net/mac80211/mlme.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/if_arp.h>
  18 #include <linux/etherdevice.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/pm_qos_params.h>
  21 #include <linux/crc32.h>
  22 #include <linux/slab.h>
  23 #include <net/mac80211.h>
  24 #include <asm/unaligned.h>
  25
  26 #include "ieee80211_i.h"
  27 #include "driver-ops.h"
  28 #include "rate.h"
  29 #include "led.h"
  30
  31 static int max_nullfunc_tries = 2;
  32 module_param(max_nullfunc_tries, int, 0644);
  33 MODULE_PARM_DESC(max_nullfunc_tries,
  34                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  35
  36 static int max_probe_tries = 5;
  37 module_param(max_probe_tries, int, 0644);
  38 MODULE_PARM_DESC(max_probe_tries,
  39                  "Maximum probe tries before disconnecting (reason 4).");
  40
  41 /*
  42  * Beacon loss timeout is calculated as N frames times the
  43  * advertised beacon interval.  This may need to be somewhat
  44  * higher than what hardware might detect to account for
  45  * delays in the host processing frames. But since we also
  46  * probe on beacon miss before declaring the connection lost
  47  * default to what we want.
  48  */
  49 #define IEEE80211_BEACON_LOSS_COUNT     7
  50
  51 /*
  52  * Time the connection can be idle before we probe
  53  * it to see if we can still talk to the AP.
  54  */
  55 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  56 /*
  57  * Time we wait for a probe response after sending
  58  * a probe request because of beacon loss or for
  59  * checking the connection still works.
  60  */
  61 static int probe_wait_ms = 500;
  62 module_param(probe_wait_ms, int, 0644);
  63 MODULE_PARM_DESC(probe_wait_ms,
  64                  "Maximum time(ms) to wait for probe response"
  65                  " before disconnecting (reason 4).");
  66
  67 /*
  68  * Weight given to the latest Beacon frame when calculating average signal
  69  * strength for Beacon frames received in the current BSS. This must be
  70  * between 1 and 15.
  71  */
  72 #define IEEE80211_SIGNAL_AVE_WEIGHT     3
  73
  74 /*
  75  * How many Beacon frames need to have been used in average signal strength
  76  * before starting to indicate signal change events.
  77  */
  78 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  79
  80 #define TMR_RUNNING_TIMER       0
  81 #define TMR_RUNNING_CHANSW      1
  82
  83 /*
  84  * All cfg80211 functions have to be called outside a locked
  85  * section so that they can acquire a lock themselves... This
  86  * is much simpler than queuing up things in cfg80211, but we
  87  * do need some indirection for that here.
  88  */
  89 enum rx_mgmt_action {
  90         /* no action required */
  91         RX_MGMT_NONE,
  92
  93         /* caller must call cfg80211_send_deauth() */
  94         RX_MGMT_CFG80211_DEAUTH,
  95
  96         /* caller must call cfg80211_send_disassoc() */
  97         RX_MGMT_CFG80211_DISASSOC,
  98 };
  99
 100 /* utils */
 101 static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
 102 {
 103         lockdep_assert_held(&ifmgd->mtx);
 104 }
 105
 106 /*
 107  * We can have multiple work items (and connection probing)
 108  * scheduling this timer, but we need to take care to only
 109  * reschedule it when it should fire _earlier_ than it was
 110  * asked for before, or if it's not pending right now. This
 111  * function ensures that. Note that it then is required to
 112  * run this function for all timeouts after the first one
 113  * has happened -- the work that runs from this timer will
 114  * do that.
 115  */
 116 static void run_again(struct ieee80211_if_managed *ifmgd,
 117                              unsigned long timeout)
 118 {
 119         ASSERT_MGD_MTX(ifmgd);
 120
 121         if (!timer_pending(&ifmgd->timer) ||
 122             time_before(timeout, ifmgd->timer.expires))
 123                 mod_timer(&ifmgd->timer, timeout);
 124 }
 125
 126 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 127 {
 128         if (sdata->local->hw.flags & IEEE80211_HW_BEACON_FILTER)
 129                 return;
 130
 131         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 132                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 133 }
 134
 135 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 136 {
 137         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 138
 139         if (unlikely(!sdata->u.mgd.associated))
 140                 return;
 141
 142         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
 143                 return;
 144
 145         mod_timer(&sdata->u.mgd.conn_mon_timer,
 146                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 147
 148         ifmgd->probe_send_count = 0;
 149 }
 150
 151 static int ecw2cw(int ecw)
 152 {
 153         return (1 << ecw) - 1;
 154 }
 155
 156 /*
 157  * ieee80211_enable_ht should be called only after the operating band
 158  * has been determined as ht configuration depends on the hw's
 159  * HT abilities for a specific band.
 160  */
 161 static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 162                                struct ieee80211_ht_info *hti,
 163                                const u8 *bssid, u16 ap_ht_cap_flags)
 164 {
 165         struct ieee80211_local *local = sdata->local;
 166         struct ieee80211_supported_band *sband;
 167         struct sta_info *sta;
 168         u32 changed = 0;
 169         int hti_cfreq;
 170         u16 ht_opmode;
 171         bool enable_ht = true;
 172         enum nl80211_channel_type prev_chantype;
 173         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 174
 175         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 176
 177         prev_chantype = sdata->vif.bss_conf.channel_type;
 178
 179         /* HT is not supported */
 180         if (!sband->ht_cap.ht_supported)
 181                 enable_ht = false;
 182
 183         if (enable_ht) {
 184                 hti_cfreq = ieee80211_channel_to_frequency(hti->control_chan,
 185                                                            sband->band);
 186                 /* check that channel matches the right operating channel */
 187                 if (local->hw.conf.channel->center_freq != hti_cfreq) {
 188                         /* Some APs mess this up, evidently.
 189                          * Netgear WNDR3700 sometimes reports 4 higher than
 190                          * the actual channel, for instance.
 191                          */
 192                         printk(KERN_DEBUG
 193                                "%s: Wrong control channel in association"
 194                                " response: configured center-freq: %d"
 195                                " hti-cfreq: %d  hti->control_chan: %d"
 196                                " band: %d.  Disabling HT.\n",
 197                                sdata->name,
 198                                local->hw.conf.channel->center_freq,
 199                                hti_cfreq, hti->control_chan,
 200                                sband->band);
 201                         enable_ht = false;
 202                 }
 203         }
 204
 205         if (enable_ht) {
 206                 channel_type = NL80211_CHAN_HT20;
 207
 208                 if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
 209                     (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
 210                     (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
 211                         switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 212                         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 213                                 if (!(local->hw.conf.channel->flags &
 214                                     IEEE80211_CHAN_NO_HT40PLUS))
 215                                         channel_type = NL80211_CHAN_HT40PLUS;
 216                                 break;
 217                         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 218                                 if (!(local->hw.conf.channel->flags &
 219                                     IEEE80211_CHAN_NO_HT40MINUS))
 220                                         channel_type = NL80211_CHAN_HT40MINUS;
 221                                 break;
 222                         }
 223                 }
 224         }
 225
 226         if (local->tmp_channel)
 227                 local->tmp_channel_type = channel_type;
 228
 229         if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
 230                 /* can only fail due to HT40+/- mismatch */
 231                 channel_type = NL80211_CHAN_HT20;
 232                 WARN_ON(!ieee80211_set_channel_type(local, sdata, channel_type));
 233         }
 234
 235         /* channel_type change automatically detected */
 236         ieee80211_hw_config(local, 0);
 237
 238         if (prev_chantype != channel_type) {
 239                 rcu_read_lock();
 240                 sta = sta_info_get(sdata, bssid);
 241                 if (sta)
 242                         rate_control_rate_update(local, sband, sta,
 243                                                  IEEE80211_RC_HT_CHANGED,
 244                                                  channel_type);
 245                 rcu_read_unlock();
 246         }
 247
 248         ht_opmode = le16_to_cpu(hti->operation_mode);
 249
 250         /* if bss configuration changed store the new one */
 251         if (sdata->ht_opmode_valid != enable_ht ||
 252             sdata->vif.bss_conf.ht_operation_mode != ht_opmode ||
 253             prev_chantype != channel_type) {
 254                 changed |= BSS_CHANGED_HT;
 255                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
 256                 sdata->ht_opmode_valid = enable_ht;
 257         }
 258
 259         return changed;
 260 }
 261
 262 /* frame sending functions */
 263
 264 static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 265                                            const u8 *bssid, u16 stype, u16 reason,
 266                                            void *cookie, bool send_frame)
 267 {
 268         struct ieee80211_local *local = sdata->local;
 269         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 270         struct sk_buff *skb;
 271         struct ieee80211_mgmt *mgmt;
 272
 273         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 274         if (!skb) {
 275                 printk(KERN_DEBUG "%s: failed to allocate buffer for "
 276                        "deauth/disassoc frame\n", sdata->name);
 277                 return;
 278         }
 279         skb_reserve(skb, local->hw.extra_tx_headroom);
 280
 281         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 282         memset(mgmt, 0, 24);
 283         memcpy(mgmt->da, bssid, ETH_ALEN);
 284         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
 285         memcpy(mgmt->bssid, bssid, ETH_ALEN);
 286         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
 287         skb_put(skb, 2);
 288         /* u.deauth.reason_code == u.disassoc.reason_code */
 289         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 290
 291         if (stype == IEEE80211_STYPE_DEAUTH)
 292                 if (cookie)
 293                         __cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
 294                 else
 295                         cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
 296         else
 297                 if (cookie)
 298                         __cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
 299                 else
 300                         cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
 301         if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
 302                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 303
 304         if (send_frame)
 305                 ieee80211_tx_skb(sdata, skb);
 306         else
 307                 kfree_skb(skb);
 308 }
 309
 310 void ieee80211_send_pspoll(struct ieee80211_local *local,
 311                            struct ieee80211_sub_if_data *sdata)
 312 {
 313         struct ieee80211_pspoll *pspoll;
 314         struct sk_buff *skb;
 315
 316         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
 317         if (!skb)
 318                 return;
 319
 320         pspoll = (struct ieee80211_pspoll *) skb->data;
 321         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 322
 323         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 324         ieee80211_tx_skb(sdata, skb);
 325 }
 326
 327 void ieee80211_send_nullfunc(struct ieee80211_local *local,
 328                              struct ieee80211_sub_if_data *sdata,
 329                              int powersave)
 330 {
 331         struct sk_buff *skb;
 332         struct ieee80211_hdr_3addr *nullfunc;
 333
 334         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
 335         if (!skb)
 336                 return;
 337
 338         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
 339         if (powersave)
 340                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 341
 342         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 343         ieee80211_tx_skb(sdata, skb);
 344 }
 345
 346 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
 347                                           struct ieee80211_sub_if_data *sdata)
 348 {
 349         struct sk_buff *skb;
 350         struct ieee80211_hdr *nullfunc;
 351         __le16 fc;
 352
 353         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
 354                 return;
 355
 356         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
 357         if (!skb) {
 358                 printk(KERN_DEBUG "%s: failed to allocate buffer for 4addr "
 359                        "nullfunc frame\n", sdata->name);
 360                 return;
 361         }
 362         skb_reserve(skb, local->hw.extra_tx_headroom);
 363
 364         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
 365         memset(nullfunc, 0, 30);
 366         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
 367                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
 368         nullfunc->frame_control = fc;
 369         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
 370         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
 371         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
 372         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
 373
 374         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 375         ieee80211_tx_skb(sdata, skb);
 376 }
 377
 378 /* spectrum management related things */
 379 static void ieee80211_chswitch_work(struct work_struct *work)
 380 {
 381         struct ieee80211_sub_if_data *sdata =
 382                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
 383         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 384
 385         if (!ieee80211_sdata_running(sdata))
 386                 return;
 387
 388         mutex_lock(&ifmgd->mtx);
 389         if (!ifmgd->associated)
 390                 goto out;
 391
 392         sdata->local->oper_channel = sdata->local->csa_channel;
 393         if (!sdata->local->ops->channel_switch) {
 394                 /* call "hw_config" only if doing sw channel switch */
 395                 ieee80211_hw_config(sdata->local,
 396                         IEEE80211_CONF_CHANGE_CHANNEL);
 397         }
 398
 399         /* XXX: shouldn't really modify cfg80211-owned data! */
 400         ifmgd->associated->channel = sdata->local->oper_channel;
 401
 402         ieee80211_wake_queues_by_reason(&sdata->local->hw,
 403                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 404  out:
 405         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
 406         mutex_unlock(&ifmgd->mtx);
 407 }
 408
 409 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
 410 {
 411         struct ieee80211_sub_if_data *sdata;
 412         struct ieee80211_if_managed *ifmgd;
 413
 414         sdata = vif_to_sdata(vif);
 415         ifmgd = &sdata->u.mgd;
 416
 417         trace_api_chswitch_done(sdata, success);
 418         if (!success) {
 419                 /*
 420                  * If the channel switch was not successful, stay
 421                  * around on the old channel. We currently lack
 422                  * good handling of this situation, possibly we
 423                  * should just drop the association.
 424                  */
 425                 sdata->local->csa_channel = sdata->local->oper_channel;
 426         }
 427
 428         ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 429 }
 430 EXPORT_SYMBOL(ieee80211_chswitch_done);
 431
 432 static void ieee80211_chswitch_timer(unsigned long data)
 433 {
 434         struct ieee80211_sub_if_data *sdata =
 435                 (struct ieee80211_sub_if_data *) data;
 436         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 437
 438         if (sdata->local->quiescing) {
 439                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
 440                 return;
 441         }
 442
 443         ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 444 }
 445
 446 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 447                                       struct ieee80211_channel_sw_ie *sw_elem,
 448                                       struct ieee80211_bss *bss,
 449                                       u64 timestamp)
 450 {
 451         struct cfg80211_bss *cbss =
 452                 container_of((void *)bss, struct cfg80211_bss, priv);
 453         struct ieee80211_channel *new_ch;
 454         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 455         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
 456                                                       cbss->channel->band);
 457
 458         ASSERT_MGD_MTX(ifmgd);
 459
 460         if (!ifmgd->associated)
 461                 return;
 462
 463         if (sdata->local->scanning)
 464                 return;
 465
 466         /* Disregard subsequent beacons if we are already running a timer
 467            processing a CSA */
 468
 469         if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
 470                 return;
 471
 472         new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
 473         if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED)
 474                 return;
 475
 476         sdata->local->csa_channel = new_ch;
 477
 478         if (sdata->local->ops->channel_switch) {
 479                 /* use driver's channel switch callback */
 480                 struct ieee80211_channel_switch ch_switch;
 481                 memset(&ch_switch, 0, sizeof(ch_switch));
 482                 ch_switch.timestamp = timestamp;
 483                 if (sw_elem->mode) {
 484                         ch_switch.block_tx = true;
 485                         ieee80211_stop_queues_by_reason(&sdata->local->hw,
 486                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 487                 }
 488                 ch_switch.channel = new_ch;
 489                 ch_switch.count = sw_elem->count;
 490                 ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
 491                 drv_channel_switch(sdata->local, &ch_switch);
 492                 return;
 493         }
 494
 495         /* channel switch handled in software */
 496         if (sw_elem->count <= 1) {
 497                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 498         } else {
 499                 if (sw_elem->mode)
 500                         ieee80211_stop_queues_by_reason(&sdata->local->hw,
 501                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 502                 ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
 503                 mod_timer(&ifmgd->chswitch_timer,
 504                           jiffies +
 505                           msecs_to_jiffies(sw_elem->count *
 506                                            cbss->beacon_interval));
 507         }
 508 }
 509
 510 static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
 511                                         u16 capab_info, u8 *pwr_constr_elem,
 512                                         u8 pwr_constr_elem_len)
 513 {
 514         struct ieee80211_conf *conf = &sdata->local->hw.conf;
 515
 516         if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
 517                 return;
 518
 519         /* Power constraint IE length should be 1 octet */
 520         if (pwr_constr_elem_len != 1)
 521                 return;
 522
 523         if ((*pwr_constr_elem <= conf->channel->max_power) &&
 524             (*pwr_constr_elem != sdata->local->power_constr_level)) {
 525                 sdata->local->power_constr_level = *pwr_constr_elem;
 526                 ieee80211_hw_config(sdata->local, 0);
 527         }
 528 }
 529
 530 void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
 531 {
 532         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 533         struct ieee80211_local *local = sdata->local;
 534         struct ieee80211_conf *conf = &local->hw.conf;
 535
 536         WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
 537                 !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
 538                 (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
 539
 540         local->disable_dynamic_ps = false;
 541         conf->dynamic_ps_timeout = local->dynamic_ps_user_timeout;
 542 }
 543 EXPORT_SYMBOL(ieee80211_enable_dyn_ps);
 544
 545 void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif)
 546 {
 547         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 548         struct ieee80211_local *local = sdata->local;
 549         struct ieee80211_conf *conf = &local->hw.conf;
 550
 551         WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
 552                 !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
 553                 (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
 554
 555         local->disable_dynamic_ps = true;
 556         conf->dynamic_ps_timeout = 0;
 557         del_timer_sync(&local->dynamic_ps_timer);
 558         ieee80211_queue_work(&local->hw,
 559                              &local->dynamic_ps_enable_work);
 560 }
 561 EXPORT_SYMBOL(ieee80211_disable_dyn_ps);
 562
 563 /* powersave */
 564 static void ieee80211_enable_ps(struct ieee80211_local *local,
 565                                 struct ieee80211_sub_if_data *sdata)
 566 {
 567         struct ieee80211_conf *conf = &local->hw.conf;
 568
 569         /*
 570          * If we are scanning right now then the parameters will
 571          * take effect when scan finishes.
 572          */
 573         if (local->scanning)
 574                 return;
 575
 576         if (conf->dynamic_ps_timeout > 0 &&
 577             !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
 578                 mod_timer(&local->dynamic_ps_timer, jiffies +
 579                           msecs_to_jiffies(conf->dynamic_ps_timeout));
 580         } else {
 581                 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
 582                         ieee80211_send_nullfunc(local, sdata, 1);
 583
 584                 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
 585                     (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
 586                         return;
 587
 588                 conf->flags |= IEEE80211_CONF_PS;
 589                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 590         }
 591 }
 592
 593 static void ieee80211_change_ps(struct ieee80211_local *local)
 594 {
 595         struct ieee80211_conf *conf = &local->hw.conf;
 596
 597         if (local->ps_sdata) {
 598                 ieee80211_enable_ps(local, local->ps_sdata);
 599         } else if (conf->flags & IEEE80211_CONF_PS) {
 600                 conf->flags &= ~IEEE80211_CONF_PS;
 601                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 602                 del_timer_sync(&local->dynamic_ps_timer);
 603                 cancel_work_sync(&local->dynamic_ps_enable_work);
 604         }
 605 }
 606
 607 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
 608 {
 609         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
 610         struct sta_info *sta = NULL;
 611         u32 sta_flags = 0;
 612
 613         if (!mgd->powersave)
 614                 return false;
 615
 616         if (!mgd->associated)
 617                 return false;
 618
 619         if (!mgd->associated->beacon_ies)
 620                 return false;
 621
 622         if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
 623                           IEEE80211_STA_CONNECTION_POLL))
 624                 return false;
 625
 626         rcu_read_lock();
 627         sta = sta_info_get(sdata, mgd->bssid);
 628         if (sta)
 629                 sta_flags = get_sta_flags(sta);
 630         rcu_read_unlock();
 631
 632         if (!(sta_flags & WLAN_STA_AUTHORIZED))
 633                 return false;
 634
 635         return true;
 636 }
 637
 638 /* need to hold RTNL or interface lock */
 639 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
 640 {
 641         struct ieee80211_sub_if_data *sdata, *found = NULL;
 642         int count = 0;
 643         int timeout;
 644
 645         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
 646                 local->ps_sdata = NULL;
 647                 return;
 648         }
 649
 650         if (!list_empty(&local->work_list)) {
 651                 local->ps_sdata = NULL;
 652                 goto change;
 653         }
 654
 655         list_for_each_entry(sdata, &local->interfaces, list) {
 656                 if (!ieee80211_sdata_running(sdata))
 657                         continue;
 658                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
 659                         /* If an AP vif is found, then disable PS
 660                          * by setting the count to zero thereby setting
 661                          * ps_sdata to NULL.
 662                          */
 663                         count = 0;
 664                         break;
 665                 }
 666                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
 667                         continue;
 668                 found = sdata;
 669                 count++;
 670         }
 671
 672         if (count == 1 && ieee80211_powersave_allowed(found)) {
 673                 struct ieee80211_conf *conf = &local->hw.conf;
 674                 s32 beaconint_us;
 675
 676                 if (latency < 0)
 677                         latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
 678
 679                 beaconint_us = ieee80211_tu_to_usec(
 680                                         found->vif.bss_conf.beacon_int);
 681
 682                 timeout = local->dynamic_ps_forced_timeout;
 683                 if (timeout < 0) {
 684                         /*
 685                          * Go to full PSM if the user configures a very low
 686                          * latency requirement.
 687                          * The 2000 second value is there for compatibility
 688                          * until the PM_QOS_NETWORK_LATENCY is configured
 689                          * with real values.
 690                          */
 691                         if (latency > (1900 * USEC_PER_MSEC) &&
 692                             latency != (2000 * USEC_PER_SEC))
 693                                 timeout = 0;
 694                         else
 695                                 timeout = 100;
 696                 }
 697                 local->dynamic_ps_user_timeout = timeout;
 698                 if (!local->disable_dynamic_ps)
 699                         conf->dynamic_ps_timeout =
 700                                 local->dynamic_ps_user_timeout;
 701
 702                 if (beaconint_us > latency) {
 703                         local->ps_sdata = NULL;
 704                 } else {
 705                         struct ieee80211_bss *bss;
 706                         int maxslp = 1;
 707                         u8 dtimper;
 708
 709                         bss = (void *)found->u.mgd.associated->priv;
 710                         dtimper = bss->dtim_period;
 711
 712                         /* If the TIM IE is invalid, pretend the value is 1 */
 713                         if (!dtimper)
 714                                 dtimper = 1;
 715                         else if (dtimper > 1)
 716                                 maxslp = min_t(int, dtimper,
 717                                                     latency / beaconint_us);
 718
 719                         local->hw.conf.max_sleep_period = maxslp;
 720                         local->hw.conf.ps_dtim_period = dtimper;
 721                         local->ps_sdata = found;
 722                 }
 723         } else {
 724                 local->ps_sdata = NULL;
 725         }
 726
 727  change:
 728         ieee80211_change_ps(local);
 729 }
 730
 731 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
 732 {
 733         struct ieee80211_local *local =
 734                 container_of(work, struct ieee80211_local,
 735                              dynamic_ps_disable_work);
 736
 737         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
 738                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
 739                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 740         }
 741
 742         ieee80211_wake_queues_by_reason(&local->hw,
 743                                         IEEE80211_QUEUE_STOP_REASON_PS);
 744 }
 745
 746 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
 747 {
 748         struct ieee80211_local *local =
 749                 container_of(work, struct ieee80211_local,
 750                              dynamic_ps_enable_work);
 751         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
 752         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 753         unsigned long flags;
 754         int q;
 755
 756         /* can only happen when PS was just disabled anyway */
 757         if (!sdata)
 758                 return;
 759
 760         if (local->hw.conf.flags & IEEE80211_CONF_PS)
 761                 return;
 762
 763         if (!local->disable_dynamic_ps &&
 764             local->hw.conf.dynamic_ps_timeout > 0) {
 765                 /* don't enter PS if TX frames are pending */
 766                 if (drv_tx_frames_pending(local)) {
 767                         mod_timer(&local->dynamic_ps_timer, jiffies +
 768                                   msecs_to_jiffies(
 769                                   local->hw.conf.dynamic_ps_timeout));
 770                         return;
 771                 }
 772
 773                 /*
 774                  * transmission can be stopped by others which leads to
 775                  * dynamic_ps_timer expiry. Postpone the ps timer if it
 776                  * is not the actual idle state.
 777                  */
 778                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 779                 for (q = 0; q < local->hw.queues; q++) {
 780                         if (local->queue_stop_reasons[q]) {
 781                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
 782                                                        flags);
 783                                 mod_timer(&local->dynamic_ps_timer, jiffies +
 784                                           msecs_to_jiffies(
 785                                           local->hw.conf.dynamic_ps_timeout));
 786                                 return;
 787                         }
 788                 }
 789                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 790         }
 791
 792         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
 793             (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
 794                 netif_tx_stop_all_queues(sdata->dev);
 795
 796                 if (drv_tx_frames_pending(local))
 797                         mod_timer(&local->dynamic_ps_timer, jiffies +
 798                                   msecs_to_jiffies(
 799                                   local->hw.conf.dynamic_ps_timeout));
 800                 else {
 801                         ieee80211_send_nullfunc(local, sdata, 1);
 802                         /* Flush to get the tx status of nullfunc frame */
 803                         drv_flush(local, false);
 804                 }
 805         }
 806
 807         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
 808               (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
 809             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
 810                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
 811                 local->hw.conf.flags |= IEEE80211_CONF_PS;
 812                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 813         }
 814
 815         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
 816                 netif_tx_wake_all_queues(sdata->dev);
 817 }
 818
 819 void ieee80211_dynamic_ps_timer(unsigned long data)
 820 {
 821         struct ieee80211_local *local = (void *) data;
 822
 823         if (local->quiescing || local->suspended)
 824                 return;
 825
 826         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 827 }
 828
 829 /* MLME */
 830 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 831                                      struct ieee80211_sub_if_data *sdata,
 832                                      u8 *wmm_param, size_t wmm_param_len)
 833 {
 834         struct ieee80211_tx_queue_params params;
 835         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 836         size_t left;
 837         int count;
 838         u8 *pos, uapsd_queues = 0;
 839
 840         if (!local->ops->conf_tx)
 841                 return;
 842
 843         if (local->hw.queues < 4)
 844                 return;
 845
 846         if (!wmm_param)
 847                 return;
 848
 849         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 850                 return;
 851
 852         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
 853                 uapsd_queues = local->uapsd_queues;
 854
 855         count = wmm_param[6] & 0x0f;
 856         if (count == ifmgd->wmm_last_param_set)
 857                 return;
 858         ifmgd->wmm_last_param_set = count;
 859
 860         pos = wmm_param + 8;
 861         left = wmm_param_len - 8;
 862
 863         memset(&params, 0, sizeof(params));
 864
 865         local->wmm_acm = 0;
 866         for (; left >= 4; left -= 4, pos += 4) {
 867                 int aci = (pos[0] >> 5) & 0x03;
 868                 int acm = (pos[0] >> 4) & 0x01;
 869                 bool uapsd = false;
 870                 int queue;
 871
 872                 switch (aci) {
 873                 case 1: /* AC_BK */
 874                         queue = 3;
 875                         if (acm)
 876                                 local->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
 877                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
 878                                 uapsd = true;
 879                         break;
 880                 case 2: /* AC_VI */
 881                         queue = 1;
 882                         if (acm)
 883                                 local->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
 884                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
 885                                 uapsd = true;
 886                         break;
 887                 case 3: /* AC_VO */
 888                         queue = 0;
 889                         if (acm)
 890                                 local->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
 891                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
 892                                 uapsd = true;
 893                         break;
 894                 case 0: /* AC_BE */
 895                 default:
 896                         queue = 2;
 897                         if (acm)
 898                                 local->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
 899                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
 900                                 uapsd = true;
 901                         break;
 902                 }
 903
 904                 params.aifs = pos[0] & 0x0f;
 905                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 906                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 907                 params.txop = get_unaligned_le16(pos + 2);
 908                 params.uapsd = uapsd;
 909
 910 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 911                 wiphy_debug(local->hw.wiphy,
 912                             "WMM queue=%d aci=%d acm=%d aifs=%d "
 913                             "cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
 914                             queue, aci, acm,
 915                             params.aifs, params.cw_min, params.cw_max,
 916                             params.txop, params.uapsd);
 917 #endif
 918                 if (drv_conf_tx(local, queue, &params))
 919                         wiphy_debug(local->hw.wiphy,
 920                                     "failed to set TX queue parameters for queue %d\n",
 921                                     queue);
 922         }
 923
 924         /* enable WMM or activate new settings */
 925         sdata->vif.bss_conf.qos = true;
 926         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
 927 }
 928
 929 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 930                                            u16 capab, bool erp_valid, u8 erp)
 931 {
 932         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 933         u32 changed = 0;
 934         bool use_protection;
 935         bool use_short_preamble;
 936         bool use_short_slot;
 937
 938         if (erp_valid) {
 939                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
 940                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
 941         } else {
 942                 use_protection = false;
 943                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
 944         }
 945
 946         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
 947         if (sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
 948                 use_short_slot = true;
 949
 950         if (use_protection != bss_conf->use_cts_prot) {
 951                 bss_conf->use_cts_prot = use_protection;
 952                 changed |= BSS_CHANGED_ERP_CTS_PROT;
 953         }
 954
 955         if (use_short_preamble != bss_conf->use_short_preamble) {
 956                 bss_conf->use_short_preamble = use_short_preamble;
 957                 changed |= BSS_CHANGED_ERP_PREAMBLE;
 958         }
 959
 960         if (use_short_slot != bss_conf->use_short_slot) {
 961                 bss_conf->use_short_slot = use_short_slot;
 962                 changed |= BSS_CHANGED_ERP_SLOT;
 963         }
 964
 965         return changed;
 966 }
 967
 968 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 969                                      struct cfg80211_bss *cbss,
 970                                      u32 bss_info_changed)
 971 {
 972         struct ieee80211_bss *bss = (void *)cbss->priv;
 973         struct ieee80211_local *local = sdata->local;
 974         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 975
 976         bss_info_changed |= BSS_CHANGED_ASSOC;
 977         /* set timing information */
 978         bss_conf->beacon_int = cbss->beacon_interval;
 979         bss_conf->timestamp = cbss->tsf;
 980
 981         bss_info_changed |= BSS_CHANGED_BEACON_INT;
 982         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
 983                 cbss->capability, bss->has_erp_value, bss->erp_value);
 984
 985         sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
 986                 IEEE80211_BEACON_LOSS_COUNT * bss_conf->beacon_int));
 987
 988         sdata->u.mgd.associated = cbss;
 989         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
 990
 991         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
 992
 993         /* just to be sure */
 994         sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
 995                                 IEEE80211_STA_BEACON_POLL);
 996
 997         ieee80211_led_assoc(local, 1);
 998
 999         if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
1000                 bss_conf->dtim_period = bss->dtim_period;
1001         else
1002                 bss_conf->dtim_period = 0;
1003
1004         bss_conf->assoc = 1;
1005         /*
1006          * For now just always ask the driver to update the basic rateset
1007          * when we have associated, we aren't checking whether it actually
1008          * changed or not.
1009          */
1010         bss_info_changed |= BSS_CHANGED_BASIC_RATES;
1011
1012         /* And the BSSID changed - we're associated now */
1013         bss_info_changed |= BSS_CHANGED_BSSID;
1014
1015         /* Tell the driver to monitor connection quality (if supported) */
1016         if ((local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI) &&
1017             bss_conf->cqm_rssi_thold)
1018                 bss_info_changed |= BSS_CHANGED_CQM;
1019
1020         /* Enable ARP filtering */
1021         if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
1022                 bss_conf->arp_filter_enabled = sdata->arp_filter_state;
1023                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1024         }
1025
1026         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1027
1028         mutex_lock(&local->iflist_mtx);
1029         ieee80211_recalc_ps(local, -1);
1030         ieee80211_recalc_smps(local);
1031         mutex_unlock(&local->iflist_mtx);
1032
1033         netif_tx_start_all_queues(sdata->dev);
1034         netif_carrier_on(sdata->dev);
1035 }
1036
1037 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1038                                    bool remove_sta, bool tx)
1039 {
1040         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1041         struct ieee80211_local *local = sdata->local;
1042         struct sta_info *sta;
1043         u32 changed = 0, config_changed = 0;
1044         u8 bssid[ETH_ALEN];
1045
1046         ASSERT_MGD_MTX(ifmgd);
1047
1048         if (WARN_ON(!ifmgd->associated))
1049                 return;
1050
1051         memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
1052
1053         ifmgd->associated = NULL;
1054         memset(ifmgd->bssid, 0, ETH_ALEN);
1055
1056         /*
1057          * we need to commit the associated = NULL change because the
1058          * scan code uses that to determine whether this iface should
1059          * go to/wake up from powersave or not -- and could otherwise
1060          * wake the queues erroneously.
1061          */
1062         smp_mb();
1063
1064         /*
1065          * Thus, we can only afterwards stop the queues -- to account
1066          * for the case where another CPU is finishing a scan at this
1067          * time -- we don't want the scan code to enable queues.
1068          */
1069
1070         netif_tx_stop_all_queues(sdata->dev);
1071         netif_carrier_off(sdata->dev);
1072
1073         mutex_lock(&local->sta_mtx);
1074         sta = sta_info_get(sdata, bssid);
1075         if (sta) {
1076                 set_sta_flags(sta, WLAN_STA_BLOCK_BA);
1077                 ieee80211_sta_tear_down_BA_sessions(sta, tx);
1078         }
1079         mutex_unlock(&local->sta_mtx);
1080
1081         changed |= ieee80211_reset_erp_info(sdata);
1082
1083         ieee80211_led_assoc(local, 0);
1084         changed |= BSS_CHANGED_ASSOC;
1085         sdata->vif.bss_conf.assoc = false;
1086
1087         ieee80211_set_wmm_default(sdata);
1088
1089         /* channel(_type) changes are handled by ieee80211_hw_config */
1090         WARN_ON(!ieee80211_set_channel_type(local, sdata, NL80211_CHAN_NO_HT));
1091
1092         /* on the next assoc, re-program HT parameters */
1093         sdata->ht_opmode_valid = false;
1094
1095         local->power_constr_level = 0;
1096
1097         del_timer_sync(&local->dynamic_ps_timer);
1098         cancel_work_sync(&local->dynamic_ps_enable_work);
1099
1100         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1101                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1102                 config_changed |= IEEE80211_CONF_CHANGE_PS;
1103         }
1104         local->ps_sdata = NULL;
1105
1106         ieee80211_hw_config(local, config_changed);
1107
1108         /* Disable ARP filtering */
1109         if (sdata->vif.bss_conf.arp_filter_enabled) {
1110                 sdata->vif.bss_conf.arp_filter_enabled = false;
1111                 changed |= BSS_CHANGED_ARP_FILTER;
1112         }
1113
1114         /* The BSSID (not really interesting) and HT changed */
1115         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1116         ieee80211_bss_info_change_notify(sdata, changed);
1117
1118         if (remove_sta)
1119                 sta_info_destroy_addr(sdata, bssid);
1120
1121         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1122         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1123         del_timer_sync(&sdata->u.mgd.timer);
1124         del_timer_sync(&sdata->u.mgd.chswitch_timer);
1125 }
1126
1127 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1128                              struct ieee80211_hdr *hdr)
1129 {
1130         /*
1131          * We can postpone the mgd.timer whenever receiving unicast frames
1132          * from AP because we know that the connection is working both ways
1133          * at that time. But multicast frames (and hence also beacons) must
1134          * be ignored here, because we need to trigger the timer during
1135          * data idle periods for sending the periodic probe request to the
1136          * AP we're connected to.
1137          */
1138         if (is_multicast_ether_addr(hdr->addr1))
1139                 return;
1140
1141         ieee80211_sta_reset_conn_monitor(sdata);
1142 }
1143
1144 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1145 {
1146         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1147
1148         if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1149                               IEEE80211_STA_CONNECTION_POLL)))
1150             return;
1151
1152         ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
1153                           IEEE80211_STA_BEACON_POLL);
1154         mutex_lock(&sdata->local->iflist_mtx);
1155         ieee80211_recalc_ps(sdata->local, -1);
1156         mutex_unlock(&sdata->local->iflist_mtx);
1157
1158         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1159                 return;
1160
1161         /*
1162          * We've received a probe response, but are not sure whether
1163          * we have or will be receiving any beacons or data, so let's
1164          * schedule the timers again, just in case.
1165          */
1166         ieee80211_sta_reset_beacon_monitor(sdata);
1167
1168         mod_timer(&ifmgd->conn_mon_timer,
1169                   round_jiffies_up(jiffies +
1170                                    IEEE80211_CONNECTION_IDLE_TIME));
1171 }
1172
1173 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
1174                              struct ieee80211_hdr *hdr, bool ack)
1175 {
1176         if (!ieee80211_is_data(hdr->frame_control))
1177             return;
1178
1179         if (ack)
1180                 ieee80211_sta_reset_conn_monitor(sdata);
1181
1182         if (ieee80211_is_nullfunc(hdr->frame_control) &&
1183             sdata->u.mgd.probe_send_count > 0) {
1184                 if (ack)
1185                         sdata->u.mgd.probe_send_count = 0;
1186                 else
1187                         sdata->u.mgd.nullfunc_failed = true;
1188                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1189         }
1190 }
1191
1192 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
1193 {
1194         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1195         const u8 *ssid;
1196         u8 *dst = ifmgd->associated->bssid;
1197         u8 unicast_limit = max(1, max_probe_tries - 3);
1198
1199         /*
1200          * Try sending broadcast probe requests for the last three
1201          * probe requests after the first ones failed since some
1202          * buggy APs only support broadcast probe requests.
1203          */
1204         if (ifmgd->probe_send_count >= unicast_limit)
1205                 dst = NULL;
1206
1207         /*
1208          * When the hardware reports an accurate Tx ACK status, it's
1209          * better to send a nullfunc frame instead of a probe request,
1210          * as it will kick us off the AP quickly if we aren't associated
1211          * anymore. The timeout will be reset if the frame is ACKed by
1212          * the AP.
1213          */
1214         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
1215                 ifmgd->nullfunc_failed = false;
1216                 ieee80211_send_nullfunc(sdata->local, sdata, 0);
1217         } else {
1218                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
1219                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0,
1220                                          true);
1221         }
1222
1223         ifmgd->probe_send_count++;
1224         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
1225         run_again(ifmgd, ifmgd->probe_timeout);
1226 }
1227
1228 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
1229                                    bool beacon)
1230 {
1231         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1232         bool already = false;
1233
1234         if (!ieee80211_sdata_running(sdata))
1235                 return;
1236
1237         if (sdata->local->scanning)
1238                 return;
1239
1240         if (sdata->local->tmp_channel)
1241                 return;
1242
1243         mutex_lock(&ifmgd->mtx);
1244
1245         if (!ifmgd->associated)
1246                 goto out;
1247
1248 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1249         if (beacon && net_ratelimit())
1250                 printk(KERN_DEBUG "%s: detected beacon loss from AP "
1251                        "- sending probe request\n", sdata->name);
1252 #endif
1253
1254         /*
1255          * The driver/our work has already reported this event or the
1256          * connection monitoring has kicked in and we have already sent
1257          * a probe request. Or maybe the AP died and the driver keeps
1258          * reporting until we disassociate...
1259          *
1260          * In either case we have to ignore the current call to this
1261          * function (except for setting the correct probe reason bit)
1262          * because otherwise we would reset the timer every time and
1263          * never check whether we received a probe response!
1264          */
1265         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1266                             IEEE80211_STA_CONNECTION_POLL))
1267                 already = true;
1268
1269         if (beacon)
1270                 ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
1271         else
1272                 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
1273
1274         if (already)
1275                 goto out;
1276
1277         mutex_lock(&sdata->local->iflist_mtx);
1278         ieee80211_recalc_ps(sdata->local, -1);
1279         mutex_unlock(&sdata->local->iflist_mtx);
1280
1281         ifmgd->probe_send_count = 0;
1282         ieee80211_mgd_probe_ap_send(sdata);
1283  out:
1284         mutex_unlock(&ifmgd->mtx);
1285 }
1286
1287 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
1288                                           struct ieee80211_vif *vif)
1289 {
1290         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1291         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1292         struct sk_buff *skb;
1293         const u8 *ssid;
1294
1295         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1296                 return NULL;
1297
1298         ASSERT_MGD_MTX(ifmgd);
1299
1300         if (!ifmgd->associated)
1301                 return NULL;
1302
1303         ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
1304         skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
1305                                         ssid + 2, ssid[1], NULL, 0, true);
1306
1307         return skb;
1308 }
1309 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
1310
1311 static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
1312 {
1313         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1314         struct ieee80211_local *local = sdata->local;
1315         u8 bssid[ETH_ALEN];
1316
1317         mutex_lock(&ifmgd->mtx);
1318         if (!ifmgd->associated) {
1319                 mutex_unlock(&ifmgd->mtx);
1320                 return;
1321         }
1322
1323         memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
1324
1325         printk(KERN_DEBUG "%s: Connection to AP %pM lost.\n",
1326                sdata->name, bssid);
1327
1328         ieee80211_set_disassoc(sdata, true, true);
1329         mutex_unlock(&ifmgd->mtx);
1330
1331         mutex_lock(&local->mtx);
1332         ieee80211_recalc_idle(local);
1333         mutex_unlock(&local->mtx);
1334         /*
1335          * must be outside lock due to cfg80211,
1336          * but that's not a problem.
1337          */
1338         ieee80211_send_deauth_disassoc(sdata, bssid,
1339                                        IEEE80211_STYPE_DEAUTH,
1340                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
1341                                        NULL, true);
1342 }
1343
1344 void ieee80211_beacon_connection_loss_work(struct work_struct *work)
1345 {
1346         struct ieee80211_sub_if_data *sdata =
1347                 container_of(work, struct ieee80211_sub_if_data,
1348                              u.mgd.beacon_connection_loss_work);
1349
1350         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1351                 __ieee80211_connection_loss(sdata);
1352         else
1353                 ieee80211_mgd_probe_ap(sdata, true);
1354 }
1355
1356 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
1357 {
1358         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1359         struct ieee80211_hw *hw = &sdata->local->hw;
1360
1361         trace_api_beacon_loss(sdata);
1362
1363         WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
1364         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
1365 }
1366 EXPORT_SYMBOL(ieee80211_beacon_loss);
1367
1368 void ieee80211_connection_loss(struct ieee80211_vif *vif)
1369 {
1370         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1371         struct ieee80211_hw *hw = &sdata->local->hw;
1372
1373         trace_api_connection_loss(sdata);
1374
1375         WARN_ON(!(hw->flags & IEEE80211_HW_CONNECTION_MONITOR));
1376         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
1377 }
1378 EXPORT_SYMBOL(ieee80211_connection_loss);
1379
1380
1381 static enum rx_mgmt_action __must_check
1382 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
1383                          struct ieee80211_mgmt *mgmt, size_t len)
1384 {
1385         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1386         const u8 *bssid = NULL;
1387         u16 reason_code;
1388
1389         if (len < 24 + 2)
1390                 return RX_MGMT_NONE;
1391
1392         ASSERT_MGD_MTX(ifmgd);
1393
1394         bssid = ifmgd->associated->bssid;
1395
1396         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1397
1398         printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
1399                         sdata->name, bssid, reason_code);
1400
1401         ieee80211_set_disassoc(sdata, true, false);
1402         mutex_lock(&sdata->local->mtx);
1403         ieee80211_recalc_idle(sdata->local);
1404         mutex_unlock(&sdata->local->mtx);
1405
1406         return RX_MGMT_CFG80211_DEAUTH;
1407 }
1408
1409
1410 static enum rx_mgmt_action __must_check
1411 ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
1412                            struct ieee80211_mgmt *mgmt, size_t len)
1413 {
1414         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1415         u16 reason_code;
1416
1417         if (len < 24 + 2)
1418                 return RX_MGMT_NONE;
1419
1420         ASSERT_MGD_MTX(ifmgd);
1421
1422         if (WARN_ON(!ifmgd->associated))
1423                 return RX_MGMT_NONE;
1424
1425         if (WARN_ON(memcmp(ifmgd->associated->bssid, mgmt->sa, ETH_ALEN)))
1426                 return RX_MGMT_NONE;
1427
1428         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1429
1430         printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
1431                         sdata->name, mgmt->sa, reason_code);
1432
1433         ieee80211_set_disassoc(sdata, true, false);
1434         mutex_lock(&sdata->local->mtx);
1435         ieee80211_recalc_idle(sdata->local);
1436         mutex_unlock(&sdata->local->mtx);
1437         return RX_MGMT_CFG80211_DISASSOC;
1438 }
1439
1440
1441 static bool ieee80211_assoc_success(struct ieee80211_work *wk,
1442                                     struct ieee80211_mgmt *mgmt, size_t len)
1443 {
1444         struct ieee80211_sub_if_data *sdata = wk->sdata;
1445         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1446         struct ieee80211_local *local = sdata->local;
1447         struct ieee80211_supported_band *sband;
1448         struct sta_info *sta;
1449         struct cfg80211_bss *cbss = wk->assoc.bss;
1450         u8 *pos;
1451         u32 rates, basic_rates;
1452         u16 capab_info, aid;
1453         struct ieee802_11_elems elems;
1454         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1455         u32 changed = 0;
1456         int i, j, err;
1457         bool have_higher_than_11mbit = false;
1458         u16 ap_ht_cap_flags;
1459
1460         /* AssocResp and ReassocResp have identical structure */
1461
1462         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1463         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1464
1465         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1466                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1467                        "set\n", sdata->name, aid);
1468         aid &= ~(BIT(15) | BIT(14));
1469
1470         pos = mgmt->u.assoc_resp.variable;
1471         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1472
1473         if (!elems.supp_rates) {
1474                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1475                        sdata->name);
1476                 return false;
1477         }
1478
1479         ifmgd->aid = aid;
1480
1481         sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
1482         if (!sta) {
1483                 printk(KERN_DEBUG "%s: failed to alloc STA entry for"
1484                        " the AP\n", sdata->name);
1485                 return false;
1486         }
1487
1488         set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
1489                            WLAN_STA_ASSOC_AP);
1490         if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
1491                 set_sta_flags(sta, WLAN_STA_AUTHORIZED);
1492
1493         rates = 0;
1494         basic_rates = 0;
1495         sband = local->hw.wiphy->bands[wk->chan->band];
1496
1497         for (i = 0; i < elems.supp_rates_len; i++) {
1498                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1499                 bool is_basic = !!(elems.supp_rates[i] & 0x80);
1500
1501                 if (rate > 110)
1502                         have_higher_than_11mbit = true;
1503
1504                 for (j = 0; j < sband->n_bitrates; j++) {
1505                         if (sband->bitrates[j].bitrate == rate) {
1506                                 rates |= BIT(j);
1507                                 if (is_basic)
1508                                         basic_rates |= BIT(j);
1509                                 break;
1510                         }
1511                 }
1512         }
1513
1514         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1515                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1516                 bool is_basic = !!(elems.ext_supp_rates[i] & 0x80);
1517
1518                 if (rate > 110)
1519                         have_higher_than_11mbit = true;
1520
1521                 for (j = 0; j < sband->n_bitrates; j++) {
1522                         if (sband->bitrates[j].bitrate == rate) {
1523                                 rates |= BIT(j);
1524                                 if (is_basic)
1525                                         basic_rates |= BIT(j);
1526                                 break;
1527                         }
1528                 }
1529         }
1530
1531         sta->sta.supp_rates[wk->chan->band] = rates;
1532         sdata->vif.bss_conf.basic_rates = basic_rates;
1533
1534         /* cf. IEEE 802.11 9.2.12 */
1535         if (wk->chan->band == IEEE80211_BAND_2GHZ &&
1536             have_higher_than_11mbit)
1537                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
1538         else
1539                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
1540
1541         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
1542                 ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
1543                                 elems.ht_cap_elem, &sta->sta.ht_cap);
1544
1545         ap_ht_cap_flags = sta->sta.ht_cap.cap;
1546
1547         rate_control_rate_init(sta);
1548
1549         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
1550                 set_sta_flags(sta, WLAN_STA_MFP);
1551
1552         if (elems.wmm_param)
1553                 set_sta_flags(sta, WLAN_STA_WME);
1554
1555         err = sta_info_insert(sta);
1556         sta = NULL;
1557         if (err) {
1558                 printk(KERN_DEBUG "%s: failed to insert STA entry for"
1559                        " the AP (error %d)\n", sdata->name, err);
1560                 return false;
1561         }
1562
1563         /*
1564          * Always handle WMM once after association regardless
1565          * of the first value the AP uses. Setting -1 here has
1566          * that effect because the AP values is an unsigned
1567          * 4-bit value.
1568          */
1569         ifmgd->wmm_last_param_set = -1;
1570
1571         if (elems.wmm_param)
1572                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
1573                                          elems.wmm_param_len);
1574         else
1575                 ieee80211_set_wmm_default(sdata);
1576
1577         local->oper_channel = wk->chan;
1578
1579         if (elems.ht_info_elem && elems.wmm_param &&
1580             (sdata->local->hw.queues >= 4) &&
1581             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
1582                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
1583                                                cbss->bssid, ap_ht_cap_flags);
1584
1585         /* set AID and assoc capability,
1586          * ieee80211_set_associated() will tell the driver */
1587         bss_conf->aid = aid;
1588         bss_conf->assoc_capability = capab_info;
1589         ieee80211_set_associated(sdata, cbss, changed);
1590
1591         /*
1592          * If we're using 4-addr mode, let the AP know that we're
1593          * doing so, so that it can create the STA VLAN on its side
1594          */
1595         if (ifmgd->use_4addr)
1596                 ieee80211_send_4addr_nullfunc(local, sdata);
1597
1598         /*
1599          * Start timer to probe the connection to the AP now.
1600          * Also start the timer that will detect beacon loss.
1601          */
1602         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
1603         ieee80211_sta_reset_beacon_monitor(sdata);
1604
1605         return true;
1606 }
1607
1608
1609 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
1610                                   struct ieee80211_mgmt *mgmt,
1611                                   size_t len,
1612                                   struct ieee80211_rx_status *rx_status,
1613                                   struct ieee802_11_elems *elems,
1614                                   bool beacon)
1615 {
1616         struct ieee80211_local *local = sdata->local;
1617         int freq;
1618         struct ieee80211_bss *bss;
1619         struct ieee80211_channel *channel;
1620         bool need_ps = false;
1621
1622         if (sdata->u.mgd.associated) {
1623                 bss = (void *)sdata->u.mgd.associated->priv;
1624                 /* not previously set so we may need to recalc */
1625                 need_ps = !bss->dtim_period;
1626         }
1627
1628         if (elems->ds_params && elems->ds_params_len == 1)
1629                 freq = ieee80211_channel_to_frequency(elems->ds_params[0],
1630                                                       rx_status->band);
1631         else
1632                 freq = rx_status->freq;
1633
1634         channel = ieee80211_get_channel(local->hw.wiphy, freq);
1635
1636         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
1637                 return;
1638
1639         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
1640                                         channel, beacon);
1641         if (bss)
1642                 ieee80211_rx_bss_put(local, bss);
1643
1644         if (!sdata->u.mgd.associated)
1645                 return;
1646
1647         if (need_ps) {
1648                 mutex_lock(&local->iflist_mtx);
1649                 ieee80211_recalc_ps(local, -1);
1650                 mutex_unlock(&local->iflist_mtx);
1651         }
1652
1653         if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
1654             (memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid,
1655                                                         ETH_ALEN) == 0)) {
1656                 struct ieee80211_channel_sw_ie *sw_elem =
1657                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
1658                 ieee80211_sta_process_chanswitch(sdata, sw_elem,
1659                                                  bss, rx_status->mactime);
1660         }
1661 }
1662
1663
1664 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
1665                                          struct sk_buff *skb)
1666 {
1667         struct ieee80211_mgmt *mgmt = (void *)skb->data;
1668         struct ieee80211_if_managed *ifmgd;
1669         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
1670         size_t baselen, len = skb->len;
1671         struct ieee802_11_elems elems;
1672
1673         ifmgd = &sdata->u.mgd;
1674
1675         ASSERT_MGD_MTX(ifmgd);
1676
1677         if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
1678                 return; /* ignore ProbeResp to foreign address */
1679
1680         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
1681         if (baselen > len)
1682                 return;
1683
1684         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
1685                                 &elems);
1686
1687         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
1688
1689         if (ifmgd->associated &&
1690             memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0)
1691                 ieee80211_reset_ap_probe(sdata);
1692 }
1693
1694 /*
1695  * This is the canonical list of information elements we care about,
1696  * the filter code also gives us all changes to the Microsoft OUI
1697  * (00:50:F2) vendor IE which is used for WMM which we need to track.
1698  *
1699  * We implement beacon filtering in software since that means we can
1700  * avoid processing the frame here and in cfg80211, and userspace
1701  * will not be able to tell whether the hardware supports it or not.
1702  *
1703  * XXX: This list needs to be dynamic -- userspace needs to be able to
1704  *      add items it requires. It also needs to be able to tell us to
1705  *      look out for other vendor IEs.
1706  */
1707 static const u64 care_about_ies =
1708         (1ULL << WLAN_EID_COUNTRY) |
1709         (1ULL << WLAN_EID_ERP_INFO) |
1710         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
1711         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
1712         (1ULL << WLAN_EID_HT_CAPABILITY) |
1713         (1ULL << WLAN_EID_HT_INFORMATION);
1714
1715 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
1716                                      struct ieee80211_mgmt *mgmt,
1717                                      size_t len,
1718                                      struct ieee80211_rx_status *rx_status)
1719 {
1720         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1721         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1722         size_t baselen;
1723         struct ieee802_11_elems elems;
1724         struct ieee80211_local *local = sdata->local;
1725         u32 changed = 0;
1726         bool erp_valid, directed_tim = false;
1727         u8 erp_value = 0;
1728         u32 ncrc;
1729         u8 *bssid;
1730
1731         ASSERT_MGD_MTX(ifmgd);
1732
1733         /* Process beacon from the current BSS */
1734         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1735         if (baselen > len)
1736                 return;
1737
1738         if (rx_status->freq != local->hw.conf.channel->center_freq)
1739                 return;
1740
1741         /*
1742          * We might have received a number of frames, among them a
1743          * disassoc frame and a beacon...
1744          */
1745         if (!ifmgd->associated)
1746                 return;
1747
1748         bssid = ifmgd->associated->bssid;
1749
1750         /*
1751          * And in theory even frames from a different AP we were just
1752          * associated to a split-second ago!
1753          */
1754         if (memcmp(bssid, mgmt->bssid, ETH_ALEN) != 0)
1755                 return;
1756
1757         /* Track average RSSI from the Beacon frames of the current AP */
1758         ifmgd->last_beacon_signal = rx_status->signal;
1759         if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
1760                 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
1761                 ifmgd->ave_beacon_signal = rx_status->signal * 16;
1762                 ifmgd->last_cqm_event_signal = 0;
1763                 ifmgd->count_beacon_signal = 1;
1764         } else {
1765                 ifmgd->ave_beacon_signal =
1766                         (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
1767                          (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
1768                          ifmgd->ave_beacon_signal) / 16;
1769                 ifmgd->count_beacon_signal++;
1770         }
1771         if (bss_conf->cqm_rssi_thold &&
1772             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
1773             !(local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)) {
1774                 int sig = ifmgd->ave_beacon_signal / 16;
1775                 int last_event = ifmgd->last_cqm_event_signal;
1776                 int thold = bss_conf->cqm_rssi_thold;
1777                 int hyst = bss_conf->cqm_rssi_hyst;
1778                 if (sig < thold &&
1779                     (last_event == 0 || sig < last_event - hyst)) {
1780                         ifmgd->last_cqm_event_signal = sig;
1781                         ieee80211_cqm_rssi_notify(
1782                                 &sdata->vif,
1783                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
1784                                 GFP_KERNEL);
1785                 } else if (sig > thold &&
1786                            (last_event == 0 || sig > last_event + hyst)) {
1787                         ifmgd->last_cqm_event_signal = sig;
1788                         ieee80211_cqm_rssi_notify(
1789                                 &sdata->vif,
1790                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
1791                                 GFP_KERNEL);
1792                 }
1793         }
1794
1795         if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
1796 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1797                 if (net_ratelimit()) {
1798                         printk(KERN_DEBUG "%s: cancelling probereq poll due "
1799                                "to a received beacon\n", sdata->name);
1800                 }
1801 #endif
1802                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
1803                 mutex_lock(&local->iflist_mtx);
1804                 ieee80211_recalc_ps(local, -1);
1805                 mutex_unlock(&local->iflist_mtx);
1806         }
1807
1808         /*
1809          * Push the beacon loss detection into the future since
1810          * we are processing a beacon from the AP just now.
1811          */
1812         ieee80211_sta_reset_beacon_monitor(sdata);
1813
1814         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
1815         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
1816                                           len - baselen, &elems,
1817                                           care_about_ies, ncrc);
1818
1819         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1820                 directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
1821                                                    ifmgd->aid);
1822
1823         if (ncrc != ifmgd->beacon_crc || !ifmgd->beacon_crc_valid) {
1824                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
1825                                       true);
1826
1827                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
1828                                          elems.wmm_param_len);
1829         }
1830
1831         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
1832                 if (directed_tim) {
1833                         if (local->hw.conf.dynamic_ps_timeout > 0) {
1834                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1835                                 ieee80211_hw_config(local,
1836                                                     IEEE80211_CONF_CHANGE_PS);
1837                                 ieee80211_send_nullfunc(local, sdata, 0);
1838                         } else {
1839                                 local->pspolling = true;
1840
1841                                 /*
1842                                  * Here is assumed that the driver will be
1843                                  * able to send ps-poll frame and receive a
1844                                  * response even though power save mode is
1845                                  * enabled, but some drivers might require
1846                                  * to disable power save here. This needs
1847                                  * to be investigated.
1848                                  */
1849                                 ieee80211_send_pspoll(local, sdata);
1850                         }
1851                 }
1852         }
1853
1854         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
1855                 return;
1856         ifmgd->beacon_crc = ncrc;
1857         ifmgd->beacon_crc_valid = true;
1858
1859         if (elems.erp_info && elems.erp_info_len >= 1) {
1860                 erp_valid = true;
1861                 erp_value = elems.erp_info[0];
1862         } else {
1863                 erp_valid = false;
1864         }
1865         changed |= ieee80211_handle_bss_capability(sdata,
1866                         le16_to_cpu(mgmt->u.beacon.capab_info),
1867                         erp_valid, erp_value);
1868
1869
1870         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
1871             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
1872                 struct sta_info *sta;
1873                 struct ieee80211_supported_band *sband;
1874                 u16 ap_ht_cap_flags;
1875
1876                 rcu_read_lock();
1877
1878                 sta = sta_info_get(sdata, bssid);
1879                 if (WARN_ON(!sta)) {
1880                         rcu_read_unlock();
1881                         return;
1882                 }
1883
1884                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1885
1886                 ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
1887                                 elems.ht_cap_elem, &sta->sta.ht_cap);
1888
1889                 ap_ht_cap_flags = sta->sta.ht_cap.cap;
1890
1891                 rcu_read_unlock();
1892
1893                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
1894                                                bssid, ap_ht_cap_flags);
1895         }
1896
1897         /* Note: country IE parsing is done for us by cfg80211 */
1898         if (elems.country_elem) {
1899                 /* TODO: IBSS also needs this */
1900                 if (elems.pwr_constr_elem)
1901                         ieee80211_handle_pwr_constr(sdata,
1902                                 le16_to_cpu(mgmt->u.probe_resp.capab_info),
1903                                 elems.pwr_constr_elem,
1904                                 elems.pwr_constr_elem_len);
1905         }
1906
1907         ieee80211_bss_info_change_notify(sdata, changed);
1908 }
1909
1910 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1911                                   struct sk_buff *skb)
1912 {
1913         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1914         struct ieee80211_rx_status *rx_status;
1915         struct ieee80211_mgmt *mgmt;
1916         enum rx_mgmt_action rma = RX_MGMT_NONE;
1917         u16 fc;
1918
1919         rx_status = (struct ieee80211_rx_status *) skb->cb;
1920         mgmt = (struct ieee80211_mgmt *) skb->data;
1921         fc = le16_to_cpu(mgmt->frame_control);
1922
1923         mutex_lock(&ifmgd->mtx);
1924
1925         if (ifmgd->associated &&
1926             memcmp(ifmgd->associated->bssid, mgmt->bssid, ETH_ALEN) == 0) {
1927                 switch (fc & IEEE80211_FCTL_STYPE) {
1928                 case IEEE80211_STYPE_BEACON:
1929                         ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
1930                                                  rx_status);
1931                         break;
1932                 case IEEE80211_STYPE_PROBE_RESP:
1933                         ieee80211_rx_mgmt_probe_resp(sdata, skb);
1934                         break;
1935                 case IEEE80211_STYPE_DEAUTH:
1936                         rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
1937                         break;
1938                 case IEEE80211_STYPE_DISASSOC:
1939                         rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
1940                         break;
1941                 case IEEE80211_STYPE_ACTION:
1942                         switch (mgmt->u.action.category) {
1943                         case WLAN_CATEGORY_SPECTRUM_MGMT:
1944                                 ieee80211_sta_process_chanswitch(sdata,
1945                                                 &mgmt->u.action.u.chan_switch.sw_elem,
1946                                                 (void *)ifmgd->associated->priv,
1947                                                 rx_status->mactime);
1948                                 break;
1949                         }
1950                 }
1951                 mutex_unlock(&ifmgd->mtx);
1952
1953                 switch (rma) {
1954                 case RX_MGMT_NONE:
1955                         /* no action */
1956                         break;
1957                 case RX_MGMT_CFG80211_DEAUTH:
1958                         cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
1959                         break;
1960                 case RX_MGMT_CFG80211_DISASSOC:
1961                         cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
1962                         break;
1963                 default:
1964                         WARN(1, "unexpected: %d", rma);
1965                 }
1966                 return;
1967         }
1968
1969         mutex_unlock(&ifmgd->mtx);
1970
1971         if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
1972             (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) {
1973                 struct ieee80211_local *local = sdata->local;
1974                 struct ieee80211_work *wk;
1975
1976                 mutex_lock(&local->mtx);
1977                 list_for_each_entry(wk, &local->work_list, list) {
1978                         if (wk->sdata != sdata)
1979                                 continue;
1980
1981                         if (wk->type != IEEE80211_WORK_ASSOC &&
1982                             wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
1983                                 continue;
1984
1985                         if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))
1986                                 continue;
1987                         if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN))
1988                                 continue;
1989
1990                         /*
1991                          * Printing the message only here means we can't
1992                          * spuriously print it, but it also means that it
1993                          * won't be printed when the frame comes in before
1994                          * we even tried to associate or in similar cases.
1995                          *
1996                          * Ultimately, I suspect cfg80211 should print the
1997                          * messages instead.
1998                          */
1999                         printk(KERN_DEBUG
2000                                "%s: deauthenticated from %pM (Reason: %u)\n",
2001                                sdata->name, mgmt->bssid,
2002                                le16_to_cpu(mgmt->u.deauth.reason_code));
2003
2004                         list_del_rcu(&wk->list);
2005                         free_work(wk);
2006                         break;
2007                 }
2008                 mutex_unlock(&local->mtx);
2009
2010                 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
2011         }
2012 }
2013
2014 static void ieee80211_sta_timer(unsigned long data)
2015 {
2016         struct ieee80211_sub_if_data *sdata =
2017                 (struct ieee80211_sub_if_data *) data;
2018         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2019         struct ieee80211_local *local = sdata->local;
2020
2021         if (local->quiescing) {
2022                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
2023                 return;
2024         }
2025
2026         ieee80211_queue_work(&local->hw, &sdata->work);
2027 }
2028
2029 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
2030                                           u8 *bssid)
2031 {
2032         struct ieee80211_local *local = sdata->local;
2033         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2034
2035         ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
2036                           IEEE80211_STA_BEACON_POLL);
2037
2038         ieee80211_set_disassoc(sdata, true, true);
2039         mutex_unlock(&ifmgd->mtx);
2040         mutex_lock(&local->mtx);
2041         ieee80211_recalc_idle(local);
2042         mutex_unlock(&local->mtx);
2043         /*
2044          * must be outside lock due to cfg80211,
2045          * but that's not a problem.
2046          */
2047         ieee80211_send_deauth_disassoc(sdata, bssid,
2048                         IEEE80211_STYPE_DEAUTH,
2049                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2050                         NULL, true);
2051         mutex_lock(&ifmgd->mtx);
2052 }
2053
2054 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
2055 {
2056         struct ieee80211_local *local = sdata->local;
2057         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2058
2059         /* then process the rest of the work */
2060         mutex_lock(&ifmgd->mtx);
2061
2062         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
2063                             IEEE80211_STA_CONNECTION_POLL) &&
2064             ifmgd->associated) {
2065                 u8 bssid[ETH_ALEN];
2066                 int max_tries;
2067
2068                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
2069
2070                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2071                         max_tries = max_nullfunc_tries;
2072                 else
2073                         max_tries = max_probe_tries;
2074
2075                 /* ACK received for nullfunc probing frame */
2076                 if (!ifmgd->probe_send_count)
2077                         ieee80211_reset_ap_probe(sdata);
2078                 else if (ifmgd->nullfunc_failed) {
2079                         if (ifmgd->probe_send_count < max_tries) {
2080 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2081                                 wiphy_debug(local->hw.wiphy,
2082                                             "%s: No ack for nullfunc frame to"
2083                                             " AP %pM, try %d/%i\n",
2084                                             sdata->name, bssid,
2085                                             ifmgd->probe_send_count, max_tries);
2086 #endif
2087                                 ieee80211_mgd_probe_ap_send(sdata);
2088                         } else {
2089 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2090                                 wiphy_debug(local->hw.wiphy,
2091                                             "%s: No ack for nullfunc frame to"
2092                                             " AP %pM, disconnecting.\n",
2093                                             sdata->name, bssid);
2094 #endif
2095                                 ieee80211_sta_connection_lost(sdata, bssid);
2096                         }
2097                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
2098                         run_again(ifmgd, ifmgd->probe_timeout);
2099                 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
2100 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2101                         wiphy_debug(local->hw.wiphy,
2102                                     "%s: Failed to send nullfunc to AP %pM"
2103                                     " after %dms, disconnecting.\n",
2104                                     sdata->name,
2105                                     bssid, probe_wait_ms);
2106 #endif
2107                         ieee80211_sta_connection_lost(sdata, bssid);
2108                 } else if (ifmgd->probe_send_count < max_tries) {
2109 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2110                         wiphy_debug(local->hw.wiphy,
2111                                     "%s: No probe response from AP %pM"
2112                                     " after %dms, try %d/%i\n",
2113                                     sdata->name,
2114                                     bssid, probe_wait_ms,
2115                                     ifmgd->probe_send_count, max_tries);
2116 #endif
2117                         ieee80211_mgd_probe_ap_send(sdata);
2118                 } else {
2119                         /*
2120                          * We actually lost the connection ... or did we?
2121                          * Let's make sure!
2122                          */
2123                         wiphy_debug(local->hw.wiphy,
2124                                     "%s: No probe response from AP %pM"
2125                                     " after %dms, disconnecting.\n",
2126                                     sdata->name,
2127                                     bssid, probe_wait_ms);
2128
2129                         ieee80211_sta_connection_lost(sdata, bssid);
2130                 }
2131         }
2132
2133         mutex_unlock(&ifmgd->mtx);
2134 }
2135
2136 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
2137 {
2138         struct ieee80211_sub_if_data *sdata =
2139                 (struct ieee80211_sub_if_data *) data;
2140         struct ieee80211_local *local = sdata->local;
2141
2142         if (local->quiescing)
2143                 return;
2144
2145         ieee80211_queue_work(&sdata->local->hw,
2146                              &sdata->u.mgd.beacon_connection_loss_work);
2147 }
2148
2149 static void ieee80211_sta_conn_mon_timer(unsigned long data)
2150 {
2151         struct ieee80211_sub_if_data *sdata =
2152                 (struct ieee80211_sub_if_data *) data;
2153         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2154         struct ieee80211_local *local = sdata->local;
2155
2156         if (local->quiescing)
2157                 return;
2158
2159         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
2160 }
2161
2162 static void ieee80211_sta_monitor_work(struct work_struct *work)
2163 {
2164         struct ieee80211_sub_if_data *sdata =
2165                 container_of(work, struct ieee80211_sub_if_data,
2166                              u.mgd.monitor_work);
2167
2168         ieee80211_mgd_probe_ap(sdata, false);
2169 }
2170
2171 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
2172 {
2173         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2174                 sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL |
2175                                         IEEE80211_STA_CONNECTION_POLL);
2176
2177                 /* let's probe the connection once */
2178                 ieee80211_queue_work(&sdata->local->hw,
2179                            &sdata->u.mgd.monitor_work);
2180                 /* and do all the other regular work too */
2181                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2182         }
2183 }
2184
2185 #ifdef CONFIG_PM
2186 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
2187 {
2188         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2189
2190         /*
2191          * we need to use atomic bitops for the running bits
2192          * only because both timers might fire at the same
2193          * time -- the code here is properly synchronised.
2194          */
2195
2196         cancel_work_sync(&ifmgd->request_smps_work);
2197
2198         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
2199         if (del_timer_sync(&ifmgd->timer))
2200                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
2201
2202         cancel_work_sync(&ifmgd->chswitch_work);
2203         if (del_timer_sync(&ifmgd->chswitch_timer))
2204                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
2205
2206         cancel_work_sync(&ifmgd->monitor_work);
2207         /* these will just be re-established on connection */
2208         del_timer_sync(&ifmgd->conn_mon_timer);
2209         del_timer_sync(&ifmgd->bcn_mon_timer);
2210 }
2211
2212 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
2213 {
2214         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2215
2216         if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
2217                 add_timer(&ifmgd->timer);
2218         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
2219                 add_timer(&ifmgd->chswitch_timer);
2220         ieee80211_sta_reset_beacon_monitor(sdata);
2221         ieee80211_restart_sta_timer(sdata);
2222         ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.monitor_work);
2223 }
2224 #endif
2225
2226 /* interface setup */
2227 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
2228 {
2229         struct ieee80211_if_managed *ifmgd;
2230
2231         ifmgd = &sdata->u.mgd;
2232         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
2233         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
2234         INIT_WORK(&ifmgd->beacon_connection_loss_work,
2235                   ieee80211_beacon_connection_loss_work);
2236         INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work);
2237         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
2238                     (unsigned long) sdata);
2239         setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
2240                     (unsigned long) sdata);
2241         setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
2242                     (unsigned long) sdata);
2243         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
2244                     (unsigned long) sdata);
2245
2246         ifmgd->flags = 0;
2247
2248         mutex_init(&ifmgd->mtx);
2249
2250         if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
2251                 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
2252         else
2253                 ifmgd->req_smps = IEEE80211_SMPS_OFF;
2254 }
2255
2256 /* scan finished notification */
2257 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
2258 {
2259         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
2260
2261         /* Restart STA timers */
2262         rcu_read_lock();
2263         list_for_each_entry_rcu(sdata, &local->interfaces, list)
2264                 ieee80211_restart_sta_timer(sdata);
2265         rcu_read_unlock();
2266 }
2267
2268 int ieee80211_max_network_latency(struct notifier_block *nb,
2269                                   unsigned long data, void *dummy)
2270 {
2271         s32 latency_usec = (s32) data;
2272         struct ieee80211_local *local =
2273                 container_of(nb, struct ieee80211_local,
2274                              network_latency_notifier);
2275
2276         mutex_lock(&local->iflist_mtx);
2277         ieee80211_recalc_ps(local, latency_usec);
2278         mutex_unlock(&local->iflist_mtx);
2279
2280         return 0;
2281 }
2282
2283 /* config hooks */
2284 static enum work_done_result
2285 ieee80211_probe_auth_done(struct ieee80211_work *wk,
2286                           struct sk_buff *skb)
2287 {
2288         if (!skb) {
2289                 cfg80211_send_auth_timeout(wk->sdata->dev, wk->filter_ta);
2290                 return WORK_DONE_DESTROY;
2291         }
2292
2293         if (wk->type == IEEE80211_WORK_AUTH) {
2294                 cfg80211_send_rx_auth(wk->sdata->dev, skb->data, skb->len);
2295                 return WORK_DONE_DESTROY;
2296         }
2297
2298         mutex_lock(&wk->sdata->u.mgd.mtx);
2299         ieee80211_rx_mgmt_probe_resp(wk->sdata, skb);
2300         mutex_unlock(&wk->sdata->u.mgd.mtx);
2301
2302         wk->type = IEEE80211_WORK_AUTH;
2303         wk->probe_auth.tries = 0;
2304         return WORK_DONE_REQUEUE;
2305 }
2306
2307 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
2308                        struct cfg80211_auth_request *req)
2309 {
2310         const u8 *ssid;
2311         struct ieee80211_work *wk;
2312         u16 auth_alg;
2313
2314         if (req->local_state_change)
2315                 return 0; /* no need to update mac80211 state */
2316
2317         switch (req->auth_type) {
2318         case NL80211_AUTHTYPE_OPEN_SYSTEM:
2319                 auth_alg = WLAN_AUTH_OPEN;
2320                 break;
2321         case NL80211_AUTHTYPE_SHARED_KEY:
2322                 if (IS_ERR(sdata->local->wep_tx_tfm))
2323                         return -EOPNOTSUPP;
2324                 auth_alg = WLAN_AUTH_SHARED_KEY;
2325                 break;
2326         case NL80211_AUTHTYPE_FT:
2327                 auth_alg = WLAN_AUTH_FT;
2328                 break;
2329         case NL80211_AUTHTYPE_NETWORK_EAP:
2330                 auth_alg = WLAN_AUTH_LEAP;
2331                 break;
2332         default:
2333                 return -EOPNOTSUPP;
2334         }
2335
2336         wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
2337         if (!wk)
2338                 return -ENOMEM;
2339
2340         memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
2341
2342         if (req->ie && req->ie_len) {
2343                 memcpy(wk->ie, req->ie, req->ie_len);
2344                 wk->ie_len = req->ie_len;
2345         }
2346
2347         if (req->key && req->key_len) {
2348                 wk->probe_auth.key_len = req->key_len;
2349                 wk->probe_auth.key_idx = req->key_idx;
2350                 memcpy(wk->probe_auth.key, req->key, req->key_len);
2351         }
2352
2353         ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
2354         memcpy(wk->probe_auth.ssid, ssid + 2, ssid[1]);
2355         wk->probe_auth.ssid_len = ssid[1];
2356
2357         wk->probe_auth.algorithm = auth_alg;
2358         wk->probe_auth.privacy = req->bss->capability & WLAN_CAPABILITY_PRIVACY;
2359
2360         /* if we already have a probe, don't probe again */
2361         if (req->bss->proberesp_ies)
2362                 wk->type = IEEE80211_WORK_AUTH;
2363         else
2364                 wk->type = IEEE80211_WORK_DIRECT_PROBE;
2365         wk->chan = req->bss->channel;
2366         wk->chan_type = NL80211_CHAN_NO_HT;
2367         wk->sdata = sdata;
2368         wk->done = ieee80211_probe_auth_done;
2369
2370         ieee80211_add_work(wk);
2371         return 0;
2372 }
2373
2374 static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
2375                                                   struct sk_buff *skb)
2376 {
2377         struct ieee80211_mgmt *mgmt;
2378         struct ieee80211_rx_status *rx_status;
2379         struct ieee802_11_elems elems;
2380         u16 status;
2381
2382         if (!skb) {
2383                 cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
2384                 return WORK_DONE_DESTROY;
2385         }
2386
2387         if (wk->type == IEEE80211_WORK_ASSOC_BEACON_WAIT) {
2388                 mutex_lock(&wk->sdata->u.mgd.mtx);
2389                 rx_status = (void *) skb->cb;
2390                 ieee802_11_parse_elems(skb->data + 24 + 12, skb->len - 24 - 12, &elems);
2391                 ieee80211_rx_bss_info(wk->sdata, (void *)skb->data, skb->len, rx_status,
2392                                       &elems, true);
2393                 mutex_unlock(&wk->sdata->u.mgd.mtx);
2394
2395                 wk->type = IEEE80211_WORK_ASSOC;
2396                 /* not really done yet */
2397                 return WORK_DONE_REQUEUE;
2398         }
2399
2400         mgmt = (void *)skb->data;
2401         status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2402
2403         if (status == WLAN_STATUS_SUCCESS) {
2404                 mutex_lock(&wk->sdata->u.mgd.mtx);
2405                 if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
2406                         mutex_unlock(&wk->sdata->u.mgd.mtx);
2407                         /* oops -- internal error -- send timeout for now */
2408                         cfg80211_send_assoc_timeout(wk->sdata->dev,
2409                                                     wk->filter_ta);
2410                         return WORK_DONE_DESTROY;
2411                 }
2412
2413                 mutex_unlock(&wk->sdata->u.mgd.mtx);
2414         }
2415
2416         cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
2417         return WORK_DONE_DESTROY;
2418 }
2419
2420 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
2421                         struct cfg80211_assoc_request *req)
2422 {
2423         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2424         struct ieee80211_bss *bss = (void *)req->bss->priv;
2425         struct ieee80211_work *wk;
2426         const u8 *ssid;
2427         int i;
2428
2429         mutex_lock(&ifmgd->mtx);
2430         if (ifmgd->associated) {
2431                 if (!req->prev_bssid ||
2432                     memcmp(req->prev_bssid, ifmgd->associated->bssid,
2433                            ETH_ALEN)) {
2434                         /*
2435                          * We are already associated and the request was not a
2436                          * reassociation request from the current BSS, so
2437                          * reject it.
2438                          */
2439                         mutex_unlock(&ifmgd->mtx);
2440                         return -EALREADY;
2441                 }
2442
2443                 /* Trying to reassociate - clear previous association state */
2444                 ieee80211_set_disassoc(sdata, true, false);
2445         }
2446         mutex_unlock(&ifmgd->mtx);
2447
2448         wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
2449         if (!wk)
2450                 return -ENOMEM;
2451
2452         ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
2453         ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
2454
2455         ifmgd->beacon_crc_valid = false;
2456
2457         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
2458                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
2459                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
2460                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
2461                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
2462
2463
2464         if (req->ie && req->ie_len) {
2465                 memcpy(wk->ie, req->ie, req->ie_len);
2466                 wk->ie_len = req->ie_len;
2467         } else
2468                 wk->ie_len = 0;
2469
2470         wk->assoc.bss = req->bss;
2471
2472         memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
2473
2474         /* new association always uses requested smps mode */
2475         if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
2476                 if (ifmgd->powersave)
2477                         ifmgd->ap_smps = IEEE80211_SMPS_DYNAMIC;
2478                 else
2479                         ifmgd->ap_smps = IEEE80211_SMPS_OFF;
2480         } else
2481                 ifmgd->ap_smps = ifmgd->req_smps;
2482
2483         wk->assoc.smps = ifmgd->ap_smps;
2484         /*
2485          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
2486          * We still associate in non-HT mode (11a/b/g) if any one of these
2487          * ciphers is configured as pairwise.
2488          * We can set this to true for non-11n hardware, that'll be checked
2489          * separately along with the peer capabilities.
2490          */
2491         wk->assoc.use_11n = !(ifmgd->flags & IEEE80211_STA_DISABLE_11N);
2492         wk->assoc.capability = req->bss->capability;
2493         wk->assoc.wmm_used = bss->wmm_used;
2494         wk->assoc.supp_rates = bss->supp_rates;
2495         wk->assoc.supp_rates_len = bss->supp_rates_len;
2496         wk->assoc.ht_information_ie =
2497                 ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_INFORMATION);
2498
2499         if (bss->wmm_used && bss->uapsd_supported &&
2500             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
2501                 wk->assoc.uapsd_used = true;
2502                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
2503         } else {
2504                 wk->assoc.uapsd_used = false;
2505                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
2506         }
2507
2508         ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
2509         memcpy(wk->assoc.ssid, ssid + 2, ssid[1]);
2510         wk->assoc.ssid_len = ssid[1];
2511
2512         if (req->prev_bssid)
2513                 memcpy(wk->assoc.prev_bssid, req->prev_bssid, ETH_ALEN);
2514
2515         wk->chan = req->bss->channel;
2516         wk->chan_type = NL80211_CHAN_NO_HT;
2517         wk->sdata = sdata;
2518         wk->done = ieee80211_assoc_done;
2519         if (!bss->dtim_period &&
2520             sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
2521                 wk->type = IEEE80211_WORK_ASSOC_BEACON_WAIT;
2522         else
2523                 wk->type = IEEE80211_WORK_ASSOC;
2524
2525         if (req->use_mfp) {
2526                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
2527                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
2528         } else {
2529                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
2530                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
2531         }
2532
2533         if (req->crypto.control_port)
2534                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
2535         else
2536                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
2537
2538         sdata->control_port_protocol = req->crypto.control_port_ethertype;
2539         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
2540
2541         ieee80211_add_work(wk);
2542         return 0;
2543 }
2544
2545 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
2546                          struct cfg80211_deauth_request *req,
2547                          void *cookie)
2548 {
2549         struct ieee80211_local *local = sdata->local;
2550         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2551         struct ieee80211_work *wk;
2552         u8 bssid[ETH_ALEN];
2553         bool assoc_bss = false;
2554
2555         mutex_lock(&ifmgd->mtx);
2556
2557         memcpy(bssid, req->bss->bssid, ETH_ALEN);
2558         if (ifmgd->associated == req->bss) {
2559                 ieee80211_set_disassoc(sdata, false, true);
2560                 mutex_unlock(&ifmgd->mtx);
2561                 assoc_bss = true;
2562         } else {
2563                 bool not_auth_yet = false;
2564
2565                 mutex_unlock(&ifmgd->mtx);
2566
2567                 mutex_lock(&local->mtx);
2568                 list_for_each_entry(wk, &local->work_list, list) {
2569                         if (wk->sdata != sdata)
2570                                 continue;
2571
2572                         if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
2573                             wk->type != IEEE80211_WORK_AUTH &&
2574                             wk->type != IEEE80211_WORK_ASSOC &&
2575                             wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
2576                                 continue;
2577
2578                         if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
2579                                 continue;
2580
2581                         not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
2582                         list_del_rcu(&wk->list);
2583                         free_work(wk);
2584                         break;
2585                 }
2586                 mutex_unlock(&local->mtx);
2587
2588                 /*
2589                  * If somebody requests authentication and we haven't
2590                  * sent out an auth frame yet there's no need to send
2591                  * out a deauth frame either. If the state was PROBE,
2592                  * then this is the case. If it's AUTH we have sent a
2593                  * frame, and if it's IDLE we have completed the auth
2594                  * process already.
2595                  */
2596                 if (not_auth_yet) {
2597                         __cfg80211_auth_canceled(sdata->dev, bssid);
2598                         return 0;
2599                 }
2600         }
2601
2602         printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
2603                sdata->name, bssid, req->reason_code);
2604
2605         ieee80211_send_deauth_disassoc(sdata, bssid, IEEE80211_STYPE_DEAUTH,
2606                                        req->reason_code, cookie,
2607                                        !req->local_state_change);
2608         if (assoc_bss)
2609                 sta_info_destroy_addr(sdata, bssid);
2610
2611         mutex_lock(&sdata->local->mtx);
2612         ieee80211_recalc_idle(sdata->local);
2613         mutex_unlock(&sdata->local->mtx);
2614
2615         return 0;
2616 }
2617
2618 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
2619                            struct cfg80211_disassoc_request *req,
2620                            void *cookie)
2621 {
2622         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2623         u8 bssid[ETH_ALEN];
2624
2625         mutex_lock(&ifmgd->mtx);
2626
2627         /*
2628          * cfg80211 should catch this ... but it's racy since
2629          * we can receive a disassoc frame, process it, hand it
2630          * to cfg80211 while that's in a locked section already
2631          * trying to tell us that the user wants to disconnect.
2632          */
2633         if (ifmgd->associated != req->bss) {
2634                 mutex_unlock(&ifmgd->mtx);
2635                 return -ENOLINK;
2636         }
2637
2638         printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
2639                sdata->name, req->bss->bssid, req->reason_code);
2640
2641         memcpy(bssid, req->bss->bssid, ETH_ALEN);
2642         ieee80211_set_disassoc(sdata, false, true);
2643
2644         mutex_unlock(&ifmgd->mtx);
2645
2646         ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
2647                         IEEE80211_STYPE_DISASSOC, req->reason_code,
2648                         cookie, !req->local_state_change);
2649         sta_info_destroy_addr(sdata, bssid);
2650
2651         mutex_lock(&sdata->local->mtx);
2652         ieee80211_recalc_idle(sdata->local);
2653         mutex_unlock(&sdata->local->mtx);
2654
2655         return 0;
2656 }
2657
2658 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
2659                                enum nl80211_cqm_rssi_threshold_event rssi_event,
2660                                gfp_t gfp)
2661 {
2662         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2663
2664         trace_api_cqm_rssi_notify(sdata, rssi_event);
2665
2666         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
2667 }
2668 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
2669
2670 unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif)
2671 {
2672         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2673         return sdata->dev->operstate;
2674 }
2675 EXPORT_SYMBOL(ieee80211_get_operstate);