1 /* 2 * Intersil Prism2 driver with Host AP (software access point) support 3 * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen 4 * <j@w1.fi> 5 * Copyright (c) 2002-2005, Jouni Malinen <j@w1.fi> 6 * 7 * This file is to be included into hostap.c when S/W AP functionality is 8 * compiled. 9 * 10 * AP: FIX: 11 * - if unicast Class 2 (assoc,reassoc,disassoc) frame received from 12 * unauthenticated STA, send deauth. frame (8802.11: 5.5) 13 * - if unicast Class 3 (data with to/from DS,deauth,pspoll) frame received 14 * from authenticated, but unassoc STA, send disassoc frame (8802.11: 5.5) 15 * - if unicast Class 3 received from unauthenticated STA, send deauth. frame 16 * (8802.11: 5.5) 17 */ 18 19 #include <linux/proc_fs.h> 20 #include <linux/seq_file.h> 21 #include <linux/delay.h> 22 #include <linux/random.h> 23 #include <linux/if_arp.h> 24 #include <linux/slab.h> 25 #include <linux/export.h> 26 #include <linux/moduleparam.h> 27 #include <linux/etherdevice.h> 28 29 #include "hostap_wlan.h" 30 #include "hostap.h" 31 #include "hostap_ap.h" 32 33 static int other_ap_policy[MAX_PARM_DEVICES] = { AP_OTHER_AP_SKIP_ALL, 34 DEF_INTS }; 35 module_param_array(other_ap_policy, int, NULL, 0444); 36 MODULE_PARM_DESC(other_ap_policy, "Other AP beacon monitoring policy (0-3)"); 37 38 static int ap_max_inactivity[MAX_PARM_DEVICES] = { AP_MAX_INACTIVITY_SEC, 39 DEF_INTS }; 40 module_param_array(ap_max_inactivity, int, NULL, 0444); 41 MODULE_PARM_DESC(ap_max_inactivity, "AP timeout (in seconds) for station " 42 "inactivity"); 43 44 static int ap_bridge_packets[MAX_PARM_DEVICES] = { 1, DEF_INTS }; 45 module_param_array(ap_bridge_packets, int, NULL, 0444); 46 MODULE_PARM_DESC(ap_bridge_packets, "Bridge packets directly between " 47 "stations"); 48 49 static int autom_ap_wds[MAX_PARM_DEVICES] = { 0, DEF_INTS }; 50 module_param_array(autom_ap_wds, int, NULL, 0444); 51 MODULE_PARM_DESC(autom_ap_wds, "Add WDS connections to other APs " 52 "automatically"); 53 54 55 static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta); 56 static void hostap_event_expired_sta(struct net_device *dev, 57 struct sta_info *sta); 58 static void handle_add_proc_queue(struct work_struct *work); 59 60 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 61 static void handle_wds_oper_queue(struct work_struct *work); 62 static void prism2_send_mgmt(struct net_device *dev, 63 u16 type_subtype, char *body, 64 int body_len, u8 *addr, u16 tx_cb_idx); 65 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 66 67 68 #ifndef PRISM2_NO_PROCFS_DEBUG 69 static int ap_debug_proc_show(struct seq_file *m, void *v) 70 { 71 struct ap_data *ap = m->private; 72 73 seq_printf(m, "BridgedUnicastFrames=%u\n", ap->bridged_unicast); 74 seq_printf(m, "BridgedMulticastFrames=%u\n", ap->bridged_multicast); 75 seq_printf(m, "max_inactivity=%u\n", ap->max_inactivity / HZ); 76 seq_printf(m, "bridge_packets=%u\n", ap->bridge_packets); 77 seq_printf(m, "nullfunc_ack=%u\n", ap->nullfunc_ack); 78 seq_printf(m, "autom_ap_wds=%u\n", ap->autom_ap_wds); 79 seq_printf(m, "auth_algs=%u\n", ap->local->auth_algs); 80 seq_printf(m, "tx_drop_nonassoc=%u\n", ap->tx_drop_nonassoc); 81 return 0; 82 } 83 84 static int ap_debug_proc_open(struct inode *inode, struct file *file) 85 { 86 return single_open(file, ap_debug_proc_show, PDE_DATA(inode)); 87 } 88 89 static const struct file_operations ap_debug_proc_fops = { 90 .open = ap_debug_proc_open, 91 .read = seq_read, 92 .llseek = seq_lseek, 93 .release = single_release, 94 }; 95 #endif /* PRISM2_NO_PROCFS_DEBUG */ 96 97 98 static void ap_sta_hash_add(struct ap_data *ap, struct sta_info *sta) 99 { 100 sta->hnext = ap->sta_hash[STA_HASH(sta->addr)]; 101 ap->sta_hash[STA_HASH(sta->addr)] = sta; 102 } 103 104 static void ap_sta_hash_del(struct ap_data *ap, struct sta_info *sta) 105 { 106 struct sta_info *s; 107 108 s = ap->sta_hash[STA_HASH(sta->addr)]; 109 if (s == NULL) return; 110 if (ether_addr_equal(s->addr, sta->addr)) { 111 ap->sta_hash[STA_HASH(sta->addr)] = s->hnext; 112 return; 113 } 114 115 while (s->hnext != NULL && !ether_addr_equal(s->hnext->addr, sta->addr)) 116 s = s->hnext; 117 if (s->hnext != NULL) 118 s->hnext = s->hnext->hnext; 119 else 120 printk("AP: could not remove STA %pM from hash table\n", 121 sta->addr); 122 } 123 124 static void ap_free_sta(struct ap_data *ap, struct sta_info *sta) 125 { 126 if (sta->ap && sta->local) 127 hostap_event_expired_sta(sta->local->dev, sta); 128 129 if (ap->proc != NULL) { 130 char name[20]; 131 sprintf(name, "%pM", sta->addr); 132 remove_proc_entry(name, ap->proc); 133 } 134 135 if (sta->crypt) { 136 sta->crypt->ops->deinit(sta->crypt->priv); 137 kfree(sta->crypt); 138 sta->crypt = NULL; 139 } 140 141 skb_queue_purge(&sta->tx_buf); 142 143 ap->num_sta--; 144 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 145 if (sta->aid > 0) 146 ap->sta_aid[sta->aid - 1] = NULL; 147 148 if (!sta->ap) 149 kfree(sta->u.sta.challenge); 150 del_timer_sync(&sta->timer); 151 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 152 153 kfree(sta); 154 } 155 156 157 static void hostap_set_tim(local_info_t *local, int aid, int set) 158 { 159 if (local->func->set_tim) 160 local->func->set_tim(local->dev, aid, set); 161 } 162 163 164 static void hostap_event_new_sta(struct net_device *dev, struct sta_info *sta) 165 { 166 union iwreq_data wrqu; 167 memset(&wrqu, 0, sizeof(wrqu)); 168 memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN); 169 wrqu.addr.sa_family = ARPHRD_ETHER; 170 wireless_send_event(dev, IWEVREGISTERED, &wrqu, NULL); 171 } 172 173 174 static void hostap_event_expired_sta(struct net_device *dev, 175 struct sta_info *sta) 176 { 177 union iwreq_data wrqu; 178 memset(&wrqu, 0, sizeof(wrqu)); 179 memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN); 180 wrqu.addr.sa_family = ARPHRD_ETHER; 181 wireless_send_event(dev, IWEVEXPIRED, &wrqu, NULL); 182 } 183 184 185 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 186 187 static void ap_handle_timer(unsigned long data) 188 { 189 struct sta_info *sta = (struct sta_info *) data; 190 local_info_t *local; 191 struct ap_data *ap; 192 unsigned long next_time = 0; 193 int was_assoc; 194 195 if (sta == NULL || sta->local == NULL || sta->local->ap == NULL) { 196 PDEBUG(DEBUG_AP, "ap_handle_timer() called with NULL data\n"); 197 return; 198 } 199 200 local = sta->local; 201 ap = local->ap; 202 was_assoc = sta->flags & WLAN_STA_ASSOC; 203 204 if (atomic_read(&sta->users) != 0) 205 next_time = jiffies + HZ; 206 else if ((sta->flags & WLAN_STA_PERM) && !(sta->flags & WLAN_STA_AUTH)) 207 next_time = jiffies + ap->max_inactivity; 208 209 if (time_before(jiffies, sta->last_rx + ap->max_inactivity)) { 210 /* station activity detected; reset timeout state */ 211 sta->timeout_next = STA_NULLFUNC; 212 next_time = sta->last_rx + ap->max_inactivity; 213 } else if (sta->timeout_next == STA_DISASSOC && 214 !(sta->flags & WLAN_STA_PENDING_POLL)) { 215 /* STA ACKed data nullfunc frame poll */ 216 sta->timeout_next = STA_NULLFUNC; 217 next_time = jiffies + ap->max_inactivity; 218 } 219 220 if (next_time) { 221 sta->timer.expires = next_time; 222 add_timer(&sta->timer); 223 return; 224 } 225 226 if (sta->ap) 227 sta->timeout_next = STA_DEAUTH; 228 229 if (sta->timeout_next == STA_DEAUTH && !(sta->flags & WLAN_STA_PERM)) { 230 spin_lock(&ap->sta_table_lock); 231 ap_sta_hash_del(ap, sta); 232 list_del(&sta->list); 233 spin_unlock(&ap->sta_table_lock); 234 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC); 235 } else if (sta->timeout_next == STA_DISASSOC) 236 sta->flags &= ~WLAN_STA_ASSOC; 237 238 if (was_assoc && !(sta->flags & WLAN_STA_ASSOC) && !sta->ap) 239 hostap_event_expired_sta(local->dev, sta); 240 241 if (sta->timeout_next == STA_DEAUTH && sta->aid > 0 && 242 !skb_queue_empty(&sta->tx_buf)) { 243 hostap_set_tim(local, sta->aid, 0); 244 sta->flags &= ~WLAN_STA_TIM; 245 } 246 247 if (sta->ap) { 248 if (ap->autom_ap_wds) { 249 PDEBUG(DEBUG_AP, "%s: removing automatic WDS " 250 "connection to AP %pM\n", 251 local->dev->name, sta->addr); 252 hostap_wds_link_oper(local, sta->addr, WDS_DEL); 253 } 254 } else if (sta->timeout_next == STA_NULLFUNC) { 255 /* send data frame to poll STA and check whether this frame 256 * is ACKed */ 257 /* FIX: IEEE80211_STYPE_NULLFUNC would be more appropriate, but 258 * it is apparently not retried so TX Exc events are not 259 * received for it */ 260 sta->flags |= WLAN_STA_PENDING_POLL; 261 prism2_send_mgmt(local->dev, IEEE80211_FTYPE_DATA | 262 IEEE80211_STYPE_DATA, NULL, 0, 263 sta->addr, ap->tx_callback_poll); 264 } else { 265 int deauth = sta->timeout_next == STA_DEAUTH; 266 __le16 resp; 267 PDEBUG(DEBUG_AP, "%s: sending %s info to STA %pM" 268 "(last=%lu, jiffies=%lu)\n", 269 local->dev->name, 270 deauth ? "deauthentication" : "disassociation", 271 sta->addr, sta->last_rx, jiffies); 272 273 resp = cpu_to_le16(deauth ? WLAN_REASON_PREV_AUTH_NOT_VALID : 274 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY); 275 prism2_send_mgmt(local->dev, IEEE80211_FTYPE_MGMT | 276 (deauth ? IEEE80211_STYPE_DEAUTH : 277 IEEE80211_STYPE_DISASSOC), 278 (char *) &resp, 2, sta->addr, 0); 279 } 280 281 if (sta->timeout_next == STA_DEAUTH) { 282 if (sta->flags & WLAN_STA_PERM) { 283 PDEBUG(DEBUG_AP, "%s: STA %pM" 284 " would have been removed, " 285 "but it has 'perm' flag\n", 286 local->dev->name, sta->addr); 287 } else 288 ap_free_sta(ap, sta); 289 return; 290 } 291 292 if (sta->timeout_next == STA_NULLFUNC) { 293 sta->timeout_next = STA_DISASSOC; 294 sta->timer.expires = jiffies + AP_DISASSOC_DELAY; 295 } else { 296 sta->timeout_next = STA_DEAUTH; 297 sta->timer.expires = jiffies + AP_DEAUTH_DELAY; 298 } 299 300 add_timer(&sta->timer); 301 } 302 303 304 void hostap_deauth_all_stas(struct net_device *dev, struct ap_data *ap, 305 int resend) 306 { 307 u8 addr[ETH_ALEN]; 308 __le16 resp; 309 int i; 310 311 PDEBUG(DEBUG_AP, "%s: Deauthenticate all stations\n", dev->name); 312 eth_broadcast_addr(addr); 313 314 resp = cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID); 315 316 /* deauth message sent; try to resend it few times; the message is 317 * broadcast, so it may be delayed until next DTIM; there is not much 318 * else we can do at this point since the driver is going to be shut 319 * down */ 320 for (i = 0; i < 5; i++) { 321 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | 322 IEEE80211_STYPE_DEAUTH, 323 (char *) &resp, 2, addr, 0); 324 325 if (!resend || ap->num_sta <= 0) 326 return; 327 328 mdelay(50); 329 } 330 } 331 332 333 static int ap_control_proc_show(struct seq_file *m, void *v) 334 { 335 struct ap_data *ap = m->private; 336 char *policy_txt; 337 struct mac_entry *entry; 338 339 if (v == SEQ_START_TOKEN) { 340 switch (ap->mac_restrictions.policy) { 341 case MAC_POLICY_OPEN: 342 policy_txt = "open"; 343 break; 344 case MAC_POLICY_ALLOW: 345 policy_txt = "allow"; 346 break; 347 case MAC_POLICY_DENY: 348 policy_txt = "deny"; 349 break; 350 default: 351 policy_txt = "unknown"; 352 break; 353 } 354 seq_printf(m, "MAC policy: %s\n", policy_txt); 355 seq_printf(m, "MAC entries: %u\n", ap->mac_restrictions.entries); 356 seq_puts(m, "MAC list:\n"); 357 return 0; 358 } 359 360 entry = v; 361 seq_printf(m, "%pM\n", entry->addr); 362 return 0; 363 } 364 365 static void *ap_control_proc_start(struct seq_file *m, loff_t *_pos) 366 { 367 struct ap_data *ap = m->private; 368 spin_lock_bh(&ap->mac_restrictions.lock); 369 return seq_list_start_head(&ap->mac_restrictions.mac_list, *_pos); 370 } 371 372 static void *ap_control_proc_next(struct seq_file *m, void *v, loff_t *_pos) 373 { 374 struct ap_data *ap = m->private; 375 return seq_list_next(v, &ap->mac_restrictions.mac_list, _pos); 376 } 377 378 static void ap_control_proc_stop(struct seq_file *m, void *v) 379 { 380 struct ap_data *ap = m->private; 381 spin_unlock_bh(&ap->mac_restrictions.lock); 382 } 383 384 static const struct seq_operations ap_control_proc_seqops = { 385 .start = ap_control_proc_start, 386 .next = ap_control_proc_next, 387 .stop = ap_control_proc_stop, 388 .show = ap_control_proc_show, 389 }; 390 391 static int ap_control_proc_open(struct inode *inode, struct file *file) 392 { 393 int ret = seq_open(file, &ap_control_proc_seqops); 394 if (ret == 0) { 395 struct seq_file *m = file->private_data; 396 m->private = PDE_DATA(inode); 397 } 398 return ret; 399 } 400 401 static const struct file_operations ap_control_proc_fops = { 402 .open = ap_control_proc_open, 403 .read = seq_read, 404 .llseek = seq_lseek, 405 .release = seq_release, 406 }; 407 408 409 int ap_control_add_mac(struct mac_restrictions *mac_restrictions, u8 *mac) 410 { 411 struct mac_entry *entry; 412 413 entry = kmalloc(sizeof(struct mac_entry), GFP_KERNEL); 414 if (entry == NULL) 415 return -ENOMEM; 416 417 memcpy(entry->addr, mac, ETH_ALEN); 418 419 spin_lock_bh(&mac_restrictions->lock); 420 list_add_tail(&entry->list, &mac_restrictions->mac_list); 421 mac_restrictions->entries++; 422 spin_unlock_bh(&mac_restrictions->lock); 423 424 return 0; 425 } 426 427 428 int ap_control_del_mac(struct mac_restrictions *mac_restrictions, u8 *mac) 429 { 430 struct list_head *ptr; 431 struct mac_entry *entry; 432 433 spin_lock_bh(&mac_restrictions->lock); 434 for (ptr = mac_restrictions->mac_list.next; 435 ptr != &mac_restrictions->mac_list; ptr = ptr->next) { 436 entry = list_entry(ptr, struct mac_entry, list); 437 438 if (ether_addr_equal(entry->addr, mac)) { 439 list_del(ptr); 440 kfree(entry); 441 mac_restrictions->entries--; 442 spin_unlock_bh(&mac_restrictions->lock); 443 return 0; 444 } 445 } 446 spin_unlock_bh(&mac_restrictions->lock); 447 return -1; 448 } 449 450 451 static int ap_control_mac_deny(struct mac_restrictions *mac_restrictions, 452 u8 *mac) 453 { 454 struct mac_entry *entry; 455 int found = 0; 456 457 if (mac_restrictions->policy == MAC_POLICY_OPEN) 458 return 0; 459 460 spin_lock_bh(&mac_restrictions->lock); 461 list_for_each_entry(entry, &mac_restrictions->mac_list, list) { 462 if (ether_addr_equal(entry->addr, mac)) { 463 found = 1; 464 break; 465 } 466 } 467 spin_unlock_bh(&mac_restrictions->lock); 468 469 if (mac_restrictions->policy == MAC_POLICY_ALLOW) 470 return !found; 471 else 472 return found; 473 } 474 475 476 void ap_control_flush_macs(struct mac_restrictions *mac_restrictions) 477 { 478 struct list_head *ptr, *n; 479 struct mac_entry *entry; 480 481 if (mac_restrictions->entries == 0) 482 return; 483 484 spin_lock_bh(&mac_restrictions->lock); 485 for (ptr = mac_restrictions->mac_list.next, n = ptr->next; 486 ptr != &mac_restrictions->mac_list; 487 ptr = n, n = ptr->next) { 488 entry = list_entry(ptr, struct mac_entry, list); 489 list_del(ptr); 490 kfree(entry); 491 } 492 mac_restrictions->entries = 0; 493 spin_unlock_bh(&mac_restrictions->lock); 494 } 495 496 497 int ap_control_kick_mac(struct ap_data *ap, struct net_device *dev, u8 *mac) 498 { 499 struct sta_info *sta; 500 __le16 resp; 501 502 spin_lock_bh(&ap->sta_table_lock); 503 sta = ap_get_sta(ap, mac); 504 if (sta) { 505 ap_sta_hash_del(ap, sta); 506 list_del(&sta->list); 507 } 508 spin_unlock_bh(&ap->sta_table_lock); 509 510 if (!sta) 511 return -EINVAL; 512 513 resp = cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID); 514 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_DEAUTH, 515 (char *) &resp, 2, sta->addr, 0); 516 517 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap) 518 hostap_event_expired_sta(dev, sta); 519 520 ap_free_sta(ap, sta); 521 522 return 0; 523 } 524 525 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 526 527 528 void ap_control_kickall(struct ap_data *ap) 529 { 530 struct list_head *ptr, *n; 531 struct sta_info *sta; 532 533 spin_lock_bh(&ap->sta_table_lock); 534 for (ptr = ap->sta_list.next, n = ptr->next; ptr != &ap->sta_list; 535 ptr = n, n = ptr->next) { 536 sta = list_entry(ptr, struct sta_info, list); 537 ap_sta_hash_del(ap, sta); 538 list_del(&sta->list); 539 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local) 540 hostap_event_expired_sta(sta->local->dev, sta); 541 ap_free_sta(ap, sta); 542 } 543 spin_unlock_bh(&ap->sta_table_lock); 544 } 545 546 547 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 548 549 static int prism2_ap_proc_show(struct seq_file *m, void *v) 550 { 551 struct sta_info *sta = v; 552 int i; 553 554 if (v == SEQ_START_TOKEN) { 555 seq_printf(m, "# BSSID CHAN SIGNAL NOISE RATE SSID FLAGS\n"); 556 return 0; 557 } 558 559 if (!sta->ap) 560 return 0; 561 562 seq_printf(m, "%pM %d %d %d %d '", 563 sta->addr, 564 sta->u.ap.channel, sta->last_rx_signal, 565 sta->last_rx_silence, sta->last_rx_rate); 566 567 for (i = 0; i < sta->u.ap.ssid_len; i++) { 568 if (sta->u.ap.ssid[i] >= 32 && sta->u.ap.ssid[i] < 127) 569 seq_putc(m, sta->u.ap.ssid[i]); 570 else 571 seq_printf(m, "<%02x>", sta->u.ap.ssid[i]); 572 } 573 574 seq_putc(m, '\''); 575 if (sta->capability & WLAN_CAPABILITY_ESS) 576 seq_puts(m, " [ESS]"); 577 if (sta->capability & WLAN_CAPABILITY_IBSS) 578 seq_puts(m, " [IBSS]"); 579 if (sta->capability & WLAN_CAPABILITY_PRIVACY) 580 seq_puts(m, " [WEP]"); 581 seq_putc(m, '\n'); 582 return 0; 583 } 584 585 static void *prism2_ap_proc_start(struct seq_file *m, loff_t *_pos) 586 { 587 struct ap_data *ap = m->private; 588 spin_lock_bh(&ap->sta_table_lock); 589 return seq_list_start_head(&ap->sta_list, *_pos); 590 } 591 592 static void *prism2_ap_proc_next(struct seq_file *m, void *v, loff_t *_pos) 593 { 594 struct ap_data *ap = m->private; 595 return seq_list_next(v, &ap->sta_list, _pos); 596 } 597 598 static void prism2_ap_proc_stop(struct seq_file *m, void *v) 599 { 600 struct ap_data *ap = m->private; 601 spin_unlock_bh(&ap->sta_table_lock); 602 } 603 604 static const struct seq_operations prism2_ap_proc_seqops = { 605 .start = prism2_ap_proc_start, 606 .next = prism2_ap_proc_next, 607 .stop = prism2_ap_proc_stop, 608 .show = prism2_ap_proc_show, 609 }; 610 611 static int prism2_ap_proc_open(struct inode *inode, struct file *file) 612 { 613 int ret = seq_open(file, &prism2_ap_proc_seqops); 614 if (ret == 0) { 615 struct seq_file *m = file->private_data; 616 m->private = PDE_DATA(inode); 617 } 618 return ret; 619 } 620 621 static const struct file_operations prism2_ap_proc_fops = { 622 .open = prism2_ap_proc_open, 623 .read = seq_read, 624 .llseek = seq_lseek, 625 .release = seq_release, 626 }; 627 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 628 629 630 void hostap_check_sta_fw_version(struct ap_data *ap, int sta_fw_ver) 631 { 632 if (!ap) 633 return; 634 635 if (sta_fw_ver == PRISM2_FW_VER(0,8,0)) { 636 PDEBUG(DEBUG_AP, "Using data::nullfunc ACK workaround - " 637 "firmware upgrade recommended\n"); 638 ap->nullfunc_ack = 1; 639 } else 640 ap->nullfunc_ack = 0; 641 642 if (sta_fw_ver == PRISM2_FW_VER(1,4,2)) { 643 printk(KERN_WARNING "%s: Warning: secondary station firmware " 644 "version 1.4.2 does not seem to work in Host AP mode\n", 645 ap->local->dev->name); 646 } 647 } 648 649 650 /* Called only as a tasklet (software IRQ) */ 651 static void hostap_ap_tx_cb(struct sk_buff *skb, int ok, void *data) 652 { 653 struct ap_data *ap = data; 654 struct ieee80211_hdr *hdr; 655 656 if (!ap->local->hostapd || !ap->local->apdev) { 657 dev_kfree_skb(skb); 658 return; 659 } 660 661 /* Pass the TX callback frame to the hostapd; use 802.11 header version 662 * 1 to indicate failure (no ACK) and 2 success (frame ACKed) */ 663 664 hdr = (struct ieee80211_hdr *) skb->data; 665 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_VERS); 666 hdr->frame_control |= cpu_to_le16(ok ? BIT(1) : BIT(0)); 667 668 skb->dev = ap->local->apdev; 669 skb_pull(skb, hostap_80211_get_hdrlen(hdr->frame_control)); 670 skb->pkt_type = PACKET_OTHERHOST; 671 skb->protocol = cpu_to_be16(ETH_P_802_2); 672 memset(skb->cb, 0, sizeof(skb->cb)); 673 netif_rx(skb); 674 } 675 676 677 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 678 /* Called only as a tasklet (software IRQ) */ 679 static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data) 680 { 681 struct ap_data *ap = data; 682 struct net_device *dev = ap->local->dev; 683 struct ieee80211_hdr *hdr; 684 u16 auth_alg, auth_transaction, status; 685 __le16 *pos; 686 struct sta_info *sta = NULL; 687 char *txt = NULL; 688 689 if (ap->local->hostapd) { 690 dev_kfree_skb(skb); 691 return; 692 } 693 694 hdr = (struct ieee80211_hdr *) skb->data; 695 if (!ieee80211_is_auth(hdr->frame_control) || 696 skb->len < IEEE80211_MGMT_HDR_LEN + 6) { 697 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_auth received invalid " 698 "frame\n", dev->name); 699 dev_kfree_skb(skb); 700 return; 701 } 702 703 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN); 704 auth_alg = le16_to_cpu(*pos++); 705 auth_transaction = le16_to_cpu(*pos++); 706 status = le16_to_cpu(*pos++); 707 708 if (!ok) { 709 txt = "frame was not ACKed"; 710 goto done; 711 } 712 713 spin_lock(&ap->sta_table_lock); 714 sta = ap_get_sta(ap, hdr->addr1); 715 if (sta) 716 atomic_inc(&sta->users); 717 spin_unlock(&ap->sta_table_lock); 718 719 if (!sta) { 720 txt = "STA not found"; 721 goto done; 722 } 723 724 if (status == WLAN_STATUS_SUCCESS && 725 ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) || 726 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) { 727 txt = "STA authenticated"; 728 sta->flags |= WLAN_STA_AUTH; 729 sta->last_auth = jiffies; 730 } else if (status != WLAN_STATUS_SUCCESS) 731 txt = "authentication failed"; 732 733 done: 734 if (sta) 735 atomic_dec(&sta->users); 736 if (txt) { 737 PDEBUG(DEBUG_AP, "%s: %pM auth_cb - alg=%d " 738 "trans#=%d status=%d - %s\n", 739 dev->name, hdr->addr1, 740 auth_alg, auth_transaction, status, txt); 741 } 742 dev_kfree_skb(skb); 743 } 744 745 746 /* Called only as a tasklet (software IRQ) */ 747 static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data) 748 { 749 struct ap_data *ap = data; 750 struct net_device *dev = ap->local->dev; 751 struct ieee80211_hdr *hdr; 752 u16 status; 753 __le16 *pos; 754 struct sta_info *sta = NULL; 755 char *txt = NULL; 756 757 if (ap->local->hostapd) { 758 dev_kfree_skb(skb); 759 return; 760 } 761 762 hdr = (struct ieee80211_hdr *) skb->data; 763 if ((!ieee80211_is_assoc_resp(hdr->frame_control) && 764 !ieee80211_is_reassoc_resp(hdr->frame_control)) || 765 skb->len < IEEE80211_MGMT_HDR_LEN + 4) { 766 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_assoc received invalid " 767 "frame\n", dev->name); 768 dev_kfree_skb(skb); 769 return; 770 } 771 772 if (!ok) { 773 txt = "frame was not ACKed"; 774 goto done; 775 } 776 777 spin_lock(&ap->sta_table_lock); 778 sta = ap_get_sta(ap, hdr->addr1); 779 if (sta) 780 atomic_inc(&sta->users); 781 spin_unlock(&ap->sta_table_lock); 782 783 if (!sta) { 784 txt = "STA not found"; 785 goto done; 786 } 787 788 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN); 789 pos++; 790 status = le16_to_cpu(*pos++); 791 if (status == WLAN_STATUS_SUCCESS) { 792 if (!(sta->flags & WLAN_STA_ASSOC)) 793 hostap_event_new_sta(dev, sta); 794 txt = "STA associated"; 795 sta->flags |= WLAN_STA_ASSOC; 796 sta->last_assoc = jiffies; 797 } else 798 txt = "association failed"; 799 800 done: 801 if (sta) 802 atomic_dec(&sta->users); 803 if (txt) { 804 PDEBUG(DEBUG_AP, "%s: %pM assoc_cb - %s\n", 805 dev->name, hdr->addr1, txt); 806 } 807 dev_kfree_skb(skb); 808 } 809 810 /* Called only as a tasklet (software IRQ); TX callback for poll frames used 811 * in verifying whether the STA is still present. */ 812 static void hostap_ap_tx_cb_poll(struct sk_buff *skb, int ok, void *data) 813 { 814 struct ap_data *ap = data; 815 struct ieee80211_hdr *hdr; 816 struct sta_info *sta; 817 818 if (skb->len < 24) 819 goto fail; 820 hdr = (struct ieee80211_hdr *) skb->data; 821 if (ok) { 822 spin_lock(&ap->sta_table_lock); 823 sta = ap_get_sta(ap, hdr->addr1); 824 if (sta) 825 sta->flags &= ~WLAN_STA_PENDING_POLL; 826 spin_unlock(&ap->sta_table_lock); 827 } else { 828 PDEBUG(DEBUG_AP, 829 "%s: STA %pM did not ACK activity poll frame\n", 830 ap->local->dev->name, hdr->addr1); 831 } 832 833 fail: 834 dev_kfree_skb(skb); 835 } 836 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 837 838 839 void hostap_init_data(local_info_t *local) 840 { 841 struct ap_data *ap = local->ap; 842 843 if (ap == NULL) { 844 printk(KERN_WARNING "hostap_init_data: ap == NULL\n"); 845 return; 846 } 847 memset(ap, 0, sizeof(struct ap_data)); 848 ap->local = local; 849 850 ap->ap_policy = GET_INT_PARM(other_ap_policy, local->card_idx); 851 ap->bridge_packets = GET_INT_PARM(ap_bridge_packets, local->card_idx); 852 ap->max_inactivity = 853 GET_INT_PARM(ap_max_inactivity, local->card_idx) * HZ; 854 ap->autom_ap_wds = GET_INT_PARM(autom_ap_wds, local->card_idx); 855 856 spin_lock_init(&ap->sta_table_lock); 857 INIT_LIST_HEAD(&ap->sta_list); 858 859 /* Initialize task queue structure for AP management */ 860 INIT_WORK(&local->ap->add_sta_proc_queue, handle_add_proc_queue); 861 862 ap->tx_callback_idx = 863 hostap_tx_callback_register(local, hostap_ap_tx_cb, ap); 864 if (ap->tx_callback_idx == 0) 865 printk(KERN_WARNING "%s: failed to register TX callback for " 866 "AP\n", local->dev->name); 867 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 868 INIT_WORK(&local->ap->wds_oper_queue, handle_wds_oper_queue); 869 870 ap->tx_callback_auth = 871 hostap_tx_callback_register(local, hostap_ap_tx_cb_auth, ap); 872 ap->tx_callback_assoc = 873 hostap_tx_callback_register(local, hostap_ap_tx_cb_assoc, ap); 874 ap->tx_callback_poll = 875 hostap_tx_callback_register(local, hostap_ap_tx_cb_poll, ap); 876 if (ap->tx_callback_auth == 0 || ap->tx_callback_assoc == 0 || 877 ap->tx_callback_poll == 0) 878 printk(KERN_WARNING "%s: failed to register TX callback for " 879 "AP\n", local->dev->name); 880 881 spin_lock_init(&ap->mac_restrictions.lock); 882 INIT_LIST_HEAD(&ap->mac_restrictions.mac_list); 883 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 884 885 ap->initialized = 1; 886 } 887 888 889 void hostap_init_ap_proc(local_info_t *local) 890 { 891 struct ap_data *ap = local->ap; 892 893 ap->proc = local->proc; 894 if (ap->proc == NULL) 895 return; 896 897 #ifndef PRISM2_NO_PROCFS_DEBUG 898 proc_create_data("ap_debug", 0, ap->proc, &ap_debug_proc_fops, ap); 899 #endif /* PRISM2_NO_PROCFS_DEBUG */ 900 901 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 902 proc_create_data("ap_control", 0, ap->proc, &ap_control_proc_fops, ap); 903 proc_create_data("ap", 0, ap->proc, &prism2_ap_proc_fops, ap); 904 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 905 906 } 907 908 909 void hostap_free_data(struct ap_data *ap) 910 { 911 struct sta_info *n, *sta; 912 913 if (ap == NULL || !ap->initialized) { 914 printk(KERN_DEBUG "hostap_free_data: ap has not yet been " 915 "initialized - skip resource freeing\n"); 916 return; 917 } 918 919 flush_work(&ap->add_sta_proc_queue); 920 921 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 922 flush_work(&ap->wds_oper_queue); 923 if (ap->crypt) 924 ap->crypt->deinit(ap->crypt_priv); 925 ap->crypt = ap->crypt_priv = NULL; 926 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 927 928 list_for_each_entry_safe(sta, n, &ap->sta_list, list) { 929 ap_sta_hash_del(ap, sta); 930 list_del(&sta->list); 931 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local) 932 hostap_event_expired_sta(sta->local->dev, sta); 933 ap_free_sta(ap, sta); 934 } 935 936 #ifndef PRISM2_NO_PROCFS_DEBUG 937 if (ap->proc != NULL) { 938 remove_proc_entry("ap_debug", ap->proc); 939 } 940 #endif /* PRISM2_NO_PROCFS_DEBUG */ 941 942 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 943 if (ap->proc != NULL) { 944 remove_proc_entry("ap", ap->proc); 945 remove_proc_entry("ap_control", ap->proc); 946 } 947 ap_control_flush_macs(&ap->mac_restrictions); 948 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 949 950 ap->initialized = 0; 951 } 952 953 954 /* caller should have mutex for AP STA list handling */ 955 static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta) 956 { 957 struct sta_info *s; 958 959 s = ap->sta_hash[STA_HASH(sta)]; 960 while (s != NULL && !ether_addr_equal(s->addr, sta)) 961 s = s->hnext; 962 return s; 963 } 964 965 966 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 967 968 /* Called from timer handler and from scheduled AP queue handlers */ 969 static void prism2_send_mgmt(struct net_device *dev, 970 u16 type_subtype, char *body, 971 int body_len, u8 *addr, u16 tx_cb_idx) 972 { 973 struct hostap_interface *iface; 974 local_info_t *local; 975 struct ieee80211_hdr *hdr; 976 u16 fc; 977 struct sk_buff *skb; 978 struct hostap_skb_tx_data *meta; 979 int hdrlen; 980 981 iface = netdev_priv(dev); 982 local = iface->local; 983 dev = local->dev; /* always use master radio device */ 984 iface = netdev_priv(dev); 985 986 if (!(dev->flags & IFF_UP)) { 987 PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt - device is not UP - " 988 "cannot send frame\n", dev->name); 989 return; 990 } 991 992 skb = dev_alloc_skb(sizeof(*hdr) + body_len); 993 if (skb == NULL) { 994 PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt failed to allocate " 995 "skb\n", dev->name); 996 return; 997 } 998 999 fc = type_subtype; 1000 hdrlen = hostap_80211_get_hdrlen(cpu_to_le16(type_subtype)); 1001 hdr = skb_put_zero(skb, hdrlen); 1002 if (body) 1003 skb_put_data(skb, body, body_len); 1004 1005 /* FIX: ctrl::ack sending used special HFA384X_TX_CTRL_802_11 1006 * tx_control instead of using local->tx_control */ 1007 1008 1009 memcpy(hdr->addr1, addr, ETH_ALEN); /* DA / RA */ 1010 if (ieee80211_is_data(hdr->frame_control)) { 1011 fc |= IEEE80211_FCTL_FROMDS; 1012 memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* BSSID */ 1013 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* SA */ 1014 } else if (ieee80211_is_ctl(hdr->frame_control)) { 1015 /* control:ACK does not have addr2 or addr3 */ 1016 eth_zero_addr(hdr->addr2); 1017 eth_zero_addr(hdr->addr3); 1018 } else { 1019 memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* SA */ 1020 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* BSSID */ 1021 } 1022 1023 hdr->frame_control = cpu_to_le16(fc); 1024 1025 meta = (struct hostap_skb_tx_data *) skb->cb; 1026 memset(meta, 0, sizeof(*meta)); 1027 meta->magic = HOSTAP_SKB_TX_DATA_MAGIC; 1028 meta->iface = iface; 1029 meta->tx_cb_idx = tx_cb_idx; 1030 1031 skb->dev = dev; 1032 skb_reset_mac_header(skb); 1033 skb_reset_network_header(skb); 1034 dev_queue_xmit(skb); 1035 } 1036 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 1037 1038 1039 static int prism2_sta_proc_show(struct seq_file *m, void *v) 1040 { 1041 struct sta_info *sta = m->private; 1042 int i; 1043 1044 /* FIX: possible race condition.. the STA data could have just expired, 1045 * but proc entry was still here so that the read could have started; 1046 * some locking should be done here.. */ 1047 1048 seq_printf(m, 1049 "%s=%pM\nusers=%d\naid=%d\n" 1050 "flags=0x%04x%s%s%s%s%s%s%s\n" 1051 "capability=0x%02x\nlisten_interval=%d\nsupported_rates=", 1052 sta->ap ? "AP" : "STA", 1053 sta->addr, atomic_read(&sta->users), sta->aid, 1054 sta->flags, 1055 sta->flags & WLAN_STA_AUTH ? " AUTH" : "", 1056 sta->flags & WLAN_STA_ASSOC ? " ASSOC" : "", 1057 sta->flags & WLAN_STA_PS ? " PS" : "", 1058 sta->flags & WLAN_STA_TIM ? " TIM" : "", 1059 sta->flags & WLAN_STA_PERM ? " PERM" : "", 1060 sta->flags & WLAN_STA_AUTHORIZED ? " AUTHORIZED" : "", 1061 sta->flags & WLAN_STA_PENDING_POLL ? " POLL" : "", 1062 sta->capability, sta->listen_interval); 1063 /* supported_rates: 500 kbit/s units with msb ignored */ 1064 for (i = 0; i < sizeof(sta->supported_rates); i++) 1065 if (sta->supported_rates[i] != 0) 1066 seq_printf(m, "%d%sMbps ", 1067 (sta->supported_rates[i] & 0x7f) / 2, 1068 sta->supported_rates[i] & 1 ? ".5" : ""); 1069 seq_printf(m, 1070 "\njiffies=%lu\nlast_auth=%lu\nlast_assoc=%lu\n" 1071 "last_rx=%lu\nlast_tx=%lu\nrx_packets=%lu\n" 1072 "tx_packets=%lu\n" 1073 "rx_bytes=%lu\ntx_bytes=%lu\nbuffer_count=%d\n" 1074 "last_rx: silence=%d dBm signal=%d dBm rate=%d%s Mbps\n" 1075 "tx_rate=%d\ntx[1M]=%d\ntx[2M]=%d\ntx[5.5M]=%d\n" 1076 "tx[11M]=%d\n" 1077 "rx[1M]=%d\nrx[2M]=%d\nrx[5.5M]=%d\nrx[11M]=%d\n", 1078 jiffies, sta->last_auth, sta->last_assoc, sta->last_rx, 1079 sta->last_tx, 1080 sta->rx_packets, sta->tx_packets, sta->rx_bytes, 1081 sta->tx_bytes, skb_queue_len(&sta->tx_buf), 1082 sta->last_rx_silence, 1083 sta->last_rx_signal, sta->last_rx_rate / 10, 1084 sta->last_rx_rate % 10 ? ".5" : "", 1085 sta->tx_rate, sta->tx_count[0], sta->tx_count[1], 1086 sta->tx_count[2], sta->tx_count[3], sta->rx_count[0], 1087 sta->rx_count[1], sta->rx_count[2], sta->rx_count[3]); 1088 if (sta->crypt && sta->crypt->ops && sta->crypt->ops->print_stats) 1089 sta->crypt->ops->print_stats(m, sta->crypt->priv); 1090 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 1091 if (sta->ap) { 1092 if (sta->u.ap.channel >= 0) 1093 seq_printf(m, "channel=%d\n", sta->u.ap.channel); 1094 seq_puts(m, "ssid="); 1095 for (i = 0; i < sta->u.ap.ssid_len; i++) { 1096 if (sta->u.ap.ssid[i] >= 32 && sta->u.ap.ssid[i] < 127) 1097 seq_putc(m, sta->u.ap.ssid[i]); 1098 else 1099 seq_printf(m, "<%02x>", sta->u.ap.ssid[i]); 1100 } 1101 seq_putc(m, '\n'); 1102 } 1103 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 1104 1105 return 0; 1106 } 1107 1108 static int prism2_sta_proc_open(struct inode *inode, struct file *file) 1109 { 1110 return single_open(file, prism2_sta_proc_show, PDE_DATA(inode)); 1111 } 1112 1113 static const struct file_operations prism2_sta_proc_fops = { 1114 .open = prism2_sta_proc_open, 1115 .read = seq_read, 1116 .llseek = seq_lseek, 1117 .release = single_release, 1118 }; 1119 1120 static void handle_add_proc_queue(struct work_struct *work) 1121 { 1122 struct ap_data *ap = container_of(work, struct ap_data, 1123 add_sta_proc_queue); 1124 struct sta_info *sta; 1125 char name[20]; 1126 struct add_sta_proc_data *entry, *prev; 1127 1128 entry = ap->add_sta_proc_entries; 1129 ap->add_sta_proc_entries = NULL; 1130 1131 while (entry) { 1132 spin_lock_bh(&ap->sta_table_lock); 1133 sta = ap_get_sta(ap, entry->addr); 1134 if (sta) 1135 atomic_inc(&sta->users); 1136 spin_unlock_bh(&ap->sta_table_lock); 1137 1138 if (sta) { 1139 sprintf(name, "%pM", sta->addr); 1140 sta->proc = proc_create_data( 1141 name, 0, ap->proc, 1142 &prism2_sta_proc_fops, sta); 1143 1144 atomic_dec(&sta->users); 1145 } 1146 1147 prev = entry; 1148 entry = entry->next; 1149 kfree(prev); 1150 } 1151 } 1152 1153 1154 static struct sta_info * ap_add_sta(struct ap_data *ap, u8 *addr) 1155 { 1156 struct sta_info *sta; 1157 1158 sta = kzalloc(sizeof(struct sta_info), GFP_ATOMIC); 1159 if (sta == NULL) { 1160 PDEBUG(DEBUG_AP, "AP: kmalloc failed\n"); 1161 return NULL; 1162 } 1163 1164 /* initialize STA info data */ 1165 sta->local = ap->local; 1166 skb_queue_head_init(&sta->tx_buf); 1167 memcpy(sta->addr, addr, ETH_ALEN); 1168 1169 atomic_inc(&sta->users); 1170 spin_lock_bh(&ap->sta_table_lock); 1171 list_add(&sta->list, &ap->sta_list); 1172 ap->num_sta++; 1173 ap_sta_hash_add(ap, sta); 1174 spin_unlock_bh(&ap->sta_table_lock); 1175 1176 if (ap->proc) { 1177 struct add_sta_proc_data *entry; 1178 /* schedule a non-interrupt context process to add a procfs 1179 * entry for the STA since procfs code use GFP_KERNEL */ 1180 entry = kmalloc(sizeof(*entry), GFP_ATOMIC); 1181 if (entry) { 1182 memcpy(entry->addr, sta->addr, ETH_ALEN); 1183 entry->next = ap->add_sta_proc_entries; 1184 ap->add_sta_proc_entries = entry; 1185 schedule_work(&ap->add_sta_proc_queue); 1186 } else 1187 printk(KERN_DEBUG "Failed to add STA proc data\n"); 1188 } 1189 1190 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 1191 init_timer(&sta->timer); 1192 sta->timer.expires = jiffies + ap->max_inactivity; 1193 sta->timer.data = (unsigned long) sta; 1194 sta->timer.function = ap_handle_timer; 1195 if (!ap->local->hostapd) 1196 add_timer(&sta->timer); 1197 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 1198 1199 return sta; 1200 } 1201 1202 1203 static int ap_tx_rate_ok(int rateidx, struct sta_info *sta, 1204 local_info_t *local) 1205 { 1206 if (rateidx > sta->tx_max_rate || 1207 !(sta->tx_supp_rates & (1 << rateidx))) 1208 return 0; 1209 1210 if (local->tx_rate_control != 0 && 1211 !(local->tx_rate_control & (1 << rateidx))) 1212 return 0; 1213 1214 return 1; 1215 } 1216 1217 1218 static void prism2_check_tx_rates(struct sta_info *sta) 1219 { 1220 int i; 1221 1222 sta->tx_supp_rates = 0; 1223 for (i = 0; i < sizeof(sta->supported_rates); i++) { 1224 if ((sta->supported_rates[i] & 0x7f) == 2) 1225 sta->tx_supp_rates |= WLAN_RATE_1M; 1226 if ((sta->supported_rates[i] & 0x7f) == 4) 1227 sta->tx_supp_rates |= WLAN_RATE_2M; 1228 if ((sta->supported_rates[i] & 0x7f) == 11) 1229 sta->tx_supp_rates |= WLAN_RATE_5M5; 1230 if ((sta->supported_rates[i] & 0x7f) == 22) 1231 sta->tx_supp_rates |= WLAN_RATE_11M; 1232 } 1233 sta->tx_max_rate = sta->tx_rate = sta->tx_rate_idx = 0; 1234 if (sta->tx_supp_rates & WLAN_RATE_1M) { 1235 sta->tx_max_rate = 0; 1236 if (ap_tx_rate_ok(0, sta, sta->local)) { 1237 sta->tx_rate = 10; 1238 sta->tx_rate_idx = 0; 1239 } 1240 } 1241 if (sta->tx_supp_rates & WLAN_RATE_2M) { 1242 sta->tx_max_rate = 1; 1243 if (ap_tx_rate_ok(1, sta, sta->local)) { 1244 sta->tx_rate = 20; 1245 sta->tx_rate_idx = 1; 1246 } 1247 } 1248 if (sta->tx_supp_rates & WLAN_RATE_5M5) { 1249 sta->tx_max_rate = 2; 1250 if (ap_tx_rate_ok(2, sta, sta->local)) { 1251 sta->tx_rate = 55; 1252 sta->tx_rate_idx = 2; 1253 } 1254 } 1255 if (sta->tx_supp_rates & WLAN_RATE_11M) { 1256 sta->tx_max_rate = 3; 1257 if (ap_tx_rate_ok(3, sta, sta->local)) { 1258 sta->tx_rate = 110; 1259 sta->tx_rate_idx = 3; 1260 } 1261 } 1262 } 1263 1264 1265 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 1266 1267 static void ap_crypt_init(struct ap_data *ap) 1268 { 1269 ap->crypt = lib80211_get_crypto_ops("WEP"); 1270 1271 if (ap->crypt) { 1272 if (ap->crypt->init) { 1273 ap->crypt_priv = ap->crypt->init(0); 1274 if (ap->crypt_priv == NULL) 1275 ap->crypt = NULL; 1276 else { 1277 u8 key[WEP_KEY_LEN]; 1278 get_random_bytes(key, WEP_KEY_LEN); 1279 ap->crypt->set_key(key, WEP_KEY_LEN, NULL, 1280 ap->crypt_priv); 1281 } 1282 } 1283 } 1284 1285 if (ap->crypt == NULL) { 1286 printk(KERN_WARNING "AP could not initialize WEP: load module " 1287 "lib80211_crypt_wep.ko\n"); 1288 } 1289 } 1290 1291 1292 /* Generate challenge data for shared key authentication. IEEE 802.11 specifies 1293 * that WEP algorithm is used for generating challenge. This should be unique, 1294 * but otherwise there is not really need for randomness etc. Initialize WEP 1295 * with pseudo random key and then use increasing IV to get unique challenge 1296 * streams. 1297 * 1298 * Called only as a scheduled task for pending AP frames. 1299 */ 1300 static char * ap_auth_make_challenge(struct ap_data *ap) 1301 { 1302 char *tmpbuf; 1303 struct sk_buff *skb; 1304 1305 if (ap->crypt == NULL) { 1306 ap_crypt_init(ap); 1307 if (ap->crypt == NULL) 1308 return NULL; 1309 } 1310 1311 tmpbuf = kmalloc(WLAN_AUTH_CHALLENGE_LEN, GFP_ATOMIC); 1312 if (tmpbuf == NULL) { 1313 PDEBUG(DEBUG_AP, "AP: kmalloc failed for challenge\n"); 1314 return NULL; 1315 } 1316 1317 skb = dev_alloc_skb(WLAN_AUTH_CHALLENGE_LEN + 1318 ap->crypt->extra_mpdu_prefix_len + 1319 ap->crypt->extra_mpdu_postfix_len); 1320 if (skb == NULL) { 1321 kfree(tmpbuf); 1322 return NULL; 1323 } 1324 1325 skb_reserve(skb, ap->crypt->extra_mpdu_prefix_len); 1326 skb_put_zero(skb, WLAN_AUTH_CHALLENGE_LEN); 1327 if (ap->crypt->encrypt_mpdu(skb, 0, ap->crypt_priv)) { 1328 dev_kfree_skb(skb); 1329 kfree(tmpbuf); 1330 return NULL; 1331 } 1332 1333 skb_copy_from_linear_data_offset(skb, ap->crypt->extra_mpdu_prefix_len, 1334 tmpbuf, WLAN_AUTH_CHALLENGE_LEN); 1335 dev_kfree_skb(skb); 1336 1337 return tmpbuf; 1338 } 1339 1340 1341 /* Called only as a scheduled task for pending AP frames. */ 1342 static void handle_authen(local_info_t *local, struct sk_buff *skb, 1343 struct hostap_80211_rx_status *rx_stats) 1344 { 1345 struct net_device *dev = local->dev; 1346 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1347 size_t hdrlen; 1348 struct ap_data *ap = local->ap; 1349 char body[8 + WLAN_AUTH_CHALLENGE_LEN], *challenge = NULL; 1350 int len, olen; 1351 u16 auth_alg, auth_transaction, status_code; 1352 __le16 *pos; 1353 u16 resp = WLAN_STATUS_SUCCESS; 1354 struct sta_info *sta = NULL; 1355 struct lib80211_crypt_data *crypt; 1356 char *txt = ""; 1357 1358 len = skb->len - IEEE80211_MGMT_HDR_LEN; 1359 1360 hdrlen = hostap_80211_get_hdrlen(hdr->frame_control); 1361 1362 if (len < 6) { 1363 PDEBUG(DEBUG_AP, "%s: handle_authen - too short payload " 1364 "(len=%d) from %pM\n", dev->name, len, hdr->addr2); 1365 return; 1366 } 1367 1368 spin_lock_bh(&local->ap->sta_table_lock); 1369 sta = ap_get_sta(local->ap, hdr->addr2); 1370 if (sta) 1371 atomic_inc(&sta->users); 1372 spin_unlock_bh(&local->ap->sta_table_lock); 1373 1374 if (sta && sta->crypt) 1375 crypt = sta->crypt; 1376 else { 1377 int idx = 0; 1378 if (skb->len >= hdrlen + 3) 1379 idx = skb->data[hdrlen + 3] >> 6; 1380 crypt = local->crypt_info.crypt[idx]; 1381 } 1382 1383 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN); 1384 auth_alg = __le16_to_cpu(*pos); 1385 pos++; 1386 auth_transaction = __le16_to_cpu(*pos); 1387 pos++; 1388 status_code = __le16_to_cpu(*pos); 1389 pos++; 1390 1391 if (ether_addr_equal(dev->dev_addr, hdr->addr2) || 1392 ap_control_mac_deny(&ap->mac_restrictions, hdr->addr2)) { 1393 txt = "authentication denied"; 1394 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1395 goto fail; 1396 } 1397 1398 if (((local->auth_algs & PRISM2_AUTH_OPEN) && 1399 auth_alg == WLAN_AUTH_OPEN) || 1400 ((local->auth_algs & PRISM2_AUTH_SHARED_KEY) && 1401 crypt && auth_alg == WLAN_AUTH_SHARED_KEY)) { 1402 } else { 1403 txt = "unsupported algorithm"; 1404 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG; 1405 goto fail; 1406 } 1407 1408 if (len >= 8) { 1409 u8 *u = (u8 *) pos; 1410 if (*u == WLAN_EID_CHALLENGE) { 1411 if (*(u + 1) != WLAN_AUTH_CHALLENGE_LEN) { 1412 txt = "invalid challenge len"; 1413 resp = WLAN_STATUS_CHALLENGE_FAIL; 1414 goto fail; 1415 } 1416 if (len - 8 < WLAN_AUTH_CHALLENGE_LEN) { 1417 txt = "challenge underflow"; 1418 resp = WLAN_STATUS_CHALLENGE_FAIL; 1419 goto fail; 1420 } 1421 challenge = (char *) (u + 2); 1422 } 1423 } 1424 1425 if (sta && sta->ap) { 1426 if (time_after(jiffies, sta->u.ap.last_beacon + 1427 (10 * sta->listen_interval * HZ) / 1024)) { 1428 PDEBUG(DEBUG_AP, "%s: no beacons received for a while," 1429 " assuming AP %pM is now STA\n", 1430 dev->name, sta->addr); 1431 sta->ap = 0; 1432 sta->flags = 0; 1433 sta->u.sta.challenge = NULL; 1434 } else { 1435 txt = "AP trying to authenticate?"; 1436 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1437 goto fail; 1438 } 1439 } 1440 1441 if ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1) || 1442 (auth_alg == WLAN_AUTH_SHARED_KEY && 1443 (auth_transaction == 1 || 1444 (auth_transaction == 3 && sta != NULL && 1445 sta->u.sta.challenge != NULL)))) { 1446 } else { 1447 txt = "unknown authentication transaction number"; 1448 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION; 1449 goto fail; 1450 } 1451 1452 if (sta == NULL) { 1453 txt = "new STA"; 1454 1455 if (local->ap->num_sta >= MAX_STA_COUNT) { 1456 /* FIX: might try to remove some old STAs first? */ 1457 txt = "no more room for new STAs"; 1458 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1459 goto fail; 1460 } 1461 1462 sta = ap_add_sta(local->ap, hdr->addr2); 1463 if (sta == NULL) { 1464 txt = "ap_add_sta failed"; 1465 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1466 goto fail; 1467 } 1468 } 1469 1470 switch (auth_alg) { 1471 case WLAN_AUTH_OPEN: 1472 txt = "authOK"; 1473 /* IEEE 802.11 standard is not completely clear about 1474 * whether STA is considered authenticated after 1475 * authentication OK frame has been send or after it 1476 * has been ACKed. In order to reduce interoperability 1477 * issues, mark the STA authenticated before ACK. */ 1478 sta->flags |= WLAN_STA_AUTH; 1479 break; 1480 1481 case WLAN_AUTH_SHARED_KEY: 1482 if (auth_transaction == 1) { 1483 if (sta->u.sta.challenge == NULL) { 1484 sta->u.sta.challenge = 1485 ap_auth_make_challenge(local->ap); 1486 if (sta->u.sta.challenge == NULL) { 1487 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1488 goto fail; 1489 } 1490 } 1491 } else { 1492 if (sta->u.sta.challenge == NULL || 1493 challenge == NULL || 1494 memcmp(sta->u.sta.challenge, challenge, 1495 WLAN_AUTH_CHALLENGE_LEN) != 0 || 1496 !ieee80211_has_protected(hdr->frame_control)) { 1497 txt = "challenge response incorrect"; 1498 resp = WLAN_STATUS_CHALLENGE_FAIL; 1499 goto fail; 1500 } 1501 1502 txt = "challenge OK - authOK"; 1503 /* IEEE 802.11 standard is not completely clear about 1504 * whether STA is considered authenticated after 1505 * authentication OK frame has been send or after it 1506 * has been ACKed. In order to reduce interoperability 1507 * issues, mark the STA authenticated before ACK. */ 1508 sta->flags |= WLAN_STA_AUTH; 1509 kfree(sta->u.sta.challenge); 1510 sta->u.sta.challenge = NULL; 1511 } 1512 break; 1513 } 1514 1515 fail: 1516 pos = (__le16 *) body; 1517 *pos = cpu_to_le16(auth_alg); 1518 pos++; 1519 *pos = cpu_to_le16(auth_transaction + 1); 1520 pos++; 1521 *pos = cpu_to_le16(resp); /* status_code */ 1522 pos++; 1523 olen = 6; 1524 1525 if (resp == WLAN_STATUS_SUCCESS && sta != NULL && 1526 sta->u.sta.challenge != NULL && 1527 auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 1) { 1528 u8 *tmp = (u8 *) pos; 1529 *tmp++ = WLAN_EID_CHALLENGE; 1530 *tmp++ = WLAN_AUTH_CHALLENGE_LEN; 1531 pos++; 1532 memcpy(pos, sta->u.sta.challenge, WLAN_AUTH_CHALLENGE_LEN); 1533 olen += 2 + WLAN_AUTH_CHALLENGE_LEN; 1534 } 1535 1536 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH, 1537 body, olen, hdr->addr2, ap->tx_callback_auth); 1538 1539 if (sta) { 1540 sta->last_rx = jiffies; 1541 atomic_dec(&sta->users); 1542 } 1543 1544 if (resp) { 1545 PDEBUG(DEBUG_AP, "%s: %pM auth (alg=%d " 1546 "trans#=%d stat=%d len=%d fc=%04x) ==> %d (%s)\n", 1547 dev->name, hdr->addr2, 1548 auth_alg, auth_transaction, status_code, len, 1549 le16_to_cpu(hdr->frame_control), resp, txt); 1550 } 1551 } 1552 1553 1554 /* Called only as a scheduled task for pending AP frames. */ 1555 static void handle_assoc(local_info_t *local, struct sk_buff *skb, 1556 struct hostap_80211_rx_status *rx_stats, int reassoc) 1557 { 1558 struct net_device *dev = local->dev; 1559 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1560 char body[12], *p, *lpos; 1561 int len, left; 1562 __le16 *pos; 1563 u16 resp = WLAN_STATUS_SUCCESS; 1564 struct sta_info *sta = NULL; 1565 int send_deauth = 0; 1566 char *txt = ""; 1567 u8 prev_ap[ETH_ALEN]; 1568 1569 left = len = skb->len - IEEE80211_MGMT_HDR_LEN; 1570 1571 if (len < (reassoc ? 10 : 4)) { 1572 PDEBUG(DEBUG_AP, "%s: handle_assoc - too short payload " 1573 "(len=%d, reassoc=%d) from %pM\n", 1574 dev->name, len, reassoc, hdr->addr2); 1575 return; 1576 } 1577 1578 spin_lock_bh(&local->ap->sta_table_lock); 1579 sta = ap_get_sta(local->ap, hdr->addr2); 1580 if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) { 1581 spin_unlock_bh(&local->ap->sta_table_lock); 1582 txt = "trying to associate before authentication"; 1583 send_deauth = 1; 1584 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1585 sta = NULL; /* do not decrement sta->users */ 1586 goto fail; 1587 } 1588 atomic_inc(&sta->users); 1589 spin_unlock_bh(&local->ap->sta_table_lock); 1590 1591 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN); 1592 sta->capability = __le16_to_cpu(*pos); 1593 pos++; left -= 2; 1594 sta->listen_interval = __le16_to_cpu(*pos); 1595 pos++; left -= 2; 1596 1597 if (reassoc) { 1598 memcpy(prev_ap, pos, ETH_ALEN); 1599 pos++; pos++; pos++; left -= 6; 1600 } else 1601 eth_zero_addr(prev_ap); 1602 1603 if (left >= 2) { 1604 unsigned int ileft; 1605 unsigned char *u = (unsigned char *) pos; 1606 1607 if (*u == WLAN_EID_SSID) { 1608 u++; left--; 1609 ileft = *u; 1610 u++; left--; 1611 1612 if (ileft > left || ileft > MAX_SSID_LEN) { 1613 txt = "SSID overflow"; 1614 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1615 goto fail; 1616 } 1617 1618 if (ileft != strlen(local->essid) || 1619 memcmp(local->essid, u, ileft) != 0) { 1620 txt = "not our SSID"; 1621 resp = WLAN_STATUS_ASSOC_DENIED_UNSPEC; 1622 goto fail; 1623 } 1624 1625 u += ileft; 1626 left -= ileft; 1627 } 1628 1629 if (left >= 2 && *u == WLAN_EID_SUPP_RATES) { 1630 u++; left--; 1631 ileft = *u; 1632 u++; left--; 1633 1634 if (ileft > left || ileft == 0 || 1635 ileft > WLAN_SUPP_RATES_MAX) { 1636 txt = "SUPP_RATES len error"; 1637 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1638 goto fail; 1639 } 1640 1641 memset(sta->supported_rates, 0, 1642 sizeof(sta->supported_rates)); 1643 memcpy(sta->supported_rates, u, ileft); 1644 prism2_check_tx_rates(sta); 1645 1646 u += ileft; 1647 left -= ileft; 1648 } 1649 1650 if (left > 0) { 1651 PDEBUG(DEBUG_AP, "%s: assoc from %pM" 1652 " with extra data (%d bytes) [", 1653 dev->name, hdr->addr2, left); 1654 while (left > 0) { 1655 PDEBUG2(DEBUG_AP, "<%02x>", *u); 1656 u++; left--; 1657 } 1658 PDEBUG2(DEBUG_AP, "]\n"); 1659 } 1660 } else { 1661 txt = "frame underflow"; 1662 resp = WLAN_STATUS_UNSPECIFIED_FAILURE; 1663 goto fail; 1664 } 1665 1666 /* get a unique AID */ 1667 if (sta->aid > 0) 1668 txt = "OK, old AID"; 1669 else { 1670 spin_lock_bh(&local->ap->sta_table_lock); 1671 for (sta->aid = 1; sta->aid <= MAX_AID_TABLE_SIZE; sta->aid++) 1672 if (local->ap->sta_aid[sta->aid - 1] == NULL) 1673 break; 1674 if (sta->aid > MAX_AID_TABLE_SIZE) { 1675 sta->aid = 0; 1676 spin_unlock_bh(&local->ap->sta_table_lock); 1677 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; 1678 txt = "no room for more AIDs"; 1679 } else { 1680 local->ap->sta_aid[sta->aid - 1] = sta; 1681 spin_unlock_bh(&local->ap->sta_table_lock); 1682 txt = "OK, new AID"; 1683 } 1684 } 1685 1686 fail: 1687 pos = (__le16 *) body; 1688 1689 if (send_deauth) { 1690 *pos = cpu_to_le16(WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH); 1691 pos++; 1692 } else { 1693 /* FIX: CF-Pollable and CF-PollReq should be set to match the 1694 * values in beacons/probe responses */ 1695 /* FIX: how about privacy and WEP? */ 1696 /* capability */ 1697 *pos = cpu_to_le16(WLAN_CAPABILITY_ESS); 1698 pos++; 1699 1700 /* status_code */ 1701 *pos = cpu_to_le16(resp); 1702 pos++; 1703 1704 *pos = cpu_to_le16((sta && sta->aid > 0 ? sta->aid : 0) | 1705 BIT(14) | BIT(15)); /* AID */ 1706 pos++; 1707 1708 /* Supported rates (Information element) */ 1709 p = (char *) pos; 1710 *p++ = WLAN_EID_SUPP_RATES; 1711 lpos = p; 1712 *p++ = 0; /* len */ 1713 if (local->tx_rate_control & WLAN_RATE_1M) { 1714 *p++ = local->basic_rates & WLAN_RATE_1M ? 0x82 : 0x02; 1715 (*lpos)++; 1716 } 1717 if (local->tx_rate_control & WLAN_RATE_2M) { 1718 *p++ = local->basic_rates & WLAN_RATE_2M ? 0x84 : 0x04; 1719 (*lpos)++; 1720 } 1721 if (local->tx_rate_control & WLAN_RATE_5M5) { 1722 *p++ = local->basic_rates & WLAN_RATE_5M5 ? 1723 0x8b : 0x0b; 1724 (*lpos)++; 1725 } 1726 if (local->tx_rate_control & WLAN_RATE_11M) { 1727 *p++ = local->basic_rates & WLAN_RATE_11M ? 1728 0x96 : 0x16; 1729 (*lpos)++; 1730 } 1731 pos = (__le16 *) p; 1732 } 1733 1734 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | 1735 (send_deauth ? IEEE80211_STYPE_DEAUTH : 1736 (reassoc ? IEEE80211_STYPE_REASSOC_RESP : 1737 IEEE80211_STYPE_ASSOC_RESP)), 1738 body, (u8 *) pos - (u8 *) body, 1739 hdr->addr2, 1740 send_deauth ? 0 : local->ap->tx_callback_assoc); 1741 1742 if (sta) { 1743 if (resp == WLAN_STATUS_SUCCESS) { 1744 sta->last_rx = jiffies; 1745 /* STA will be marked associated from TX callback, if 1746 * AssocResp is ACKed */ 1747 } 1748 atomic_dec(&sta->users); 1749 } 1750 1751 #if 0 1752 PDEBUG(DEBUG_AP, "%s: %pM %sassoc (len=%d " 1753 "prev_ap=%pM) => %d(%d) (%s)\n", 1754 dev->name, 1755 hdr->addr2, 1756 reassoc ? "re" : "", len, 1757 prev_ap, 1758 resp, send_deauth, txt); 1759 #endif 1760 } 1761 1762 1763 /* Called only as a scheduled task for pending AP frames. */ 1764 static void handle_deauth(local_info_t *local, struct sk_buff *skb, 1765 struct hostap_80211_rx_status *rx_stats) 1766 { 1767 struct net_device *dev = local->dev; 1768 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1769 char *body = (char *) (skb->data + IEEE80211_MGMT_HDR_LEN); 1770 int len; 1771 u16 reason_code; 1772 __le16 *pos; 1773 struct sta_info *sta = NULL; 1774 1775 len = skb->len - IEEE80211_MGMT_HDR_LEN; 1776 1777 if (len < 2) { 1778 printk("handle_deauth - too short payload (len=%d)\n", len); 1779 return; 1780 } 1781 1782 pos = (__le16 *) body; 1783 reason_code = le16_to_cpu(*pos); 1784 1785 PDEBUG(DEBUG_AP, "%s: deauthentication: %pM len=%d, " 1786 "reason_code=%d\n", dev->name, hdr->addr2, 1787 len, reason_code); 1788 1789 spin_lock_bh(&local->ap->sta_table_lock); 1790 sta = ap_get_sta(local->ap, hdr->addr2); 1791 if (sta != NULL) { 1792 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap) 1793 hostap_event_expired_sta(local->dev, sta); 1794 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC); 1795 } 1796 spin_unlock_bh(&local->ap->sta_table_lock); 1797 if (sta == NULL) { 1798 printk("%s: deauthentication from %pM, " 1799 "reason_code=%d, but STA not authenticated\n", dev->name, 1800 hdr->addr2, reason_code); 1801 } 1802 } 1803 1804 1805 /* Called only as a scheduled task for pending AP frames. */ 1806 static void handle_disassoc(local_info_t *local, struct sk_buff *skb, 1807 struct hostap_80211_rx_status *rx_stats) 1808 { 1809 struct net_device *dev = local->dev; 1810 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1811 char *body = skb->data + IEEE80211_MGMT_HDR_LEN; 1812 int len; 1813 u16 reason_code; 1814 __le16 *pos; 1815 struct sta_info *sta = NULL; 1816 1817 len = skb->len - IEEE80211_MGMT_HDR_LEN; 1818 1819 if (len < 2) { 1820 printk("handle_disassoc - too short payload (len=%d)\n", len); 1821 return; 1822 } 1823 1824 pos = (__le16 *) body; 1825 reason_code = le16_to_cpu(*pos); 1826 1827 PDEBUG(DEBUG_AP, "%s: disassociation: %pM len=%d, " 1828 "reason_code=%d\n", dev->name, hdr->addr2, 1829 len, reason_code); 1830 1831 spin_lock_bh(&local->ap->sta_table_lock); 1832 sta = ap_get_sta(local->ap, hdr->addr2); 1833 if (sta != NULL) { 1834 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap) 1835 hostap_event_expired_sta(local->dev, sta); 1836 sta->flags &= ~WLAN_STA_ASSOC; 1837 } 1838 spin_unlock_bh(&local->ap->sta_table_lock); 1839 if (sta == NULL) { 1840 printk("%s: disassociation from %pM, " 1841 "reason_code=%d, but STA not authenticated\n", 1842 dev->name, hdr->addr2, reason_code); 1843 } 1844 } 1845 1846 1847 /* Called only as a scheduled task for pending AP frames. */ 1848 static void ap_handle_data_nullfunc(local_info_t *local, 1849 struct ieee80211_hdr *hdr) 1850 { 1851 struct net_device *dev = local->dev; 1852 1853 /* some STA f/w's seem to require control::ACK frame for 1854 * data::nullfunc, but at least Prism2 station f/w version 0.8.0 does 1855 * not send this.. 1856 * send control::ACK for the data::nullfunc */ 1857 1858 printk(KERN_DEBUG "Sending control::ACK for data::nullfunc\n"); 1859 prism2_send_mgmt(dev, IEEE80211_FTYPE_CTL | IEEE80211_STYPE_ACK, 1860 NULL, 0, hdr->addr2, 0); 1861 } 1862 1863 1864 /* Called only as a scheduled task for pending AP frames. */ 1865 static void ap_handle_dropped_data(local_info_t *local, 1866 struct ieee80211_hdr *hdr) 1867 { 1868 struct net_device *dev = local->dev; 1869 struct sta_info *sta; 1870 __le16 reason; 1871 1872 spin_lock_bh(&local->ap->sta_table_lock); 1873 sta = ap_get_sta(local->ap, hdr->addr2); 1874 if (sta) 1875 atomic_inc(&sta->users); 1876 spin_unlock_bh(&local->ap->sta_table_lock); 1877 1878 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC)) { 1879 PDEBUG(DEBUG_AP, "ap_handle_dropped_data: STA is now okay?\n"); 1880 atomic_dec(&sta->users); 1881 return; 1882 } 1883 1884 reason = cpu_to_le16(WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA); 1885 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | 1886 ((sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) ? 1887 IEEE80211_STYPE_DEAUTH : IEEE80211_STYPE_DISASSOC), 1888 (char *) &reason, sizeof(reason), hdr->addr2, 0); 1889 1890 if (sta) 1891 atomic_dec(&sta->users); 1892 } 1893 1894 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 1895 1896 1897 /* Called only as a scheduled task for pending AP frames. */ 1898 static void pspoll_send_buffered(local_info_t *local, struct sta_info *sta, 1899 struct sk_buff *skb) 1900 { 1901 struct hostap_skb_tx_data *meta; 1902 1903 if (!(sta->flags & WLAN_STA_PS)) { 1904 /* Station has moved to non-PS mode, so send all buffered 1905 * frames using normal device queue. */ 1906 dev_queue_xmit(skb); 1907 return; 1908 } 1909 1910 /* add a flag for hostap_handle_sta_tx() to know that this skb should 1911 * be passed through even though STA is using PS */ 1912 meta = (struct hostap_skb_tx_data *) skb->cb; 1913 meta->flags |= HOSTAP_TX_FLAGS_BUFFERED_FRAME; 1914 if (!skb_queue_empty(&sta->tx_buf)) { 1915 /* indicate to STA that more frames follow */ 1916 meta->flags |= HOSTAP_TX_FLAGS_ADD_MOREDATA; 1917 } 1918 dev_queue_xmit(skb); 1919 } 1920 1921 1922 /* Called only as a scheduled task for pending AP frames. */ 1923 static void handle_pspoll(local_info_t *local, 1924 struct ieee80211_hdr *hdr, 1925 struct hostap_80211_rx_status *rx_stats) 1926 { 1927 struct net_device *dev = local->dev; 1928 struct sta_info *sta; 1929 u16 aid; 1930 struct sk_buff *skb; 1931 1932 PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=%pM, TA=%pM PWRMGT=%d\n", 1933 hdr->addr1, hdr->addr2, !!ieee80211_has_pm(hdr->frame_control)); 1934 1935 if (!ether_addr_equal(hdr->addr1, dev->dev_addr)) { 1936 PDEBUG(DEBUG_AP, 1937 "handle_pspoll - addr1(BSSID)=%pM not own MAC\n", 1938 hdr->addr1); 1939 return; 1940 } 1941 1942 aid = le16_to_cpu(hdr->duration_id); 1943 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14))) { 1944 PDEBUG(DEBUG_PS, " PSPOLL and AID[15:14] not set\n"); 1945 return; 1946 } 1947 aid &= ~(BIT(15) | BIT(14)); 1948 if (aid == 0 || aid > MAX_AID_TABLE_SIZE) { 1949 PDEBUG(DEBUG_PS, " invalid aid=%d\n", aid); 1950 return; 1951 } 1952 PDEBUG(DEBUG_PS2, " aid=%d\n", aid); 1953 1954 spin_lock_bh(&local->ap->sta_table_lock); 1955 sta = ap_get_sta(local->ap, hdr->addr2); 1956 if (sta) 1957 atomic_inc(&sta->users); 1958 spin_unlock_bh(&local->ap->sta_table_lock); 1959 1960 if (sta == NULL) { 1961 PDEBUG(DEBUG_PS, " STA not found\n"); 1962 return; 1963 } 1964 if (sta->aid != aid) { 1965 PDEBUG(DEBUG_PS, " received aid=%i does not match with " 1966 "assoc.aid=%d\n", aid, sta->aid); 1967 return; 1968 } 1969 1970 /* FIX: todo: 1971 * - add timeout for buffering (clear aid in TIM vector if buffer timed 1972 * out (expiry time must be longer than ListenInterval for 1973 * the corresponding STA; "8802-11: 11.2.1.9 AP aging function" 1974 * - what to do, if buffered, pspolled, and sent frame is not ACKed by 1975 * sta; store buffer for later use and leave TIM aid bit set? use 1976 * TX event to check whether frame was ACKed? 1977 */ 1978 1979 while ((skb = skb_dequeue(&sta->tx_buf)) != NULL) { 1980 /* send buffered frame .. */ 1981 PDEBUG(DEBUG_PS2, "Sending buffered frame to STA after PS POLL" 1982 " (buffer_count=%d)\n", skb_queue_len(&sta->tx_buf)); 1983 1984 pspoll_send_buffered(local, sta, skb); 1985 1986 if (sta->flags & WLAN_STA_PS) { 1987 /* send only one buffered packet per PS Poll */ 1988 /* FIX: should ignore further PS Polls until the 1989 * buffered packet that was just sent is acknowledged 1990 * (Tx or TxExc event) */ 1991 break; 1992 } 1993 } 1994 1995 if (skb_queue_empty(&sta->tx_buf)) { 1996 /* try to clear aid from TIM */ 1997 if (!(sta->flags & WLAN_STA_TIM)) 1998 PDEBUG(DEBUG_PS2, "Re-unsetting TIM for aid %d\n", 1999 aid); 2000 hostap_set_tim(local, aid, 0); 2001 sta->flags &= ~WLAN_STA_TIM; 2002 } 2003 2004 atomic_dec(&sta->users); 2005 } 2006 2007 2008 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 2009 2010 static void handle_wds_oper_queue(struct work_struct *work) 2011 { 2012 struct ap_data *ap = container_of(work, struct ap_data, 2013 wds_oper_queue); 2014 local_info_t *local = ap->local; 2015 struct wds_oper_data *entry, *prev; 2016 2017 spin_lock_bh(&local->lock); 2018 entry = local->ap->wds_oper_entries; 2019 local->ap->wds_oper_entries = NULL; 2020 spin_unlock_bh(&local->lock); 2021 2022 while (entry) { 2023 PDEBUG(DEBUG_AP, "%s: %s automatic WDS connection " 2024 "to AP %pM\n", 2025 local->dev->name, 2026 entry->type == WDS_ADD ? "adding" : "removing", 2027 entry->addr); 2028 if (entry->type == WDS_ADD) 2029 prism2_wds_add(local, entry->addr, 0); 2030 else if (entry->type == WDS_DEL) 2031 prism2_wds_del(local, entry->addr, 0, 1); 2032 2033 prev = entry; 2034 entry = entry->next; 2035 kfree(prev); 2036 } 2037 } 2038 2039 2040 /* Called only as a scheduled task for pending AP frames. */ 2041 static void handle_beacon(local_info_t *local, struct sk_buff *skb, 2042 struct hostap_80211_rx_status *rx_stats) 2043 { 2044 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 2045 char *body = skb->data + IEEE80211_MGMT_HDR_LEN; 2046 int len, left; 2047 u16 beacon_int, capability; 2048 __le16 *pos; 2049 char *ssid = NULL; 2050 unsigned char *supp_rates = NULL; 2051 int ssid_len = 0, supp_rates_len = 0; 2052 struct sta_info *sta = NULL; 2053 int new_sta = 0, channel = -1; 2054 2055 len = skb->len - IEEE80211_MGMT_HDR_LEN; 2056 2057 if (len < 8 + 2 + 2) { 2058 printk(KERN_DEBUG "handle_beacon - too short payload " 2059 "(len=%d)\n", len); 2060 return; 2061 } 2062 2063 pos = (__le16 *) body; 2064 left = len; 2065 2066 /* Timestamp (8 octets) */ 2067 pos += 4; left -= 8; 2068 /* Beacon interval (2 octets) */ 2069 beacon_int = le16_to_cpu(*pos); 2070 pos++; left -= 2; 2071 /* Capability information (2 octets) */ 2072 capability = le16_to_cpu(*pos); 2073 pos++; left -= 2; 2074 2075 if (local->ap->ap_policy != AP_OTHER_AP_EVEN_IBSS && 2076 capability & WLAN_CAPABILITY_IBSS) 2077 return; 2078 2079 if (left >= 2) { 2080 unsigned int ileft; 2081 unsigned char *u = (unsigned char *) pos; 2082 2083 if (*u == WLAN_EID_SSID) { 2084 u++; left--; 2085 ileft = *u; 2086 u++; left--; 2087 2088 if (ileft > left || ileft > MAX_SSID_LEN) { 2089 PDEBUG(DEBUG_AP, "SSID: overflow\n"); 2090 return; 2091 } 2092 2093 if (local->ap->ap_policy == AP_OTHER_AP_SAME_SSID && 2094 (ileft != strlen(local->essid) || 2095 memcmp(local->essid, u, ileft) != 0)) { 2096 /* not our SSID */ 2097 return; 2098 } 2099 2100 ssid = u; 2101 ssid_len = ileft; 2102 2103 u += ileft; 2104 left -= ileft; 2105 } 2106 2107 if (*u == WLAN_EID_SUPP_RATES) { 2108 u++; left--; 2109 ileft = *u; 2110 u++; left--; 2111 2112 if (ileft > left || ileft == 0 || ileft > 8) { 2113 PDEBUG(DEBUG_AP, " - SUPP_RATES len error\n"); 2114 return; 2115 } 2116 2117 supp_rates = u; 2118 supp_rates_len = ileft; 2119 2120 u += ileft; 2121 left -= ileft; 2122 } 2123 2124 if (*u == WLAN_EID_DS_PARAMS) { 2125 u++; left--; 2126 ileft = *u; 2127 u++; left--; 2128 2129 if (ileft > left || ileft != 1) { 2130 PDEBUG(DEBUG_AP, " - DS_PARAMS len error\n"); 2131 return; 2132 } 2133 2134 channel = *u; 2135 2136 u += ileft; 2137 left -= ileft; 2138 } 2139 } 2140 2141 spin_lock_bh(&local->ap->sta_table_lock); 2142 sta = ap_get_sta(local->ap, hdr->addr2); 2143 if (sta != NULL) 2144 atomic_inc(&sta->users); 2145 spin_unlock_bh(&local->ap->sta_table_lock); 2146 2147 if (sta == NULL) { 2148 /* add new AP */ 2149 new_sta = 1; 2150 sta = ap_add_sta(local->ap, hdr->addr2); 2151 if (sta == NULL) { 2152 printk(KERN_INFO "prism2: kmalloc failed for AP " 2153 "data structure\n"); 2154 return; 2155 } 2156 hostap_event_new_sta(local->dev, sta); 2157 2158 /* mark APs authentication and associated for pseudo ad-hoc 2159 * style communication */ 2160 sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC; 2161 2162 if (local->ap->autom_ap_wds) { 2163 hostap_wds_link_oper(local, sta->addr, WDS_ADD); 2164 } 2165 } 2166 2167 sta->ap = 1; 2168 if (ssid) { 2169 sta->u.ap.ssid_len = ssid_len; 2170 memcpy(sta->u.ap.ssid, ssid, ssid_len); 2171 sta->u.ap.ssid[ssid_len] = '\0'; 2172 } else { 2173 sta->u.ap.ssid_len = 0; 2174 sta->u.ap.ssid[0] = '\0'; 2175 } 2176 sta->u.ap.channel = channel; 2177 sta->rx_packets++; 2178 sta->rx_bytes += len; 2179 sta->u.ap.last_beacon = sta->last_rx = jiffies; 2180 sta->capability = capability; 2181 sta->listen_interval = beacon_int; 2182 2183 atomic_dec(&sta->users); 2184 2185 if (new_sta) { 2186 memset(sta->supported_rates, 0, sizeof(sta->supported_rates)); 2187 memcpy(sta->supported_rates, supp_rates, supp_rates_len); 2188 prism2_check_tx_rates(sta); 2189 } 2190 } 2191 2192 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 2193 2194 2195 /* Called only as a tasklet. */ 2196 static void handle_ap_item(local_info_t *local, struct sk_buff *skb, 2197 struct hostap_80211_rx_status *rx_stats) 2198 { 2199 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 2200 struct net_device *dev = local->dev; 2201 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 2202 u16 fc, type, stype; 2203 struct ieee80211_hdr *hdr; 2204 2205 /* FIX: should give skb->len to handler functions and check that the 2206 * buffer is long enough */ 2207 hdr = (struct ieee80211_hdr *) skb->data; 2208 fc = le16_to_cpu(hdr->frame_control); 2209 type = fc & IEEE80211_FCTL_FTYPE; 2210 stype = fc & IEEE80211_FCTL_STYPE; 2211 2212 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 2213 if (!local->hostapd && type == IEEE80211_FTYPE_DATA) { 2214 PDEBUG(DEBUG_AP, "handle_ap_item - data frame\n"); 2215 2216 if (!(fc & IEEE80211_FCTL_TODS) || 2217 (fc & IEEE80211_FCTL_FROMDS)) { 2218 if (stype == IEEE80211_STYPE_NULLFUNC) { 2219 /* no ToDS nullfunc seems to be used to check 2220 * AP association; so send reject message to 2221 * speed up re-association */ 2222 ap_handle_dropped_data(local, hdr); 2223 goto done; 2224 } 2225 PDEBUG(DEBUG_AP, " not ToDS frame (fc=0x%04x)\n", 2226 fc); 2227 goto done; 2228 } 2229 2230 if (!ether_addr_equal(hdr->addr1, dev->dev_addr)) { 2231 PDEBUG(DEBUG_AP, "handle_ap_item - addr1(BSSID)=%pM" 2232 " not own MAC\n", hdr->addr1); 2233 goto done; 2234 } 2235 2236 if (local->ap->nullfunc_ack && 2237 stype == IEEE80211_STYPE_NULLFUNC) 2238 ap_handle_data_nullfunc(local, hdr); 2239 else 2240 ap_handle_dropped_data(local, hdr); 2241 goto done; 2242 } 2243 2244 if (type == IEEE80211_FTYPE_MGMT && stype == IEEE80211_STYPE_BEACON) { 2245 handle_beacon(local, skb, rx_stats); 2246 goto done; 2247 } 2248 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 2249 2250 if (type == IEEE80211_FTYPE_CTL && stype == IEEE80211_STYPE_PSPOLL) { 2251 handle_pspoll(local, hdr, rx_stats); 2252 goto done; 2253 } 2254 2255 if (local->hostapd) { 2256 PDEBUG(DEBUG_AP, "Unknown frame in AP queue: type=0x%02x " 2257 "subtype=0x%02x\n", type, stype); 2258 goto done; 2259 } 2260 2261 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 2262 if (type != IEEE80211_FTYPE_MGMT) { 2263 PDEBUG(DEBUG_AP, "handle_ap_item - not a management frame?\n"); 2264 goto done; 2265 } 2266 2267 if (!ether_addr_equal(hdr->addr1, dev->dev_addr)) { 2268 PDEBUG(DEBUG_AP, "handle_ap_item - addr1(DA)=%pM" 2269 " not own MAC\n", hdr->addr1); 2270 goto done; 2271 } 2272 2273 if (!ether_addr_equal(hdr->addr3, dev->dev_addr)) { 2274 PDEBUG(DEBUG_AP, "handle_ap_item - addr3(BSSID)=%pM" 2275 " not own MAC\n", hdr->addr3); 2276 goto done; 2277 } 2278 2279 switch (stype) { 2280 case IEEE80211_STYPE_ASSOC_REQ: 2281 handle_assoc(local, skb, rx_stats, 0); 2282 break; 2283 case IEEE80211_STYPE_ASSOC_RESP: 2284 PDEBUG(DEBUG_AP, "==> ASSOC RESP (ignored)\n"); 2285 break; 2286 case IEEE80211_STYPE_REASSOC_REQ: 2287 handle_assoc(local, skb, rx_stats, 1); 2288 break; 2289 case IEEE80211_STYPE_REASSOC_RESP: 2290 PDEBUG(DEBUG_AP, "==> REASSOC RESP (ignored)\n"); 2291 break; 2292 case IEEE80211_STYPE_ATIM: 2293 PDEBUG(DEBUG_AP, "==> ATIM (ignored)\n"); 2294 break; 2295 case IEEE80211_STYPE_DISASSOC: 2296 handle_disassoc(local, skb, rx_stats); 2297 break; 2298 case IEEE80211_STYPE_AUTH: 2299 handle_authen(local, skb, rx_stats); 2300 break; 2301 case IEEE80211_STYPE_DEAUTH: 2302 handle_deauth(local, skb, rx_stats); 2303 break; 2304 default: 2305 PDEBUG(DEBUG_AP, "Unknown mgmt frame subtype 0x%02x\n", 2306 stype >> 4); 2307 break; 2308 } 2309 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 2310 2311 done: 2312 dev_kfree_skb(skb); 2313 } 2314 2315 2316 /* Called only as a tasklet (software IRQ) */ 2317 void hostap_rx(struct net_device *dev, struct sk_buff *skb, 2318 struct hostap_80211_rx_status *rx_stats) 2319 { 2320 struct hostap_interface *iface; 2321 local_info_t *local; 2322 struct ieee80211_hdr *hdr; 2323 2324 iface = netdev_priv(dev); 2325 local = iface->local; 2326 2327 if (skb->len < 16) 2328 goto drop; 2329 2330 dev->stats.rx_packets++; 2331 2332 hdr = (struct ieee80211_hdr *) skb->data; 2333 2334 if (local->ap->ap_policy == AP_OTHER_AP_SKIP_ALL && 2335 ieee80211_is_beacon(hdr->frame_control)) 2336 goto drop; 2337 2338 skb->protocol = cpu_to_be16(ETH_P_HOSTAP); 2339 handle_ap_item(local, skb, rx_stats); 2340 return; 2341 2342 drop: 2343 dev_kfree_skb(skb); 2344 } 2345 2346 2347 /* Called only as a tasklet (software IRQ) */ 2348 static void schedule_packet_send(local_info_t *local, struct sta_info *sta) 2349 { 2350 struct sk_buff *skb; 2351 struct ieee80211_hdr *hdr; 2352 struct hostap_80211_rx_status rx_stats; 2353 2354 if (skb_queue_empty(&sta->tx_buf)) 2355 return; 2356 2357 skb = dev_alloc_skb(16); 2358 if (skb == NULL) { 2359 printk(KERN_DEBUG "%s: schedule_packet_send: skb alloc " 2360 "failed\n", local->dev->name); 2361 return; 2362 } 2363 2364 hdr = skb_put(skb, 16); 2365 2366 /* Generate a fake pspoll frame to start packet delivery */ 2367 hdr->frame_control = cpu_to_le16( 2368 IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL); 2369 memcpy(hdr->addr1, local->dev->dev_addr, ETH_ALEN); 2370 memcpy(hdr->addr2, sta->addr, ETH_ALEN); 2371 hdr->duration_id = cpu_to_le16(sta->aid | BIT(15) | BIT(14)); 2372 2373 PDEBUG(DEBUG_PS2, 2374 "%s: Scheduling buffered packet delivery for STA %pM\n", 2375 local->dev->name, sta->addr); 2376 2377 skb->dev = local->dev; 2378 2379 memset(&rx_stats, 0, sizeof(rx_stats)); 2380 hostap_rx(local->dev, skb, &rx_stats); 2381 } 2382 2383 2384 int prism2_ap_get_sta_qual(local_info_t *local, struct sockaddr addr[], 2385 struct iw_quality qual[], int buf_size, 2386 int aplist) 2387 { 2388 struct ap_data *ap = local->ap; 2389 struct list_head *ptr; 2390 int count = 0; 2391 2392 spin_lock_bh(&ap->sta_table_lock); 2393 2394 for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list; 2395 ptr = ptr->next) { 2396 struct sta_info *sta = (struct sta_info *) ptr; 2397 2398 if (aplist && !sta->ap) 2399 continue; 2400 addr[count].sa_family = ARPHRD_ETHER; 2401 memcpy(addr[count].sa_data, sta->addr, ETH_ALEN); 2402 if (sta->last_rx_silence == 0) 2403 qual[count].qual = sta->last_rx_signal < 27 ? 2404 0 : (sta->last_rx_signal - 27) * 92 / 127; 2405 else 2406 qual[count].qual = sta->last_rx_signal - 2407 sta->last_rx_silence - 35; 2408 qual[count].level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal); 2409 qual[count].noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence); 2410 qual[count].updated = sta->last_rx_updated; 2411 2412 sta->last_rx_updated = IW_QUAL_DBM; 2413 2414 count++; 2415 if (count >= buf_size) 2416 break; 2417 } 2418 spin_unlock_bh(&ap->sta_table_lock); 2419 2420 return count; 2421 } 2422 2423 2424 /* Translate our list of Access Points & Stations to a card independent 2425 * format that the Wireless Tools will understand - Jean II */ 2426 int prism2_ap_translate_scan(struct net_device *dev, 2427 struct iw_request_info *info, char *buffer) 2428 { 2429 struct hostap_interface *iface; 2430 local_info_t *local; 2431 struct ap_data *ap; 2432 struct list_head *ptr; 2433 struct iw_event iwe; 2434 char *current_ev = buffer; 2435 char *end_buf = buffer + IW_SCAN_MAX_DATA; 2436 #if !defined(PRISM2_NO_KERNEL_IEEE80211_MGMT) 2437 char buf[64]; 2438 #endif 2439 2440 iface = netdev_priv(dev); 2441 local = iface->local; 2442 ap = local->ap; 2443 2444 spin_lock_bh(&ap->sta_table_lock); 2445 2446 for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list; 2447 ptr = ptr->next) { 2448 struct sta_info *sta = (struct sta_info *) ptr; 2449 2450 /* First entry *MUST* be the AP MAC address */ 2451 memset(&iwe, 0, sizeof(iwe)); 2452 iwe.cmd = SIOCGIWAP; 2453 iwe.u.ap_addr.sa_family = ARPHRD_ETHER; 2454 memcpy(iwe.u.ap_addr.sa_data, sta->addr, ETH_ALEN); 2455 iwe.len = IW_EV_ADDR_LEN; 2456 current_ev = iwe_stream_add_event(info, current_ev, end_buf, 2457 &iwe, IW_EV_ADDR_LEN); 2458 2459 /* Use the mode to indicate if it's a station or 2460 * an Access Point */ 2461 memset(&iwe, 0, sizeof(iwe)); 2462 iwe.cmd = SIOCGIWMODE; 2463 if (sta->ap) 2464 iwe.u.mode = IW_MODE_MASTER; 2465 else 2466 iwe.u.mode = IW_MODE_INFRA; 2467 iwe.len = IW_EV_UINT_LEN; 2468 current_ev = iwe_stream_add_event(info, current_ev, end_buf, 2469 &iwe, IW_EV_UINT_LEN); 2470 2471 /* Some quality */ 2472 memset(&iwe, 0, sizeof(iwe)); 2473 iwe.cmd = IWEVQUAL; 2474 if (sta->last_rx_silence == 0) 2475 iwe.u.qual.qual = sta->last_rx_signal < 27 ? 2476 0 : (sta->last_rx_signal - 27) * 92 / 127; 2477 else 2478 iwe.u.qual.qual = sta->last_rx_signal - 2479 sta->last_rx_silence - 35; 2480 iwe.u.qual.level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal); 2481 iwe.u.qual.noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence); 2482 iwe.u.qual.updated = sta->last_rx_updated; 2483 iwe.len = IW_EV_QUAL_LEN; 2484 current_ev = iwe_stream_add_event(info, current_ev, end_buf, 2485 &iwe, IW_EV_QUAL_LEN); 2486 2487 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 2488 if (sta->ap) { 2489 memset(&iwe, 0, sizeof(iwe)); 2490 iwe.cmd = SIOCGIWESSID; 2491 iwe.u.data.length = sta->u.ap.ssid_len; 2492 iwe.u.data.flags = 1; 2493 current_ev = iwe_stream_add_point(info, current_ev, 2494 end_buf, &iwe, 2495 sta->u.ap.ssid); 2496 2497 memset(&iwe, 0, sizeof(iwe)); 2498 iwe.cmd = SIOCGIWENCODE; 2499 if (sta->capability & WLAN_CAPABILITY_PRIVACY) 2500 iwe.u.data.flags = 2501 IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; 2502 else 2503 iwe.u.data.flags = IW_ENCODE_DISABLED; 2504 current_ev = iwe_stream_add_point(info, current_ev, 2505 end_buf, &iwe, 2506 sta->u.ap.ssid); 2507 2508 if (sta->u.ap.channel > 0 && 2509 sta->u.ap.channel <= FREQ_COUNT) { 2510 memset(&iwe, 0, sizeof(iwe)); 2511 iwe.cmd = SIOCGIWFREQ; 2512 iwe.u.freq.m = freq_list[sta->u.ap.channel - 1] 2513 * 100000; 2514 iwe.u.freq.e = 1; 2515 current_ev = iwe_stream_add_event( 2516 info, current_ev, end_buf, &iwe, 2517 IW_EV_FREQ_LEN); 2518 } 2519 2520 memset(&iwe, 0, sizeof(iwe)); 2521 iwe.cmd = IWEVCUSTOM; 2522 sprintf(buf, "beacon_interval=%d", 2523 sta->listen_interval); 2524 iwe.u.data.length = strlen(buf); 2525 current_ev = iwe_stream_add_point(info, current_ev, 2526 end_buf, &iwe, buf); 2527 } 2528 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 2529 2530 sta->last_rx_updated = IW_QUAL_DBM; 2531 2532 /* To be continued, we should make good use of IWEVCUSTOM */ 2533 } 2534 2535 spin_unlock_bh(&ap->sta_table_lock); 2536 2537 return current_ev - buffer; 2538 } 2539 2540 2541 static int prism2_hostapd_add_sta(struct ap_data *ap, 2542 struct prism2_hostapd_param *param) 2543 { 2544 struct sta_info *sta; 2545 2546 spin_lock_bh(&ap->sta_table_lock); 2547 sta = ap_get_sta(ap, param->sta_addr); 2548 if (sta) 2549 atomic_inc(&sta->users); 2550 spin_unlock_bh(&ap->sta_table_lock); 2551 2552 if (sta == NULL) { 2553 sta = ap_add_sta(ap, param->sta_addr); 2554 if (sta == NULL) 2555 return -1; 2556 } 2557 2558 if (!(sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local) 2559 hostap_event_new_sta(sta->local->dev, sta); 2560 2561 sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC; 2562 sta->last_rx = jiffies; 2563 sta->aid = param->u.add_sta.aid; 2564 sta->capability = param->u.add_sta.capability; 2565 sta->tx_supp_rates = param->u.add_sta.tx_supp_rates; 2566 if (sta->tx_supp_rates & WLAN_RATE_1M) 2567 sta->supported_rates[0] = 2; 2568 if (sta->tx_supp_rates & WLAN_RATE_2M) 2569 sta->supported_rates[1] = 4; 2570 if (sta->tx_supp_rates & WLAN_RATE_5M5) 2571 sta->supported_rates[2] = 11; 2572 if (sta->tx_supp_rates & WLAN_RATE_11M) 2573 sta->supported_rates[3] = 22; 2574 prism2_check_tx_rates(sta); 2575 atomic_dec(&sta->users); 2576 return 0; 2577 } 2578 2579 2580 static int prism2_hostapd_remove_sta(struct ap_data *ap, 2581 struct prism2_hostapd_param *param) 2582 { 2583 struct sta_info *sta; 2584 2585 spin_lock_bh(&ap->sta_table_lock); 2586 sta = ap_get_sta(ap, param->sta_addr); 2587 if (sta) { 2588 ap_sta_hash_del(ap, sta); 2589 list_del(&sta->list); 2590 } 2591 spin_unlock_bh(&ap->sta_table_lock); 2592 2593 if (!sta) 2594 return -ENOENT; 2595 2596 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local) 2597 hostap_event_expired_sta(sta->local->dev, sta); 2598 ap_free_sta(ap, sta); 2599 2600 return 0; 2601 } 2602 2603 2604 static int prism2_hostapd_get_info_sta(struct ap_data *ap, 2605 struct prism2_hostapd_param *param) 2606 { 2607 struct sta_info *sta; 2608 2609 spin_lock_bh(&ap->sta_table_lock); 2610 sta = ap_get_sta(ap, param->sta_addr); 2611 if (sta) 2612 atomic_inc(&sta->users); 2613 spin_unlock_bh(&ap->sta_table_lock); 2614 2615 if (!sta) 2616 return -ENOENT; 2617 2618 param->u.get_info_sta.inactive_sec = (jiffies - sta->last_rx) / HZ; 2619 2620 atomic_dec(&sta->users); 2621 2622 return 1; 2623 } 2624 2625 2626 static int prism2_hostapd_set_flags_sta(struct ap_data *ap, 2627 struct prism2_hostapd_param *param) 2628 { 2629 struct sta_info *sta; 2630 2631 spin_lock_bh(&ap->sta_table_lock); 2632 sta = ap_get_sta(ap, param->sta_addr); 2633 if (sta) { 2634 sta->flags |= param->u.set_flags_sta.flags_or; 2635 sta->flags &= param->u.set_flags_sta.flags_and; 2636 } 2637 spin_unlock_bh(&ap->sta_table_lock); 2638 2639 if (!sta) 2640 return -ENOENT; 2641 2642 return 0; 2643 } 2644 2645 2646 static int prism2_hostapd_sta_clear_stats(struct ap_data *ap, 2647 struct prism2_hostapd_param *param) 2648 { 2649 struct sta_info *sta; 2650 int rate; 2651 2652 spin_lock_bh(&ap->sta_table_lock); 2653 sta = ap_get_sta(ap, param->sta_addr); 2654 if (sta) { 2655 sta->rx_packets = sta->tx_packets = 0; 2656 sta->rx_bytes = sta->tx_bytes = 0; 2657 for (rate = 0; rate < WLAN_RATE_COUNT; rate++) { 2658 sta->tx_count[rate] = 0; 2659 sta->rx_count[rate] = 0; 2660 } 2661 } 2662 spin_unlock_bh(&ap->sta_table_lock); 2663 2664 if (!sta) 2665 return -ENOENT; 2666 2667 return 0; 2668 } 2669 2670 2671 int prism2_hostapd(struct ap_data *ap, struct prism2_hostapd_param *param) 2672 { 2673 switch (param->cmd) { 2674 case PRISM2_HOSTAPD_FLUSH: 2675 ap_control_kickall(ap); 2676 return 0; 2677 case PRISM2_HOSTAPD_ADD_STA: 2678 return prism2_hostapd_add_sta(ap, param); 2679 case PRISM2_HOSTAPD_REMOVE_STA: 2680 return prism2_hostapd_remove_sta(ap, param); 2681 case PRISM2_HOSTAPD_GET_INFO_STA: 2682 return prism2_hostapd_get_info_sta(ap, param); 2683 case PRISM2_HOSTAPD_SET_FLAGS_STA: 2684 return prism2_hostapd_set_flags_sta(ap, param); 2685 case PRISM2_HOSTAPD_STA_CLEAR_STATS: 2686 return prism2_hostapd_sta_clear_stats(ap, param); 2687 default: 2688 printk(KERN_WARNING "prism2_hostapd: unknown cmd=%d\n", 2689 param->cmd); 2690 return -EOPNOTSUPP; 2691 } 2692 } 2693 2694 2695 /* Update station info for host-based TX rate control and return current 2696 * TX rate */ 2697 static int ap_update_sta_tx_rate(struct sta_info *sta, struct net_device *dev) 2698 { 2699 int ret = sta->tx_rate; 2700 struct hostap_interface *iface; 2701 local_info_t *local; 2702 2703 iface = netdev_priv(dev); 2704 local = iface->local; 2705 2706 sta->tx_count[sta->tx_rate_idx]++; 2707 sta->tx_since_last_failure++; 2708 sta->tx_consecutive_exc = 0; 2709 if (sta->tx_since_last_failure >= WLAN_RATE_UPDATE_COUNT && 2710 sta->tx_rate_idx < sta->tx_max_rate) { 2711 /* use next higher rate */ 2712 int old_rate, new_rate; 2713 old_rate = new_rate = sta->tx_rate_idx; 2714 while (new_rate < sta->tx_max_rate) { 2715 new_rate++; 2716 if (ap_tx_rate_ok(new_rate, sta, local)) { 2717 sta->tx_rate_idx = new_rate; 2718 break; 2719 } 2720 } 2721 if (old_rate != sta->tx_rate_idx) { 2722 switch (sta->tx_rate_idx) { 2723 case 0: sta->tx_rate = 10; break; 2724 case 1: sta->tx_rate = 20; break; 2725 case 2: sta->tx_rate = 55; break; 2726 case 3: sta->tx_rate = 110; break; 2727 default: sta->tx_rate = 0; break; 2728 } 2729 PDEBUG(DEBUG_AP, "%s: STA %pM TX rate raised to %d\n", 2730 dev->name, sta->addr, sta->tx_rate); 2731 } 2732 sta->tx_since_last_failure = 0; 2733 } 2734 2735 return ret; 2736 } 2737 2738 2739 /* Called only from software IRQ. Called for each TX frame prior possible 2740 * encryption and transmit. */ 2741 ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx) 2742 { 2743 struct sta_info *sta = NULL; 2744 struct sk_buff *skb = tx->skb; 2745 int set_tim, ret; 2746 struct ieee80211_hdr *hdr; 2747 struct hostap_skb_tx_data *meta; 2748 2749 meta = (struct hostap_skb_tx_data *) skb->cb; 2750 ret = AP_TX_CONTINUE; 2751 if (local->ap == NULL || skb->len < 10 || 2752 meta->iface->type == HOSTAP_INTERFACE_STA) 2753 goto out; 2754 2755 hdr = (struct ieee80211_hdr *) skb->data; 2756 2757 if (hdr->addr1[0] & 0x01) { 2758 /* broadcast/multicast frame - no AP related processing */ 2759 if (local->ap->num_sta <= 0) 2760 ret = AP_TX_DROP; 2761 goto out; 2762 } 2763 2764 /* unicast packet - check whether destination STA is associated */ 2765 spin_lock(&local->ap->sta_table_lock); 2766 sta = ap_get_sta(local->ap, hdr->addr1); 2767 if (sta) 2768 atomic_inc(&sta->users); 2769 spin_unlock(&local->ap->sta_table_lock); 2770 2771 if (local->iw_mode == IW_MODE_MASTER && sta == NULL && 2772 !(meta->flags & HOSTAP_TX_FLAGS_WDS) && 2773 meta->iface->type != HOSTAP_INTERFACE_MASTER && 2774 meta->iface->type != HOSTAP_INTERFACE_AP) { 2775 #if 0 2776 /* This can happen, e.g., when wlan0 is added to a bridge and 2777 * bridging code does not know which port is the correct target 2778 * for a unicast frame. In this case, the packet is send to all 2779 * ports of the bridge. Since this is a valid scenario, do not 2780 * print out any errors here. */ 2781 if (net_ratelimit()) { 2782 printk(KERN_DEBUG "AP: drop packet to non-associated " 2783 "STA %pM\n", hdr->addr1); 2784 } 2785 #endif 2786 local->ap->tx_drop_nonassoc++; 2787 ret = AP_TX_DROP; 2788 goto out; 2789 } 2790 2791 if (sta == NULL) 2792 goto out; 2793 2794 if (!(sta->flags & WLAN_STA_AUTHORIZED)) 2795 ret = AP_TX_CONTINUE_NOT_AUTHORIZED; 2796 2797 /* Set tx_rate if using host-based TX rate control */ 2798 if (!local->fw_tx_rate_control) 2799 local->ap->last_tx_rate = meta->rate = 2800 ap_update_sta_tx_rate(sta, local->dev); 2801 2802 if (local->iw_mode != IW_MODE_MASTER) 2803 goto out; 2804 2805 if (!(sta->flags & WLAN_STA_PS)) 2806 goto out; 2807 2808 if (meta->flags & HOSTAP_TX_FLAGS_ADD_MOREDATA) { 2809 /* indicate to STA that more frames follow */ 2810 hdr->frame_control |= 2811 cpu_to_le16(IEEE80211_FCTL_MOREDATA); 2812 } 2813 2814 if (meta->flags & HOSTAP_TX_FLAGS_BUFFERED_FRAME) { 2815 /* packet was already buffered and now send due to 2816 * PS poll, so do not rebuffer it */ 2817 goto out; 2818 } 2819 2820 if (skb_queue_len(&sta->tx_buf) >= STA_MAX_TX_BUFFER) { 2821 PDEBUG(DEBUG_PS, "%s: No more space in STA (%pM)'s" 2822 "PS mode buffer\n", 2823 local->dev->name, sta->addr); 2824 /* Make sure that TIM is set for the station (it might not be 2825 * after AP wlan hw reset). */ 2826 /* FIX: should fix hw reset to restore bits based on STA 2827 * buffer state.. */ 2828 hostap_set_tim(local, sta->aid, 1); 2829 sta->flags |= WLAN_STA_TIM; 2830 ret = AP_TX_DROP; 2831 goto out; 2832 } 2833 2834 /* STA in PS mode, buffer frame for later delivery */ 2835 set_tim = skb_queue_empty(&sta->tx_buf); 2836 skb_queue_tail(&sta->tx_buf, skb); 2837 /* FIX: could save RX time to skb and expire buffered frames after 2838 * some time if STA does not poll for them */ 2839 2840 if (set_tim) { 2841 if (sta->flags & WLAN_STA_TIM) 2842 PDEBUG(DEBUG_PS2, "Re-setting TIM for aid %d\n", 2843 sta->aid); 2844 hostap_set_tim(local, sta->aid, 1); 2845 sta->flags |= WLAN_STA_TIM; 2846 } 2847 2848 ret = AP_TX_BUFFERED; 2849 2850 out: 2851 if (sta != NULL) { 2852 if (ret == AP_TX_CONTINUE || 2853 ret == AP_TX_CONTINUE_NOT_AUTHORIZED) { 2854 sta->tx_packets++; 2855 sta->tx_bytes += skb->len; 2856 sta->last_tx = jiffies; 2857 } 2858 2859 if ((ret == AP_TX_CONTINUE || 2860 ret == AP_TX_CONTINUE_NOT_AUTHORIZED) && 2861 sta->crypt && tx->host_encrypt) { 2862 tx->crypt = sta->crypt; 2863 tx->sta_ptr = sta; /* hostap_handle_sta_release() will 2864 * be called to release sta info 2865 * later */ 2866 } else 2867 atomic_dec(&sta->users); 2868 } 2869 2870 return ret; 2871 } 2872 2873 2874 void hostap_handle_sta_release(void *ptr) 2875 { 2876 struct sta_info *sta = ptr; 2877 atomic_dec(&sta->users); 2878 } 2879 2880 2881 /* Called only as a tasklet (software IRQ) */ 2882 void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb) 2883 { 2884 struct sta_info *sta; 2885 struct ieee80211_hdr *hdr; 2886 struct hostap_skb_tx_data *meta; 2887 2888 hdr = (struct ieee80211_hdr *) skb->data; 2889 meta = (struct hostap_skb_tx_data *) skb->cb; 2890 2891 spin_lock(&local->ap->sta_table_lock); 2892 sta = ap_get_sta(local->ap, hdr->addr1); 2893 if (!sta) { 2894 spin_unlock(&local->ap->sta_table_lock); 2895 PDEBUG(DEBUG_AP, "%s: Could not find STA %pM" 2896 " for this TX error (@%lu)\n", 2897 local->dev->name, hdr->addr1, jiffies); 2898 return; 2899 } 2900 2901 sta->tx_since_last_failure = 0; 2902 sta->tx_consecutive_exc++; 2903 2904 if (sta->tx_consecutive_exc >= WLAN_RATE_DECREASE_THRESHOLD && 2905 sta->tx_rate_idx > 0 && meta->rate <= sta->tx_rate) { 2906 /* use next lower rate */ 2907 int old, rate; 2908 old = rate = sta->tx_rate_idx; 2909 while (rate > 0) { 2910 rate--; 2911 if (ap_tx_rate_ok(rate, sta, local)) { 2912 sta->tx_rate_idx = rate; 2913 break; 2914 } 2915 } 2916 if (old != sta->tx_rate_idx) { 2917 switch (sta->tx_rate_idx) { 2918 case 0: sta->tx_rate = 10; break; 2919 case 1: sta->tx_rate = 20; break; 2920 case 2: sta->tx_rate = 55; break; 2921 case 3: sta->tx_rate = 110; break; 2922 default: sta->tx_rate = 0; break; 2923 } 2924 PDEBUG(DEBUG_AP, 2925 "%s: STA %pM TX rate lowered to %d\n", 2926 local->dev->name, sta->addr, sta->tx_rate); 2927 } 2928 sta->tx_consecutive_exc = 0; 2929 } 2930 spin_unlock(&local->ap->sta_table_lock); 2931 } 2932 2933 2934 static void hostap_update_sta_ps2(local_info_t *local, struct sta_info *sta, 2935 int pwrmgt, int type, int stype) 2936 { 2937 if (pwrmgt && !(sta->flags & WLAN_STA_PS)) { 2938 sta->flags |= WLAN_STA_PS; 2939 PDEBUG(DEBUG_PS2, "STA %pM changed to use PS " 2940 "mode (type=0x%02X, stype=0x%02X)\n", 2941 sta->addr, type >> 2, stype >> 4); 2942 } else if (!pwrmgt && (sta->flags & WLAN_STA_PS)) { 2943 sta->flags &= ~WLAN_STA_PS; 2944 PDEBUG(DEBUG_PS2, "STA %pM changed to not use " 2945 "PS mode (type=0x%02X, stype=0x%02X)\n", 2946 sta->addr, type >> 2, stype >> 4); 2947 if (type != IEEE80211_FTYPE_CTL || 2948 stype != IEEE80211_STYPE_PSPOLL) 2949 schedule_packet_send(local, sta); 2950 } 2951 } 2952 2953 2954 /* Called only as a tasklet (software IRQ). Called for each RX frame to update 2955 * STA power saving state. pwrmgt is a flag from 802.11 frame_control field. */ 2956 int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr *hdr) 2957 { 2958 struct sta_info *sta; 2959 u16 fc; 2960 2961 spin_lock(&local->ap->sta_table_lock); 2962 sta = ap_get_sta(local->ap, hdr->addr2); 2963 if (sta) 2964 atomic_inc(&sta->users); 2965 spin_unlock(&local->ap->sta_table_lock); 2966 2967 if (!sta) 2968 return -1; 2969 2970 fc = le16_to_cpu(hdr->frame_control); 2971 hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM, 2972 fc & IEEE80211_FCTL_FTYPE, 2973 fc & IEEE80211_FCTL_STYPE); 2974 2975 atomic_dec(&sta->users); 2976 return 0; 2977 } 2978 2979 2980 /* Called only as a tasklet (software IRQ). Called for each RX frame after 2981 * getting RX header and payload from hardware. */ 2982 ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev, 2983 struct sk_buff *skb, 2984 struct hostap_80211_rx_status *rx_stats, 2985 int wds) 2986 { 2987 int ret; 2988 struct sta_info *sta; 2989 u16 fc, type, stype; 2990 struct ieee80211_hdr *hdr; 2991 2992 if (local->ap == NULL) 2993 return AP_RX_CONTINUE; 2994 2995 hdr = (struct ieee80211_hdr *) skb->data; 2996 2997 fc = le16_to_cpu(hdr->frame_control); 2998 type = fc & IEEE80211_FCTL_FTYPE; 2999 stype = fc & IEEE80211_FCTL_STYPE; 3000 3001 spin_lock(&local->ap->sta_table_lock); 3002 sta = ap_get_sta(local->ap, hdr->addr2); 3003 if (sta) 3004 atomic_inc(&sta->users); 3005 spin_unlock(&local->ap->sta_table_lock); 3006 3007 if (sta && !(sta->flags & WLAN_STA_AUTHORIZED)) 3008 ret = AP_RX_CONTINUE_NOT_AUTHORIZED; 3009 else 3010 ret = AP_RX_CONTINUE; 3011 3012 3013 if (fc & IEEE80211_FCTL_TODS) { 3014 if (!wds && (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) { 3015 if (local->hostapd) { 3016 prism2_rx_80211(local->apdev, skb, rx_stats, 3017 PRISM2_RX_NON_ASSOC); 3018 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 3019 } else { 3020 printk(KERN_DEBUG "%s: dropped received packet" 3021 " from non-associated STA %pM" 3022 " (type=0x%02x, subtype=0x%02x)\n", 3023 dev->name, hdr->addr2, 3024 type >> 2, stype >> 4); 3025 hostap_rx(dev, skb, rx_stats); 3026 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 3027 } 3028 ret = AP_RX_EXIT; 3029 goto out; 3030 } 3031 } else if (fc & IEEE80211_FCTL_FROMDS) { 3032 if (!wds) { 3033 /* FromDS frame - not for us; probably 3034 * broadcast/multicast in another BSS - drop */ 3035 if (ether_addr_equal(hdr->addr1, dev->dev_addr)) { 3036 printk(KERN_DEBUG "Odd.. FromDS packet " 3037 "received with own BSSID\n"); 3038 hostap_dump_rx_80211(dev->name, skb, rx_stats); 3039 } 3040 ret = AP_RX_DROP; 3041 goto out; 3042 } 3043 } else if (stype == IEEE80211_STYPE_NULLFUNC && sta == NULL && 3044 ether_addr_equal(hdr->addr1, dev->dev_addr)) { 3045 3046 if (local->hostapd) { 3047 prism2_rx_80211(local->apdev, skb, rx_stats, 3048 PRISM2_RX_NON_ASSOC); 3049 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 3050 } else { 3051 /* At least Lucent f/w seems to send data::nullfunc 3052 * frames with no ToDS flag when the current AP returns 3053 * after being unavailable for some time. Speed up 3054 * re-association by informing the station about it not 3055 * being associated. */ 3056 printk(KERN_DEBUG "%s: rejected received nullfunc frame" 3057 " without ToDS from not associated STA %pM\n", 3058 dev->name, hdr->addr2); 3059 hostap_rx(dev, skb, rx_stats); 3060 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 3061 } 3062 ret = AP_RX_EXIT; 3063 goto out; 3064 } else if (stype == IEEE80211_STYPE_NULLFUNC) { 3065 /* At least Lucent cards seem to send periodic nullfunc 3066 * frames with ToDS. Let these through to update SQ 3067 * stats and PS state. Nullfunc frames do not contain 3068 * any data and they will be dropped below. */ 3069 } else { 3070 /* If BSSID (Addr3) is foreign, this frame is a normal 3071 * broadcast frame from an IBSS network. Drop it silently. 3072 * If BSSID is own, report the dropping of this frame. */ 3073 if (ether_addr_equal(hdr->addr3, dev->dev_addr)) { 3074 printk(KERN_DEBUG "%s: dropped received packet from %pM" 3075 " with no ToDS flag " 3076 "(type=0x%02x, subtype=0x%02x)\n", dev->name, 3077 hdr->addr2, type >> 2, stype >> 4); 3078 hostap_dump_rx_80211(dev->name, skb, rx_stats); 3079 } 3080 ret = AP_RX_DROP; 3081 goto out; 3082 } 3083 3084 if (sta) { 3085 hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM, 3086 type, stype); 3087 3088 sta->rx_packets++; 3089 sta->rx_bytes += skb->len; 3090 sta->last_rx = jiffies; 3091 } 3092 3093 if (local->ap->nullfunc_ack && stype == IEEE80211_STYPE_NULLFUNC && 3094 fc & IEEE80211_FCTL_TODS) { 3095 if (local->hostapd) { 3096 prism2_rx_80211(local->apdev, skb, rx_stats, 3097 PRISM2_RX_NULLFUNC_ACK); 3098 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 3099 } else { 3100 /* some STA f/w's seem to require control::ACK frame 3101 * for data::nullfunc, but Prism2 f/w 0.8.0 (at least 3102 * from Compaq) does not send this.. Try to generate 3103 * ACK for these frames from the host driver to make 3104 * power saving work with, e.g., Lucent WaveLAN f/w */ 3105 hostap_rx(dev, skb, rx_stats); 3106 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 3107 } 3108 ret = AP_RX_EXIT; 3109 goto out; 3110 } 3111 3112 out: 3113 if (sta) 3114 atomic_dec(&sta->users); 3115 3116 return ret; 3117 } 3118 3119 3120 /* Called only as a tasklet (software IRQ) */ 3121 int hostap_handle_sta_crypto(local_info_t *local, 3122 struct ieee80211_hdr *hdr, 3123 struct lib80211_crypt_data **crypt, 3124 void **sta_ptr) 3125 { 3126 struct sta_info *sta; 3127 3128 spin_lock(&local->ap->sta_table_lock); 3129 sta = ap_get_sta(local->ap, hdr->addr2); 3130 if (sta) 3131 atomic_inc(&sta->users); 3132 spin_unlock(&local->ap->sta_table_lock); 3133 3134 if (!sta) 3135 return -1; 3136 3137 if (sta->crypt) { 3138 *crypt = sta->crypt; 3139 *sta_ptr = sta; 3140 /* hostap_handle_sta_release() will be called to release STA 3141 * info */ 3142 } else 3143 atomic_dec(&sta->users); 3144 3145 return 0; 3146 } 3147 3148 3149 /* Called only as a tasklet (software IRQ) */ 3150 int hostap_is_sta_assoc(struct ap_data *ap, u8 *sta_addr) 3151 { 3152 struct sta_info *sta; 3153 int ret = 0; 3154 3155 spin_lock(&ap->sta_table_lock); 3156 sta = ap_get_sta(ap, sta_addr); 3157 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap) 3158 ret = 1; 3159 spin_unlock(&ap->sta_table_lock); 3160 3161 return ret; 3162 } 3163 3164 3165 /* Called only as a tasklet (software IRQ) */ 3166 int hostap_is_sta_authorized(struct ap_data *ap, u8 *sta_addr) 3167 { 3168 struct sta_info *sta; 3169 int ret = 0; 3170 3171 spin_lock(&ap->sta_table_lock); 3172 sta = ap_get_sta(ap, sta_addr); 3173 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap && 3174 ((sta->flags & WLAN_STA_AUTHORIZED) || 3175 ap->local->ieee_802_1x == 0)) 3176 ret = 1; 3177 spin_unlock(&ap->sta_table_lock); 3178 3179 return ret; 3180 } 3181 3182 3183 /* Called only as a tasklet (software IRQ) */ 3184 int hostap_add_sta(struct ap_data *ap, u8 *sta_addr) 3185 { 3186 struct sta_info *sta; 3187 int ret = 1; 3188 3189 if (!ap) 3190 return -1; 3191 3192 spin_lock(&ap->sta_table_lock); 3193 sta = ap_get_sta(ap, sta_addr); 3194 if (sta) 3195 ret = 0; 3196 spin_unlock(&ap->sta_table_lock); 3197 3198 if (ret == 1) { 3199 sta = ap_add_sta(ap, sta_addr); 3200 if (!sta) 3201 return -1; 3202 sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC; 3203 sta->ap = 1; 3204 memset(sta->supported_rates, 0, sizeof(sta->supported_rates)); 3205 /* No way of knowing which rates are supported since we did not 3206 * get supported rates element from beacon/assoc req. Assume 3207 * that remote end supports all 802.11b rates. */ 3208 sta->supported_rates[0] = 0x82; 3209 sta->supported_rates[1] = 0x84; 3210 sta->supported_rates[2] = 0x0b; 3211 sta->supported_rates[3] = 0x16; 3212 sta->tx_supp_rates = WLAN_RATE_1M | WLAN_RATE_2M | 3213 WLAN_RATE_5M5 | WLAN_RATE_11M; 3214 sta->tx_rate = 110; 3215 sta->tx_max_rate = sta->tx_rate_idx = 3; 3216 } 3217 3218 return ret; 3219 } 3220 3221 3222 /* Called only as a tasklet (software IRQ) */ 3223 int hostap_update_rx_stats(struct ap_data *ap, 3224 struct ieee80211_hdr *hdr, 3225 struct hostap_80211_rx_status *rx_stats) 3226 { 3227 struct sta_info *sta; 3228 3229 if (!ap) 3230 return -1; 3231 3232 spin_lock(&ap->sta_table_lock); 3233 sta = ap_get_sta(ap, hdr->addr2); 3234 if (sta) { 3235 sta->last_rx_silence = rx_stats->noise; 3236 sta->last_rx_signal = rx_stats->signal; 3237 sta->last_rx_rate = rx_stats->rate; 3238 sta->last_rx_updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM; 3239 if (rx_stats->rate == 10) 3240 sta->rx_count[0]++; 3241 else if (rx_stats->rate == 20) 3242 sta->rx_count[1]++; 3243 else if (rx_stats->rate == 55) 3244 sta->rx_count[2]++; 3245 else if (rx_stats->rate == 110) 3246 sta->rx_count[3]++; 3247 } 3248 spin_unlock(&ap->sta_table_lock); 3249 3250 return sta ? 0 : -1; 3251 } 3252 3253 3254 void hostap_update_rates(local_info_t *local) 3255 { 3256 struct sta_info *sta; 3257 struct ap_data *ap = local->ap; 3258 3259 if (!ap) 3260 return; 3261 3262 spin_lock_bh(&ap->sta_table_lock); 3263 list_for_each_entry(sta, &ap->sta_list, list) { 3264 prism2_check_tx_rates(sta); 3265 } 3266 spin_unlock_bh(&ap->sta_table_lock); 3267 } 3268 3269 3270 void * ap_crypt_get_ptrs(struct ap_data *ap, u8 *addr, int permanent, 3271 struct lib80211_crypt_data ***crypt) 3272 { 3273 struct sta_info *sta; 3274 3275 spin_lock_bh(&ap->sta_table_lock); 3276 sta = ap_get_sta(ap, addr); 3277 if (sta) 3278 atomic_inc(&sta->users); 3279 spin_unlock_bh(&ap->sta_table_lock); 3280 3281 if (!sta && permanent) 3282 sta = ap_add_sta(ap, addr); 3283 3284 if (!sta) 3285 return NULL; 3286 3287 if (permanent) 3288 sta->flags |= WLAN_STA_PERM; 3289 3290 *crypt = &sta->crypt; 3291 3292 return sta; 3293 } 3294 3295 3296 void hostap_add_wds_links(local_info_t *local) 3297 { 3298 struct ap_data *ap = local->ap; 3299 struct sta_info *sta; 3300 3301 spin_lock_bh(&ap->sta_table_lock); 3302 list_for_each_entry(sta, &ap->sta_list, list) { 3303 if (sta->ap) 3304 hostap_wds_link_oper(local, sta->addr, WDS_ADD); 3305 } 3306 spin_unlock_bh(&ap->sta_table_lock); 3307 3308 schedule_work(&local->ap->wds_oper_queue); 3309 } 3310 3311 3312 void hostap_wds_link_oper(local_info_t *local, u8 *addr, wds_oper_type type) 3313 { 3314 struct wds_oper_data *entry; 3315 3316 entry = kmalloc(sizeof(*entry), GFP_ATOMIC); 3317 if (!entry) 3318 return; 3319 memcpy(entry->addr, addr, ETH_ALEN); 3320 entry->type = type; 3321 spin_lock_bh(&local->lock); 3322 entry->next = local->ap->wds_oper_entries; 3323 local->ap->wds_oper_entries = entry; 3324 spin_unlock_bh(&local->lock); 3325 3326 schedule_work(&local->ap->wds_oper_queue); 3327 } 3328 3329 3330 EXPORT_SYMBOL(hostap_init_data); 3331 EXPORT_SYMBOL(hostap_init_ap_proc); 3332 EXPORT_SYMBOL(hostap_free_data); 3333 EXPORT_SYMBOL(hostap_check_sta_fw_version); 3334 EXPORT_SYMBOL(hostap_handle_sta_tx_exc); 3335 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT 3336 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */ 3337