xref: /openbmc/linux/net/mac80211/ibss.c (revision 5bd8e16d)
1 /*
2  * IBSS mode implementation
3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4  * Copyright 2004, Instant802 Networks, Inc.
5  * Copyright 2005, Devicescape Software, Inc.
6  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8  * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2 as
12  * published by the Free Software Foundation.
13  */
14 
15 #include <linux/delay.h>
16 #include <linux/slab.h>
17 #include <linux/if_ether.h>
18 #include <linux/skbuff.h>
19 #include <linux/if_arp.h>
20 #include <linux/etherdevice.h>
21 #include <linux/rtnetlink.h>
22 #include <net/mac80211.h>
23 
24 #include "ieee80211_i.h"
25 #include "driver-ops.h"
26 #include "rate.h"
27 
28 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
29 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
30 
31 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
32 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
33 #define IEEE80211_IBSS_RSN_INACTIVITY_LIMIT (10 * HZ)
34 
35 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
36 
37 static struct beacon_data *
38 ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
39 			   const int beacon_int, const u32 basic_rates,
40 			   const u16 capability, u64 tsf,
41 			   struct cfg80211_chan_def *chandef,
42 			   bool *have_higher_than_11mbit)
43 {
44 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
45 	struct ieee80211_local *local = sdata->local;
46 	int rates_n = 0, i, ri;
47 	struct ieee80211_mgmt *mgmt;
48 	u8 *pos;
49 	struct ieee80211_supported_band *sband;
50 	u32 rate_flags, rates = 0, rates_added = 0;
51 	struct beacon_data *presp;
52 	int frame_len;
53 	int shift;
54 
55 	/* Build IBSS probe response */
56 	frame_len = sizeof(struct ieee80211_hdr_3addr) +
57 		    12 /* struct ieee80211_mgmt.u.beacon */ +
58 		    2 + IEEE80211_MAX_SSID_LEN /* max SSID */ +
59 		    2 + 8 /* max Supported Rates */ +
60 		    3 /* max DS params */ +
61 		    4 /* IBSS params */ +
62 		    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
63 		    2 + sizeof(struct ieee80211_ht_cap) +
64 		    2 + sizeof(struct ieee80211_ht_operation) +
65 		    ifibss->ie_len;
66 	presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
67 	if (!presp)
68 		return NULL;
69 
70 	presp->head = (void *)(presp + 1);
71 
72 	mgmt = (void *) presp->head;
73 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
74 					  IEEE80211_STYPE_PROBE_RESP);
75 	eth_broadcast_addr(mgmt->da);
76 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
77 	memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
78 	mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
79 	mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
80 	mgmt->u.beacon.capab_info = cpu_to_le16(capability);
81 
82 	pos = (u8 *)mgmt + offsetof(struct ieee80211_mgmt, u.beacon.variable);
83 
84 	*pos++ = WLAN_EID_SSID;
85 	*pos++ = ifibss->ssid_len;
86 	memcpy(pos, ifibss->ssid, ifibss->ssid_len);
87 	pos += ifibss->ssid_len;
88 
89 	sband = local->hw.wiphy->bands[chandef->chan->band];
90 	rate_flags = ieee80211_chandef_rate_flags(chandef);
91 	shift = ieee80211_chandef_get_shift(chandef);
92 	rates_n = 0;
93 	if (have_higher_than_11mbit)
94 		*have_higher_than_11mbit = false;
95 
96 	for (i = 0; i < sband->n_bitrates; i++) {
97 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
98 			continue;
99 		if (sband->bitrates[i].bitrate > 110 &&
100 		    have_higher_than_11mbit)
101 			*have_higher_than_11mbit = true;
102 
103 		rates |= BIT(i);
104 		rates_n++;
105 	}
106 
107 	*pos++ = WLAN_EID_SUPP_RATES;
108 	*pos++ = min_t(int, 8, rates_n);
109 	for (ri = 0; ri < sband->n_bitrates; ri++) {
110 		int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
111 					5 * (1 << shift));
112 		u8 basic = 0;
113 		if (!(rates & BIT(ri)))
114 			continue;
115 
116 		if (basic_rates & BIT(ri))
117 			basic = 0x80;
118 		*pos++ = basic | (u8) rate;
119 		if (++rates_added == 8) {
120 			ri++; /* continue at next rate for EXT_SUPP_RATES */
121 			break;
122 		}
123 	}
124 
125 	if (sband->band == IEEE80211_BAND_2GHZ) {
126 		*pos++ = WLAN_EID_DS_PARAMS;
127 		*pos++ = 1;
128 		*pos++ = ieee80211_frequency_to_channel(
129 				chandef->chan->center_freq);
130 	}
131 
132 	*pos++ = WLAN_EID_IBSS_PARAMS;
133 	*pos++ = 2;
134 	/* FIX: set ATIM window based on scan results */
135 	*pos++ = 0;
136 	*pos++ = 0;
137 
138 	/* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
139 	if (rates_n > 8) {
140 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
141 		*pos++ = rates_n - 8;
142 		for (; ri < sband->n_bitrates; ri++) {
143 			int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
144 						5 * (1 << shift));
145 			u8 basic = 0;
146 			if (!(rates & BIT(ri)))
147 				continue;
148 
149 			if (basic_rates & BIT(ri))
150 				basic = 0x80;
151 			*pos++ = basic | (u8) rate;
152 		}
153 	}
154 
155 	if (ifibss->ie_len) {
156 		memcpy(pos, ifibss->ie, ifibss->ie_len);
157 		pos += ifibss->ie_len;
158 	}
159 
160 	/* add HT capability and information IEs */
161 	if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
162 	    chandef->width != NL80211_CHAN_WIDTH_5 &&
163 	    chandef->width != NL80211_CHAN_WIDTH_10 &&
164 	    sband->ht_cap.ht_supported) {
165 		struct ieee80211_sta_ht_cap ht_cap;
166 
167 		memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
168 		ieee80211_apply_htcap_overrides(sdata, &ht_cap);
169 
170 		pos = ieee80211_ie_build_ht_cap(pos, &ht_cap, ht_cap.cap);
171 		/*
172 		 * Note: According to 802.11n-2009 9.13.3.1, HT Protection
173 		 * field and RIFS Mode are reserved in IBSS mode, therefore
174 		 * keep them at 0
175 		 */
176 		pos = ieee80211_ie_build_ht_oper(pos, &sband->ht_cap,
177 						 chandef, 0);
178 	}
179 
180 	if (local->hw.queues >= IEEE80211_NUM_ACS) {
181 		*pos++ = WLAN_EID_VENDOR_SPECIFIC;
182 		*pos++ = 7; /* len */
183 		*pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
184 		*pos++ = 0x50;
185 		*pos++ = 0xf2;
186 		*pos++ = 2; /* WME */
187 		*pos++ = 0; /* WME info */
188 		*pos++ = 1; /* WME ver */
189 		*pos++ = 0; /* U-APSD no in use */
190 	}
191 
192 	presp->head_len = pos - presp->head;
193 	if (WARN_ON(presp->head_len > frame_len))
194 		goto error;
195 
196 	return presp;
197 error:
198 	kfree(presp);
199 	return NULL;
200 }
201 
202 static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
203 				      const u8 *bssid, const int beacon_int,
204 				      struct cfg80211_chan_def *req_chandef,
205 				      const u32 basic_rates,
206 				      const u16 capability, u64 tsf,
207 				      bool creator)
208 {
209 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
210 	struct ieee80211_local *local = sdata->local;
211 	struct ieee80211_supported_band *sband;
212 	struct ieee80211_mgmt *mgmt;
213 	struct cfg80211_bss *bss;
214 	u32 bss_change;
215 	struct cfg80211_chan_def chandef;
216 	struct ieee80211_channel *chan;
217 	struct beacon_data *presp;
218 	enum nl80211_bss_scan_width scan_width;
219 	bool have_higher_than_11mbit;
220 
221 	sdata_assert_lock(sdata);
222 
223 	/* Reset own TSF to allow time synchronization work. */
224 	drv_reset_tsf(local, sdata);
225 
226 	if (!ether_addr_equal(ifibss->bssid, bssid))
227 		sta_info_flush(sdata);
228 
229 	/* if merging, indicate to driver that we leave the old IBSS */
230 	if (sdata->vif.bss_conf.ibss_joined) {
231 		sdata->vif.bss_conf.ibss_joined = false;
232 		sdata->vif.bss_conf.ibss_creator = false;
233 		sdata->vif.bss_conf.enable_beacon = false;
234 		netif_carrier_off(sdata->dev);
235 		ieee80211_bss_info_change_notify(sdata,
236 						 BSS_CHANGED_IBSS |
237 						 BSS_CHANGED_BEACON_ENABLED);
238 	}
239 
240 	presp = rcu_dereference_protected(ifibss->presp,
241 					  lockdep_is_held(&sdata->wdev.mtx));
242 	rcu_assign_pointer(ifibss->presp, NULL);
243 	if (presp)
244 		kfree_rcu(presp, rcu_head);
245 
246 	sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
247 
248 	/* make a copy of the chandef, it could be modified below. */
249 	chandef = *req_chandef;
250 	chan = chandef.chan;
251 	if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
252 		if (chandef.width == NL80211_CHAN_WIDTH_5 ||
253 		    chandef.width == NL80211_CHAN_WIDTH_10 ||
254 		    chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
255 		    chandef.width == NL80211_CHAN_WIDTH_20) {
256 			sdata_info(sdata,
257 				   "Failed to join IBSS, beacons forbidden\n");
258 			return;
259 		}
260 		chandef.width = NL80211_CHAN_WIDTH_20;
261 		chandef.center_freq1 = chan->center_freq;
262 	}
263 
264 	ieee80211_vif_release_channel(sdata);
265 	if (ieee80211_vif_use_channel(sdata, &chandef,
266 				      ifibss->fixed_channel ?
267 					IEEE80211_CHANCTX_SHARED :
268 					IEEE80211_CHANCTX_EXCLUSIVE)) {
269 		sdata_info(sdata, "Failed to join IBSS, no channel context\n");
270 		return;
271 	}
272 
273 	memcpy(ifibss->bssid, bssid, ETH_ALEN);
274 
275 	sband = local->hw.wiphy->bands[chan->band];
276 
277 	presp = ieee80211_ibss_build_presp(sdata, beacon_int, basic_rates,
278 					   capability, tsf, &chandef,
279 					   &have_higher_than_11mbit);
280 	if (!presp)
281 		return;
282 
283 	rcu_assign_pointer(ifibss->presp, presp);
284 	mgmt = (void *)presp->head;
285 
286 	sdata->vif.bss_conf.enable_beacon = true;
287 	sdata->vif.bss_conf.beacon_int = beacon_int;
288 	sdata->vif.bss_conf.basic_rates = basic_rates;
289 	sdata->vif.bss_conf.ssid_len = ifibss->ssid_len;
290 	memcpy(sdata->vif.bss_conf.ssid, ifibss->ssid, ifibss->ssid_len);
291 	bss_change = BSS_CHANGED_BEACON_INT;
292 	bss_change |= ieee80211_reset_erp_info(sdata);
293 	bss_change |= BSS_CHANGED_BSSID;
294 	bss_change |= BSS_CHANGED_BEACON;
295 	bss_change |= BSS_CHANGED_BEACON_ENABLED;
296 	bss_change |= BSS_CHANGED_BASIC_RATES;
297 	bss_change |= BSS_CHANGED_HT;
298 	bss_change |= BSS_CHANGED_IBSS;
299 	bss_change |= BSS_CHANGED_SSID;
300 
301 	/*
302 	 * In 5 GHz/802.11a, we can always use short slot time.
303 	 * (IEEE 802.11-2012 18.3.8.7)
304 	 *
305 	 * In 2.4GHz, we must always use long slots in IBSS for compatibility
306 	 * reasons.
307 	 * (IEEE 802.11-2012 19.4.5)
308 	 *
309 	 * HT follows these specifications (IEEE 802.11-2012 20.3.18)
310 	 */
311 	sdata->vif.bss_conf.use_short_slot = chan->band == IEEE80211_BAND_5GHZ;
312 	bss_change |= BSS_CHANGED_ERP_SLOT;
313 
314 	/* cf. IEEE 802.11 9.2.12 */
315 	if (chan->band == IEEE80211_BAND_2GHZ && have_higher_than_11mbit)
316 		sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
317 	else
318 		sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
319 
320 	sdata->vif.bss_conf.ibss_joined = true;
321 	sdata->vif.bss_conf.ibss_creator = creator;
322 	ieee80211_bss_info_change_notify(sdata, bss_change);
323 
324 	ieee80211_set_wmm_default(sdata, true);
325 
326 	ifibss->state = IEEE80211_IBSS_MLME_JOINED;
327 	mod_timer(&ifibss->timer,
328 		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
329 
330 	scan_width = cfg80211_chandef_to_scan_width(&chandef);
331 	bss = cfg80211_inform_bss_width_frame(local->hw.wiphy, chan,
332 					      scan_width, mgmt,
333 					      presp->head_len, 0, GFP_KERNEL);
334 	cfg80211_put_bss(local->hw.wiphy, bss);
335 	netif_carrier_on(sdata->dev);
336 	cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
337 }
338 
339 static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
340 				    struct ieee80211_bss *bss)
341 {
342 	struct cfg80211_bss *cbss =
343 		container_of((void *)bss, struct cfg80211_bss, priv);
344 	struct ieee80211_supported_band *sband;
345 	struct cfg80211_chan_def chandef;
346 	u32 basic_rates;
347 	int i, j;
348 	u16 beacon_int = cbss->beacon_interval;
349 	const struct cfg80211_bss_ies *ies;
350 	enum nl80211_channel_type chan_type;
351 	u64 tsf;
352 	u32 rate_flags;
353 	int shift;
354 
355 	sdata_assert_lock(sdata);
356 
357 	if (beacon_int < 10)
358 		beacon_int = 10;
359 
360 	switch (sdata->u.ibss.chandef.width) {
361 	case NL80211_CHAN_WIDTH_20_NOHT:
362 	case NL80211_CHAN_WIDTH_20:
363 	case NL80211_CHAN_WIDTH_40:
364 		chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
365 		cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
366 		break;
367 	case NL80211_CHAN_WIDTH_5:
368 	case NL80211_CHAN_WIDTH_10:
369 		cfg80211_chandef_create(&chandef, cbss->channel,
370 					NL80211_CHAN_WIDTH_20_NOHT);
371 		chandef.width = sdata->u.ibss.chandef.width;
372 		break;
373 	default:
374 		/* fall back to 20 MHz for unsupported modes */
375 		cfg80211_chandef_create(&chandef, cbss->channel,
376 					NL80211_CHAN_WIDTH_20_NOHT);
377 		break;
378 	}
379 
380 	sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
381 	rate_flags = ieee80211_chandef_rate_flags(&sdata->u.ibss.chandef);
382 	shift = ieee80211_vif_get_shift(&sdata->vif);
383 
384 	basic_rates = 0;
385 
386 	for (i = 0; i < bss->supp_rates_len; i++) {
387 		int rate = bss->supp_rates[i] & 0x7f;
388 		bool is_basic = !!(bss->supp_rates[i] & 0x80);
389 
390 		for (j = 0; j < sband->n_bitrates; j++) {
391 			int brate;
392 			if ((rate_flags & sband->bitrates[j].flags)
393 			    != rate_flags)
394 				continue;
395 
396 			brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
397 					     5 * (1 << shift));
398 			if (brate == rate) {
399 				if (is_basic)
400 					basic_rates |= BIT(j);
401 				break;
402 			}
403 		}
404 	}
405 
406 	rcu_read_lock();
407 	ies = rcu_dereference(cbss->ies);
408 	tsf = ies->tsf;
409 	rcu_read_unlock();
410 
411 	__ieee80211_sta_join_ibss(sdata, cbss->bssid,
412 				  beacon_int,
413 				  &chandef,
414 				  basic_rates,
415 				  cbss->capability,
416 				  tsf, false);
417 }
418 
419 static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
420 	__acquires(RCU)
421 {
422 	struct ieee80211_sub_if_data *sdata = sta->sdata;
423 	u8 addr[ETH_ALEN];
424 
425 	memcpy(addr, sta->sta.addr, ETH_ALEN);
426 
427 	ibss_dbg(sdata, "Adding new IBSS station %pM\n", addr);
428 
429 	sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
430 	sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
431 	/* authorize the station only if the network is not RSN protected. If
432 	 * not wait for the userspace to authorize it */
433 	if (!sta->sdata->u.ibss.control_port)
434 		sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
435 
436 	rate_control_rate_init(sta);
437 
438 	/* If it fails, maybe we raced another insertion? */
439 	if (sta_info_insert_rcu(sta))
440 		return sta_info_get(sdata, addr);
441 	return sta;
442 }
443 
444 static struct sta_info *
445 ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
446 		       const u8 *addr, u32 supp_rates)
447 	__acquires(RCU)
448 {
449 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
450 	struct ieee80211_local *local = sdata->local;
451 	struct sta_info *sta;
452 	struct ieee80211_chanctx_conf *chanctx_conf;
453 	struct ieee80211_supported_band *sband;
454 	enum nl80211_bss_scan_width scan_width;
455 	int band;
456 
457 	/*
458 	 * XXX: Consider removing the least recently used entry and
459 	 * 	allow new one to be added.
460 	 */
461 	if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
462 		net_info_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
463 				    sdata->name, addr);
464 		rcu_read_lock();
465 		return NULL;
466 	}
467 
468 	if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH) {
469 		rcu_read_lock();
470 		return NULL;
471 	}
472 
473 	if (!ether_addr_equal(bssid, sdata->u.ibss.bssid)) {
474 		rcu_read_lock();
475 		return NULL;
476 	}
477 
478 	rcu_read_lock();
479 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
480 	if (WARN_ON_ONCE(!chanctx_conf))
481 		return NULL;
482 	band = chanctx_conf->def.chan->band;
483 	scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
484 	rcu_read_unlock();
485 
486 	sta = sta_info_alloc(sdata, addr, GFP_KERNEL);
487 	if (!sta) {
488 		rcu_read_lock();
489 		return NULL;
490 	}
491 
492 	sta->last_rx = jiffies;
493 
494 	/* make sure mandatory rates are always added */
495 	sband = local->hw.wiphy->bands[band];
496 	sta->sta.supp_rates[band] = supp_rates |
497 			ieee80211_mandatory_rates(sband, scan_width);
498 
499 	return ieee80211_ibss_finish_sta(sta);
500 }
501 
502 static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
503 					  struct ieee80211_mgmt *mgmt,
504 					  size_t len)
505 {
506 	u16 reason = le16_to_cpu(mgmt->u.deauth.reason_code);
507 
508 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
509 		return;
510 
511 	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
512 		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
513 	sta_info_destroy_addr(sdata, mgmt->sa);
514 }
515 
516 static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
517 					struct ieee80211_mgmt *mgmt,
518 					size_t len)
519 {
520 	u16 auth_alg, auth_transaction;
521 
522 	sdata_assert_lock(sdata);
523 
524 	if (len < 24 + 6)
525 		return;
526 
527 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
528 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
529 
530 	ibss_dbg(sdata,
531 		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
532 		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
533 
534 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
535 		return;
536 
537 	/*
538 	 * IEEE 802.11 standard does not require authentication in IBSS
539 	 * networks and most implementations do not seem to use it.
540 	 * However, try to reply to authentication attempts if someone
541 	 * has actually implemented this.
542 	 */
543 	ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, 0, NULL, 0,
544 			    mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0, 0);
545 }
546 
547 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
548 				  struct ieee80211_mgmt *mgmt, size_t len,
549 				  struct ieee80211_rx_status *rx_status,
550 				  struct ieee802_11_elems *elems)
551 {
552 	struct ieee80211_local *local = sdata->local;
553 	int freq;
554 	struct cfg80211_bss *cbss;
555 	struct ieee80211_bss *bss;
556 	struct sta_info *sta;
557 	struct ieee80211_channel *channel;
558 	u64 beacon_timestamp, rx_timestamp;
559 	u32 supp_rates = 0;
560 	enum ieee80211_band band = rx_status->band;
561 	enum nl80211_bss_scan_width scan_width;
562 	struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
563 	bool rates_updated = false;
564 
565 	if (elems->ds_params)
566 		freq = ieee80211_channel_to_frequency(elems->ds_params[0],
567 						      band);
568 	else
569 		freq = rx_status->freq;
570 
571 	channel = ieee80211_get_channel(local->hw.wiphy, freq);
572 
573 	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
574 		return;
575 
576 	if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
577 	    ether_addr_equal(mgmt->bssid, sdata->u.ibss.bssid)) {
578 
579 		rcu_read_lock();
580 		sta = sta_info_get(sdata, mgmt->sa);
581 
582 		if (elems->supp_rates) {
583 			supp_rates = ieee80211_sta_get_rates(sdata, elems,
584 							     band, NULL);
585 			if (sta) {
586 				u32 prev_rates;
587 
588 				prev_rates = sta->sta.supp_rates[band];
589 				/* make sure mandatory rates are always added */
590 				scan_width = NL80211_BSS_CHAN_WIDTH_20;
591 				if (rx_status->flag & RX_FLAG_5MHZ)
592 					scan_width = NL80211_BSS_CHAN_WIDTH_5;
593 				if (rx_status->flag & RX_FLAG_10MHZ)
594 					scan_width = NL80211_BSS_CHAN_WIDTH_10;
595 
596 				sta->sta.supp_rates[band] = supp_rates |
597 					ieee80211_mandatory_rates(sband,
598 								  scan_width);
599 				if (sta->sta.supp_rates[band] != prev_rates) {
600 					ibss_dbg(sdata,
601 						 "updated supp_rates set for %pM based on beacon/probe_resp (0x%x -> 0x%x)\n",
602 						 sta->sta.addr, prev_rates,
603 						 sta->sta.supp_rates[band]);
604 					rates_updated = true;
605 				}
606 			} else {
607 				rcu_read_unlock();
608 				sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid,
609 						mgmt->sa, supp_rates);
610 			}
611 		}
612 
613 		if (sta && elems->wmm_info)
614 			set_sta_flag(sta, WLAN_STA_WME);
615 
616 		if (sta && elems->ht_operation && elems->ht_cap_elem &&
617 		    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
618 		    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_5 &&
619 		    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_10) {
620 			/* we both use HT */
621 			struct ieee80211_ht_cap htcap_ie;
622 			struct cfg80211_chan_def chandef;
623 
624 			ieee80211_ht_oper_to_chandef(channel,
625 						     elems->ht_operation,
626 						     &chandef);
627 
628 			memcpy(&htcap_ie, elems->ht_cap_elem, sizeof(htcap_ie));
629 
630 			/*
631 			 * fall back to HT20 if we don't use or use
632 			 * the other extension channel
633 			 */
634 			if (chandef.center_freq1 !=
635 			    sdata->u.ibss.chandef.center_freq1)
636 				htcap_ie.cap_info &=
637 					cpu_to_le16(~IEEE80211_HT_CAP_SUP_WIDTH_20_40);
638 
639 			rates_updated |= ieee80211_ht_cap_ie_to_sta_ht_cap(
640 						sdata, sband, &htcap_ie, sta);
641 		}
642 
643 		if (sta && rates_updated) {
644 			drv_sta_rc_update(local, sdata, &sta->sta,
645 					  IEEE80211_RC_SUPP_RATES_CHANGED);
646 			rate_control_rate_init(sta);
647 		}
648 
649 		rcu_read_unlock();
650 	}
651 
652 	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
653 					channel);
654 	if (!bss)
655 		return;
656 
657 	cbss = container_of((void *)bss, struct cfg80211_bss, priv);
658 
659 	/* same for beacon and probe response */
660 	beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
661 
662 	/* check if we need to merge IBSS */
663 
664 	/* we use a fixed BSSID */
665 	if (sdata->u.ibss.fixed_bssid)
666 		goto put_bss;
667 
668 	/* not an IBSS */
669 	if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
670 		goto put_bss;
671 
672 	/* different channel */
673 	if (sdata->u.ibss.fixed_channel &&
674 	    sdata->u.ibss.chandef.chan != cbss->channel)
675 		goto put_bss;
676 
677 	/* different SSID */
678 	if (elems->ssid_len != sdata->u.ibss.ssid_len ||
679 	    memcmp(elems->ssid, sdata->u.ibss.ssid,
680 				sdata->u.ibss.ssid_len))
681 		goto put_bss;
682 
683 	/* same BSSID */
684 	if (ether_addr_equal(cbss->bssid, sdata->u.ibss.bssid))
685 		goto put_bss;
686 
687 	if (ieee80211_have_rx_timestamp(rx_status)) {
688 		/* time when timestamp field was received */
689 		rx_timestamp =
690 			ieee80211_calculate_rx_timestamp(local, rx_status,
691 							 len + FCS_LEN, 24);
692 	} else {
693 		/*
694 		 * second best option: get current TSF
695 		 * (will return -1 if not supported)
696 		 */
697 		rx_timestamp = drv_get_tsf(local, sdata);
698 	}
699 
700 	ibss_dbg(sdata,
701 		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
702 		 mgmt->sa, mgmt->bssid,
703 		 (unsigned long long)rx_timestamp,
704 		 (unsigned long long)beacon_timestamp,
705 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
706 		 jiffies);
707 
708 	if (beacon_timestamp > rx_timestamp) {
709 		ibss_dbg(sdata,
710 			 "beacon TSF higher than local TSF - IBSS merge with BSSID %pM\n",
711 			 mgmt->bssid);
712 		ieee80211_sta_join_ibss(sdata, bss);
713 		supp_rates = ieee80211_sta_get_rates(sdata, elems, band, NULL);
714 		ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
715 				       supp_rates);
716 		rcu_read_unlock();
717 	}
718 
719  put_bss:
720 	ieee80211_rx_bss_put(local, bss);
721 }
722 
723 void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
724 			      const u8 *bssid, const u8 *addr,
725 			      u32 supp_rates)
726 {
727 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
728 	struct ieee80211_local *local = sdata->local;
729 	struct sta_info *sta;
730 	struct ieee80211_chanctx_conf *chanctx_conf;
731 	struct ieee80211_supported_band *sband;
732 	enum nl80211_bss_scan_width scan_width;
733 	int band;
734 
735 	/*
736 	 * XXX: Consider removing the least recently used entry and
737 	 * 	allow new one to be added.
738 	 */
739 	if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
740 		net_info_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
741 				    sdata->name, addr);
742 		return;
743 	}
744 
745 	if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
746 		return;
747 
748 	if (!ether_addr_equal(bssid, sdata->u.ibss.bssid))
749 		return;
750 
751 	rcu_read_lock();
752 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
753 	if (WARN_ON_ONCE(!chanctx_conf)) {
754 		rcu_read_unlock();
755 		return;
756 	}
757 	band = chanctx_conf->def.chan->band;
758 	scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
759 	rcu_read_unlock();
760 
761 	sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
762 	if (!sta)
763 		return;
764 
765 	sta->last_rx = jiffies;
766 
767 	/* make sure mandatory rates are always added */
768 	sband = local->hw.wiphy->bands[band];
769 	sta->sta.supp_rates[band] = supp_rates |
770 			ieee80211_mandatory_rates(sband, scan_width);
771 
772 	spin_lock(&ifibss->incomplete_lock);
773 	list_add(&sta->list, &ifibss->incomplete_stations);
774 	spin_unlock(&ifibss->incomplete_lock);
775 	ieee80211_queue_work(&local->hw, &sdata->work);
776 }
777 
778 static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
779 {
780 	struct ieee80211_local *local = sdata->local;
781 	int active = 0;
782 	struct sta_info *sta;
783 
784 	sdata_assert_lock(sdata);
785 
786 	rcu_read_lock();
787 
788 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
789 		if (sta->sdata == sdata &&
790 		    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
791 			       jiffies)) {
792 			active++;
793 			break;
794 		}
795 	}
796 
797 	rcu_read_unlock();
798 
799 	return active;
800 }
801 
802 static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
803 {
804 	struct ieee80211_local *local = sdata->local;
805 	struct sta_info *sta, *tmp;
806 	unsigned long exp_time = IEEE80211_IBSS_INACTIVITY_LIMIT;
807 	unsigned long exp_rsn_time = IEEE80211_IBSS_RSN_INACTIVITY_LIMIT;
808 
809 	mutex_lock(&local->sta_mtx);
810 
811 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
812 		if (sdata != sta->sdata)
813 			continue;
814 
815 		if (time_after(jiffies, sta->last_rx + exp_time) ||
816 		    (time_after(jiffies, sta->last_rx + exp_rsn_time) &&
817 		     sta->sta_state != IEEE80211_STA_AUTHORIZED)) {
818 			sta_dbg(sta->sdata, "expiring inactive %sSTA %pM\n",
819 				sta->sta_state != IEEE80211_STA_AUTHORIZED ?
820 				"not authorized " : "", sta->sta.addr);
821 
822 			WARN_ON(__sta_info_destroy(sta));
823 		}
824 	}
825 
826 	mutex_unlock(&local->sta_mtx);
827 }
828 
829 /*
830  * This function is called with state == IEEE80211_IBSS_MLME_JOINED
831  */
832 
833 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
834 {
835 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
836 	enum nl80211_bss_scan_width scan_width;
837 
838 	sdata_assert_lock(sdata);
839 
840 	mod_timer(&ifibss->timer,
841 		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
842 
843 	ieee80211_ibss_sta_expire(sdata);
844 
845 	if (time_before(jiffies, ifibss->last_scan_completed +
846 		       IEEE80211_IBSS_MERGE_INTERVAL))
847 		return;
848 
849 	if (ieee80211_sta_active_ibss(sdata))
850 		return;
851 
852 	if (ifibss->fixed_channel)
853 		return;
854 
855 	sdata_info(sdata,
856 		   "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
857 
858 	scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
859 	ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
860 				    NULL, scan_width);
861 }
862 
863 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
864 {
865 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
866 	u8 bssid[ETH_ALEN];
867 	u16 capability;
868 	int i;
869 
870 	sdata_assert_lock(sdata);
871 
872 	if (ifibss->fixed_bssid) {
873 		memcpy(bssid, ifibss->bssid, ETH_ALEN);
874 	} else {
875 		/* Generate random, not broadcast, locally administered BSSID. Mix in
876 		 * own MAC address to make sure that devices that do not have proper
877 		 * random number generator get different BSSID. */
878 		get_random_bytes(bssid, ETH_ALEN);
879 		for (i = 0; i < ETH_ALEN; i++)
880 			bssid[i] ^= sdata->vif.addr[i];
881 		bssid[0] &= ~0x01;
882 		bssid[0] |= 0x02;
883 	}
884 
885 	sdata_info(sdata, "Creating new IBSS network, BSSID %pM\n", bssid);
886 
887 	capability = WLAN_CAPABILITY_IBSS;
888 
889 	if (ifibss->privacy)
890 		capability |= WLAN_CAPABILITY_PRIVACY;
891 	else
892 		sdata->drop_unencrypted = 0;
893 
894 	__ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
895 				  &ifibss->chandef, ifibss->basic_rates,
896 				  capability, 0, true);
897 }
898 
899 /*
900  * This function is called with state == IEEE80211_IBSS_MLME_SEARCH
901  */
902 
903 static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
904 {
905 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
906 	struct ieee80211_local *local = sdata->local;
907 	struct cfg80211_bss *cbss;
908 	struct ieee80211_channel *chan = NULL;
909 	const u8 *bssid = NULL;
910 	enum nl80211_bss_scan_width scan_width;
911 	int active_ibss;
912 	u16 capability;
913 
914 	sdata_assert_lock(sdata);
915 
916 	active_ibss = ieee80211_sta_active_ibss(sdata);
917 	ibss_dbg(sdata, "sta_find_ibss (active_ibss=%d)\n", active_ibss);
918 
919 	if (active_ibss)
920 		return;
921 
922 	capability = WLAN_CAPABILITY_IBSS;
923 	if (ifibss->privacy)
924 		capability |= WLAN_CAPABILITY_PRIVACY;
925 	if (ifibss->fixed_bssid)
926 		bssid = ifibss->bssid;
927 	if (ifibss->fixed_channel)
928 		chan = ifibss->chandef.chan;
929 	if (!is_zero_ether_addr(ifibss->bssid))
930 		bssid = ifibss->bssid;
931 	cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
932 				ifibss->ssid, ifibss->ssid_len,
933 				WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_PRIVACY,
934 				capability);
935 
936 	if (cbss) {
937 		struct ieee80211_bss *bss;
938 
939 		bss = (void *)cbss->priv;
940 		ibss_dbg(sdata,
941 			 "sta_find_ibss: selected %pM current %pM\n",
942 			 cbss->bssid, ifibss->bssid);
943 		sdata_info(sdata,
944 			   "Selected IBSS BSSID %pM based on configured SSID\n",
945 			   cbss->bssid);
946 
947 		ieee80211_sta_join_ibss(sdata, bss);
948 		ieee80211_rx_bss_put(local, bss);
949 		return;
950 	}
951 
952 	/* if a fixed bssid and a fixed freq have been provided create the IBSS
953 	 * directly and do not waste time scanning
954 	 */
955 	if (ifibss->fixed_bssid && ifibss->fixed_channel) {
956 		sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
957 			   bssid);
958 		ieee80211_sta_create_ibss(sdata);
959 		return;
960 	}
961 
962 
963 	ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
964 
965 	/* Selected IBSS not found in current scan results - try to scan */
966 	if (time_after(jiffies, ifibss->last_scan_completed +
967 					IEEE80211_SCAN_INTERVAL)) {
968 		sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
969 
970 		scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
971 		ieee80211_request_ibss_scan(sdata, ifibss->ssid,
972 					    ifibss->ssid_len, chan,
973 					    scan_width);
974 	} else {
975 		int interval = IEEE80211_SCAN_INTERVAL;
976 
977 		if (time_after(jiffies, ifibss->ibss_join_req +
978 			       IEEE80211_IBSS_JOIN_TIMEOUT))
979 			ieee80211_sta_create_ibss(sdata);
980 
981 		mod_timer(&ifibss->timer,
982 			  round_jiffies(jiffies + interval));
983 	}
984 }
985 
986 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
987 					struct sk_buff *req)
988 {
989 	struct ieee80211_mgmt *mgmt = (void *)req->data;
990 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
991 	struct ieee80211_local *local = sdata->local;
992 	int tx_last_beacon, len = req->len;
993 	struct sk_buff *skb;
994 	struct beacon_data *presp;
995 	u8 *pos, *end;
996 
997 	sdata_assert_lock(sdata);
998 
999 	presp = rcu_dereference_protected(ifibss->presp,
1000 					  lockdep_is_held(&sdata->wdev.mtx));
1001 
1002 	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
1003 	    len < 24 + 2 || !presp)
1004 		return;
1005 
1006 	tx_last_beacon = drv_tx_last_beacon(local);
1007 
1008 	ibss_dbg(sdata,
1009 		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
1010 		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
1011 
1012 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
1013 		return;
1014 
1015 	if (!ether_addr_equal(mgmt->bssid, ifibss->bssid) &&
1016 	    !is_broadcast_ether_addr(mgmt->bssid))
1017 		return;
1018 
1019 	end = ((u8 *) mgmt) + len;
1020 	pos = mgmt->u.probe_req.variable;
1021 	if (pos[0] != WLAN_EID_SSID ||
1022 	    pos + 2 + pos[1] > end) {
1023 		ibss_dbg(sdata, "Invalid SSID IE in ProbeReq from %pM\n",
1024 			 mgmt->sa);
1025 		return;
1026 	}
1027 	if (pos[1] != 0 &&
1028 	    (pos[1] != ifibss->ssid_len ||
1029 	     memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
1030 		/* Ignore ProbeReq for foreign SSID */
1031 		return;
1032 	}
1033 
1034 	/* Reply with ProbeResp */
1035 	skb = dev_alloc_skb(local->tx_headroom + presp->head_len);
1036 	if (!skb)
1037 		return;
1038 
1039 	skb_reserve(skb, local->tx_headroom);
1040 	memcpy(skb_put(skb, presp->head_len), presp->head, presp->head_len);
1041 
1042 	memcpy(((struct ieee80211_mgmt *) skb->data)->da, mgmt->sa, ETH_ALEN);
1043 	ibss_dbg(sdata, "Sending ProbeResp to %pM\n", mgmt->sa);
1044 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1045 	ieee80211_tx_skb(sdata, skb);
1046 }
1047 
1048 static
1049 void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
1050 				    struct ieee80211_mgmt *mgmt, size_t len,
1051 				    struct ieee80211_rx_status *rx_status)
1052 {
1053 	size_t baselen;
1054 	struct ieee802_11_elems elems;
1055 
1056 	BUILD_BUG_ON(offsetof(typeof(mgmt->u.probe_resp), variable) !=
1057 		     offsetof(typeof(mgmt->u.beacon), variable));
1058 
1059 	/*
1060 	 * either beacon or probe_resp but the variable field is at the
1061 	 * same offset
1062 	 */
1063 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
1064 	if (baselen > len)
1065 		return;
1066 
1067 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
1068 			       false, &elems);
1069 
1070 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
1071 }
1072 
1073 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1074 				   struct sk_buff *skb)
1075 {
1076 	struct ieee80211_rx_status *rx_status;
1077 	struct ieee80211_mgmt *mgmt;
1078 	u16 fc;
1079 
1080 	rx_status = IEEE80211_SKB_RXCB(skb);
1081 	mgmt = (struct ieee80211_mgmt *) skb->data;
1082 	fc = le16_to_cpu(mgmt->frame_control);
1083 
1084 	sdata_lock(sdata);
1085 
1086 	if (!sdata->u.ibss.ssid_len)
1087 		goto mgmt_out; /* not ready to merge yet */
1088 
1089 	switch (fc & IEEE80211_FCTL_STYPE) {
1090 	case IEEE80211_STYPE_PROBE_REQ:
1091 		ieee80211_rx_mgmt_probe_req(sdata, skb);
1092 		break;
1093 	case IEEE80211_STYPE_PROBE_RESP:
1094 	case IEEE80211_STYPE_BEACON:
1095 		ieee80211_rx_mgmt_probe_beacon(sdata, mgmt, skb->len,
1096 					       rx_status);
1097 		break;
1098 	case IEEE80211_STYPE_AUTH:
1099 		ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
1100 		break;
1101 	case IEEE80211_STYPE_DEAUTH:
1102 		ieee80211_rx_mgmt_deauth_ibss(sdata, mgmt, skb->len);
1103 		break;
1104 	}
1105 
1106  mgmt_out:
1107 	sdata_unlock(sdata);
1108 }
1109 
1110 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
1111 {
1112 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1113 	struct sta_info *sta;
1114 
1115 	sdata_lock(sdata);
1116 
1117 	/*
1118 	 * Work could be scheduled after scan or similar
1119 	 * when we aren't even joined (or trying) with a
1120 	 * network.
1121 	 */
1122 	if (!ifibss->ssid_len)
1123 		goto out;
1124 
1125 	spin_lock_bh(&ifibss->incomplete_lock);
1126 	while (!list_empty(&ifibss->incomplete_stations)) {
1127 		sta = list_first_entry(&ifibss->incomplete_stations,
1128 				       struct sta_info, list);
1129 		list_del(&sta->list);
1130 		spin_unlock_bh(&ifibss->incomplete_lock);
1131 
1132 		ieee80211_ibss_finish_sta(sta);
1133 		rcu_read_unlock();
1134 		spin_lock_bh(&ifibss->incomplete_lock);
1135 	}
1136 	spin_unlock_bh(&ifibss->incomplete_lock);
1137 
1138 	switch (ifibss->state) {
1139 	case IEEE80211_IBSS_MLME_SEARCH:
1140 		ieee80211_sta_find_ibss(sdata);
1141 		break;
1142 	case IEEE80211_IBSS_MLME_JOINED:
1143 		ieee80211_sta_merge_ibss(sdata);
1144 		break;
1145 	default:
1146 		WARN_ON(1);
1147 		break;
1148 	}
1149 
1150  out:
1151 	sdata_unlock(sdata);
1152 }
1153 
1154 static void ieee80211_ibss_timer(unsigned long data)
1155 {
1156 	struct ieee80211_sub_if_data *sdata =
1157 		(struct ieee80211_sub_if_data *) data;
1158 
1159 	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1160 }
1161 
1162 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
1163 {
1164 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1165 
1166 	setup_timer(&ifibss->timer, ieee80211_ibss_timer,
1167 		    (unsigned long) sdata);
1168 	INIT_LIST_HEAD(&ifibss->incomplete_stations);
1169 	spin_lock_init(&ifibss->incomplete_lock);
1170 }
1171 
1172 /* scan finished notification */
1173 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
1174 {
1175 	struct ieee80211_sub_if_data *sdata;
1176 
1177 	mutex_lock(&local->iflist_mtx);
1178 	list_for_each_entry(sdata, &local->interfaces, list) {
1179 		if (!ieee80211_sdata_running(sdata))
1180 			continue;
1181 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
1182 			continue;
1183 		sdata->u.ibss.last_scan_completed = jiffies;
1184 		ieee80211_queue_work(&local->hw, &sdata->work);
1185 	}
1186 	mutex_unlock(&local->iflist_mtx);
1187 }
1188 
1189 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
1190 			struct cfg80211_ibss_params *params)
1191 {
1192 	u32 changed = 0;
1193 	u32 rate_flags;
1194 	struct ieee80211_supported_band *sband;
1195 	int i;
1196 
1197 	if (params->bssid) {
1198 		memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
1199 		sdata->u.ibss.fixed_bssid = true;
1200 	} else
1201 		sdata->u.ibss.fixed_bssid = false;
1202 
1203 	sdata->u.ibss.privacy = params->privacy;
1204 	sdata->u.ibss.control_port = params->control_port;
1205 	sdata->u.ibss.basic_rates = params->basic_rates;
1206 
1207 	/* fix basic_rates if channel does not support these rates */
1208 	rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
1209 	sband = sdata->local->hw.wiphy->bands[params->chandef.chan->band];
1210 	for (i = 0; i < sband->n_bitrates; i++) {
1211 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
1212 			sdata->u.ibss.basic_rates &= ~BIT(i);
1213 	}
1214 	memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
1215 	       sizeof(params->mcast_rate));
1216 
1217 	sdata->vif.bss_conf.beacon_int = params->beacon_interval;
1218 
1219 	sdata->u.ibss.chandef = params->chandef;
1220 	sdata->u.ibss.fixed_channel = params->channel_fixed;
1221 
1222 	if (params->ie) {
1223 		sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
1224 					   GFP_KERNEL);
1225 		if (sdata->u.ibss.ie)
1226 			sdata->u.ibss.ie_len = params->ie_len;
1227 	}
1228 
1229 	sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
1230 	sdata->u.ibss.ibss_join_req = jiffies;
1231 
1232 	memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
1233 	sdata->u.ibss.ssid_len = params->ssid_len;
1234 
1235 	memcpy(&sdata->u.ibss.ht_capa, &params->ht_capa,
1236 	       sizeof(sdata->u.ibss.ht_capa));
1237 	memcpy(&sdata->u.ibss.ht_capa_mask, &params->ht_capa_mask,
1238 	       sizeof(sdata->u.ibss.ht_capa_mask));
1239 
1240 	/*
1241 	 * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
1242 	 * reserved, but an HT STA shall protect HT transmissions as though
1243 	 * the HT Protection field were set to non-HT mixed mode.
1244 	 *
1245 	 * In an IBSS, the RIFS Mode field of the HT Operation element is
1246 	 * also reserved, but an HT STA shall operate as though this field
1247 	 * were set to 1.
1248 	 */
1249 
1250 	sdata->vif.bss_conf.ht_operation_mode |=
1251 		  IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED
1252 		| IEEE80211_HT_PARAM_RIFS_MODE;
1253 
1254 	changed |= BSS_CHANGED_HT;
1255 	ieee80211_bss_info_change_notify(sdata, changed);
1256 
1257 	sdata->smps_mode = IEEE80211_SMPS_OFF;
1258 	sdata->needed_rx_chains = sdata->local->rx_chains;
1259 
1260 	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1261 
1262 	return 0;
1263 }
1264 
1265 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
1266 {
1267 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1268 	struct ieee80211_local *local = sdata->local;
1269 	struct cfg80211_bss *cbss;
1270 	u16 capability;
1271 	int active_ibss;
1272 	struct sta_info *sta;
1273 	struct beacon_data *presp;
1274 
1275 	active_ibss = ieee80211_sta_active_ibss(sdata);
1276 
1277 	if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
1278 		capability = WLAN_CAPABILITY_IBSS;
1279 
1280 		if (ifibss->privacy)
1281 			capability |= WLAN_CAPABILITY_PRIVACY;
1282 
1283 		cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
1284 					ifibss->bssid, ifibss->ssid,
1285 					ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
1286 					WLAN_CAPABILITY_PRIVACY,
1287 					capability);
1288 
1289 		if (cbss) {
1290 			cfg80211_unlink_bss(local->hw.wiphy, cbss);
1291 			cfg80211_put_bss(local->hw.wiphy, cbss);
1292 		}
1293 	}
1294 
1295 	ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
1296 	memset(ifibss->bssid, 0, ETH_ALEN);
1297 	ifibss->ssid_len = 0;
1298 
1299 	sta_info_flush(sdata);
1300 
1301 	spin_lock_bh(&ifibss->incomplete_lock);
1302 	while (!list_empty(&ifibss->incomplete_stations)) {
1303 		sta = list_first_entry(&ifibss->incomplete_stations,
1304 				       struct sta_info, list);
1305 		list_del(&sta->list);
1306 		spin_unlock_bh(&ifibss->incomplete_lock);
1307 
1308 		sta_info_free(local, sta);
1309 		spin_lock_bh(&ifibss->incomplete_lock);
1310 	}
1311 	spin_unlock_bh(&ifibss->incomplete_lock);
1312 
1313 	netif_carrier_off(sdata->dev);
1314 
1315 	/* remove beacon */
1316 	kfree(sdata->u.ibss.ie);
1317 	presp = rcu_dereference_protected(ifibss->presp,
1318 					  lockdep_is_held(&sdata->wdev.mtx));
1319 	RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
1320 
1321 	/* on the next join, re-program HT parameters */
1322 	memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
1323 	memset(&ifibss->ht_capa_mask, 0, sizeof(ifibss->ht_capa_mask));
1324 
1325 	sdata->vif.bss_conf.ibss_joined = false;
1326 	sdata->vif.bss_conf.ibss_creator = false;
1327 	sdata->vif.bss_conf.enable_beacon = false;
1328 	sdata->vif.bss_conf.ssid_len = 0;
1329 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
1330 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
1331 						BSS_CHANGED_IBSS);
1332 	ieee80211_vif_release_channel(sdata);
1333 	synchronize_rcu();
1334 	kfree(presp);
1335 
1336 	skb_queue_purge(&sdata->skb_queue);
1337 
1338 	del_timer_sync(&sdata->u.ibss.timer);
1339 
1340 	return 0;
1341 }
1342