for (i = 0; i < bss->supp_rates_len; i++) {
2106                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2107                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2108                                 rate *= 2;
2109                         for (j = 0; j < local->num_curr_rates; j++)
2110                                 if (local->curr_rates[j].rate == rate)
2111                                         rates |= BIT(j);
2112                 }
2113                 ifsta->supp_rates_bits = rates;
2114         } while (0);
2115
2116         if (skb) {
2117                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2118                        "template\n", dev->name);
2119                 dev_kfree_skb(skb);
2120         }
2121
2122         ifsta->state = IEEE80211_IBSS_JOINED;
2123         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2124
2125         ieee80211_rx_bss_put(dev, bss);
2126
2127         return res;
2128 }
2129
2130
2131 static int ieee80211_sta_create_ibss(struct net_device *dev,
2132                                      struct ieee80211_if_sta *ifsta)
2133 {
2134         struct ieee80211_local *local = dev->priv;
2135         struct ieee80211_sta_bss *bss;
2136         struct ieee80211_sub_if_data *sdata;
2137         u8 bssid[ETH_ALEN], *pos;
2138         int i;
2139
2140 #if 0
2141         /* Easier testing, use fixed BSSID. */
2142         memset(bssid, 0xfe, ETH_ALEN);
2143 #else
2144         /* Generate random, not broadcast, locally administered BSSID. Mix in
2145          * own MAC address to make sure that devices that do not have proper
2146          * random number generator get different BSSID. */
2147         get_random_bytes(bssid, ETH_ALEN);
2148         for (i = 0; i < ETH_ALEN; i++)
2149                 bssid[i] ^= dev->dev_addr[i];
2150         bssid[0] &= ~0x01;
2151         bssid[0] |= 0x02;
2152 #endif
2153
2154         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID " MACSTR "\n",
2155                dev->name, MAC2STR(bssid));
2156
2157         bss = ieee80211_rx_bss_add(dev, bssid);
2158         if (bss == NULL)
2159                 return -ENOMEM;
2160
2161         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2162
2163         if (local->conf.beacon_int == 0)
2164                 local->conf.beacon_int = 100;
2165         bss->beacon_int = local->conf.beacon_int;
2166         bss->hw_mode = local->conf.phymode;
2167         bss->channel = local->conf.channel;
2168         bss->freq = local->conf.freq;
2169         bss->last_update = jiffies;
2170         bss->capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
2171         if (sdata->default_key) {
2172                 bss->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
2173         } else
2174                 sdata->drop_unencrypted = 0;
2175         bss->supp_rates_len = local->num_curr_rates;
2176         pos = bss->supp_rates;
2177         for (i = 0; i < local->num_curr_rates; i++) {
2178                 int rate = local->curr_rates[i].rate;
2179                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2180                         rate /= 2;
2181                 *pos++ = (u8) (rate / 5);
2182         }
2183
2184         return ieee80211_sta_join_ibss(dev, ifsta, bss);
2185 }
2186
2187
2188 static int ieee80211_sta_find_ibss(struct net_device *dev,
2189                                    struct ieee80211_if_sta *ifsta)
2190 {
2191         struct ieee80211_local *local = dev->priv;
2192         struct ieee80211_sta_bss *bss;
2193         int found = 0;
2194         u8 bssid[ETH_ALEN];
2195         struct list_head *ptr;
2196         int active_ibss;
2197
2198         if (ifsta->ssid_len == 0)
2199                 return -EINVAL;
2200
2201         active_ibss = ieee80211_sta_active_ibss(dev);
2202 #ifdef IEEE80211_IBSS_DEBUG
2203         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
2204                dev->name, active_ibss);
2205 #endif /* IEEE80211_IBSS_DEBUG */
2206         spin_lock_bh(&local->sta_bss_lock);
2207         list_for_each(ptr, &local->sta_bss_list) {
2208                 bss = list_entry(ptr, struct ieee80211_sta_bss, list);
2209                 if (ifsta->ssid_len != bss->ssid_len ||
2210                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
2211                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2212                         continue;
2213 #ifdef IEEE80211_IBSS_DEBUG
2214                 printk(KERN_DEBUG "   bssid=" MACSTR " found\n",
2215                        MAC2STR(bss->bssid));
2216 #endif /* IEEE80211_IBSS_DEBUG */
2217                 memcpy(bssid, bss->bssid, ETH_ALEN);
2218                 found = 1;
2219                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
2220                         break;
2221         }
2222         spin_unlock_bh(&local->sta_bss_lock);
2223
2224 #ifdef IEEE80211_IBSS_DEBUG
2225         printk(KERN_DEBUG "   sta_find_ibss: selected " MACSTR " current "
2226                MACSTR "\n", MAC2STR(bssid), MAC2STR(ifsta->bssid));
2227 #endif /* IEEE80211_IBSS_DEBUG */
2228         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
2229             (bss = ieee80211_rx_bss_get(dev, bssid))) {
2230                 printk(KERN_DEBUG "%s: Selected IBSS BSSID " MACSTR
2231                        " based on configured SSID\n",
2232                        dev->name, MAC2STR(bssid));
2233                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
2234         }
2235 #ifdef IEEE80211_IBSS_DEBUG
2236         printk(KERN_DEBUG "   did not try to join ibss\n");
2237 #endif /* IEEE80211_IBSS_DEBUG */
2238
2239         /* Selected IBSS not found in current scan results - try to scan */
2240         if (ifsta->state == IEEE80211_IBSS_JOINED &&
2241             !ieee80211_sta_active_ibss(dev)) {
2242                 mod_timer(&ifsta->timer,
2243                           jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2244         } else if (time_after(jiffies, local->last_scan_completed +
2245                               IEEE80211_SCAN_INTERVAL)) {
2246                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
2247                        "join\n", dev->name);
2248                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
2249                                               ifsta->ssid_len);
2250         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
2251                 int interval = IEEE80211_SCAN_INTERVAL;
2252
2253                 if (time_after(jiffies, ifsta->ibss_join_req +
2254                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2255                         if (ifsta->create_ibss &&
2256                             ieee80211_ibss_allowed(local))
2257                                 return ieee80211_sta_create_ibss(dev, ifsta);
2258                         if (ifsta->create_ibss) {
2259                                 printk(KERN_DEBUG "%s: IBSS not allowed on the"
2260                                        " configured channel %d (%d MHz)\n",
2261                                        dev->name, local->conf.channel,
2262                                        local->conf.freq);
2263                         }
2264
2265                         /* No IBSS found - decrease scan interval and continue
2266                          * scanning. */
2267                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2268                 }
2269
2270                 ifsta->state = IEEE80211_IBSS_SEARCH;
2271                 mod_timer(&ifsta->timer, jiffies + interval);
2272                 return 0;
2273         }
2274
2275         return 0;
2276 }
2277
2278
2279 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
2280 {
2281         struct ieee80211_sub_if_data *sdata;
2282         struct ieee80211_if_sta *ifsta;
2283         struct ieee80211_local *local = dev->priv;
2284
2285         if (len > IEEE80211_MAX_SSID_LEN)
2286                 return -EINVAL;
2287
2288         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2289          * not defined. */
2290         if (local->hw->conf_tx) {
2291                 struct ieee80211_tx_queue_params qparam;
2292                 int i;
2293
2294                 memset(&qparam, 0, sizeof(qparam));
2295                 /* TODO: are these ok defaults for all hw_modes? */
2296                 qparam.aifs = 2;
2297                 qparam.cw_min =
2298                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2299                 qparam.cw_max = 1023;
2300                 qparam.burst_time = 0;
2301                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2302                 {
2303                         local->hw->conf_tx(dev, i + IEEE80211_TX_QUEUE_DATA0,
2304                                            &qparam);
2305                 }
2306                 /* IBSS uses different parameters for Beacon sending */
2307                 qparam.cw_min++;
2308                 qparam.cw_min *= 2;
2309                 qparam.cw_min--;
2310                 local->hw->conf_tx(dev, IEEE80211_TX_QUEUE_BEACON, &qparam);
2311         }
2312
2313         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2314         ifsta = &sdata->u.sta;
2315
2316         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
2317                 ifsta->prev_bssid_set = 0;
2318         memcpy(ifsta->ssid, ssid, len);
2319         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
2320         ifsta->ssid_len = len;
2321
2322         ifsta->ssid_set = 1;
2323         if (local->conf.mode == IW_MODE_ADHOC && !ifsta->bssid_set) {
2324                 ifsta->ibss_join_req = jiffies;
2325                 ifsta->state = IEEE80211_IBSS_SEARCH;
2326                 return ieee80211_sta_find_ibss(dev, ifsta);
2327         }
2328
2329         if (ifsta->bssid_set && ifsta->state != IEEE80211_AUTHENTICATE)
2330                 ieee80211_sta_new_auth(dev, ifsta);
2331
2332         return 0;
2333 }
2334
2335
2336 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
2337 {
2338         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2339         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2340         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
2341         *len = ifsta->ssid_len;
2342         return 0;
2343 }
2344
2345
2346 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
2347 {
2348         struct ieee80211_local *local = dev->priv;
2349         struct ieee80211_sub_if_data *sdata;
2350         struct ieee80211_if_sta *ifsta;
2351
2352         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2353         ifsta = &sdata->u.sta;
2354
2355         memcpy(ifsta->bssid, bssid, ETH_ALEN);
2356         if (local->conf.mode == IW_MODE_ADHOC)
2357                 memcpy(local->bssid, bssid, ETH_ALEN);
2358
2359         if (memcmp(bssid, "\x00\x00\x00\x00\x00\x00", ETH_ALEN) == 0)
2360                 ifsta->bssid_set = 0;
2361         else
2362                 ifsta->bssid_set = 1;
2363         if (ifsta->ssid_set)
2364                 ieee80211_sta_new_auth(dev, ifsta);
2365
2366         return 0;
2367 }
2368
2369
2370 static void ieee80211_sta_save_oper_chan(struct net_device *dev)
2371 {
2372         struct ieee80211_local *local = dev->priv;
2373         local->scan_oper_channel = local->conf.channel;
2374         local->scan_oper_channel_val = local->conf.channel_val;
2375         local->scan_oper_power_level = local->conf.power_level;
2376         local->scan_oper_freq = local->conf.freq;
2377         local->scan_oper_phymode = local->conf.phymode;
2378         local->scan_oper_antenna_max = local->conf.antenna_max;
2379 }
2380
2381
2382 static int ieee80211_sta_restore_oper_chan(struct net_device *dev)
2383 {
2384         struct ieee80211_local *local = dev->priv;
2385         local->conf.channel = local->scan_oper_channel;
2386         local->conf.channel_val = local->scan_oper_channel_val;
2387         local->conf.power_level = local->scan_oper_power_level;
2388         local->conf.freq = local->scan_oper_freq;
2389         local->conf.phymode = local->scan_oper_phymode;
2390         local->conf.antenna_max = local->scan_oper_antenna_max;
2391         return ieee80211_hw_config(dev);
2392 }
2393
2394
2395 static int ieee80211_active_scan(struct ieee80211_local *local)
2396 {
2397         int m, c;
2398
2399         for (m = 0; m < local->hw->num_modes; m++) {
2400                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2401                 if (mode->mode != local->conf.phymode)
2402                         continue;
2403                 for (c = 0; c < mode->num_channels; c++) {
2404                         struct ieee80211_channel *chan = &mode->channels[c];
2405                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2406                             chan->chan == local->conf.channel) {
2407                                 if (chan->flag & IEEE80211_CHAN_W_ACTIVE_SCAN)
2408                                         return 1;
2409                                 break;
2410                         }
2411                 }
2412         }
2413
2414         return 0;
2415 }
2416
2417
2418 static void ieee80211_sta_scan_timer(unsigned long ptr)
2419 {
2420         struct net_device *dev = (struct net_device *) ptr;
2421         struct ieee80211_local *local = dev->priv;
2422         struct ieee80211_hw_modes *mode;
2423         struct ieee80211_channel *chan;
2424         int skip;
2425         union iwreq_data wrqu;
2426
2427         if (!local->sta_scanning)
2428                 return;
2429
2430         switch (local->scan_state) {
2431         case SCAN_SET_CHANNEL:
2432                 mode = &local->hw->modes[local->scan_hw_mode_idx];
2433                 if (local->scan_hw_mode_idx >= local->hw->num_modes ||
2434                     (local->scan_hw_mode_idx + 1 == local->hw->num_modes &&
2435                      local->scan_channel_idx >= mode->num_channels)) {
2436                         if (ieee80211_sta_restore_oper_chan(dev)) {
2437                                 printk(KERN_DEBUG "%s: failed to restore "
2438                                        "operational channel after scan\n",
2439                                        dev->name);
2440                         }
2441                         printk(KERN_DEBUG "%s: scan completed\n", dev->name);
2442                         local->sta_scanning = 0;
2443                         local->last_scan_completed = jiffies;
2444                         memset(&wrqu, 0, sizeof(wrqu));
2445                         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2446                         if (local->conf.mode == IW_MODE_ADHOC) {
2447                                 struct ieee80211_sub_if_data *sdata =
2448                                         IEEE80211_DEV_TO_SUB_IF(dev);
2449                                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2450                                 if (!ifsta->bssid_set ||
2451                                     (ifsta->state == IEEE80211_IBSS_JOINED &&
2452                                      !ieee80211_sta_active_ibss(dev)))
2453                                         ieee80211_sta_find_ibss(dev, ifsta);
2454                         }
2455                         return;
2456                 }
2457                 skip = !(local->hw_modes & (1 << mode->mode));
2458                 chan = &mode->channels[local->scan_channel_idx];
2459                 if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
2460                     (local->conf.mode == IW_MODE_ADHOC &&
2461                      !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
2462                     (local->hw_modes & (1 << MODE_IEEE80211G) &&
2463                      mode->mode == MODE_IEEE80211B && local->scan_skip_11b))
2464                         skip = 1;
2465
2466                 if (!skip) {
2467 #if 0
2468                         printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
2469                                dev->name, chan->chan, chan->freq);
2470 #endif
2471
2472                         local->conf.channel = chan->chan;
2473                         local->conf.channel_val = chan->val;
2474                         local->conf.power_level = chan->power_level;
2475                         local->conf.freq = chan->freq;
2476                         local->conf.phymode = mode->mode;
2477                         local->conf.antenna_max = chan->antenna_max;
2478                         if (ieee80211_hw_config(dev)) {
2479                                 printk(KERN_DEBUG "%s: failed to set channel "
2480                                        "%d (%d MHz) for scan\n", dev->name,
2481                                        chan->chan, chan->freq);
2482                                 skip = 1;
2483                         }
2484                 }
2485
2486                 local->scan_channel_idx++;
2487                 if (local->scan_channel_idx >=
2488                     local->hw->modes[local->scan_hw_mode_idx].num_channels) {
2489                         local->scan_hw_mode_idx++;
2490                         local->scan_channel_idx = 0;
2491                 }
2492
2493                 if (skip) {
2494                         local->scan_timer.expires = jiffies;
2495                         break;
2496                 }
2497
2498                 local->scan_timer.expires = jiffies + IEEE80211_PROBE_DELAY;
2499                 local->scan_state = SCAN_SEND_PROBE;
2500                 break;
2501         case SCAN_SEND_PROBE:
2502                 if (ieee80211_active_scan(local)) {
2503                         ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
2504                                                  local->scan_ssid_len);
2505                         local->scan_timer.expires =
2506                                 jiffies + IEEE80211_CHANNEL_TIME;
2507                 } else {
2508                         local->scan_timer.expires =
2509                                 jiffies + IEEE80211_PASSIVE_CHANNEL_TIME;
2510                 }
2511                 local->scan_state = SCAN_SET_CHANNEL;
2512                 break;
2513         }
2514
2515         add_timer(&local->scan_timer);
2516 }
2517
2518
2519 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
2520 {
2521         struct ieee80211_local *local = dev->priv;
2522
2523         if (ssid_len > IEEE80211_MAX_SSID_LEN)
2524                 return -EINVAL;
2525
2526         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2527          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2528          * BSSID: MACAddress
2529          * SSID
2530          * ScanType: ACTIVE, PASSIVE
2531          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2532          *    a Probe frame during active scanning
2533          * ChannelList
2534          * MinChannelTime (>= ProbeDelay), in TU
2535          * MaxChannelTime: (>= MinChannelTime), in TU
2536          */
2537
2538          /* MLME-SCAN.confirm
2539           * BSSDescriptionSet
2540           * ResultCode: SUCCESS, INVALID_PARAMETERS
2541          */
2542
2543         /* TODO: if assoc, move to power save mode for the duration of the
2544          * scan */
2545
2546         if (local->sta_scanning)
2547                 return -EBUSY;
2548
2549         printk(KERN_DEBUG "%s: starting scan\n", dev->name);
2550
2551         ieee80211_sta_save_oper_chan(dev);
2552
2553         local->sta_scanning = 1;
2554         /* TODO: stop TX queue? */
2555
2556         if (ssid) {
2557                 local->scan_ssid_len = ssid_len;
2558                 memcpy(local->scan_ssid, ssid, ssid_len);
2559         } else
2560                 local->scan_ssid_len = 0;
2561         local->scan_skip_11b = 1; /* FIX: clear this is 11g is not supported */
2562         local->scan_state = SCAN_SET_CHANNEL;
2563         local->scan_hw_mode_idx = 0;
2564         local->scan_channel_idx = 0;
2565         init_timer(&local->scan_timer);
2566         local->scan_timer.data = (unsigned long) dev;
2567         local->scan_timer.function = ieee80211_sta_scan_timer;
2568         local->scan_timer.expires = jiffies + 1;
2569         add_timer(&local->scan_timer);
2570
2571         return 0;
2572 }
2573
2574
2575 static char *
2576 ieee80211_sta_scan_result(struct net_device *dev,
2577                           struct ieee80211_sta_bss *bss,
2578                           char *current_ev, char *end_buf)
2579 {
2580         struct ieee80211_local *local = dev->priv;
2581         struct iw_event iwe;
2582
2583         if (time_after(jiffies,
2584                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
2585                 return current_ev;
2586
2587         if (!(local->hw_modes & (1 << bss->hw_mode)))
2588                 return current_ev;
2589
2590         if (local->scan_flags & IEEE80211_SCAN_WPA_ONLY &&
2591             bss->wpa_ie == NULL && bss->rsn_ie == NULL)
2592                 return current_ev;
2593
2594         if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID &&
2595             (local->scan_ssid_len != bss->ssid_len ||
2596              memcmp(local->scan_ssid, bss->ssid, bss->ssid_len) != 0))
2597                 return current_ev;
2598
2599         memset(&iwe, 0, sizeof(iwe));
2600         iwe.cmd = SIOCGIWAP;
2601         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2602         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
2603         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2604                                           IW_EV_ADDR_LEN);
2605
2606         memset(&iwe, 0, sizeof(iwe));
2607         iwe.cmd = SIOCGIWESSID;
2608         iwe.u.data.length = bss->ssid_len;
2609         iwe.u.data.flags = 1;
2610         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2611                                           bss->ssid);
2612
2613         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
2614                 memset(&iwe, 0, sizeof(iwe));
2615                 iwe.cmd = SIOCGIWMODE;
2616                 if (bss->capability & WLAN_CAPABILITY_ESS)
2617                         iwe.u.mode = IW_MODE_MASTER;
2618                 else
2619                         iwe.u.mode = IW_MODE_ADHOC;
2620                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2621                                                   IW_EV_UINT_LEN);
2622         }
2623
2624         memset(&iwe, 0, sizeof(iwe));
2625         iwe.cmd = SIOCGIWFREQ;
2626         iwe.u.freq.m = bss->freq * 100000;
2627         iwe.u.freq.e = 1;
2628         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2629                                           IW_EV_FREQ_LEN);
2630
2631         memset(&iwe, 0, sizeof(iwe));
2632         iwe.cmd = SIOCGIWENCODE;
2633         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
2634                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2635         else
2636                 iwe.u.data.flags = IW_ENCODE_DISABLED;
2637         iwe.u.data.length = 0;
2638         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
2639
2640         if (bss && bss->wpa_ie) {
2641                 char *buf, *p;
2642                 int i;
2643                 buf = kmalloc(30 + bss->wpa_ie_len * 2, GFP_ATOMIC);
2644                 if (buf) {
2645                         p = buf;
2646                         p += sprintf(p, "wpa_ie=");
2647                         for (i = 0; i < bss->wpa_ie_len; i++)
2648                                 p+= sprintf(p, "%02x", bss->wpa_ie[i]);
2649                         memset(&iwe, 0, sizeof(iwe));
2650                         iwe.cmd = IWEVCUSTOM;
2651                         iwe.u.data.length = strlen(buf);
2652                         current_ev = iwe_stream_add_point(current_ev, end_buf,
2653                                                           &iwe, buf);
2654                         kfree(buf);
2655                 }
2656         }
2657
2658         if (bss && bss->rsn_ie) {
2659                 char *buf, *p;
2660                 int i;
2661                 buf = kmalloc(30 + bss->rsn_ie_len * 2, GFP_ATOMIC);
2662                 if (buf) {
2663                         p = buf;
2664                         p += sprintf(p, "rsn_ie=");
2665                         for (i = 0; i < bss->rsn_ie_len; i++)
2666                                 p+= sprintf(p, "%02x", bss->rsn_ie[i]);
2667                         memset(&iwe, 0, sizeof(iwe));
2668                         iwe.cmd = IWEVCUSTOM;
2669                         iwe.u.data.length = strlen(buf);
2670                         current_ev = iwe_stream_add_point(current_ev, end_buf,
2671                                                           &iwe, buf);
2672                         kfree(buf);
2673                 }
2674         }
2675
2676         if (bss) {
2677                 char *buf;
2678                 buf = kmalloc(30, GFP_ATOMIC);
2679                 if (buf) {
2680                         memset(&iwe, 0, sizeof(iwe));
2681                         iwe.cmd = IWEVCUSTOM;
2682                         sprintf(buf, "tsf=%016llx", bss->timestamp);
2683                         iwe.u.data.length = strlen(buf);
2684                         current_ev = iwe_stream_add_point(current_ev, end_buf,
2685                                                           &iwe, buf);
2686                         kfree(buf);
2687                 }
2688         }
2689
2690         do {
2691                 char *buf, *p;
2692                 int i;
2693
2694                 if (!(local->scan_flags & IEEE80211_SCAN_EXTRA_INFO))
2695                         break;
2696
2697                 buf = kmalloc(100, GFP_ATOMIC);
2698                 if (buf == NULL)
2699                         break;
2700
2701                 memset(&iwe, 0, sizeof(iwe));
2702                 iwe.cmd = IWEVCUSTOM;
2703                 sprintf(buf, "bcn_int=%d", bss->beacon_int);
2704                 iwe.u.data.length = strlen(buf);
2705                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2706                                                   buf);
2707
2708                 memset(&iwe, 0, sizeof(iwe));
2709                 iwe.cmd = IWEVCUSTOM;
2710                 sprintf(buf, "rssi=%d", bss->rssi);
2711                 iwe.u.data.length = strlen(buf);
2712                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2713                                                   buf);
2714
2715                 memset(&iwe, 0, sizeof(iwe));
2716                 iwe.cmd = IWEVCUSTOM;
2717                 sprintf(buf, "capab=0x%04x", bss->capability);
2718                 iwe.u.data.length = strlen(buf);
2719                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2720                                                   buf);
2721
2722                 p = buf;
2723                 p += sprintf(p, "supp_rates=");
2724                 for (i = 0; i < bss->supp_rates_len; i++)
2725                         p+= sprintf(p, "%02x", bss->supp_rates[i]);
2726                 memset(&iwe, 0, sizeof(iwe));
2727                 iwe.cmd = IWEVCUSTOM;
2728                 iwe.u.data.length = strlen(buf);
2729                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
2730                                                   buf);
2731
2732                 kfree(buf);
2733                 break;
2734         } while (0);
2735
2736         return current_ev;
2737 }
2738
2739
2740 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
2741 {
2742         struct ieee80211_local *local = dev->priv;
2743         struct list_head *ptr;
2744         char *current_ev = buf;
2745         char *end_buf = buf + len;
2746         struct ieee80211_sta_bss *bss;
2747
2748         spin_lock_bh(&local->sta_bss_lock);
2749         list_for_each(ptr, &local->sta_bss_list) {
2750                 bss = list_entry(ptr, struct ieee80211_sta_bss, list);
2751                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
2752                                                        end_buf);
2753         }
2754         spin_unlock_bh(&local->sta_bss_lock);
2755         return current_ev - buf;
2756 }
2757
2758
2759 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
2760 {
2761         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2762         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2763         kfree(ifsta->extra_ie);
2764         if (len == 0) {
2765                 ifsta->extra_ie = NULL;
2766                 ifsta->extra_ie_len = 0;
2767                 return 0;
2768         }
2769         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
2770         if (ifsta->extra_ie == NULL) {
2771                 ifsta->extra_ie_len = 0;
2772                 return -ENOMEM;
2773         }
2774         memcpy(ifsta->extra_ie, ie, len);
2775         ifsta->extra_ie_len = len;
2776         if (ifsta->bssid_set && ifsta->ssid_set &&
2777             ifsta->state != IEEE80211_AUTHENTICATE)
2778                 ieee80211_sta_new_auth(dev, ifsta);
2779         return 0;
2780 }
2781
2782
2783 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
2784                                          struct sk_buff *skb, u8 *bssid,
2785                                          u8 *addr)
2786 {
2787         struct ieee80211_local *local = dev->priv;
2788         struct list_head *ptr;
2789         struct sta_info *sta;
2790         struct ieee80211_sub_if_data *sdata = NULL;
2791         struct net_device *sta_dev = NULL;
2792
2793         /* TODO: Could consider removing the least recently used entry and
2794          * allow new one to be added. */
2795         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2796                 if (net_ratelimit()) {
2797                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
2798                                "entry " MACSTR "\n", dev->name, MAC2STR(addr));
2799                 }
2800                 return NULL;
2801         }
2802
2803         spin_lock_bh(&local->sub_if_lock);
2804         list_for_each(ptr, &local->sub_if_list) {
2805                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2806                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2807                     memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2808                         sta_dev = sdata->dev;
2809                         break;
2810                 }
2811         }
2812         spin_unlock_bh(&local->sub_if_lock);
2813
2814         if (sta_dev == NULL)
2815                 return NULL;
2816
2817         printk(KERN_DEBUG "%s: Adding new IBSS station " MACSTR " (dev=%s)\n",
2818                dev->name, MAC2STR(addr), sta_dev->name);
2819
2820         sta = sta_info_add(local, dev, addr);
2821         if (sta == NULL) {
2822                 return NULL;
2823         }
2824
2825         sta->dev = sta_dev;
2826         sta->supp_rates = sdata->u.sta.supp_rates_bits;
2827
2828         rate_control_rate_init(local, sta);
2829
2830         return sta; /* caller will call sta_info_release() */
2831 }
2832
2833
2834 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
2835 {
2836         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2837         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2838
2839         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
2840                dev->name, reason);
2841
2842         if (sdata->type != IEEE80211_SUB_IF_TYPE_STA)
2843                 return -EINVAL;
2844
2845         ieee80211_send_deauth(dev, ifsta, reason);
2846         ieee80211_set_associated(dev, ifsta, 0);
2847         return 0;
2848 }
2849
2850
2851 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
2852 {
2853         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2854         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2855
2856         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
2857                dev->name, reason);
2858
2859         if (sdata->type != IEEE80211_SUB_IF_TYPE_STA)
2860                 return -EINVAL;
2861
2862         if (!ifsta->associated)
2863                 return -1;
2864
2865         ieee80211_send_disassoc(dev, ifsta, reason);
2866         ieee80211_set_associated(dev, ifsta, 0);
2867         return 0;
2868 }