]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blame - drivers/net/wireless/hostap/hostap_ap.c
projects / mirror_ubuntu-zesty-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[NET]: Introduce and use print_mac() and DECLARE_MAC_BUF()
[mirror_ubuntu-zesty-kernel.git] / drivers / net / wireless / hostap / hostap_ap.c
CommitLineData
ff1d2767
JM		 1/*
2 * Intersil Prism2 driver with Host AP (software access point) support
3 * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
85d32e7b
JM		 4 * <j@w1.fi>
5 * Copyright (c) 2002-2005, Jouni Malinen <j@w1.fi>
ff1d2767
JM		 6 *
7 * This file is to be included into hostap.c when S/W AP functionality is
8 * compiled.
9 *
10 * AP: FIX:
11 * - if unicast Class 2 (assoc,reassoc,disassoc) frame received from
12 * unauthenticated STA, send deauth. frame (8802.11: 5.5)
13 * - if unicast Class 3 (data with to/from DS,deauth,pspoll) frame received
14 * from authenticated, but unassoc STA, send disassoc frame (8802.11: 5.5)
15 * - if unicast Class 3 received from unauthenticated STA, send deauth. frame
16 * (8802.11: 5.5)
17 */
18
5fad5a2e
AB		 19#include <linux/proc_fs.h>
20#include <linux/delay.h>
21#include <linux/random.h>
22
23#include "hostap_wlan.h"
24#include "hostap.h"
25#include "hostap_ap.h"
26
ff1d2767
JM		 27static int other_ap_policy[MAX_PARM_DEVICES] = { AP_OTHER_AP_SKIP_ALL,
28 DEF_INTS };
29module_param_array(other_ap_policy, int, NULL, 0444);
30MODULE_PARM_DESC(other_ap_policy, "Other AP beacon monitoring policy (0-3)");
31
32static int ap_max_inactivity[MAX_PARM_DEVICES] = { AP_MAX_INACTIVITY_SEC,
33 DEF_INTS };
34module_param_array(ap_max_inactivity, int, NULL, 0444);
35MODULE_PARM_DESC(ap_max_inactivity, "AP timeout (in seconds) for station "
36 "inactivity");
37
38static int ap_bridge_packets[MAX_PARM_DEVICES] = { 1, DEF_INTS };
39module_param_array(ap_bridge_packets, int, NULL, 0444);
40MODULE_PARM_DESC(ap_bridge_packets, "Bridge packets directly between "
41 "stations");
42
43static int autom_ap_wds[MAX_PARM_DEVICES] = { 0, DEF_INTS };
44module_param_array(autom_ap_wds, int, NULL, 0444);
45MODULE_PARM_DESC(autom_ap_wds, "Add WDS connections to other APs "
46 "automatically");
47
48
49static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta);
50static void hostap_event_expired_sta(struct net_device *dev,
51 struct sta_info *sta);
c4028958 52static void handle_add_proc_queue(struct work_struct *work);
ff1d2767
JM		 53
54#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
c4028958 55static void handle_wds_oper_queue(struct work_struct *work);
ff1d2767 56static void prism2_send_mgmt(struct net_device *dev,
4339d328 57 u16 type_subtype, char *body,
ff1d2767
JM		 58 int body_len, u8 *addr, u16 tx_cb_idx);
59#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
60
61
62#ifndef PRISM2_NO_PROCFS_DEBUG
63static int ap_debug_proc_read(char *page, char **start, off_t off,
64 int count, int *eof, void *data)
65{
66 char *p = page;
67 struct ap_data *ap = (struct ap_data *) data;
68
69 if (off != 0) {
70 *eof = 1;
71 return 0;
72 }
73
74 p += sprintf(p, "BridgedUnicastFrames=%u\n", ap->bridged_unicast);
75 p += sprintf(p, "BridgedMulticastFrames=%u\n", ap->bridged_multicast);
76 p += sprintf(p, "max_inactivity=%u\n", ap->max_inactivity / HZ);
77 p += sprintf(p, "bridge_packets=%u\n", ap->bridge_packets);
78 p += sprintf(p, "nullfunc_ack=%u\n", ap->nullfunc_ack);
79 p += sprintf(p, "autom_ap_wds=%u\n", ap->autom_ap_wds);
80 p += sprintf(p, "auth_algs=%u\n", ap->local->auth_algs);
81 p += sprintf(p, "tx_drop_nonassoc=%u\n", ap->tx_drop_nonassoc);
82
83 return (p - page);
84}
85#endif /* PRISM2_NO_PROCFS_DEBUG */
86
87
88static void ap_sta_hash_add(struct ap_data *ap, struct sta_info *sta)
89{
90 sta->hnext = ap->sta_hash[STA_HASH(sta->addr)];
91 ap->sta_hash[STA_HASH(sta->addr)] = sta;
92}
93
94static void ap_sta_hash_del(struct ap_data *ap, struct sta_info *sta)
95{
96 struct sta_info *s;
0795af57 97 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 98
99 s = ap->sta_hash[STA_HASH(sta->addr)];
100 if (s == NULL) return;
101 if (memcmp(s->addr, sta->addr, ETH_ALEN) == 0) {
102 ap->sta_hash[STA_HASH(sta->addr)] = s->hnext;
103 return;
104 }
105
106 while (s->hnext != NULL && memcmp(s->hnext->addr, sta->addr, ETH_ALEN)
107 != 0)
108 s = s->hnext;
109 if (s->hnext != NULL)
110 s->hnext = s->hnext->hnext;
111 else
0795af57
JP		 112 printk("AP: could not remove STA %s"
113 " from hash table\n",
114 print_mac(mac, sta->addr));
ff1d2767
JM		 115}
116
117static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
118{
0795af57 119 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 120 if (sta->ap && sta->local)
121 hostap_event_expired_sta(sta->local->dev, sta);
122
123 if (ap->proc != NULL) {
124 char name[20];
0795af57 125 sprintf(name, "%s", print_mac(mac, sta->addr));
ff1d2767
JM		 126 remove_proc_entry(name, ap->proc);
127 }
128
129 if (sta->crypt) {
130 sta->crypt->ops->deinit(sta->crypt->priv);
131 kfree(sta->crypt);
132 sta->crypt = NULL;
133 }
134
135 skb_queue_purge(&sta->tx_buf);
136
137 ap->num_sta--;
138#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
139 if (sta->aid > 0)
140 ap->sta_aid[sta->aid - 1] = NULL;
141
142 if (!sta->ap && sta->u.sta.challenge)
143 kfree(sta->u.sta.challenge);
144 del_timer(&sta->timer);
145#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
146
147 kfree(sta);
148}
149
150
151static void hostap_set_tim(local_info_t *local, int aid, int set)
152{
153 if (local->func->set_tim)
154 local->func->set_tim(local->dev, aid, set);
155}
156
157
158static void hostap_event_new_sta(struct net_device *dev, struct sta_info *sta)
159{
160 union iwreq_data wrqu;
161 memset(&wrqu, 0, sizeof(wrqu));
162 memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN);
163 wrqu.addr.sa_family = ARPHRD_ETHER;
164 wireless_send_event(dev, IWEVREGISTERED, &wrqu, NULL);
165}
166
167
168static void hostap_event_expired_sta(struct net_device *dev,
169 struct sta_info *sta)
170{
171 union iwreq_data wrqu;
172 memset(&wrqu, 0, sizeof(wrqu));
173 memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN);
174 wrqu.addr.sa_family = ARPHRD_ETHER;
175 wireless_send_event(dev, IWEVEXPIRED, &wrqu, NULL);
176}
177
178
179#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
180
181static void ap_handle_timer(unsigned long data)
182{
183 struct sta_info *sta = (struct sta_info *) data;
184 local_info_t *local;
185 struct ap_data *ap;
186 unsigned long next_time = 0;
187 int was_assoc;
0795af57 188 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 189
190 if (sta == NULL || sta->local == NULL || sta->local->ap == NULL) {
191 PDEBUG(DEBUG_AP, "ap_handle_timer() called with NULL data\n");
192 return;
193 }
194
195 local = sta->local;
196 ap = local->ap;
197 was_assoc = sta->flags & WLAN_STA_ASSOC;
198
199 if (atomic_read(&sta->users) != 0)
200 next_time = jiffies + HZ;
201 else if ((sta->flags & WLAN_STA_PERM) && !(sta->flags & WLAN_STA_AUTH))
202 next_time = jiffies + ap->max_inactivity;
203
204 if (time_before(jiffies, sta->last_rx + ap->max_inactivity)) {
205 /* station activity detected; reset timeout state */
206 sta->timeout_next = STA_NULLFUNC;
207 next_time = sta->last_rx + ap->max_inactivity;
208 } else if (sta->timeout_next == STA_DISASSOC &&
209 !(sta->flags & WLAN_STA_PENDING_POLL)) {
210 /* STA ACKed data nullfunc frame poll */
211 sta->timeout_next = STA_NULLFUNC;
212 next_time = jiffies + ap->max_inactivity;
213 }
214
215 if (next_time) {
216 sta->timer.expires = next_time;
217 add_timer(&sta->timer);
218 return;
219 }
220
221 if (sta->ap)
222 sta->timeout_next = STA_DEAUTH;
223
224 if (sta->timeout_next == STA_DEAUTH && !(sta->flags & WLAN_STA_PERM)) {
225 spin_lock(&ap->sta_table_lock);
226 ap_sta_hash_del(ap, sta);
227 list_del(&sta->list);
228 spin_unlock(&ap->sta_table_lock);
229 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
230 } else if (sta->timeout_next == STA_DISASSOC)
231 sta->flags &= ~WLAN_STA_ASSOC;
232
233 if (was_assoc && !(sta->flags & WLAN_STA_ASSOC) && !sta->ap)
234 hostap_event_expired_sta(local->dev, sta);
235
236 if (sta->timeout_next == STA_DEAUTH && sta->aid > 0 &&
237 !skb_queue_empty(&sta->tx_buf)) {
238 hostap_set_tim(local, sta->aid, 0);
239 sta->flags &= ~WLAN_STA_TIM;
240 }
241
242 if (sta->ap) {
243 if (ap->autom_ap_wds) {
244 PDEBUG(DEBUG_AP, "%s: removing automatic WDS "
0795af57
JP		 245 "connection to AP %s\n",
246 local->dev->name, print_mac(mac, sta->addr));
ff1d2767
JM		 247 hostap_wds_link_oper(local, sta->addr, WDS_DEL);
248 }
249 } else if (sta->timeout_next == STA_NULLFUNC) {
250 /* send data frame to poll STA and check whether this frame
251 * is ACKed */
4339d328 252 /* FIX: IEEE80211_STYPE_NULLFUNC would be more appropriate, but
ff1d2767
JM		 253 * it is apparently not retried so TX Exc events are not
254 * received for it */
255 sta->flags |= WLAN_STA_PENDING_POLL;
4339d328
JM		 256 prism2_send_mgmt(local->dev, IEEE80211_FTYPE_DATA |
257 IEEE80211_STYPE_DATA, NULL, 0,
ff1d2767
JM		 258 sta->addr, ap->tx_callback_poll);
259 } else {
260 int deauth = sta->timeout_next == STA_DEAUTH;
261 u16 resp;
0795af57 262 PDEBUG(DEBUG_AP, "%s: sending %s info to STA %s"
ff1d2767
JM		 263 "(last=%lu, jiffies=%lu)\n",
264 local->dev->name,
265 deauth ? "deauthentication" : "disassociation",
0795af57 266 print_mac(mac, sta->addr), sta->last_rx, jiffies);
ff1d2767
JM		 267
268 resp = cpu_to_le16(deauth ? WLAN_REASON_PREV_AUTH_NOT_VALID :
269 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
4339d328
JM		 270 prism2_send_mgmt(local->dev, IEEE80211_FTYPE_MGMT |
271 (deauth ? IEEE80211_STYPE_DEAUTH :
272 IEEE80211_STYPE_DISASSOC),
ff1d2767
JM		 273 (char *) &resp, 2, sta->addr, 0);
274 }
275
276 if (sta->timeout_next == STA_DEAUTH) {
277 if (sta->flags & WLAN_STA_PERM) {
0795af57
JP		 278 PDEBUG(DEBUG_AP, "%s: STA %s"
279 " would have been removed, "
280 "but it has 'perm' flag\n",
281 local->dev->name, print_mac(mac, sta->addr));
ff1d2767
JM		 282 } else
283 ap_free_sta(ap, sta);
284 return;
285 }
286
287 if (sta->timeout_next == STA_NULLFUNC) {
288 sta->timeout_next = STA_DISASSOC;
289 sta->timer.expires = jiffies + AP_DISASSOC_DELAY;
290 } else {
291 sta->timeout_next = STA_DEAUTH;
292 sta->timer.expires = jiffies + AP_DEAUTH_DELAY;
293 }
294
295 add_timer(&sta->timer);
296}
297
298
299void hostap_deauth_all_stas(struct net_device *dev, struct ap_data *ap,
300 int resend)
301{
302 u8 addr[ETH_ALEN];
303 u16 resp;
304 int i;
305
306 PDEBUG(DEBUG_AP, "%s: Deauthenticate all stations\n", dev->name);
307 memset(addr, 0xff, ETH_ALEN);
308
309 resp = __constant_cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
310
311 /* deauth message sent; try to resend it few times; the message is
312 * broadcast, so it may be delayed until next DTIM; there is not much
313 * else we can do at this point since the driver is going to be shut
314 * down */
315 for (i = 0; i < 5; i++) {
4339d328
JM		 316 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
317 IEEE80211_STYPE_DEAUTH,
ff1d2767
JM		 318 (char *) &resp, 2, addr, 0);
319
320 if (!resend || ap->num_sta <= 0)
321 return;
322
323 mdelay(50);
324 }
325}
326
327
328static int ap_control_proc_read(char *page, char **start, off_t off,
329 int count, int *eof, void *data)
330{
331 char *p = page;
332 struct ap_data *ap = (struct ap_data *) data;
333 char *policy_txt;
ff1d2767 334 struct mac_entry *entry;
0795af57 335 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 336
337 if (off != 0) {
338 *eof = 1;
339 return 0;
340 }
341
342 switch (ap->mac_restrictions.policy) {
343 case MAC_POLICY_OPEN:
344 policy_txt = "open";
345 break;
346 case MAC_POLICY_ALLOW:
347 policy_txt = "allow";
348 break;
349 case MAC_POLICY_DENY:
350 policy_txt = "deny";
351 break;
352 default:
353 policy_txt = "unknown";
354 break;
355 };
356 p += sprintf(p, "MAC policy: %s\n", policy_txt);
357 p += sprintf(p, "MAC entries: %u\n", ap->mac_restrictions.entries);
358 p += sprintf(p, "MAC list:\n");
359 spin_lock_bh(&ap->mac_restrictions.lock);
c1505731 360 list_for_each_entry(entry, &ap->mac_restrictions.mac_list, list) {
ff1d2767
JM		 361 if (p - page > PAGE_SIZE - 80) {
362 p += sprintf(p, "All entries did not fit one page.\n");
363 break;
364 }
365
0795af57 366 p += sprintf(p, "%s\n", print_mac(mac, entry->addr));
ff1d2767
JM		 367 }
368 spin_unlock_bh(&ap->mac_restrictions.lock);
369
370 return (p - page);
371}
372
373
5fad5a2e 374int ap_control_add_mac(struct mac_restrictions *mac_restrictions, u8 *mac)
ff1d2767
JM		 375{
376 struct mac_entry *entry;
377
378 entry = kmalloc(sizeof(struct mac_entry), GFP_KERNEL);
379 if (entry == NULL)
380 return -1;
381
382 memcpy(entry->addr, mac, ETH_ALEN);
383
384 spin_lock_bh(&mac_restrictions->lock);
385 list_add_tail(&entry->list, &mac_restrictions->mac_list);
386 mac_restrictions->entries++;
387 spin_unlock_bh(&mac_restrictions->lock);
388
389 return 0;
390}
391
392
5fad5a2e 393int ap_control_del_mac(struct mac_restrictions *mac_restrictions, u8 *mac)
ff1d2767
JM		 394{
395 struct list_head *ptr;
396 struct mac_entry *entry;
397
398 spin_lock_bh(&mac_restrictions->lock);
399 for (ptr = mac_restrictions->mac_list.next;
400 ptr != &mac_restrictions->mac_list; ptr = ptr->next) {
401 entry = list_entry(ptr, struct mac_entry, list);
402
403 if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
404 list_del(ptr);
405 kfree(entry);
406 mac_restrictions->entries--;
407 spin_unlock_bh(&mac_restrictions->lock);
408 return 0;
409 }
410 }
411 spin_unlock_bh(&mac_restrictions->lock);
412 return -1;
413}
414
415
416static int ap_control_mac_deny(struct mac_restrictions *mac_restrictions,
417 u8 *mac)
418{
ff1d2767
JM		 419 struct mac_entry *entry;
420 int found = 0;
421
422 if (mac_restrictions->policy == MAC_POLICY_OPEN)
423 return 0;
424
425 spin_lock_bh(&mac_restrictions->lock);
c1505731 426 list_for_each_entry(entry, &mac_restrictions->mac_list, list) {
ff1d2767
JM		 427 if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
428 found = 1;
429 break;
430 }
431 }
432 spin_unlock_bh(&mac_restrictions->lock);
433
434 if (mac_restrictions->policy == MAC_POLICY_ALLOW)
435 return !found;
436 else
437 return found;
438}
439
440
5fad5a2e 441void ap_control_flush_macs(struct mac_restrictions *mac_restrictions)
ff1d2767
JM		 442{
443 struct list_head *ptr, *n;
444 struct mac_entry *entry;
445
446 if (mac_restrictions->entries == 0)
447 return;
448
449 spin_lock_bh(&mac_restrictions->lock);
450 for (ptr = mac_restrictions->mac_list.next, n = ptr->next;
451 ptr != &mac_restrictions->mac_list;
452 ptr = n, n = ptr->next) {
453 entry = list_entry(ptr, struct mac_entry, list);
454 list_del(ptr);
455 kfree(entry);
456 }
457 mac_restrictions->entries = 0;
458 spin_unlock_bh(&mac_restrictions->lock);
459}
460
461
5fad5a2e 462int ap_control_kick_mac(struct ap_data *ap, struct net_device *dev, u8 *mac)
ff1d2767
JM		 463{
464 struct sta_info *sta;
465 u16 resp;
466
467 spin_lock_bh(&ap->sta_table_lock);
468 sta = ap_get_sta(ap, mac);
469 if (sta) {
470 ap_sta_hash_del(ap, sta);
471 list_del(&sta->list);
472 }
473 spin_unlock_bh(&ap->sta_table_lock);
474
475 if (!sta)
476 return -EINVAL;
477
478 resp = cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
4339d328 479 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_DEAUTH,
ff1d2767
JM		 480 (char *) &resp, 2, sta->addr, 0);
481
482 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
483 hostap_event_expired_sta(dev, sta);
484
485 ap_free_sta(ap, sta);
486
487 return 0;
488}
489
490#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
491
492
5fad5a2e 493void ap_control_kickall(struct ap_data *ap)
ff1d2767
JM		 494{
495 struct list_head *ptr, *n;
496 struct sta_info *sta;
74fae82c 497
ff1d2767
JM		 498 spin_lock_bh(&ap->sta_table_lock);
499 for (ptr = ap->sta_list.next, n = ptr->next; ptr != &ap->sta_list;
500 ptr = n, n = ptr->next) {
501 sta = list_entry(ptr, struct sta_info, list);
502 ap_sta_hash_del(ap, sta);
503 list_del(&sta->list);
504 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
505 hostap_event_expired_sta(sta->local->dev, sta);
506 ap_free_sta(ap, sta);
507 }
508 spin_unlock_bh(&ap->sta_table_lock);
509}
510
511
512#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
513
514#define PROC_LIMIT (PAGE_SIZE - 80)
515
516static int prism2_ap_proc_read(char *page, char **start, off_t off,
517 int count, int *eof, void *data)
518{
519 char *p = page;
520 struct ap_data *ap = (struct ap_data *) data;
c1505731 521 struct sta_info *sta;
ff1d2767 522 int i;
0795af57 523 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 524
525 if (off > PROC_LIMIT) {
526 *eof = 1;
527 return 0;
528 }
529
530 p += sprintf(p, "# BSSID CHAN SIGNAL NOISE RATE SSID FLAGS\n");
531 spin_lock_bh(&ap->sta_table_lock);
c1505731 532 list_for_each_entry(sta, &ap->sta_list, list) {
ff1d2767
JM		 533 if (!sta->ap)
534 continue;
535
0795af57
JP		 536 p += sprintf(p, "%s %d %d %d %d '",
537 print_mac(mac, sta->addr),
ff1d2767
JM		 538 sta->u.ap.channel, sta->last_rx_signal,
539 sta->last_rx_silence, sta->last_rx_rate);
540 for (i = 0; i < sta->u.ap.ssid_len; i++)
541 p += sprintf(p, ((sta->u.ap.ssid[i] >= 32 &&
542 sta->u.ap.ssid[i] < 127) ?
543 "%c" : "<%02x>"),
544 sta->u.ap.ssid[i]);
545 p += sprintf(p, "'");
546 if (sta->capability & WLAN_CAPABILITY_ESS)
547 p += sprintf(p, " [ESS]");
548 if (sta->capability & WLAN_CAPABILITY_IBSS)
549 p += sprintf(p, " [IBSS]");
550 if (sta->capability & WLAN_CAPABILITY_PRIVACY)
551 p += sprintf(p, " [WEP]");
552 p += sprintf(p, "\n");
553
554 if ((p - page) > PROC_LIMIT) {
555 printk(KERN_DEBUG "hostap: ap proc did not fit\n");
556 break;
557 }
558 }
559 spin_unlock_bh(&ap->sta_table_lock);
560
561 if ((p - page) <= off) {
562 *eof = 1;
563 return 0;
564 }
565
566 *start = page + off;
567
568 return (p - page - off);
569}
570#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
571
572
573void hostap_check_sta_fw_version(struct ap_data *ap, int sta_fw_ver)
574{
575 if (!ap)
576 return;
577
578 if (sta_fw_ver == PRISM2_FW_VER(0,8,0)) {
579 PDEBUG(DEBUG_AP, "Using data::nullfunc ACK workaround - "
580 "firmware upgrade recommended\n");
581 ap->nullfunc_ack = 1;
582 } else
583 ap->nullfunc_ack = 0;
584
585 if (sta_fw_ver == PRISM2_FW_VER(1,4,2)) {
586 printk(KERN_WARNING "%s: Warning: secondary station firmware "
587 "version 1.4.2 does not seem to work in Host AP mode\n",
588 ap->local->dev->name);
589 }
590}
591
592
593/* Called only as a tasklet (software IRQ) */
594static void hostap_ap_tx_cb(struct sk_buff *skb, int ok, void *data)
595{
596 struct ap_data *ap = data;
597 u16 fc;
d041674d 598 struct ieee80211_hdr_4addr *hdr;
ff1d2767
JM		 599
600 if (!ap->local->hostapd || !ap->local->apdev) {
601 dev_kfree_skb(skb);
602 return;
603 }
604
d041674d 605 hdr = (struct ieee80211_hdr_4addr *) skb->data;
c0f72ca8 606 fc = le16_to_cpu(hdr->frame_ctl);
ff1d2767
JM		 607
608 /* Pass the TX callback frame to the hostapd; use 802.11 header version
609 * 1 to indicate failure (no ACK) and 2 success (frame ACKed) */
610
b2f4a2e3 611 fc &= ~IEEE80211_FCTL_VERS;
ff1d2767 612 fc |= ok ? BIT(1) : BIT(0);
c0f72ca8 613 hdr->frame_ctl = cpu_to_le16(fc);
ff1d2767
JM		 614
615 skb->dev = ap->local->apdev;
616 skb_pull(skb, hostap_80211_get_hdrlen(fc));
617 skb->pkt_type = PACKET_OTHERHOST;
618 skb->protocol = __constant_htons(ETH_P_802_2);
619 memset(skb->cb, 0, sizeof(skb->cb));
620 netif_rx(skb);
621}
622
623
624#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
625/* Called only as a tasklet (software IRQ) */
626static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data)
627{
628 struct ap_data *ap = data;
629 struct net_device *dev = ap->local->dev;
d041674d 630 struct ieee80211_hdr_4addr *hdr;
ff1d2767
JM		 631 u16 fc, *pos, auth_alg, auth_transaction, status;
632 struct sta_info *sta = NULL;
633 char *txt = NULL;
0795af57 634 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 635
636 if (ap->local->hostapd) {
637 dev_kfree_skb(skb);
638 return;
639 }
640
d041674d 641 hdr = (struct ieee80211_hdr_4addr *) skb->data;
c0f72ca8 642 fc = le16_to_cpu(hdr->frame_ctl);
4339d328
JM		 643 if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
644 WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_AUTH ||
ff1d2767
JM		 645 skb->len < IEEE80211_MGMT_HDR_LEN + 6) {
646 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_auth received invalid "
647 "frame\n", dev->name);
648 dev_kfree_skb(skb);
649 return;
650 }
651
652 pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
653 auth_alg = le16_to_cpu(*pos++);
654 auth_transaction = le16_to_cpu(*pos++);
655 status = le16_to_cpu(*pos++);
656
657 if (!ok) {
658 txt = "frame was not ACKed";
659 goto done;
660 }
661
662 spin_lock(&ap->sta_table_lock);
663 sta = ap_get_sta(ap, hdr->addr1);
664 if (sta)
665 atomic_inc(&sta->users);
666 spin_unlock(&ap->sta_table_lock);
667
668 if (!sta) {
669 txt = "STA not found";
670 goto done;
671 }
672
673 if (status == WLAN_STATUS_SUCCESS &&
674 ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
675 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
676 txt = "STA authenticated";
677 sta->flags |= WLAN_STA_AUTH;
678 sta->last_auth = jiffies;
679 } else if (status != WLAN_STATUS_SUCCESS)
680 txt = "authentication failed";
681
682 done:
683 if (sta)
684 atomic_dec(&sta->users);
685 if (txt) {
0795af57
JP		 686 PDEBUG(DEBUG_AP, "%s: %s auth_cb - alg=%d "
687 "trans#=%d status=%d - %s\n",
688 dev->name, print_mac(mac, hdr->addr1), auth_alg,
ff1d2767
JM		 689 auth_transaction, status, txt);
690 }
691 dev_kfree_skb(skb);
692}
693
694
695/* Called only as a tasklet (software IRQ) */
696static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
697{
698 struct ap_data *ap = data;
699 struct net_device *dev = ap->local->dev;
d041674d 700 struct ieee80211_hdr_4addr *hdr;
ff1d2767
JM		 701 u16 fc, *pos, status;
702 struct sta_info *sta = NULL;
703 char *txt = NULL;
0795af57 704 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 705
706 if (ap->local->hostapd) {
707 dev_kfree_skb(skb);
708 return;
709 }
710
d041674d 711 hdr = (struct ieee80211_hdr_4addr *) skb->data;
c0f72ca8 712 fc = le16_to_cpu(hdr->frame_ctl);
4339d328
JM		 713 if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
714 (WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_ASSOC_RESP &&
715 WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_REASSOC_RESP) ||
ff1d2767
JM		 716 skb->len < IEEE80211_MGMT_HDR_LEN + 4) {
717 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_assoc received invalid "
718 "frame\n", dev->name);
719 dev_kfree_skb(skb);
720 return;
721 }
722
723 if (!ok) {
724 txt = "frame was not ACKed";
725 goto done;
726 }
727
728 spin_lock(&ap->sta_table_lock);
729 sta = ap_get_sta(ap, hdr->addr1);
730 if (sta)
731 atomic_inc(&sta->users);
732 spin_unlock(&ap->sta_table_lock);
733
734 if (!sta) {
735 txt = "STA not found";
736 goto done;
737 }
738
739 pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
740 pos++;
741 status = le16_to_cpu(*pos++);
742 if (status == WLAN_STATUS_SUCCESS) {
743 if (!(sta->flags & WLAN_STA_ASSOC))
744 hostap_event_new_sta(dev, sta);
745 txt = "STA associated";
746 sta->flags |= WLAN_STA_ASSOC;
747 sta->last_assoc = jiffies;
748 } else
749 txt = "association failed";
750
751 done:
752 if (sta)
753 atomic_dec(&sta->users);
754 if (txt) {
0795af57
JP		 755 PDEBUG(DEBUG_AP, "%s: %s assoc_cb - %s\n",
756 dev->name, print_mac(mac, hdr->addr1), txt);
ff1d2767
JM		 757 }
758 dev_kfree_skb(skb);
759}
760
761/* Called only as a tasklet (software IRQ); TX callback for poll frames used
762 * in verifying whether the STA is still present. */
763static void hostap_ap_tx_cb_poll(struct sk_buff *skb, int ok, void *data)
764{
765 struct ap_data *ap = data;
d041674d 766 struct ieee80211_hdr_4addr *hdr;
ff1d2767 767 struct sta_info *sta;
0795af57 768 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 769
770 if (skb->len < 24)
771 goto fail;
d041674d 772 hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 773 if (ok) {
774 spin_lock(&ap->sta_table_lock);
775 sta = ap_get_sta(ap, hdr->addr1);
776 if (sta)
777 sta->flags &= ~WLAN_STA_PENDING_POLL;
778 spin_unlock(&ap->sta_table_lock);
779 } else {
0795af57
JP		 780 PDEBUG(DEBUG_AP, "%s: STA %s"
781 " did not ACK activity poll frame\n",
782 ap->local->dev->name, print_mac(mac, hdr->addr1));
ff1d2767
JM		 783 }
784
785 fail:
786 dev_kfree_skb(skb);
787}
788#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
789
790
791void hostap_init_data(local_info_t *local)
792{
793 struct ap_data *ap = local->ap;
794
795 if (ap == NULL) {
796 printk(KERN_WARNING "hostap_init_data: ap == NULL\n");
797 return;
798 }
799 memset(ap, 0, sizeof(struct ap_data));
800 ap->local = local;
801
802 ap->ap_policy = GET_INT_PARM(other_ap_policy, local->card_idx);
803 ap->bridge_packets = GET_INT_PARM(ap_bridge_packets, local->card_idx);
804 ap->max_inactivity =
805 GET_INT_PARM(ap_max_inactivity, local->card_idx) * HZ;
806 ap->autom_ap_wds = GET_INT_PARM(autom_ap_wds, local->card_idx);
807
808 spin_lock_init(&ap->sta_table_lock);
809 INIT_LIST_HEAD(&ap->sta_list);
810
811 /* Initialize task queue structure for AP management */
c4028958 812 INIT_WORK(&local->ap->add_sta_proc_queue, handle_add_proc_queue);
ff1d2767
JM		 813
814 ap->tx_callback_idx =
815 hostap_tx_callback_register(local, hostap_ap_tx_cb, ap);
816 if (ap->tx_callback_idx == 0)
817 printk(KERN_WARNING "%s: failed to register TX callback for "
818 "AP\n", local->dev->name);
819#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
c4028958 820 INIT_WORK(&local->ap->wds_oper_queue, handle_wds_oper_queue);
ff1d2767
JM		 821
822 ap->tx_callback_auth =
823 hostap_tx_callback_register(local, hostap_ap_tx_cb_auth, ap);
824 ap->tx_callback_assoc =
825 hostap_tx_callback_register(local, hostap_ap_tx_cb_assoc, ap);
826 ap->tx_callback_poll =
827 hostap_tx_callback_register(local, hostap_ap_tx_cb_poll, ap);
828 if (ap->tx_callback_auth == 0 || ap->tx_callback_assoc == 0 ||
829 ap->tx_callback_poll == 0)
830 printk(KERN_WARNING "%s: failed to register TX callback for "
831 "AP\n", local->dev->name);
832
833 spin_lock_init(&ap->mac_restrictions.lock);
834 INIT_LIST_HEAD(&ap->mac_restrictions.mac_list);
835#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
836
837 ap->initialized = 1;
838}
839
840
841void hostap_init_ap_proc(local_info_t *local)
842{
843 struct ap_data *ap = local->ap;
844
845 ap->proc = local->proc;
846 if (ap->proc == NULL)
847 return;
848
849#ifndef PRISM2_NO_PROCFS_DEBUG
850 create_proc_read_entry("ap_debug", 0, ap->proc,
851 ap_debug_proc_read, ap);
852#endif /* PRISM2_NO_PROCFS_DEBUG */
853
854#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
855 create_proc_read_entry("ap_control", 0, ap->proc,
856 ap_control_proc_read, ap);
857 create_proc_read_entry("ap", 0, ap->proc,
858 prism2_ap_proc_read, ap);
859#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
860
861}
862
863
864void hostap_free_data(struct ap_data *ap)
865{
c1505731 866 struct sta_info *n, *sta;
ff1d2767
JM		 867
868 if (ap == NULL || !ap->initialized) {
869 printk(KERN_DEBUG "hostap_free_data: ap has not yet been "
870 "initialized - skip resource freeing\n");
871 return;
872 }
873
874#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
875 if (ap->crypt)
876 ap->crypt->deinit(ap->crypt_priv);
877 ap->crypt = ap->crypt_priv = NULL;
878#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
879
c1505731 880 list_for_each_entry_safe(sta, n, &ap->sta_list, list) {
ff1d2767
JM		 881 ap_sta_hash_del(ap, sta);
882 list_del(&sta->list);
883 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
884 hostap_event_expired_sta(sta->local->dev, sta);
885 ap_free_sta(ap, sta);
886 }
887
888#ifndef PRISM2_NO_PROCFS_DEBUG
889 if (ap->proc != NULL) {
890 remove_proc_entry("ap_debug", ap->proc);
891 }
892#endif /* PRISM2_NO_PROCFS_DEBUG */
893
894#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
895 if (ap->proc != NULL) {
896 remove_proc_entry("ap", ap->proc);
897 remove_proc_entry("ap_control", ap->proc);
898 }
899 ap_control_flush_macs(&ap->mac_restrictions);
900#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
901
902 ap->initialized = 0;
903}
904
905
906/* caller should have mutex for AP STA list handling */
907static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta)
908{
909 struct sta_info *s;
910
911 s = ap->sta_hash[STA_HASH(sta)];
912 while (s != NULL && memcmp(s->addr, sta, ETH_ALEN) != 0)
913 s = s->hnext;
914 return s;
915}
916
917
918#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
919
920/* Called from timer handler and from scheduled AP queue handlers */
921static void prism2_send_mgmt(struct net_device *dev,
4339d328 922 u16 type_subtype, char *body,
ff1d2767
JM		 923 int body_len, u8 *addr, u16 tx_cb_idx)
924{
925 struct hostap_interface *iface;
926 local_info_t *local;
d041674d 927 struct ieee80211_hdr_4addr *hdr;
ff1d2767
JM		 928 u16 fc;
929 struct sk_buff *skb;
930 struct hostap_skb_tx_data *meta;
931 int hdrlen;
932
933 iface = netdev_priv(dev);
934 local = iface->local;
935 dev = local->dev; /* always use master radio device */
936 iface = netdev_priv(dev);
937
938 if (!(dev->flags & IFF_UP)) {
939 PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt - device is not UP - "
940 "cannot send frame\n", dev->name);
941 return;
942 }
943
944 skb = dev_alloc_skb(sizeof(*hdr) + body_len);
945 if (skb == NULL) {
946 PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt failed to allocate "
947 "skb\n", dev->name);
948 return;
949 }
950
4339d328 951 fc = type_subtype;
ff1d2767 952 hdrlen = hostap_80211_get_hdrlen(fc);
d041674d 953 hdr = (struct ieee80211_hdr_4addr *) skb_put(skb, hdrlen);
ff1d2767
JM		 954 if (body)
955 memcpy(skb_put(skb, body_len), body, body_len);
956
957 memset(hdr, 0, hdrlen);
958
959 /* FIX: ctrl::ack sending used special HFA384X_TX_CTRL_802_11
960 * tx_control instead of using local->tx_control */
961
962
963 memcpy(hdr->addr1, addr, ETH_ALEN); /* DA / RA */
4339d328 964 if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) {
b2f4a2e3 965 fc |= IEEE80211_FCTL_FROMDS;
ff1d2767
JM		 966 memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* BSSID */
967 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* SA */
4339d328 968 } else if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_CTL) {
ff1d2767
JM		 969 /* control:ACK does not have addr2 or addr3 */
970 memset(hdr->addr2, 0, ETH_ALEN);
971 memset(hdr->addr3, 0, ETH_ALEN);
972 } else {
973 memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* SA */
974 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* BSSID */
975 }
976
c0f72ca8 977 hdr->frame_ctl = cpu_to_le16(fc);
ff1d2767
JM		 978
979 meta = (struct hostap_skb_tx_data *) skb->cb;
980 memset(meta, 0, sizeof(*meta));
981 meta->magic = HOSTAP_SKB_TX_DATA_MAGIC;
982 meta->iface = iface;
983 meta->tx_cb_idx = tx_cb_idx;
984
985 skb->dev = dev;
459a98ed 986 skb_reset_mac_header(skb);
c1d2bbe1 987 skb_reset_network_header(skb);
ff1d2767
JM		 988 dev_queue_xmit(skb);
989}
990#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
991
992
993static int prism2_sta_proc_read(char *page, char **start, off_t off,
994 int count, int *eof, void *data)
995{
996 char *p = page;
997 struct sta_info *sta = (struct sta_info *) data;
998 int i;
0795af57 999 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 1000
1001 /* FIX: possible race condition.. the STA data could have just expired,
1002 * but proc entry was still here so that the read could have started;
1003 * some locking should be done here.. */
1004
1005 if (off != 0) {
1006 *eof = 1;
1007 return 0;
1008 }
1009
0795af57 1010 p += sprintf(p, "%s=%s\nusers=%d\naid=%d\n"
ff1d2767
JM		 1011 "flags=0x%04x%s%s%s%s%s%s%s\n"
1012 "capability=0x%02x\nlisten_interval=%d\nsupported_rates=",
1013 sta->ap ? "AP" : "STA",
0795af57 1014 print_mac(mac, sta->addr), atomic_read(&sta->users), sta->aid,
ff1d2767
JM		 1015 sta->flags,
1016 sta->flags & WLAN_STA_AUTH ? " AUTH" : "",
1017 sta->flags & WLAN_STA_ASSOC ? " ASSOC" : "",
1018 sta->flags & WLAN_STA_PS ? " PS" : "",
1019 sta->flags & WLAN_STA_TIM ? " TIM" : "",
1020 sta->flags & WLAN_STA_PERM ? " PERM" : "",
1021 sta->flags & WLAN_STA_AUTHORIZED ? " AUTHORIZED" : "",
1022 sta->flags & WLAN_STA_PENDING_POLL ? " POLL" : "",
1023 sta->capability, sta->listen_interval);
1024 /* supported_rates: 500 kbit/s units with msb ignored */
1025 for (i = 0; i < sizeof(sta->supported_rates); i++)
1026 if (sta->supported_rates[i] != 0)
1027 p += sprintf(p, "%d%sMbps ",
1028 (sta->supported_rates[i] & 0x7f) / 2,
1029 sta->supported_rates[i] & 1 ? ".5" : "");
1030 p += sprintf(p, "\njiffies=%lu\nlast_auth=%lu\nlast_assoc=%lu\n"
1031 "last_rx=%lu\nlast_tx=%lu\nrx_packets=%lu\n"
1032 "tx_packets=%lu\n"
1033 "rx_bytes=%lu\ntx_bytes=%lu\nbuffer_count=%d\n"
1034 "last_rx: silence=%d dBm signal=%d dBm rate=%d%s Mbps\n"
1035 "tx_rate=%d\ntx[1M]=%d\ntx[2M]=%d\ntx[5.5M]=%d\n"
1036 "tx[11M]=%d\n"
1037 "rx[1M]=%d\nrx[2M]=%d\nrx[5.5M]=%d\nrx[11M]=%d\n",
1038 jiffies, sta->last_auth, sta->last_assoc, sta->last_rx,
1039 sta->last_tx,
1040 sta->rx_packets, sta->tx_packets, sta->rx_bytes,
1041 sta->tx_bytes, skb_queue_len(&sta->tx_buf),
1042 sta->last_rx_silence,
1043 sta->last_rx_signal, sta->last_rx_rate / 10,
1044 sta->last_rx_rate % 10 ? ".5" : "",
1045 sta->tx_rate, sta->tx_count[0], sta->tx_count[1],
1046 sta->tx_count[2], sta->tx_count[3], sta->rx_count[0],
1047 sta->rx_count[1], sta->rx_count[2], sta->rx_count[3]);
1048 if (sta->crypt && sta->crypt->ops && sta->crypt->ops->print_stats)
1049 p = sta->crypt->ops->print_stats(p, sta->crypt->priv);
1050#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1051 if (sta->ap) {
1052 if (sta->u.ap.channel >= 0)
1053 p += sprintf(p, "channel=%d\n", sta->u.ap.channel);
1054 p += sprintf(p, "ssid=");
1055 for (i = 0; i < sta->u.ap.ssid_len; i++)
1056 p += sprintf(p, ((sta->u.ap.ssid[i] >= 32 &&
1057 sta->u.ap.ssid[i] < 127) ?
1058 "%c" : "<%02x>"),
1059 sta->u.ap.ssid[i]);
1060 p += sprintf(p, "\n");
1061 }
1062#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
1063
1064 return (p - page);
1065}
1066
1067
c4028958 1068static void handle_add_proc_queue(struct work_struct *work)
ff1d2767 1069{
c4028958
DH		 1070 struct ap_data *ap = container_of(work, struct ap_data,
1071 add_sta_proc_queue);
ff1d2767
JM		 1072 struct sta_info *sta;
1073 char name[20];
1074 struct add_sta_proc_data *entry, *prev;
0795af57 1075 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 1076
1077 entry = ap->add_sta_proc_entries;
1078 ap->add_sta_proc_entries = NULL;
1079
1080 while (entry) {
1081 spin_lock_bh(&ap->sta_table_lock);
1082 sta = ap_get_sta(ap, entry->addr);
1083 if (sta)
1084 atomic_inc(&sta->users);
1085 spin_unlock_bh(&ap->sta_table_lock);
1086
1087 if (sta) {
0795af57 1088 sprintf(name, "%s", print_mac(mac, sta->addr));
ff1d2767
JM		 1089 sta->proc = create_proc_read_entry(
1090 name, 0, ap->proc,
1091 prism2_sta_proc_read, sta);
1092
1093 atomic_dec(&sta->users);
1094 }
1095
1096 prev = entry;
1097 entry = entry->next;
1098 kfree(prev);
1099 }
1100}
1101
1102
1103static struct sta_info * ap_add_sta(struct ap_data *ap, u8 *addr)
1104{
1105 struct sta_info *sta;
1106
b0471bb7 1107 sta = kzalloc(sizeof(struct sta_info), GFP_ATOMIC);
ff1d2767
JM		 1108 if (sta == NULL) {
1109 PDEBUG(DEBUG_AP, "AP: kmalloc failed\n");
1110 return NULL;
1111 }
1112
1113 /* initialize STA info data */
ff1d2767
JM		 1114 sta->local = ap->local;
1115 skb_queue_head_init(&sta->tx_buf);
1116 memcpy(sta->addr, addr, ETH_ALEN);
1117
1118 atomic_inc(&sta->users);
1119 spin_lock_bh(&ap->sta_table_lock);
1120 list_add(&sta->list, &ap->sta_list);
1121 ap->num_sta++;
1122 ap_sta_hash_add(ap, sta);
1123 spin_unlock_bh(&ap->sta_table_lock);
1124
1125 if (ap->proc) {
1126 struct add_sta_proc_data *entry;
1127 /* schedule a non-interrupt context process to add a procfs
1128 * entry for the STA since procfs code use GFP_KERNEL */
1129 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
1130 if (entry) {
1131 memcpy(entry->addr, sta->addr, ETH_ALEN);
1132 entry->next = ap->add_sta_proc_entries;
1133 ap->add_sta_proc_entries = entry;
1134 schedule_work(&ap->add_sta_proc_queue);
1135 } else
1136 printk(KERN_DEBUG "Failed to add STA proc data\n");
1137 }
1138
1139#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1140 init_timer(&sta->timer);
1141 sta->timer.expires = jiffies + ap->max_inactivity;
1142 sta->timer.data = (unsigned long) sta;
1143 sta->timer.function = ap_handle_timer;
1144 if (!ap->local->hostapd)
1145 add_timer(&sta->timer);
1146#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
1147
1148 return sta;
1149}
1150
1151
1152static int ap_tx_rate_ok(int rateidx, struct sta_info *sta,
1153 local_info_t *local)
1154{
1155 if (rateidx > sta->tx_max_rate ||
1156 !(sta->tx_supp_rates & (1 << rateidx)))
1157 return 0;
1158
1159 if (local->tx_rate_control != 0 &&
1160 !(local->tx_rate_control & (1 << rateidx)))
1161 return 0;
1162
1163 return 1;
1164}
1165
1166
1167static void prism2_check_tx_rates(struct sta_info *sta)
1168{
1169 int i;
1170
1171 sta->tx_supp_rates = 0;
1172 for (i = 0; i < sizeof(sta->supported_rates); i++) {
1173 if ((sta->supported_rates[i] & 0x7f) == 2)
1174 sta->tx_supp_rates |= WLAN_RATE_1M;
1175 if ((sta->supported_rates[i] & 0x7f) == 4)
1176 sta->tx_supp_rates |= WLAN_RATE_2M;
1177 if ((sta->supported_rates[i] & 0x7f) == 11)
1178 sta->tx_supp_rates |= WLAN_RATE_5M5;
1179 if ((sta->supported_rates[i] & 0x7f) == 22)
1180 sta->tx_supp_rates |= WLAN_RATE_11M;
1181 }
1182 sta->tx_max_rate = sta->tx_rate = sta->tx_rate_idx = 0;
1183 if (sta->tx_supp_rates & WLAN_RATE_1M) {
1184 sta->tx_max_rate = 0;
1185 if (ap_tx_rate_ok(0, sta, sta->local)) {
1186 sta->tx_rate = 10;
1187 sta->tx_rate_idx = 0;
1188 }
1189 }
1190 if (sta->tx_supp_rates & WLAN_RATE_2M) {
1191 sta->tx_max_rate = 1;
1192 if (ap_tx_rate_ok(1, sta, sta->local)) {
1193 sta->tx_rate = 20;
1194 sta->tx_rate_idx = 1;
1195 }
1196 }
1197 if (sta->tx_supp_rates & WLAN_RATE_5M5) {
1198 sta->tx_max_rate = 2;
1199 if (ap_tx_rate_ok(2, sta, sta->local)) {
1200 sta->tx_rate = 55;
1201 sta->tx_rate_idx = 2;
1202 }
1203 }
1204 if (sta->tx_supp_rates & WLAN_RATE_11M) {
1205 sta->tx_max_rate = 3;
1206 if (ap_tx_rate_ok(3, sta, sta->local)) {
1207 sta->tx_rate = 110;
1208 sta->tx_rate_idx = 3;
1209 }
1210 }
1211}
1212
1213
1214#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1215
1216static void ap_crypt_init(struct ap_data *ap)
1217{
62fe7e37 1218 ap->crypt = ieee80211_get_crypto_ops("WEP");
ff1d2767
JM		 1219
1220 if (ap->crypt) {
1221 if (ap->crypt->init) {
1222 ap->crypt_priv = ap->crypt->init(0);
1223 if (ap->crypt_priv == NULL)
1224 ap->crypt = NULL;
1225 else {
1226 u8 key[WEP_KEY_LEN];
1227 get_random_bytes(key, WEP_KEY_LEN);
1228 ap->crypt->set_key(key, WEP_KEY_LEN, NULL,
1229 ap->crypt_priv);
1230 }
1231 }
1232 }
1233
1234 if (ap->crypt == NULL) {
1235 printk(KERN_WARNING "AP could not initialize WEP: load module "
62fe7e37 1236 "ieee80211_crypt_wep.ko\n");
ff1d2767
JM		 1237 }
1238}
1239
1240
1241/* Generate challenge data for shared key authentication. IEEE 802.11 specifies
1242 * that WEP algorithm is used for generating challange. This should be unique,
1243 * but otherwise there is not really need for randomness etc. Initialize WEP
1244 * with pseudo random key and then use increasing IV to get unique challenge
1245 * streams.
1246 *
1247 * Called only as a scheduled task for pending AP frames.
1248 */
1249static char * ap_auth_make_challenge(struct ap_data *ap)
1250{
1251 char *tmpbuf;
1252 struct sk_buff *skb;
1253
1254 if (ap->crypt == NULL) {
1255 ap_crypt_init(ap);
1256 if (ap->crypt == NULL)
1257 return NULL;
1258 }
1259
5cbded58 1260 tmpbuf = kmalloc(WLAN_AUTH_CHALLENGE_LEN, GFP_ATOMIC);
ff1d2767
JM		 1261 if (tmpbuf == NULL) {
1262 PDEBUG(DEBUG_AP, "AP: kmalloc failed for challenge\n");
1263 return NULL;
1264 }
1265
1266 skb = dev_alloc_skb(WLAN_AUTH_CHALLENGE_LEN +
5bfc819b
JK		 1267 ap->crypt->extra_mpdu_prefix_len +
1268 ap->crypt->extra_mpdu_postfix_len);
ff1d2767
JM		 1269 if (skb == NULL) {
1270 kfree(tmpbuf);
1271 return NULL;
1272 }
1273
5bfc819b 1274 skb_reserve(skb, ap->crypt->extra_mpdu_prefix_len);
ff1d2767
JM		 1275 memset(skb_put(skb, WLAN_AUTH_CHALLENGE_LEN), 0,
1276 WLAN_AUTH_CHALLENGE_LEN);
1277 if (ap->crypt->encrypt_mpdu(skb, 0, ap->crypt_priv)) {
1278 dev_kfree_skb(skb);
1279 kfree(tmpbuf);
1280 return NULL;
1281 }
1282
d626f62b
ACM		 1283 skb_copy_from_linear_data_offset(skb, ap->crypt->extra_mpdu_prefix_len,
1284 tmpbuf, WLAN_AUTH_CHALLENGE_LEN);
ff1d2767
JM		 1285 dev_kfree_skb(skb);
1286
1287 return tmpbuf;
1288}
1289
1290
1291/* Called only as a scheduled task for pending AP frames. */
1292static void handle_authen(local_info_t *local, struct sk_buff *skb,
1293 struct hostap_80211_rx_status *rx_stats)
1294{
1295 struct net_device *dev = local->dev;
d041674d 1296 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 1297 size_t hdrlen;
1298 struct ap_data *ap = local->ap;
1299 char body[8 + WLAN_AUTH_CHALLENGE_LEN], *challenge = NULL;
1300 int len, olen;
1301 u16 auth_alg, auth_transaction, status_code, *pos;
1302 u16 resp = WLAN_STATUS_SUCCESS, fc;
1303 struct sta_info *sta = NULL;
62fe7e37 1304 struct ieee80211_crypt_data *crypt;
ff1d2767 1305 char *txt = "";
0795af57 1306 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 1307
1308 len = skb->len - IEEE80211_MGMT_HDR_LEN;
1309
c0f72ca8 1310 fc = le16_to_cpu(hdr->frame_ctl);
ff1d2767
JM		 1311 hdrlen = hostap_80211_get_hdrlen(fc);
1312
1313 if (len < 6) {
1314 PDEBUG(DEBUG_AP, "%s: handle_authen - too short payload "
0795af57
JP		 1315 "(len=%d) from %s\n", dev->name, len,
1316 print_mac(mac, hdr->addr2));
ff1d2767
JM		 1317 return;
1318 }
1319
1320 spin_lock_bh(&local->ap->sta_table_lock);
1321 sta = ap_get_sta(local->ap, hdr->addr2);
1322 if (sta)
1323 atomic_inc(&sta->users);
1324 spin_unlock_bh(&local->ap->sta_table_lock);
1325
1326 if (sta && sta->crypt)
1327 crypt = sta->crypt;
1328 else {
1329 int idx = 0;
1330 if (skb->len >= hdrlen + 3)
1331 idx = skb->data[hdrlen + 3] >> 6;
1332 crypt = local->crypt[idx];
1333 }
1334
1335 pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
1336 auth_alg = __le16_to_cpu(*pos);
1337 pos++;
1338 auth_transaction = __le16_to_cpu(*pos);
1339 pos++;
1340 status_code = __le16_to_cpu(*pos);
1341 pos++;
1342
1343 if (memcmp(dev->dev_addr, hdr->addr2, ETH_ALEN) == 0 ||
1344 ap_control_mac_deny(&ap->mac_restrictions, hdr->addr2)) {
1345 txt = "authentication denied";
1346 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1347 goto fail;
1348 }
1349
1350 if (((local->auth_algs & PRISM2_AUTH_OPEN) &&
1351 auth_alg == WLAN_AUTH_OPEN) ||
1352 ((local->auth_algs & PRISM2_AUTH_SHARED_KEY) &&
1353 crypt && auth_alg == WLAN_AUTH_SHARED_KEY)) {
1354 } else {
1355 txt = "unsupported algorithm";
1356 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1357 goto fail;
1358 }
1359
1360 if (len >= 8) {
1361 u8 *u = (u8 *) pos;
1362 if (*u == WLAN_EID_CHALLENGE) {
1363 if (*(u + 1) != WLAN_AUTH_CHALLENGE_LEN) {
1364 txt = "invalid challenge len";
1365 resp = WLAN_STATUS_CHALLENGE_FAIL;
1366 goto fail;
1367 }
1368 if (len - 8 < WLAN_AUTH_CHALLENGE_LEN) {
1369 txt = "challenge underflow";
1370 resp = WLAN_STATUS_CHALLENGE_FAIL;
1371 goto fail;
1372 }
1373 challenge = (char *) (u + 2);
1374 }
1375 }
1376
1377 if (sta && sta->ap) {
1378 if (time_after(jiffies, sta->u.ap.last_beacon +
1379 (10 * sta->listen_interval * HZ) / 1024)) {
1380 PDEBUG(DEBUG_AP, "%s: no beacons received for a while,"
0795af57
JP		 1381 " assuming AP %s is now STA\n",
1382 dev->name, print_mac(mac, sta->addr));
ff1d2767
JM		 1383 sta->ap = 0;
1384 sta->flags = 0;
1385 sta->u.sta.challenge = NULL;
1386 } else {
1387 txt = "AP trying to authenticate?";
1388 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1389 goto fail;
1390 }
1391 }
1392
1393 if ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1) ||
1394 (auth_alg == WLAN_AUTH_SHARED_KEY &&
1395 (auth_transaction == 1 ||
1396 (auth_transaction == 3 && sta != NULL &&
1397 sta->u.sta.challenge != NULL)))) {
1398 } else {
1399 txt = "unknown authentication transaction number";
1400 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1401 goto fail;
1402 }
1403
1404 if (sta == NULL) {
1405 txt = "new STA";
1406
1407 if (local->ap->num_sta >= MAX_STA_COUNT) {
1408 /* FIX: might try to remove some old STAs first? */
1409 txt = "no more room for new STAs";
1410 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1411 goto fail;
1412 }
1413
1414 sta = ap_add_sta(local->ap, hdr->addr2);
1415 if (sta == NULL) {
1416 txt = "ap_add_sta failed";
1417 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1418 goto fail;
1419 }
1420 }
1421
1422 switch (auth_alg) {
1423 case WLAN_AUTH_OPEN:
1424 txt = "authOK";
1425 /* IEEE 802.11 standard is not completely clear about
1426 * whether STA is considered authenticated after
1427 * authentication OK frame has been send or after it
1428 * has been ACKed. In order to reduce interoperability
1429 * issues, mark the STA authenticated before ACK. */
1430 sta->flags |= WLAN_STA_AUTH;
1431 break;
1432
1433 case WLAN_AUTH_SHARED_KEY:
1434 if (auth_transaction == 1) {
1435 if (sta->u.sta.challenge == NULL) {
1436 sta->u.sta.challenge =
1437 ap_auth_make_challenge(local->ap);
1438 if (sta->u.sta.challenge == NULL) {
1439 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1440 goto fail;
1441 }
1442 }
1443 } else {
1444 if (sta->u.sta.challenge == NULL ||
1445 challenge == NULL ||
1446 memcmp(sta->u.sta.challenge, challenge,
1447 WLAN_AUTH_CHALLENGE_LEN) != 0 ||
831a179f 1448 !(fc & IEEE80211_FCTL_PROTECTED)) {
ff1d2767
JM		 1449 txt = "challenge response incorrect";
1450 resp = WLAN_STATUS_CHALLENGE_FAIL;
1451 goto fail;
1452 }
1453
1454 txt = "challenge OK - authOK";
1455 /* IEEE 802.11 standard is not completely clear about
1456 * whether STA is considered authenticated after
1457 * authentication OK frame has been send or after it
1458 * has been ACKed. In order to reduce interoperability
1459 * issues, mark the STA authenticated before ACK. */
1460 sta->flags |= WLAN_STA_AUTH;
1461 kfree(sta->u.sta.challenge);
1462 sta->u.sta.challenge = NULL;
1463 }
1464 break;
1465 }
1466
1467 fail:
1468 pos = (u16 *) body;
1469 *pos = cpu_to_le16(auth_alg);
1470 pos++;
1471 *pos = cpu_to_le16(auth_transaction + 1);
1472 pos++;
1473 *pos = cpu_to_le16(resp); /* status_code */
1474 pos++;
1475 olen = 6;
1476
1477 if (resp == WLAN_STATUS_SUCCESS && sta != NULL &&
1478 sta->u.sta.challenge != NULL &&
1479 auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 1) {
1480 u8 *tmp = (u8 *) pos;
1481 *tmp++ = WLAN_EID_CHALLENGE;
1482 *tmp++ = WLAN_AUTH_CHALLENGE_LEN;
1483 pos++;
1484 memcpy(pos, sta->u.sta.challenge, WLAN_AUTH_CHALLENGE_LEN);
1485 olen += 2 + WLAN_AUTH_CHALLENGE_LEN;
1486 }
1487
4339d328 1488 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH,
ff1d2767
JM		 1489 body, olen, hdr->addr2, ap->tx_callback_auth);
1490
1491 if (sta) {
1492 sta->last_rx = jiffies;
1493 atomic_dec(&sta->users);
1494 }
1495
1496 if (resp) {
0795af57
JP		 1497 PDEBUG(DEBUG_AP, "%s: %s auth (alg=%d "
1498 "trans#=%d stat=%d len=%d fc=%04x) ==> %d (%s)\n",
1499 dev->name, print_mac(mac, hdr->addr2), auth_alg,
ff1d2767
JM		 1500 auth_transaction, status_code, len, fc, resp, txt);
1501 }
1502}
1503
1504
1505/* Called only as a scheduled task for pending AP frames. */
1506static void handle_assoc(local_info_t *local, struct sk_buff *skb,
1507 struct hostap_80211_rx_status *rx_stats, int reassoc)
1508{
1509 struct net_device *dev = local->dev;
d041674d 1510 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 1511 char body[12], *p, *lpos;
1512 int len, left;
1513 u16 *pos;
1514 u16 resp = WLAN_STATUS_SUCCESS;
1515 struct sta_info *sta = NULL;
1516 int send_deauth = 0;
1517 char *txt = "";
1518 u8 prev_ap[ETH_ALEN];
0795af57 1519 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 1520
1521 left = len = skb->len - IEEE80211_MGMT_HDR_LEN;
1522
1523 if (len < (reassoc ? 10 : 4)) {
1524 PDEBUG(DEBUG_AP, "%s: handle_assoc - too short payload "
0795af57
JP		 1525 "(len=%d, reassoc=%d) from %s\n",
1526 dev->name, len, reassoc, print_mac(mac, hdr->addr2));
ff1d2767
JM		 1527 return;
1528 }
1529
1530 spin_lock_bh(&local->ap->sta_table_lock);
1531 sta = ap_get_sta(local->ap, hdr->addr2);
1532 if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
1533 spin_unlock_bh(&local->ap->sta_table_lock);
1534 txt = "trying to associate before authentication";
1535 send_deauth = 1;
1536 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1537 sta = NULL; /* do not decrement sta->users */
1538 goto fail;
1539 }
1540 atomic_inc(&sta->users);
1541 spin_unlock_bh(&local->ap->sta_table_lock);
1542
1543 pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
1544 sta->capability = __le16_to_cpu(*pos);
1545 pos++; left -= 2;
1546 sta->listen_interval = __le16_to_cpu(*pos);
1547 pos++; left -= 2;
1548
1549 if (reassoc) {
1550 memcpy(prev_ap, pos, ETH_ALEN);
1551 pos++; pos++; pos++; left -= 6;
1552 } else
1553 memset(prev_ap, 0, ETH_ALEN);
1554
1555 if (left >= 2) {
1556 unsigned int ileft;
1557 unsigned char *u = (unsigned char *) pos;
1558
1559 if (*u == WLAN_EID_SSID) {
1560 u++; left--;
1561 ileft = *u;
1562 u++; left--;
1563
1564 if (ileft > left || ileft > MAX_SSID_LEN) {
1565 txt = "SSID overflow";
1566 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1567 goto fail;
1568 }
1569
1570 if (ileft != strlen(local->essid) ||
1571 memcmp(local->essid, u, ileft) != 0) {
1572 txt = "not our SSID";
1573 resp = WLAN_STATUS_ASSOC_DENIED_UNSPEC;
1574 goto fail;
1575 }
1576
1577 u += ileft;
1578 left -= ileft;
1579 }
1580
1581 if (left >= 2 && *u == WLAN_EID_SUPP_RATES) {
1582 u++; left--;
1583 ileft = *u;
1584 u++; left--;
74fae82c 1585
ff1d2767
JM		 1586 if (ileft > left || ileft == 0 ||
1587 ileft > WLAN_SUPP_RATES_MAX) {
1588 txt = "SUPP_RATES len error";
1589 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1590 goto fail;
1591 }
1592
1593 memset(sta->supported_rates, 0,
1594 sizeof(sta->supported_rates));
1595 memcpy(sta->supported_rates, u, ileft);
1596 prism2_check_tx_rates(sta);
1597
1598 u += ileft;
1599 left -= ileft;
1600 }
1601
1602 if (left > 0) {
0795af57
JP		 1603 PDEBUG(DEBUG_AP, "%s: assoc from %s"
1604 " with extra data (%d bytes) [",
1605 dev->name, print_mac(mac, hdr->addr2), left);
ff1d2767
JM		 1606 while (left > 0) {
1607 PDEBUG2(DEBUG_AP, "<%02x>", *u);
1608 u++; left--;
1609 }
1610 PDEBUG2(DEBUG_AP, "]\n");
1611 }
1612 } else {
1613 txt = "frame underflow";
1614 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1615 goto fail;
1616 }
1617
1618 /* get a unique AID */
1619 if (sta->aid > 0)
1620 txt = "OK, old AID";
1621 else {
1622 spin_lock_bh(&local->ap->sta_table_lock);
1623 for (sta->aid = 1; sta->aid <= MAX_AID_TABLE_SIZE; sta->aid++)
1624 if (local->ap->sta_aid[sta->aid - 1] == NULL)
1625 break;
1626 if (sta->aid > MAX_AID_TABLE_SIZE) {
1627 sta->aid = 0;
1628 spin_unlock_bh(&local->ap->sta_table_lock);
1629 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1630 txt = "no room for more AIDs";
1631 } else {
1632 local->ap->sta_aid[sta->aid - 1] = sta;
1633 spin_unlock_bh(&local->ap->sta_table_lock);
1634 txt = "OK, new AID";
1635 }
1636 }
1637
1638 fail:
1639 pos = (u16 *) body;
1640
1641 if (send_deauth) {
1642 *pos = __constant_cpu_to_le16(
1643 WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH);
1644 pos++;
1645 } else {
1646 /* FIX: CF-Pollable and CF-PollReq should be set to match the
1647 * values in beacons/probe responses */
1648 /* FIX: how about privacy and WEP? */
1649 /* capability */
1650 *pos = __constant_cpu_to_le16(WLAN_CAPABILITY_ESS);
1651 pos++;
1652
1653 /* status_code */
1654 *pos = __cpu_to_le16(resp);
1655 pos++;
1656
1657 *pos = __cpu_to_le16((sta && sta->aid > 0 ? sta->aid : 0) |
1658 BIT(14) | BIT(15)); /* AID */
1659 pos++;
1660
1661 /* Supported rates (Information element) */
1662 p = (char *) pos;
1663 *p++ = WLAN_EID_SUPP_RATES;
1664 lpos = p;
1665 *p++ = 0; /* len */
1666 if (local->tx_rate_control & WLAN_RATE_1M) {
1667 *p++ = local->basic_rates & WLAN_RATE_1M ? 0x82 : 0x02;
1668 (*lpos)++;
1669 }
1670 if (local->tx_rate_control & WLAN_RATE_2M) {
1671 *p++ = local->basic_rates & WLAN_RATE_2M ? 0x84 : 0x04;
1672 (*lpos)++;
1673 }
1674 if (local->tx_rate_control & WLAN_RATE_5M5) {
1675 *p++ = local->basic_rates & WLAN_RATE_5M5 ?
1676 0x8b : 0x0b;
1677 (*lpos)++;
1678 }
1679 if (local->tx_rate_control & WLAN_RATE_11M) {
1680 *p++ = local->basic_rates & WLAN_RATE_11M ?
1681 0x96 : 0x16;
1682 (*lpos)++;
1683 }
1684 pos = (u16 *) p;
1685 }
1686
4339d328
JM		 1687 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
1688 (send_deauth ? IEEE80211_STYPE_DEAUTH :
1689 (reassoc ? IEEE80211_STYPE_REASSOC_RESP :
1690 IEEE80211_STYPE_ASSOC_RESP)),
ff1d2767
JM		 1691 body, (u8 *) pos - (u8 *) body,
1692 hdr->addr2,
1693 send_deauth ? 0 : local->ap->tx_callback_assoc);
1694
1695 if (sta) {
1696 if (resp == WLAN_STATUS_SUCCESS) {
1697 sta->last_rx = jiffies;
1698 /* STA will be marked associated from TX callback, if
1699 * AssocResp is ACKed */
1700 }
1701 atomic_dec(&sta->users);
1702 }
1703
1704#if 0
0795af57
JP		 1705 PDEBUG(DEBUG_AP, "%s: %s %sassoc (len=%d "
1706 "prev_ap=%s) => %d(%d) (%s)\n",
1707 dev->name, print_mac(mac, hdr->addr2), reassoc ? "re" : "", len,
1708 print_mac(mac, prev_ap), resp, send_deauth, txt);
ff1d2767
JM		 1709#endif
1710}
1711
1712
1713/* Called only as a scheduled task for pending AP frames. */
1714static void handle_deauth(local_info_t *local, struct sk_buff *skb,
1715 struct hostap_80211_rx_status *rx_stats)
1716{
1717 struct net_device *dev = local->dev;
d041674d 1718 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 1719 char *body = (char *) (skb->data + IEEE80211_MGMT_HDR_LEN);
1720 int len;
1721 u16 reason_code, *pos;
1722 struct sta_info *sta = NULL;
0795af57 1723 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 1724
1725 len = skb->len - IEEE80211_MGMT_HDR_LEN;
1726
1727 if (len < 2) {
1728 printk("handle_deauth - too short payload (len=%d)\n", len);
1729 return;
1730 }
1731
1732 pos = (u16 *) body;
1733 reason_code = __le16_to_cpu(*pos);
1734
0795af57
JP		 1735 PDEBUG(DEBUG_AP, "%s: deauthentication: %s len=%d, "
1736 "reason_code=%d\n", dev->name, print_mac(mac, hdr->addr2), len,
ff1d2767
JM		 1737 reason_code);
1738
1739 spin_lock_bh(&local->ap->sta_table_lock);
1740 sta = ap_get_sta(local->ap, hdr->addr2);
1741 if (sta != NULL) {
1742 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
1743 hostap_event_expired_sta(local->dev, sta);
1744 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
1745 }
1746 spin_unlock_bh(&local->ap->sta_table_lock);
1747 if (sta == NULL) {
0795af57 1748 printk("%s: deauthentication from %s, "
ff1d2767 1749 "reason_code=%d, but STA not authenticated\n", dev->name,
0795af57 1750 print_mac(mac, hdr->addr2), reason_code);
ff1d2767
JM		 1751 }
1752}
1753
1754
1755/* Called only as a scheduled task for pending AP frames. */
1756static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
1757 struct hostap_80211_rx_status *rx_stats)
1758{
1759 struct net_device *dev = local->dev;
d041674d 1760 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 1761 char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
1762 int len;
1763 u16 reason_code, *pos;
1764 struct sta_info *sta = NULL;
0795af57 1765 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 1766
1767 len = skb->len - IEEE80211_MGMT_HDR_LEN;
1768
1769 if (len < 2) {
1770 printk("handle_disassoc - too short payload (len=%d)\n", len);
1771 return;
1772 }
1773
1774 pos = (u16 *) body;
1775 reason_code = __le16_to_cpu(*pos);
1776
0795af57
JP		 1777 PDEBUG(DEBUG_AP, "%s: disassociation: %s len=%d, "
1778 "reason_code=%d\n", dev->name, print_mac(mac, hdr->addr2), len,
ff1d2767
JM		 1779 reason_code);
1780
1781 spin_lock_bh(&local->ap->sta_table_lock);
1782 sta = ap_get_sta(local->ap, hdr->addr2);
1783 if (sta != NULL) {
1784 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
1785 hostap_event_expired_sta(local->dev, sta);
1786 sta->flags &= ~WLAN_STA_ASSOC;
1787 }
1788 spin_unlock_bh(&local->ap->sta_table_lock);
1789 if (sta == NULL) {
0795af57 1790 printk("%s: disassociation from %s, "
ff1d2767 1791 "reason_code=%d, but STA not authenticated\n",
0795af57 1792 dev->name, print_mac(mac, hdr->addr2), reason_code);
ff1d2767
JM		 1793 }
1794}
1795
1796
1797/* Called only as a scheduled task for pending AP frames. */
1798static void ap_handle_data_nullfunc(local_info_t *local,
d041674d 1799 struct ieee80211_hdr_4addr *hdr)
ff1d2767
JM		 1800{
1801 struct net_device *dev = local->dev;
1802
1803 /* some STA f/w's seem to require control::ACK frame for
1804 * data::nullfunc, but at least Prism2 station f/w version 0.8.0 does
1805 * not send this..
1806 * send control::ACK for the data::nullfunc */
1807
1808 printk(KERN_DEBUG "Sending control::ACK for data::nullfunc\n");
4339d328 1809 prism2_send_mgmt(dev, IEEE80211_FTYPE_CTL | IEEE80211_STYPE_ACK,
ff1d2767
JM		 1810 NULL, 0, hdr->addr2, 0);
1811}
1812
1813
1814/* Called only as a scheduled task for pending AP frames. */
1815static void ap_handle_dropped_data(local_info_t *local,
d041674d 1816 struct ieee80211_hdr_4addr *hdr)
ff1d2767
JM		 1817{
1818 struct net_device *dev = local->dev;
1819 struct sta_info *sta;
1820 u16 reason;
1821
1822 spin_lock_bh(&local->ap->sta_table_lock);
1823 sta = ap_get_sta(local->ap, hdr->addr2);
1824 if (sta)
1825 atomic_inc(&sta->users);
1826 spin_unlock_bh(&local->ap->sta_table_lock);
1827
1828 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC)) {
1829 PDEBUG(DEBUG_AP, "ap_handle_dropped_data: STA is now okay?\n");
1830 atomic_dec(&sta->users);
1831 return;
1832 }
1833
1834 reason = __constant_cpu_to_le16(
1835 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
4339d328 1836 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
ff1d2767 1837 ((sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) ?
4339d328 1838 IEEE80211_STYPE_DEAUTH : IEEE80211_STYPE_DISASSOC),
ff1d2767
JM		 1839 (char *) &reason, sizeof(reason), hdr->addr2, 0);
1840
1841 if (sta)
1842 atomic_dec(&sta->users);
1843}
1844
1845#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
1846
1847
1848/* Called only as a scheduled task for pending AP frames. */
1849static void pspoll_send_buffered(local_info_t *local, struct sta_info *sta,
1850 struct sk_buff *skb)
1851{
5bee720f
JM		 1852 struct hostap_skb_tx_data *meta;
1853
ff1d2767
JM		 1854 if (!(sta->flags & WLAN_STA_PS)) {
1855 /* Station has moved to non-PS mode, so send all buffered
1856 * frames using normal device queue. */
1857 dev_queue_xmit(skb);
1858 return;
1859 }
1860
1861 /* add a flag for hostap_handle_sta_tx() to know that this skb should
1862 * be passed through even though STA is using PS */
5bee720f
JM		 1863 meta = (struct hostap_skb_tx_data *) skb->cb;
1864 meta->flags |= HOSTAP_TX_FLAGS_BUFFERED_FRAME;
ff1d2767
JM		 1865 if (!skb_queue_empty(&sta->tx_buf)) {
1866 /* indicate to STA that more frames follow */
5bee720f 1867 meta->flags |= HOSTAP_TX_FLAGS_ADD_MOREDATA;
ff1d2767
JM		 1868 }
1869 dev_queue_xmit(skb);
1870}
1871
1872
1873/* Called only as a scheduled task for pending AP frames. */
1874static void handle_pspoll(local_info_t *local,
d041674d 1875 struct ieee80211_hdr_4addr *hdr,
ff1d2767
JM		 1876 struct hostap_80211_rx_status *rx_stats)
1877{
1878 struct net_device *dev = local->dev;
1879 struct sta_info *sta;
1880 u16 aid;
1881 struct sk_buff *skb;
0795af57 1882 DECLARE_MAC_BUF(mac);
ff1d2767 1883
0795af57
JP		 1884 PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=%s"
1885 ", TA=%s PWRMGT=%d\n",
1886 print_mac(mac, hdr->addr1), print_mac(mac, hdr->addr2),
b2f4a2e3 1887 !!(le16_to_cpu(hdr->frame_ctl) & IEEE80211_FCTL_PM));
ff1d2767
JM		 1888
1889 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
0795af57
JP		 1890 PDEBUG(DEBUG_AP, "handle_pspoll - addr1(BSSID)=%s"
1891 " not own MAC\n", print_mac(mac, hdr->addr1));
ff1d2767
JM		 1892 return;
1893 }
1894
1895 aid = __le16_to_cpu(hdr->duration_id);
1896 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14))) {
1897 PDEBUG(DEBUG_PS, " PSPOLL and AID[15:14] not set\n");
1898 return;
1899 }
1900 aid &= ~BIT(15) & ~BIT(14);
1901 if (aid == 0 || aid > MAX_AID_TABLE_SIZE) {
1902 PDEBUG(DEBUG_PS, " invalid aid=%d\n", aid);
1903 return;
1904 }
1905 PDEBUG(DEBUG_PS2, " aid=%d\n", aid);
1906
1907 spin_lock_bh(&local->ap->sta_table_lock);
1908 sta = ap_get_sta(local->ap, hdr->addr2);
1909 if (sta)
1910 atomic_inc(&sta->users);
1911 spin_unlock_bh(&local->ap->sta_table_lock);
1912
1913 if (sta == NULL) {
1914 PDEBUG(DEBUG_PS, " STA not found\n");
1915 return;
1916 }
1917 if (sta->aid != aid) {
1918 PDEBUG(DEBUG_PS, " received aid=%i does not match with "
1919 "assoc.aid=%d\n", aid, sta->aid);
1920 return;
1921 }
1922
1923 /* FIX: todo:
1924 * - add timeout for buffering (clear aid in TIM vector if buffer timed
1925 * out (expiry time must be longer than ListenInterval for
1926 * the corresponding STA; "8802-11: 11.2.1.9 AP aging function"
1927 * - what to do, if buffered, pspolled, and sent frame is not ACKed by
1928 * sta; store buffer for later use and leave TIM aid bit set? use
1929 * TX event to check whether frame was ACKed?
1930 */
1931
1932 while ((skb = skb_dequeue(&sta->tx_buf)) != NULL) {
1933 /* send buffered frame .. */
1934 PDEBUG(DEBUG_PS2, "Sending buffered frame to STA after PS POLL"
1935 " (buffer_count=%d)\n", skb_queue_len(&sta->tx_buf));
1936
1937 pspoll_send_buffered(local, sta, skb);
1938
1939 if (sta->flags & WLAN_STA_PS) {
1940 /* send only one buffered packet per PS Poll */
1941 /* FIX: should ignore further PS Polls until the
1942 * buffered packet that was just sent is acknowledged
1943 * (Tx or TxExc event) */
1944 break;
1945 }
1946 }
1947
1948 if (skb_queue_empty(&sta->tx_buf)) {
1949 /* try to clear aid from TIM */
1950 if (!(sta->flags & WLAN_STA_TIM))
1951 PDEBUG(DEBUG_PS2, "Re-unsetting TIM for aid %d\n",
1952 aid);
1953 hostap_set_tim(local, aid, 0);
1954 sta->flags &= ~WLAN_STA_TIM;
1955 }
1956
1957 atomic_dec(&sta->users);
1958}
1959
1960
1961#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1962
c4028958 1963static void handle_wds_oper_queue(struct work_struct *work)
ff1d2767 1964{
c4028958
DH		 1965 struct ap_data *ap = container_of(work, struct ap_data,
1966 wds_oper_queue);
1967 local_info_t *local = ap->local;
ff1d2767 1968 struct wds_oper_data *entry, *prev;
0795af57 1969 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 1970
1971 spin_lock_bh(&local->lock);
1972 entry = local->ap->wds_oper_entries;
1973 local->ap->wds_oper_entries = NULL;
1974 spin_unlock_bh(&local->lock);
1975
1976 while (entry) {
1977 PDEBUG(DEBUG_AP, "%s: %s automatic WDS connection "
0795af57 1978 "to AP %s\n",
ff1d2767
JM		 1979 local->dev->name,
1980 entry->type == WDS_ADD ? "adding" : "removing",
0795af57 1981 print_mac(mac, entry->addr));
ff1d2767
JM		 1982 if (entry->type == WDS_ADD)
1983 prism2_wds_add(local, entry->addr, 0);
1984 else if (entry->type == WDS_DEL)
1985 prism2_wds_del(local, entry->addr, 0, 1);
1986
1987 prev = entry;
1988 entry = entry->next;
1989 kfree(prev);
1990 }
1991}
1992
1993
1994/* Called only as a scheduled task for pending AP frames. */
1995static void handle_beacon(local_info_t *local, struct sk_buff *skb,
1996 struct hostap_80211_rx_status *rx_stats)
1997{
d041674d 1998 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 1999 char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
2000 int len, left;
2001 u16 *pos, beacon_int, capability;
2002 char *ssid = NULL;
2003 unsigned char *supp_rates = NULL;
2004 int ssid_len = 0, supp_rates_len = 0;
2005 struct sta_info *sta = NULL;
2006 int new_sta = 0, channel = -1;
2007
2008 len = skb->len - IEEE80211_MGMT_HDR_LEN;
2009
2010 if (len < 8 + 2 + 2) {
2011 printk(KERN_DEBUG "handle_beacon - too short payload "
2012 "(len=%d)\n", len);
2013 return;
2014 }
2015
2016 pos = (u16 *) body;
2017 left = len;
2018
2019 /* Timestamp (8 octets) */
2020 pos += 4; left -= 8;
2021 /* Beacon interval (2 octets) */
2022 beacon_int = __le16_to_cpu(*pos);
2023 pos++; left -= 2;
2024 /* Capability information (2 octets) */
2025 capability = __le16_to_cpu(*pos);
2026 pos++; left -= 2;
2027
2028 if (local->ap->ap_policy != AP_OTHER_AP_EVEN_IBSS &&
2029 capability & WLAN_CAPABILITY_IBSS)
2030 return;
2031
2032 if (left >= 2) {
2033 unsigned int ileft;
2034 unsigned char *u = (unsigned char *) pos;
2035
2036 if (*u == WLAN_EID_SSID) {
2037 u++; left--;
2038 ileft = *u;
2039 u++; left--;
2040
2041 if (ileft > left || ileft > MAX_SSID_LEN) {
2042 PDEBUG(DEBUG_AP, "SSID: overflow\n");
2043 return;
2044 }
2045
2046 if (local->ap->ap_policy == AP_OTHER_AP_SAME_SSID &&
2047 (ileft != strlen(local->essid) ||
2048 memcmp(local->essid, u, ileft) != 0)) {
2049 /* not our SSID */
2050 return;
2051 }
2052
2053 ssid = u;
2054 ssid_len = ileft;
2055
2056 u += ileft;
2057 left -= ileft;
2058 }
2059
2060 if (*u == WLAN_EID_SUPP_RATES) {
2061 u++; left--;
2062 ileft = *u;
2063 u++; left--;
74fae82c 2064
ff1d2767
JM		 2065 if (ileft > left || ileft == 0 || ileft > 8) {
2066 PDEBUG(DEBUG_AP, " - SUPP_RATES len error\n");
2067 return;
2068 }
2069
2070 supp_rates = u;
2071 supp_rates_len = ileft;
2072
2073 u += ileft;
2074 left -= ileft;
2075 }
2076
2077 if (*u == WLAN_EID_DS_PARAMS) {
2078 u++; left--;
2079 ileft = *u;
2080 u++; left--;
74fae82c 2081
ff1d2767
JM		 2082 if (ileft > left || ileft != 1) {
2083 PDEBUG(DEBUG_AP, " - DS_PARAMS len error\n");
2084 return;
2085 }
2086
2087 channel = *u;
2088
2089 u += ileft;
2090 left -= ileft;
2091 }
2092 }
2093
2094 spin_lock_bh(&local->ap->sta_table_lock);
2095 sta = ap_get_sta(local->ap, hdr->addr2);
2096 if (sta != NULL)
2097 atomic_inc(&sta->users);
2098 spin_unlock_bh(&local->ap->sta_table_lock);
2099
2100 if (sta == NULL) {
2101 /* add new AP */
2102 new_sta = 1;
2103 sta = ap_add_sta(local->ap, hdr->addr2);
2104 if (sta == NULL) {
2105 printk(KERN_INFO "prism2: kmalloc failed for AP "
2106 "data structure\n");
2107 return;
2108 }
2109 hostap_event_new_sta(local->dev, sta);
2110
2111 /* mark APs authentication and associated for pseudo ad-hoc
2112 * style communication */
2113 sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
2114
2115 if (local->ap->autom_ap_wds) {
2116 hostap_wds_link_oper(local, sta->addr, WDS_ADD);
2117 }
2118 }
2119
2120 sta->ap = 1;
2121 if (ssid) {
2122 sta->u.ap.ssid_len = ssid_len;
2123 memcpy(sta->u.ap.ssid, ssid, ssid_len);
2124 sta->u.ap.ssid[ssid_len] = '\0';
2125 } else {
2126 sta->u.ap.ssid_len = 0;
2127 sta->u.ap.ssid[0] = '\0';
2128 }
2129 sta->u.ap.channel = channel;
2130 sta->rx_packets++;
2131 sta->rx_bytes += len;
2132 sta->u.ap.last_beacon = sta->last_rx = jiffies;
2133 sta->capability = capability;
2134 sta->listen_interval = beacon_int;
2135
2136 atomic_dec(&sta->users);
2137
2138 if (new_sta) {
2139 memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
2140 memcpy(sta->supported_rates, supp_rates, supp_rates_len);
2141 prism2_check_tx_rates(sta);
2142 }
2143}
2144
2145#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2146
2147
2148/* Called only as a tasklet. */
2149static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
2150 struct hostap_80211_rx_status *rx_stats)
2151{
2152#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2153 struct net_device *dev = local->dev;
2154#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2155 u16 fc, type, stype;
d041674d 2156 struct ieee80211_hdr_4addr *hdr;
0795af57 2157 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 2158
2159 /* FIX: should give skb->len to handler functions and check that the
2160 * buffer is long enough */
d041674d 2161 hdr = (struct ieee80211_hdr_4addr *) skb->data;
c0f72ca8 2162 fc = le16_to_cpu(hdr->frame_ctl);
4339d328
JM		 2163 type = WLAN_FC_GET_TYPE(fc);
2164 stype = WLAN_FC_GET_STYPE(fc);
ff1d2767
JM		 2165
2166#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
4339d328 2167 if (!local->hostapd && type == IEEE80211_FTYPE_DATA) {
ff1d2767
JM		 2168 PDEBUG(DEBUG_AP, "handle_ap_item - data frame\n");
2169
b2f4a2e3
JM		 2170 if (!(fc & IEEE80211_FCTL_TODS) ||
2171 (fc & IEEE80211_FCTL_FROMDS)) {
4339d328 2172 if (stype == IEEE80211_STYPE_NULLFUNC) {
ff1d2767
JM		 2173 /* no ToDS nullfunc seems to be used to check
2174 * AP association; so send reject message to
2175 * speed up re-association */
2176 ap_handle_dropped_data(local, hdr);
2177 goto done;
2178 }
2179 PDEBUG(DEBUG_AP, " not ToDS frame (fc=0x%04x)\n",
2180 fc);
2181 goto done;
2182 }
2183
2184 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
2185 PDEBUG(DEBUG_AP, "handle_ap_item - addr1(BSSID)="
0795af57
JP		 2186 "%s not own MAC\n",
2187 print_mac(mac, hdr->addr1));
ff1d2767
JM		 2188 goto done;
2189 }
2190
4339d328
JM		 2191 if (local->ap->nullfunc_ack &&
2192 stype == IEEE80211_STYPE_NULLFUNC)
ff1d2767
JM		 2193 ap_handle_data_nullfunc(local, hdr);
2194 else
2195 ap_handle_dropped_data(local, hdr);
2196 goto done;
2197 }
2198
4339d328 2199 if (type == IEEE80211_FTYPE_MGMT && stype == IEEE80211_STYPE_BEACON) {
ff1d2767
JM		 2200 handle_beacon(local, skb, rx_stats);
2201 goto done;
2202 }
2203#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2204
4339d328 2205 if (type == IEEE80211_FTYPE_CTL && stype == IEEE80211_STYPE_PSPOLL) {
ff1d2767
JM		 2206 handle_pspoll(local, hdr, rx_stats);
2207 goto done;
2208 }
2209
2210 if (local->hostapd) {
2211 PDEBUG(DEBUG_AP, "Unknown frame in AP queue: type=0x%02x "
2212 "subtype=0x%02x\n", type, stype);
2213 goto done;
2214 }
2215
2216#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
4339d328 2217 if (type != IEEE80211_FTYPE_MGMT) {
ff1d2767
JM		 2218 PDEBUG(DEBUG_AP, "handle_ap_item - not a management frame?\n");
2219 goto done;
2220 }
2221
2222 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
0795af57
JP		 2223 PDEBUG(DEBUG_AP, "handle_ap_item - addr1(DA)=%s"
2224 " not own MAC\n", print_mac(mac, hdr->addr1));
ff1d2767
JM		 2225 goto done;
2226 }
2227
2228 if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN)) {
0795af57
JP		 2229 PDEBUG(DEBUG_AP, "handle_ap_item - addr3(BSSID)=%s"
2230 " not own MAC\n", print_mac(mac, hdr->addr3));
ff1d2767
JM		 2231 goto done;
2232 }
2233
2234 switch (stype) {
4339d328 2235 case IEEE80211_STYPE_ASSOC_REQ:
ff1d2767
JM		 2236 handle_assoc(local, skb, rx_stats, 0);
2237 break;
4339d328 2238 case IEEE80211_STYPE_ASSOC_RESP:
ff1d2767
JM		 2239 PDEBUG(DEBUG_AP, "==> ASSOC RESP (ignored)\n");
2240 break;
4339d328 2241 case IEEE80211_STYPE_REASSOC_REQ:
ff1d2767
JM		 2242 handle_assoc(local, skb, rx_stats, 1);
2243 break;
4339d328 2244 case IEEE80211_STYPE_REASSOC_RESP:
ff1d2767
JM		 2245 PDEBUG(DEBUG_AP, "==> REASSOC RESP (ignored)\n");
2246 break;
4339d328 2247 case IEEE80211_STYPE_ATIM:
ff1d2767
JM		 2248 PDEBUG(DEBUG_AP, "==> ATIM (ignored)\n");
2249 break;
4339d328 2250 case IEEE80211_STYPE_DISASSOC:
ff1d2767
JM		 2251 handle_disassoc(local, skb, rx_stats);
2252 break;
4339d328 2253 case IEEE80211_STYPE_AUTH:
ff1d2767
JM		 2254 handle_authen(local, skb, rx_stats);
2255 break;
4339d328 2256 case IEEE80211_STYPE_DEAUTH:
ff1d2767
JM		 2257 handle_deauth(local, skb, rx_stats);
2258 break;
2259 default:
4339d328
JM		 2260 PDEBUG(DEBUG_AP, "Unknown mgmt frame subtype 0x%02x\n",
2261 stype >> 4);
ff1d2767
JM		 2262 break;
2263 }
2264#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2265
2266 done:
2267 dev_kfree_skb(skb);
2268}
2269
2270
2271/* Called only as a tasklet (software IRQ) */
2272void hostap_rx(struct net_device *dev, struct sk_buff *skb,
2273 struct hostap_80211_rx_status *rx_stats)
2274{
2275 struct hostap_interface *iface;
2276 local_info_t *local;
2277 u16 fc;
d041674d 2278 struct ieee80211_hdr_4addr *hdr;
ff1d2767
JM		 2279
2280 iface = netdev_priv(dev);
2281 local = iface->local;
2282
2283 if (skb->len < 16)
2284 goto drop;
2285
2286 local->stats.rx_packets++;
2287
d041674d 2288 hdr = (struct ieee80211_hdr_4addr *) skb->data;
c0f72ca8 2289 fc = le16_to_cpu(hdr->frame_ctl);
ff1d2767
JM		 2290
2291 if (local->ap->ap_policy == AP_OTHER_AP_SKIP_ALL &&
4339d328
JM		 2292 WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_MGMT &&
2293 WLAN_FC_GET_STYPE(fc) == IEEE80211_STYPE_BEACON)
ff1d2767
JM		 2294 goto drop;
2295
2296 skb->protocol = __constant_htons(ETH_P_HOSTAP);
2297 handle_ap_item(local, skb, rx_stats);
2298 return;
2299
2300 drop:
2301 dev_kfree_skb(skb);
2302}
2303
2304
2305/* Called only as a tasklet (software IRQ) */
2306static void schedule_packet_send(local_info_t *local, struct sta_info *sta)
2307{
2308 struct sk_buff *skb;
d041674d 2309 struct ieee80211_hdr_4addr *hdr;
ff1d2767 2310 struct hostap_80211_rx_status rx_stats;
0795af57 2311 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 2312
2313 if (skb_queue_empty(&sta->tx_buf))
2314 return;
2315
2316 skb = dev_alloc_skb(16);
2317 if (skb == NULL) {
2318 printk(KERN_DEBUG "%s: schedule_packet_send: skb alloc "
2319 "failed\n", local->dev->name);
2320 return;
2321 }
2322
d041674d 2323 hdr = (struct ieee80211_hdr_4addr *) skb_put(skb, 16);
ff1d2767
JM		 2324
2325 /* Generate a fake pspoll frame to start packet delivery */
c0f72ca8 2326 hdr->frame_ctl = __constant_cpu_to_le16(
4339d328 2327 IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
ff1d2767
JM		 2328 memcpy(hdr->addr1, local->dev->dev_addr, ETH_ALEN);
2329 memcpy(hdr->addr2, sta->addr, ETH_ALEN);
2330 hdr->duration_id = cpu_to_le16(sta->aid | BIT(15) | BIT(14));
2331
0795af57
JP		 2332 PDEBUG(DEBUG_PS2, "%s: Scheduling buffered packet delivery for STA "
2333 "%s\n", local->dev->name, print_mac(mac, sta->addr));
ff1d2767
JM		 2334
2335 skb->dev = local->dev;
2336
2337 memset(&rx_stats, 0, sizeof(rx_stats));
2338 hostap_rx(local->dev, skb, &rx_stats);
2339}
2340
2341
5fad5a2e
AB		 2342int prism2_ap_get_sta_qual(local_info_t *local, struct sockaddr addr[],
2343 struct iw_quality qual[], int buf_size,
2344 int aplist)
ff1d2767
JM		 2345{
2346 struct ap_data *ap = local->ap;
2347 struct list_head *ptr;
2348 int count = 0;
2349
2350 spin_lock_bh(&ap->sta_table_lock);
2351
2352 for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list;
2353 ptr = ptr->next) {
2354 struct sta_info *sta = (struct sta_info *) ptr;
2355
2356 if (aplist && !sta->ap)
2357 continue;
2358 addr[count].sa_family = ARPHRD_ETHER;
2359 memcpy(addr[count].sa_data, sta->addr, ETH_ALEN);
2360 if (sta->last_rx_silence == 0)
2361 qual[count].qual = sta->last_rx_signal < 27 ?
2362 0 : (sta->last_rx_signal - 27) * 92 / 127;
2363 else
2364 qual[count].qual = sta->last_rx_signal -
2365 sta->last_rx_silence - 35;
2366 qual[count].level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
2367 qual[count].noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
2368 qual[count].updated = sta->last_rx_updated;
2369
c28df16e 2370 sta->last_rx_updated = IW_QUAL_DBM;
ff1d2767
JM		 2371
2372 count++;
2373 if (count >= buf_size)
2374 break;
2375 }
2376 spin_unlock_bh(&ap->sta_table_lock);
2377
2378 return count;
2379}
2380
2381
2382/* Translate our list of Access Points & Stations to a card independant
2383 * format that the Wireless Tools will understand - Jean II */
5fad5a2e 2384int prism2_ap_translate_scan(struct net_device *dev, char *buffer)
ff1d2767
JM		 2385{
2386 struct hostap_interface *iface;
2387 local_info_t *local;
2388 struct ap_data *ap;
2389 struct list_head *ptr;
2390 struct iw_event iwe;
2391 char *current_ev = buffer;
2392 char *end_buf = buffer + IW_SCAN_MAX_DATA;
2393#if !defined(PRISM2_NO_KERNEL_IEEE80211_MGMT)
2394 char buf[64];
2395#endif
2396
2397 iface = netdev_priv(dev);
2398 local = iface->local;
2399 ap = local->ap;
2400
2401 spin_lock_bh(&ap->sta_table_lock);
2402
2403 for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list;
2404 ptr = ptr->next) {
2405 struct sta_info *sta = (struct sta_info *) ptr;
2406
2407 /* First entry *MUST* be the AP MAC address */
2408 memset(&iwe, 0, sizeof(iwe));
2409 iwe.cmd = SIOCGIWAP;
2410 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2411 memcpy(iwe.u.ap_addr.sa_data, sta->addr, ETH_ALEN);
2412 iwe.len = IW_EV_ADDR_LEN;
2413 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2414 IW_EV_ADDR_LEN);
2415
2416 /* Use the mode to indicate if it's a station or
2417 * an Access Point */
2418 memset(&iwe, 0, sizeof(iwe));
2419 iwe.cmd = SIOCGIWMODE;
2420 if (sta->ap)
2421 iwe.u.mode = IW_MODE_MASTER;
2422 else
2423 iwe.u.mode = IW_MODE_INFRA;
2424 iwe.len = IW_EV_UINT_LEN;
2425 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2426 IW_EV_UINT_LEN);
2427
2428 /* Some quality */
2429 memset(&iwe, 0, sizeof(iwe));
2430 iwe.cmd = IWEVQUAL;
2431 if (sta->last_rx_silence == 0)
2432 iwe.u.qual.qual = sta->last_rx_signal < 27 ?
2433 0 : (sta->last_rx_signal - 27) * 92 / 127;
2434 else
2435 iwe.u.qual.qual = sta->last_rx_signal -
2436 sta->last_rx_silence - 35;
2437 iwe.u.qual.level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
2438 iwe.u.qual.noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
2439 iwe.u.qual.updated = sta->last_rx_updated;
2440 iwe.len = IW_EV_QUAL_LEN;
2441 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
2442 IW_EV_QUAL_LEN);
2443
2444#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2445 if (sta->ap) {
2446 memset(&iwe, 0, sizeof(iwe));
2447 iwe.cmd = SIOCGIWESSID;
2448 iwe.u.data.length = sta->u.ap.ssid_len;
2449 iwe.u.data.flags = 1;
2450 current_ev = iwe_stream_add_point(current_ev, end_buf,
2451 &iwe,
2452 sta->u.ap.ssid);
2453
2454 memset(&iwe, 0, sizeof(iwe));
2455 iwe.cmd = SIOCGIWENCODE;
2456 if (sta->capability & WLAN_CAPABILITY_PRIVACY)
2457 iwe.u.data.flags =
2458 IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2459 else
2460 iwe.u.data.flags = IW_ENCODE_DISABLED;
2461 current_ev = iwe_stream_add_point(current_ev, end_buf,
2462 &iwe,
2463 sta->u.ap.ssid
2464 /* 0 byte memcpy */);
2465
2466 if (sta->u.ap.channel > 0 &&
2467 sta->u.ap.channel <= FREQ_COUNT) {
2468 memset(&iwe, 0, sizeof(iwe));
2469 iwe.cmd = SIOCGIWFREQ;
2470 iwe.u.freq.m = freq_list[sta->u.ap.channel - 1]
2471 * 100000;
2472 iwe.u.freq.e = 1;
2473 current_ev = iwe_stream_add_event(
2474 current_ev, end_buf, &iwe,
2475 IW_EV_FREQ_LEN);
2476 }
2477
2478 memset(&iwe, 0, sizeof(iwe));
2479 iwe.cmd = IWEVCUSTOM;
2480 sprintf(buf, "beacon_interval=%d",
2481 sta->listen_interval);
2482 iwe.u.data.length = strlen(buf);
2483 current_ev = iwe_stream_add_point(current_ev, end_buf,
2484 &iwe, buf);
2485 }
2486#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2487
c28df16e 2488 sta->last_rx_updated = IW_QUAL_DBM;
ff1d2767
JM		 2489
2490 /* To be continued, we should make good use of IWEVCUSTOM */
2491 }
2492
2493 spin_unlock_bh(&ap->sta_table_lock);
2494
2495 return current_ev - buffer;
2496}
2497
2498
2499static int prism2_hostapd_add_sta(struct ap_data *ap,
2500 struct prism2_hostapd_param *param)
2501{
2502 struct sta_info *sta;
2503
2504 spin_lock_bh(&ap->sta_table_lock);
2505 sta = ap_get_sta(ap, param->sta_addr);
2506 if (sta)
2507 atomic_inc(&sta->users);
2508 spin_unlock_bh(&ap->sta_table_lock);
2509
2510 if (sta == NULL) {
2511 sta = ap_add_sta(ap, param->sta_addr);
2512 if (sta == NULL)
2513 return -1;
2514 }
2515
2516 if (!(sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
2517 hostap_event_new_sta(sta->local->dev, sta);
2518
2519 sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
2520 sta->last_rx = jiffies;
2521 sta->aid = param->u.add_sta.aid;
2522 sta->capability = param->u.add_sta.capability;
2523 sta->tx_supp_rates = param->u.add_sta.tx_supp_rates;
2524 if (sta->tx_supp_rates & WLAN_RATE_1M)
2525 sta->supported_rates[0] = 2;
2526 if (sta->tx_supp_rates & WLAN_RATE_2M)
2527 sta->supported_rates[1] = 4;
2528 if (sta->tx_supp_rates & WLAN_RATE_5M5)
2529 sta->supported_rates[2] = 11;
2530 if (sta->tx_supp_rates & WLAN_RATE_11M)
2531 sta->supported_rates[3] = 22;
2532 prism2_check_tx_rates(sta);
2533 atomic_dec(&sta->users);
2534 return 0;
2535}
2536
2537
2538static int prism2_hostapd_remove_sta(struct ap_data *ap,
2539 struct prism2_hostapd_param *param)
2540{
2541 struct sta_info *sta;
2542
2543 spin_lock_bh(&ap->sta_table_lock);
2544 sta = ap_get_sta(ap, param->sta_addr);
2545 if (sta) {
2546 ap_sta_hash_del(ap, sta);
2547 list_del(&sta->list);
2548 }
2549 spin_unlock_bh(&ap->sta_table_lock);
2550
2551 if (!sta)
2552 return -ENOENT;
2553
2554 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
2555 hostap_event_expired_sta(sta->local->dev, sta);
2556 ap_free_sta(ap, sta);
2557
2558 return 0;
2559}
2560
2561
2562static int prism2_hostapd_get_info_sta(struct ap_data *ap,
2563 struct prism2_hostapd_param *param)
2564{
2565 struct sta_info *sta;
2566
2567 spin_lock_bh(&ap->sta_table_lock);
2568 sta = ap_get_sta(ap, param->sta_addr);
2569 if (sta)
2570 atomic_inc(&sta->users);
2571 spin_unlock_bh(&ap->sta_table_lock);
2572
2573 if (!sta)
2574 return -ENOENT;
2575
2576 param->u.get_info_sta.inactive_sec = (jiffies - sta->last_rx) / HZ;
2577
2578 atomic_dec(&sta->users);
2579
2580 return 1;
2581}
2582
2583
2584static int prism2_hostapd_set_flags_sta(struct ap_data *ap,
2585 struct prism2_hostapd_param *param)
2586{
2587 struct sta_info *sta;
2588
2589 spin_lock_bh(&ap->sta_table_lock);
2590 sta = ap_get_sta(ap, param->sta_addr);
2591 if (sta) {
2592 sta->flags |= param->u.set_flags_sta.flags_or;
2593 sta->flags &= param->u.set_flags_sta.flags_and;
2594 }
2595 spin_unlock_bh(&ap->sta_table_lock);
2596
2597 if (!sta)
2598 return -ENOENT;
2599
2600 return 0;
2601}
2602
2603
2604static int prism2_hostapd_sta_clear_stats(struct ap_data *ap,
2605 struct prism2_hostapd_param *param)
2606{
2607 struct sta_info *sta;
2608 int rate;
2609
2610 spin_lock_bh(&ap->sta_table_lock);
2611 sta = ap_get_sta(ap, param->sta_addr);
2612 if (sta) {
2613 sta->rx_packets = sta->tx_packets = 0;
2614 sta->rx_bytes = sta->tx_bytes = 0;
2615 for (rate = 0; rate < WLAN_RATE_COUNT; rate++) {
2616 sta->tx_count[rate] = 0;
2617 sta->rx_count[rate] = 0;
2618 }
2619 }
2620 spin_unlock_bh(&ap->sta_table_lock);
2621
2622 if (!sta)
2623 return -ENOENT;
2624
2625 return 0;
2626}
2627
2628
5fad5a2e 2629int prism2_hostapd(struct ap_data *ap, struct prism2_hostapd_param *param)
ff1d2767
JM		 2630{
2631 switch (param->cmd) {
2632 case PRISM2_HOSTAPD_FLUSH:
2633 ap_control_kickall(ap);
2634 return 0;
2635 case PRISM2_HOSTAPD_ADD_STA:
2636 return prism2_hostapd_add_sta(ap, param);
2637 case PRISM2_HOSTAPD_REMOVE_STA:
2638 return prism2_hostapd_remove_sta(ap, param);
2639 case PRISM2_HOSTAPD_GET_INFO_STA:
2640 return prism2_hostapd_get_info_sta(ap, param);
2641 case PRISM2_HOSTAPD_SET_FLAGS_STA:
2642 return prism2_hostapd_set_flags_sta(ap, param);
2643 case PRISM2_HOSTAPD_STA_CLEAR_STATS:
2644 return prism2_hostapd_sta_clear_stats(ap, param);
2645 default:
2646 printk(KERN_WARNING "prism2_hostapd: unknown cmd=%d\n",
2647 param->cmd);
2648 return -EOPNOTSUPP;
2649 }
2650}
2651
2652
2653/* Update station info for host-based TX rate control and return current
2654 * TX rate */
2655static int ap_update_sta_tx_rate(struct sta_info *sta, struct net_device *dev)
2656{
2657 int ret = sta->tx_rate;
2658 struct hostap_interface *iface;
2659 local_info_t *local;
0795af57 2660 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 2661
2662 iface = netdev_priv(dev);
2663 local = iface->local;
2664
2665 sta->tx_count[sta->tx_rate_idx]++;
2666 sta->tx_since_last_failure++;
2667 sta->tx_consecutive_exc = 0;
2668 if (sta->tx_since_last_failure >= WLAN_RATE_UPDATE_COUNT &&
2669 sta->tx_rate_idx < sta->tx_max_rate) {
2670 /* use next higher rate */
2671 int old_rate, new_rate;
2672 old_rate = new_rate = sta->tx_rate_idx;
2673 while (new_rate < sta->tx_max_rate) {
2674 new_rate++;
2675 if (ap_tx_rate_ok(new_rate, sta, local)) {
2676 sta->tx_rate_idx = new_rate;
2677 break;
2678 }
2679 }
2680 if (old_rate != sta->tx_rate_idx) {
2681 switch (sta->tx_rate_idx) {
2682 case 0: sta->tx_rate = 10; break;
2683 case 1: sta->tx_rate = 20; break;
2684 case 2: sta->tx_rate = 55; break;
2685 case 3: sta->tx_rate = 110; break;
2686 default: sta->tx_rate = 0; break;
2687 }
0795af57
JP		 2688 PDEBUG(DEBUG_AP, "%s: STA %s"
2689 " TX rate raised to %d\n",
2690 dev->name, print_mac(mac, sta->addr), sta->tx_rate);
ff1d2767
JM		 2691 }
2692 sta->tx_since_last_failure = 0;
2693 }
2694
2695 return ret;
2696}
2697
2698
2699/* Called only from software IRQ. Called for each TX frame prior possible
2700 * encryption and transmit. */
2701ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
2702{
2703 struct sta_info *sta = NULL;
2704 struct sk_buff *skb = tx->skb;
2705 int set_tim, ret;
d041674d 2706 struct ieee80211_hdr_4addr *hdr;
ff1d2767 2707 struct hostap_skb_tx_data *meta;
0795af57 2708 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 2709
2710 meta = (struct hostap_skb_tx_data *) skb->cb;
2711 ret = AP_TX_CONTINUE;
2712 if (local->ap == NULL || skb->len < 10 ||
2713 meta->iface->type == HOSTAP_INTERFACE_STA)
2714 goto out;
2715
d041674d 2716 hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 2717
2718 if (hdr->addr1[0] & 0x01) {
2719 /* broadcast/multicast frame - no AP related processing */
b9180990
PR		 2720 if (local->ap->num_sta <= 0)
2721 ret = AP_TX_DROP;
ff1d2767
JM		 2722 goto out;
2723 }
2724
2725 /* unicast packet - check whether destination STA is associated */
2726 spin_lock(&local->ap->sta_table_lock);
2727 sta = ap_get_sta(local->ap, hdr->addr1);
2728 if (sta)
2729 atomic_inc(&sta->users);
2730 spin_unlock(&local->ap->sta_table_lock);
2731
5bee720f
JM		 2732 if (local->iw_mode == IW_MODE_MASTER && sta == NULL &&
2733 !(meta->flags & HOSTAP_TX_FLAGS_WDS) &&
ff1d2767
JM		 2734 meta->iface->type != HOSTAP_INTERFACE_MASTER &&
2735 meta->iface->type != HOSTAP_INTERFACE_AP) {
2736#if 0
2737 /* This can happen, e.g., when wlan0 is added to a bridge and
2738 * bridging code does not know which port is the correct target
2739 * for a unicast frame. In this case, the packet is send to all
2740 * ports of the bridge. Since this is a valid scenario, do not
2741 * print out any errors here. */
2742 if (net_ratelimit()) {
2743 printk(KERN_DEBUG "AP: drop packet to non-associated "
0795af57
JP		 2744 "STA %s\n",
2745 print_mac(mac, hdr->addr1));
ff1d2767
JM		 2746 }
2747#endif
2748 local->ap->tx_drop_nonassoc++;
2749 ret = AP_TX_DROP;
2750 goto out;
2751 }
2752
2753 if (sta == NULL)
2754 goto out;
2755
2756 if (!(sta->flags & WLAN_STA_AUTHORIZED))
2757 ret = AP_TX_CONTINUE_NOT_AUTHORIZED;
2758
2759 /* Set tx_rate if using host-based TX rate control */
2760 if (!local->fw_tx_rate_control)
2761 local->ap->last_tx_rate = meta->rate =
2762 ap_update_sta_tx_rate(sta, local->dev);
2763
2764 if (local->iw_mode != IW_MODE_MASTER)
2765 goto out;
2766
2767 if (!(sta->flags & WLAN_STA_PS))
2768 goto out;
2769
5bee720f
JM		 2770 if (meta->flags & HOSTAP_TX_FLAGS_ADD_MOREDATA) {
2771 /* indicate to STA that more frames follow */
b2f4a2e3
JM		 2772 hdr->frame_ctl |=
2773 __constant_cpu_to_le16(IEEE80211_FCTL_MOREDATA);
5bee720f 2774 }
ff1d2767 2775
5bee720f
JM		 2776 if (meta->flags & HOSTAP_TX_FLAGS_BUFFERED_FRAME) {
2777 /* packet was already buffered and now send due to
2778 * PS poll, so do not rebuffer it */
2779 goto out;
ff1d2767
JM		 2780 }
2781
2782 if (skb_queue_len(&sta->tx_buf) >= STA_MAX_TX_BUFFER) {
0795af57
JP		 2783 PDEBUG(DEBUG_PS, "%s: No more space in STA (%s"
2784 ")'s PS mode buffer\n",
2785 local->dev->name, print_mac(mac, sta->addr));
ff1d2767
JM		 2786 /* Make sure that TIM is set for the station (it might not be
2787 * after AP wlan hw reset). */
2788 /* FIX: should fix hw reset to restore bits based on STA
2789 * buffer state.. */
2790 hostap_set_tim(local, sta->aid, 1);
2791 sta->flags |= WLAN_STA_TIM;
2792 ret = AP_TX_DROP;
2793 goto out;
2794 }
2795
2796 /* STA in PS mode, buffer frame for later delivery */
2797 set_tim = skb_queue_empty(&sta->tx_buf);
2798 skb_queue_tail(&sta->tx_buf, skb);
2799 /* FIX: could save RX time to skb and expire buffered frames after
2800 * some time if STA does not poll for them */
2801
2802 if (set_tim) {
2803 if (sta->flags & WLAN_STA_TIM)
2804 PDEBUG(DEBUG_PS2, "Re-setting TIM for aid %d\n",
2805 sta->aid);
2806 hostap_set_tim(local, sta->aid, 1);
2807 sta->flags |= WLAN_STA_TIM;
2808 }
2809
2810 ret = AP_TX_BUFFERED;
2811
2812 out:
2813 if (sta != NULL) {
2814 if (ret == AP_TX_CONTINUE ||
2815 ret == AP_TX_CONTINUE_NOT_AUTHORIZED) {
2816 sta->tx_packets++;
2817 sta->tx_bytes += skb->len;
2818 sta->last_tx = jiffies;
2819 }
2820
2821 if ((ret == AP_TX_CONTINUE ||
2822 ret == AP_TX_CONTINUE_NOT_AUTHORIZED) &&
2823 sta->crypt && tx->host_encrypt) {
2824 tx->crypt = sta->crypt;
2825 tx->sta_ptr = sta; /* hostap_handle_sta_release() will
2826 * be called to release sta info
2827 * later */
2828 } else
2829 atomic_dec(&sta->users);
2830 }
2831
2832 return ret;
2833}
2834
2835
2836void hostap_handle_sta_release(void *ptr)
2837{
2838 struct sta_info *sta = ptr;
2839 atomic_dec(&sta->users);
2840}
2841
2842
2843/* Called only as a tasklet (software IRQ) */
2844void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb)
2845{
2846 struct sta_info *sta;
d041674d 2847 struct ieee80211_hdr_4addr *hdr;
ff1d2767 2848 struct hostap_skb_tx_data *meta;
0795af57 2849 DECLARE_MAC_BUF(mac);
ff1d2767 2850
d041674d 2851 hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767
JM		 2852 meta = (struct hostap_skb_tx_data *) skb->cb;
2853
2854 spin_lock(&local->ap->sta_table_lock);
2855 sta = ap_get_sta(local->ap, hdr->addr1);
2856 if (!sta) {
2857 spin_unlock(&local->ap->sta_table_lock);
0795af57
JP		 2858 PDEBUG(DEBUG_AP, "%s: Could not find STA %s"
2859 " for this TX error (@%lu)\n",
2860 local->dev->name, print_mac(mac, hdr->addr1), jiffies);
ff1d2767
JM		 2861 return;
2862 }
2863
2864 sta->tx_since_last_failure = 0;
2865 sta->tx_consecutive_exc++;
74fae82c 2866
ff1d2767
JM		 2867 if (sta->tx_consecutive_exc >= WLAN_RATE_DECREASE_THRESHOLD &&
2868 sta->tx_rate_idx > 0 && meta->rate <= sta->tx_rate) {
2869 /* use next lower rate */
2870 int old, rate;
2871 old = rate = sta->tx_rate_idx;
2872 while (rate > 0) {
2873 rate--;
2874 if (ap_tx_rate_ok(rate, sta, local)) {
2875 sta->tx_rate_idx = rate;
2876 break;
2877 }
2878 }
2879 if (old != sta->tx_rate_idx) {
2880 switch (sta->tx_rate_idx) {
2881 case 0: sta->tx_rate = 10; break;
2882 case 1: sta->tx_rate = 20; break;
2883 case 2: sta->tx_rate = 55; break;
2884 case 3: sta->tx_rate = 110; break;
2885 default: sta->tx_rate = 0; break;
2886 }
0795af57
JP		 2887 PDEBUG(DEBUG_AP, "%s: STA %s"
2888 " TX rate lowered to %d\n",
2889 local->dev->name, print_mac(mac, sta->addr),
ff1d2767
JM		 2890 sta->tx_rate);
2891 }
2892 sta->tx_consecutive_exc = 0;
2893 }
2894 spin_unlock(&local->ap->sta_table_lock);
2895}
2896
2897
2898static void hostap_update_sta_ps2(local_info_t *local, struct sta_info *sta,
2899 int pwrmgt, int type, int stype)
2900{
0795af57 2901 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 2902 if (pwrmgt && !(sta->flags & WLAN_STA_PS)) {
2903 sta->flags |= WLAN_STA_PS;
0795af57 2904 PDEBUG(DEBUG_PS2, "STA %s changed to use PS "
ff1d2767 2905 "mode (type=0x%02X, stype=0x%02X)\n",
0795af57 2906 print_mac(mac, sta->addr), type >> 2, stype >> 4);
ff1d2767
JM		 2907 } else if (!pwrmgt && (sta->flags & WLAN_STA_PS)) {
2908 sta->flags &= ~WLAN_STA_PS;
0795af57 2909 PDEBUG(DEBUG_PS2, "STA %s changed to not use "
ff1d2767 2910 "PS mode (type=0x%02X, stype=0x%02X)\n",
0795af57 2911 print_mac(mac, sta->addr), type >> 2, stype >> 4);
4339d328
JM		 2912 if (type != IEEE80211_FTYPE_CTL ||
2913 stype != IEEE80211_STYPE_PSPOLL)
ff1d2767
JM		 2914 schedule_packet_send(local, sta);
2915 }
2916}
2917
2918
2919/* Called only as a tasklet (software IRQ). Called for each RX frame to update
c0f72ca8 2920 * STA power saving state. pwrmgt is a flag from 802.11 frame_ctl field. */
d041674d 2921int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr_4addr *hdr)
ff1d2767
JM		 2922{
2923 struct sta_info *sta;
2924 u16 fc;
2925
2926 spin_lock(&local->ap->sta_table_lock);
2927 sta = ap_get_sta(local->ap, hdr->addr2);
2928 if (sta)
2929 atomic_inc(&sta->users);
2930 spin_unlock(&local->ap->sta_table_lock);
2931
2932 if (!sta)
2933 return -1;
2934
c0f72ca8 2935 fc = le16_to_cpu(hdr->frame_ctl);
b2f4a2e3 2936 hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM,
4339d328 2937 WLAN_FC_GET_TYPE(fc), WLAN_FC_GET_STYPE(fc));
ff1d2767
JM		 2938
2939 atomic_dec(&sta->users);
2940 return 0;
2941}
2942
2943
2944/* Called only as a tasklet (software IRQ). Called for each RX frame after
2945 * getting RX header and payload from hardware. */
2946ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
2947 struct sk_buff *skb,
2948 struct hostap_80211_rx_status *rx_stats,
2949 int wds)
2950{
2951 int ret;
2952 struct sta_info *sta;
2953 u16 fc, type, stype;
d041674d 2954 struct ieee80211_hdr_4addr *hdr;
0795af57 2955 DECLARE_MAC_BUF(mac);
ff1d2767
JM		 2956
2957 if (local->ap == NULL)
2958 return AP_RX_CONTINUE;
2959
d041674d 2960 hdr = (struct ieee80211_hdr_4addr *) skb->data;
ff1d2767 2961
c0f72ca8 2962 fc = le16_to_cpu(hdr->frame_ctl);
4339d328
JM		 2963 type = WLAN_FC_GET_TYPE(fc);
2964 stype = WLAN_FC_GET_STYPE(fc);
ff1d2767
JM		 2965
2966 spin_lock(&local->ap->sta_table_lock);
2967 sta = ap_get_sta(local->ap, hdr->addr2);
2968 if (sta)
2969 atomic_inc(&sta->users);
2970 spin_unlock(&local->ap->sta_table_lock);
2971
2972 if (sta && !(sta->flags & WLAN_STA_AUTHORIZED))
2973 ret = AP_RX_CONTINUE_NOT_AUTHORIZED;
2974 else
2975 ret = AP_RX_CONTINUE;
2976
2977
b2f4a2e3 2978 if (fc & IEEE80211_FCTL_TODS) {
ff1d2767
JM		 2979 if (!wds && (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
2980 if (local->hostapd) {
2981 prism2_rx_80211(local->apdev, skb, rx_stats,
2982 PRISM2_RX_NON_ASSOC);
2983#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2984 } else {
2985 printk(KERN_DEBUG "%s: dropped received packet"
0795af57
JP		 2986 " from non-associated STA "
2987 "%s"
ff1d2767 2988 " (type=0x%02x, subtype=0x%02x)\n",
0795af57 2989 dev->name, print_mac(mac, hdr->addr2),
4339d328 2990 type >> 2, stype >> 4);
ff1d2767
JM		 2991 hostap_rx(dev, skb, rx_stats);
2992#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2993 }
2994 ret = AP_RX_EXIT;
2995 goto out;
2996 }
b2f4a2e3 2997 } else if (fc & IEEE80211_FCTL_FROMDS) {
ff1d2767
JM		 2998 if (!wds) {
2999 /* FromDS frame - not for us; probably
3000 * broadcast/multicast in another BSS - drop */
3001 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
3002 printk(KERN_DEBUG "Odd.. FromDS packet "
3003 "received with own BSSID\n");
3004 hostap_dump_rx_80211(dev->name, skb, rx_stats);
3005 }
3006 ret = AP_RX_DROP;
3007 goto out;
3008 }
4339d328 3009 } else if (stype == IEEE80211_STYPE_NULLFUNC && sta == NULL &&
ff1d2767
JM		 3010 memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
3011
3012 if (local->hostapd) {
3013 prism2_rx_80211(local->apdev, skb, rx_stats,
3014 PRISM2_RX_NON_ASSOC);
3015#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
3016 } else {
3017 /* At least Lucent f/w seems to send data::nullfunc
3018 * frames with no ToDS flag when the current AP returns
3019 * after being unavailable for some time. Speed up
3020 * re-association by informing the station about it not
3021 * being associated. */
3022 printk(KERN_DEBUG "%s: rejected received nullfunc "
3023 "frame without ToDS from not associated STA "
0795af57
JP		 3024 "%s\n",
3025 dev->name, print_mac(mac, hdr->addr2));
ff1d2767
JM		 3026 hostap_rx(dev, skb, rx_stats);
3027#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
3028 }
3029 ret = AP_RX_EXIT;
3030 goto out;
4339d328 3031 } else if (stype == IEEE80211_STYPE_NULLFUNC) {
ff1d2767
JM		 3032 /* At least Lucent cards seem to send periodic nullfunc
3033 * frames with ToDS. Let these through to update SQ
3034 * stats and PS state. Nullfunc frames do not contain
3035 * any data and they will be dropped below. */
3036 } else {
3037 /* If BSSID (Addr3) is foreign, this frame is a normal
3038 * broadcast frame from an IBSS network. Drop it silently.
3039 * If BSSID is own, report the dropping of this frame. */
3040 if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
3041 printk(KERN_DEBUG "%s: dropped received packet from "
0795af57
JP		 3042 "%s with no ToDS flag "
3043 "(type=0x%02x, subtype=0x%02x)\n", dev->name,
3044 print_mac(mac, hdr->addr2), type >> 2, stype >> 4);
ff1d2767
JM		 3045 hostap_dump_rx_80211(dev->name, skb, rx_stats);
3046 }
3047 ret = AP_RX_DROP;
3048 goto out;
3049 }
3050
3051 if (sta) {
b2f4a2e3 3052 hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM,
ff1d2767
JM		 3053 type, stype);
3054
3055 sta->rx_packets++;
3056 sta->rx_bytes += skb->len;
3057 sta->last_rx = jiffies;
3058 }
3059
4339d328 3060 if (local->ap->nullfunc_ack && stype == IEEE80211_STYPE_NULLFUNC &&
b2f4a2e3 3061 fc & IEEE80211_FCTL_TODS) {
ff1d2767
JM		 3062 if (local->hostapd) {
3063 prism2_rx_80211(local->apdev, skb, rx_stats,
3064 PRISM2_RX_NULLFUNC_ACK);
3065#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
3066 } else {
3067 /* some STA f/w's seem to require control::ACK frame
3068 * for data::nullfunc, but Prism2 f/w 0.8.0 (at least
3069 * from Compaq) does not send this.. Try to generate
3070 * ACK for these frames from the host driver to make
3071 * power saving work with, e.g., Lucent WaveLAN f/w */
3072 hostap_rx(dev, skb, rx_stats);
3073#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
3074 }
3075 ret = AP_RX_EXIT;
3076 goto out;
3077 }
3078
3079 out:
3080 if (sta)
3081 atomic_dec(&sta->users);
3082
3083 return ret;
3084}
3085
3086
3087/* Called only as a tasklet (software IRQ) */
3088int hostap_handle_sta_crypto(local_info_t *local,
d041674d 3089 struct ieee80211_hdr_4addr *hdr,
62fe7e37
JM		 3090 struct ieee80211_crypt_data **crypt,
3091 void **sta_ptr)
ff1d2767
JM		 3092{
3093 struct sta_info *sta;
3094
3095 spin_lock(&local->ap->sta_table_lock);
3096 sta = ap_get_sta(local->ap, hdr->addr2);
3097 if (sta)
3098 atomic_inc(&sta->users);
3099 spin_unlock(&local->ap->sta_table_lock);
3100
3101 if (!sta)
3102 return -1;
3103
3104 if (sta->crypt) {
3105 *crypt = sta->crypt;
3106 *sta_ptr = sta;
3107 /* hostap_handle_sta_release() will be called to release STA
3108 * info */
3109 } else
3110 atomic_dec(&sta->users);
3111
3112 return 0;
3113}
3114
3115
3116/* Called only as a tasklet (software IRQ) */
3117int hostap_is_sta_assoc(struct ap_data *ap, u8 *sta_addr)
3118{
3119 struct sta_info *sta;
3120 int ret = 0;
3121
3122 spin_lock(&ap->sta_table_lock);
3123 sta = ap_get_sta(ap, sta_addr);
3124 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap)
3125 ret = 1;
3126 spin_unlock(&ap->sta_table_lock);
3127
3128 return ret;
3129}
3130
3131
3132/* Called only as a tasklet (software IRQ) */
3133int hostap_is_sta_authorized(struct ap_data *ap, u8 *sta_addr)
3134{
3135 struct sta_info *sta;
3136 int ret = 0;
3137
3138 spin_lock(&ap->sta_table_lock);
3139 sta = ap_get_sta(ap, sta_addr);
3140 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap &&
3141 ((sta->flags & WLAN_STA_AUTHORIZED) ||
3142 ap->local->ieee_802_1x == 0))
3143 ret = 1;
3144 spin_unlock(&ap->sta_table_lock);
3145
3146 return ret;
3147}
3148
3149
3150/* Called only as a tasklet (software IRQ) */
3151int hostap_add_sta(struct ap_data *ap, u8 *sta_addr)
3152{
3153 struct sta_info *sta;
3154 int ret = 1;
3155
3156 if (!ap)
3157 return -1;
3158
3159 spin_lock(&ap->sta_table_lock);
3160 sta = ap_get_sta(ap, sta_addr);
3161 if (sta)
3162 ret = 0;
3163 spin_unlock(&ap->sta_table_lock);
3164
3165 if (ret == 1) {
3166 sta = ap_add_sta(ap, sta_addr);
3167 if (!sta)
54b85f48 3168 return -1;
ff1d2767
JM		 3169 sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
3170 sta->ap = 1;
3171 memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
3172 /* No way of knowing which rates are supported since we did not
3173 * get supported rates element from beacon/assoc req. Assume
3174 * that remote end supports all 802.11b rates. */
3175 sta->supported_rates[0] = 0x82;
3176 sta->supported_rates[1] = 0x84;
3177 sta->supported_rates[2] = 0x0b;
3178 sta->supported_rates[3] = 0x16;
3179 sta->tx_supp_rates = WLAN_RATE_1M | WLAN_RATE_2M |
3180 WLAN_RATE_5M5 | WLAN_RATE_11M;
3181 sta->tx_rate = 110;
3182 sta->tx_max_rate = sta->tx_rate_idx = 3;
3183 }
3184
3185 return ret;
3186}
3187
3188
3189/* Called only as a tasklet (software IRQ) */
3190int hostap_update_rx_stats(struct ap_data *ap,
d041674d 3191 struct ieee80211_hdr_4addr *hdr,
ff1d2767
JM		 3192 struct hostap_80211_rx_status *rx_stats)
3193{
3194 struct sta_info *sta;
3195
3196 if (!ap)
3197 return -1;
3198
3199 spin_lock(&ap->sta_table_lock);
3200 sta = ap_get_sta(ap, hdr->addr2);
3201 if (sta) {
3202 sta->last_rx_silence = rx_stats->noise;
3203 sta->last_rx_signal = rx_stats->signal;
3204 sta->last_rx_rate = rx_stats->rate;
c28df16e 3205 sta->last_rx_updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
ff1d2767
JM		 3206 if (rx_stats->rate == 10)
3207 sta->rx_count[0]++;
3208 else if (rx_stats->rate == 20)
3209 sta->rx_count[1]++;
3210 else if (rx_stats->rate == 55)
3211 sta->rx_count[2]++;
3212 else if (rx_stats->rate == 110)
3213 sta->rx_count[3]++;
3214 }
3215 spin_unlock(&ap->sta_table_lock);
3216
3217 return sta ? 0 : -1;
3218}
3219
3220
3221void hostap_update_rates(local_info_t *local)
3222{
c1505731 3223 struct sta_info *sta;
ff1d2767
JM		 3224 struct ap_data *ap = local->ap;
3225
3226 if (!ap)
3227 return;
3228
3229 spin_lock_bh(&ap->sta_table_lock);
c1505731 3230 list_for_each_entry(sta, &ap->sta_list, list) {
ff1d2767
JM		 3231 prism2_check_tx_rates(sta);
3232 }
3233 spin_unlock_bh(&ap->sta_table_lock);
3234}
3235
3236
5fad5a2e
AB		 3237void * ap_crypt_get_ptrs(struct ap_data *ap, u8 *addr, int permanent,
3238 struct ieee80211_crypt_data ***crypt)
ff1d2767
JM		 3239{
3240 struct sta_info *sta;
3241
3242 spin_lock_bh(&ap->sta_table_lock);
3243 sta = ap_get_sta(ap, addr);
3244 if (sta)
3245 atomic_inc(&sta->users);
3246 spin_unlock_bh(&ap->sta_table_lock);
3247
3248 if (!sta && permanent)
3249 sta = ap_add_sta(ap, addr);
3250
3251 if (!sta)
3252 return NULL;
3253
3254 if (permanent)
3255 sta->flags |= WLAN_STA_PERM;
3256
3257 *crypt = &sta->crypt;
3258
3259 return sta;
3260}
3261
3262
3263void hostap_add_wds_links(local_info_t *local)
3264{
3265 struct ap_data *ap = local->ap;
c1505731 3266 struct sta_info *sta;
ff1d2767
JM		 3267
3268 spin_lock_bh(&ap->sta_table_lock);
c1505731 3269 list_for_each_entry(sta, &ap->sta_list, list) {
ff1d2767
JM		 3270 if (sta->ap)
3271 hostap_wds_link_oper(local, sta->addr, WDS_ADD);
3272 }
3273 spin_unlock_bh(&ap->sta_table_lock);
3274
3275 schedule_work(&local->ap->wds_oper_queue);
3276}
3277
3278
3279void hostap_wds_link_oper(local_info_t *local, u8 *addr, wds_oper_type type)
3280{
3281 struct wds_oper_data *entry;
3282
3283 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
3284 if (!entry)
3285 return;
3286 memcpy(entry->addr, addr, ETH_ALEN);
3287 entry->type = type;
3288 spin_lock_bh(&local->lock);
3289 entry->next = local->ap->wds_oper_entries;
3290 local->ap->wds_oper_entries = entry;
3291 spin_unlock_bh(&local->lock);
3292
3293 schedule_work(&local->ap->wds_oper_queue);
3294}
3295
3296
3297EXPORT_SYMBOL(hostap_init_data);
3298EXPORT_SYMBOL(hostap_init_ap_proc);
3299EXPORT_SYMBOL(hostap_free_data);
3300EXPORT_SYMBOL(hostap_check_sta_fw_version);
ff1d2767 3301EXPORT_SYMBOL(hostap_handle_sta_tx_exc);
ff1d2767 3302#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
ff1d2767 3303#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
ubuntu-zesty-kernel mirror