xref: /linux/net/mac80211/ibss.c (revision b889fcf63cb62e7fdb7816565e28f44dbe4a76a5)
1 /*
2  * IBSS mode implementation
3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4  * Copyright 2004, Instant802 Networks, Inc.
5  * Copyright 2005, Devicescape Software, Inc.
6  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8  * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2 as
12  * published by the Free Software Foundation.
13  */
14 
15 #include <linux/delay.h>
16 #include <linux/slab.h>
17 #include <linux/if_ether.h>
18 #include <linux/skbuff.h>
19 #include <linux/if_arp.h>
20 #include <linux/etherdevice.h>
21 #include <linux/rtnetlink.h>
22 #include <net/mac80211.h>
23 
24 #include "ieee80211_i.h"
25 #include "driver-ops.h"
26 #include "rate.h"
27 
28 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
29 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
30 
31 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
32 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
33 
34 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
35 
36 
37 static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
38 				      const u8 *bssid, const int beacon_int,
39 				      struct ieee80211_channel *chan,
40 				      const u32 basic_rates,
41 				      const u16 capability, u64 tsf,
42 				      bool creator)
43 {
44 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
45 	struct ieee80211_local *local = sdata->local;
46 	int rates, i;
47 	struct sk_buff *skb;
48 	struct ieee80211_mgmt *mgmt;
49 	u8 *pos;
50 	struct ieee80211_supported_band *sband;
51 	struct cfg80211_bss *bss;
52 	u32 bss_change;
53 	u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
54 	struct cfg80211_chan_def chandef;
55 
56 	lockdep_assert_held(&ifibss->mtx);
57 
58 	/* Reset own TSF to allow time synchronization work. */
59 	drv_reset_tsf(local, sdata);
60 
61 	skb = ifibss->skb;
62 	RCU_INIT_POINTER(ifibss->presp, NULL);
63 	synchronize_rcu();
64 	skb->data = skb->head;
65 	skb->len = 0;
66 	skb_reset_tail_pointer(skb);
67 	skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
68 
69 	if (!ether_addr_equal(ifibss->bssid, bssid))
70 		sta_info_flush(sdata->local, sdata);
71 
72 	/* if merging, indicate to driver that we leave the old IBSS */
73 	if (sdata->vif.bss_conf.ibss_joined) {
74 		sdata->vif.bss_conf.ibss_joined = false;
75 		sdata->vif.bss_conf.ibss_creator = false;
76 		netif_carrier_off(sdata->dev);
77 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IBSS);
78 	}
79 
80 	sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
81 
82 	cfg80211_chandef_create(&chandef, chan, ifibss->channel_type);
83 	if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
84 		chandef.width = NL80211_CHAN_WIDTH_20;
85 		chandef.center_freq1 = chan->center_freq;
86 	}
87 
88 	ieee80211_vif_release_channel(sdata);
89 	if (ieee80211_vif_use_channel(sdata, &chandef,
90 				      ifibss->fixed_channel ?
91 					IEEE80211_CHANCTX_SHARED :
92 					IEEE80211_CHANCTX_EXCLUSIVE)) {
93 		sdata_info(sdata, "Failed to join IBSS, no channel context\n");
94 		return;
95 	}
96 
97 	memcpy(ifibss->bssid, bssid, ETH_ALEN);
98 
99 	sband = local->hw.wiphy->bands[chan->band];
100 
101 	/* build supported rates array */
102 	pos = supp_rates;
103 	for (i = 0; i < sband->n_bitrates; i++) {
104 		int rate = sband->bitrates[i].bitrate;
105 		u8 basic = 0;
106 		if (basic_rates & BIT(i))
107 			basic = 0x80;
108 		*pos++ = basic | (u8) (rate / 5);
109 	}
110 
111 	/* Build IBSS probe response */
112 	mgmt = (void *) skb_put(skb, 24 + sizeof(mgmt->u.beacon));
113 	memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
114 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
115 					  IEEE80211_STYPE_PROBE_RESP);
116 	eth_broadcast_addr(mgmt->da);
117 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
118 	memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
119 	mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
120 	mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
121 	mgmt->u.beacon.capab_info = cpu_to_le16(capability);
122 
123 	pos = skb_put(skb, 2 + ifibss->ssid_len);
124 	*pos++ = WLAN_EID_SSID;
125 	*pos++ = ifibss->ssid_len;
126 	memcpy(pos, ifibss->ssid, ifibss->ssid_len);
127 
128 	rates = sband->n_bitrates;
129 	if (rates > 8)
130 		rates = 8;
131 	pos = skb_put(skb, 2 + rates);
132 	*pos++ = WLAN_EID_SUPP_RATES;
133 	*pos++ = rates;
134 	memcpy(pos, supp_rates, rates);
135 
136 	if (sband->band == IEEE80211_BAND_2GHZ) {
137 		pos = skb_put(skb, 2 + 1);
138 		*pos++ = WLAN_EID_DS_PARAMS;
139 		*pos++ = 1;
140 		*pos++ = ieee80211_frequency_to_channel(chan->center_freq);
141 	}
142 
143 	pos = skb_put(skb, 2 + 2);
144 	*pos++ = WLAN_EID_IBSS_PARAMS;
145 	*pos++ = 2;
146 	/* FIX: set ATIM window based on scan results */
147 	*pos++ = 0;
148 	*pos++ = 0;
149 
150 	if (sband->n_bitrates > 8) {
151 		rates = sband->n_bitrates - 8;
152 		pos = skb_put(skb, 2 + rates);
153 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
154 		*pos++ = rates;
155 		memcpy(pos, &supp_rates[8], rates);
156 	}
157 
158 	if (ifibss->ie_len)
159 		memcpy(skb_put(skb, ifibss->ie_len),
160 		       ifibss->ie, ifibss->ie_len);
161 
162 	/* add HT capability and information IEs */
163 	if (chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
164 	    sband->ht_cap.ht_supported) {
165 		pos = skb_put(skb, 4 +
166 				   sizeof(struct ieee80211_ht_cap) +
167 				   sizeof(struct ieee80211_ht_operation));
168 		pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
169 						sband->ht_cap.cap);
170 		/*
171 		 * Note: According to 802.11n-2009 9.13.3.1, HT Protection
172 		 * field and RIFS Mode are reserved in IBSS mode, therefore
173 		 * keep them at 0
174 		 */
175 		pos = ieee80211_ie_build_ht_oper(pos, &sband->ht_cap,
176 						 &chandef, 0);
177 	}
178 
179 	if (local->hw.queues >= IEEE80211_NUM_ACS) {
180 		pos = skb_put(skb, 9);
181 		*pos++ = WLAN_EID_VENDOR_SPECIFIC;
182 		*pos++ = 7; /* len */
183 		*pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
184 		*pos++ = 0x50;
185 		*pos++ = 0xf2;
186 		*pos++ = 2; /* WME */
187 		*pos++ = 0; /* WME info */
188 		*pos++ = 1; /* WME ver */
189 		*pos++ = 0; /* U-APSD no in use */
190 	}
191 
192 	rcu_assign_pointer(ifibss->presp, skb);
193 
194 	sdata->vif.bss_conf.beacon_int = beacon_int;
195 	sdata->vif.bss_conf.basic_rates = basic_rates;
196 	bss_change = BSS_CHANGED_BEACON_INT;
197 	bss_change |= ieee80211_reset_erp_info(sdata);
198 	bss_change |= BSS_CHANGED_BSSID;
199 	bss_change |= BSS_CHANGED_BEACON;
200 	bss_change |= BSS_CHANGED_BEACON_ENABLED;
201 	bss_change |= BSS_CHANGED_BASIC_RATES;
202 	bss_change |= BSS_CHANGED_HT;
203 	bss_change |= BSS_CHANGED_IBSS;
204 
205 	/*
206 	 * In 5 GHz/802.11a, we can always use short slot time.
207 	 * (IEEE 802.11-2012 18.3.8.7)
208 	 *
209 	 * In 2.4GHz, we must always use long slots in IBSS for compatibility
210 	 * reasons.
211 	 * (IEEE 802.11-2012 19.4.5)
212 	 *
213 	 * HT follows these specifications (IEEE 802.11-2012 20.3.18)
214 	 */
215 	sdata->vif.bss_conf.use_short_slot = chan->band == IEEE80211_BAND_5GHZ;
216 	bss_change |= BSS_CHANGED_ERP_SLOT;
217 
218 	sdata->vif.bss_conf.ibss_joined = true;
219 	sdata->vif.bss_conf.ibss_creator = creator;
220 	ieee80211_bss_info_change_notify(sdata, bss_change);
221 
222 	ieee80211_sta_def_wmm_params(sdata, sband->n_bitrates, supp_rates);
223 
224 	ifibss->state = IEEE80211_IBSS_MLME_JOINED;
225 	mod_timer(&ifibss->timer,
226 		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
227 
228 	bss = cfg80211_inform_bss_frame(local->hw.wiphy, chan,
229 					mgmt, skb->len, 0, GFP_KERNEL);
230 	cfg80211_put_bss(bss);
231 	netif_carrier_on(sdata->dev);
232 	cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
233 }
234 
235 static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
236 				    struct ieee80211_bss *bss)
237 {
238 	struct cfg80211_bss *cbss =
239 		container_of((void *)bss, struct cfg80211_bss, priv);
240 	struct ieee80211_supported_band *sband;
241 	u32 basic_rates;
242 	int i, j;
243 	u16 beacon_int = cbss->beacon_interval;
244 
245 	lockdep_assert_held(&sdata->u.ibss.mtx);
246 
247 	if (beacon_int < 10)
248 		beacon_int = 10;
249 
250 	sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
251 
252 	basic_rates = 0;
253 
254 	for (i = 0; i < bss->supp_rates_len; i++) {
255 		int rate = (bss->supp_rates[i] & 0x7f) * 5;
256 		bool is_basic = !!(bss->supp_rates[i] & 0x80);
257 
258 		for (j = 0; j < sband->n_bitrates; j++) {
259 			if (sband->bitrates[j].bitrate == rate) {
260 				if (is_basic)
261 					basic_rates |= BIT(j);
262 				break;
263 			}
264 		}
265 	}
266 
267 	__ieee80211_sta_join_ibss(sdata, cbss->bssid,
268 				  beacon_int,
269 				  cbss->channel,
270 				  basic_rates,
271 				  cbss->capability,
272 				  cbss->tsf,
273 				  false);
274 }
275 
276 static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
277 						  bool auth)
278 	__acquires(RCU)
279 {
280 	struct ieee80211_sub_if_data *sdata = sta->sdata;
281 	u8 addr[ETH_ALEN];
282 
283 	memcpy(addr, sta->sta.addr, ETH_ALEN);
284 
285 	ibss_dbg(sdata, "Adding new IBSS station %pM\n", addr);
286 
287 	sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
288 	sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
289 	/* authorize the station only if the network is not RSN protected. If
290 	 * not wait for the userspace to authorize it */
291 	if (!sta->sdata->u.ibss.control_port)
292 		sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
293 
294 	rate_control_rate_init(sta);
295 
296 	/* If it fails, maybe we raced another insertion? */
297 	if (sta_info_insert_rcu(sta))
298 		return sta_info_get(sdata, addr);
299 	if (auth && !sdata->u.ibss.auth_frame_registrations) {
300 		ibss_dbg(sdata,
301 			 "TX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=1)\n",
302 			 sdata->vif.addr, addr, sdata->u.ibss.bssid);
303 		ieee80211_send_auth(sdata, 1, WLAN_AUTH_OPEN, 0, NULL, 0,
304 				    addr, sdata->u.ibss.bssid, NULL, 0, 0);
305 	}
306 	return sta;
307 }
308 
309 static struct sta_info *
310 ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
311 		       const u8 *bssid, const u8 *addr,
312 		       u32 supp_rates, bool auth)
313 	__acquires(RCU)
314 {
315 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
316 	struct ieee80211_local *local = sdata->local;
317 	struct sta_info *sta;
318 	struct ieee80211_chanctx_conf *chanctx_conf;
319 	int band;
320 
321 	/*
322 	 * XXX: Consider removing the least recently used entry and
323 	 * 	allow new one to be added.
324 	 */
325 	if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
326 		net_info_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
327 				    sdata->name, addr);
328 		rcu_read_lock();
329 		return NULL;
330 	}
331 
332 	if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH) {
333 		rcu_read_lock();
334 		return NULL;
335 	}
336 
337 	if (!ether_addr_equal(bssid, sdata->u.ibss.bssid)) {
338 		rcu_read_lock();
339 		return NULL;
340 	}
341 
342 	rcu_read_lock();
343 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
344 	if (WARN_ON_ONCE(!chanctx_conf))
345 		return NULL;
346 	band = chanctx_conf->def.chan->band;
347 	rcu_read_unlock();
348 
349 	sta = sta_info_alloc(sdata, addr, GFP_KERNEL);
350 	if (!sta) {
351 		rcu_read_lock();
352 		return NULL;
353 	}
354 
355 	sta->last_rx = jiffies;
356 
357 	/* make sure mandatory rates are always added */
358 	sta->sta.supp_rates[band] = supp_rates |
359 			ieee80211_mandatory_rates(local, band);
360 
361 	return ieee80211_ibss_finish_sta(sta, auth);
362 }
363 
364 static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
365 					  struct ieee80211_mgmt *mgmt,
366 					  size_t len)
367 {
368 	u16 reason = le16_to_cpu(mgmt->u.deauth.reason_code);
369 
370 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
371 		return;
372 
373 	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
374 		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
375 	sta_info_destroy_addr(sdata, mgmt->sa);
376 }
377 
378 static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
379 					struct ieee80211_mgmt *mgmt,
380 					size_t len)
381 {
382 	u16 auth_alg, auth_transaction;
383 	struct sta_info *sta;
384 	u8 deauth_frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
385 
386 	lockdep_assert_held(&sdata->u.ibss.mtx);
387 
388 	if (len < 24 + 6)
389 		return;
390 
391 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
392 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
393 
394 	ibss_dbg(sdata,
395 		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
396 		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
397 
398 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
399 		return;
400 
401 	sta_info_destroy_addr(sdata, mgmt->sa);
402 	sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, 0, false);
403 	rcu_read_unlock();
404 
405 	/*
406 	 * if we have any problem in allocating the new station, we reply with a
407 	 * DEAUTH frame to tell the other end that we had a problem
408 	 */
409 	if (!sta) {
410 		ieee80211_send_deauth_disassoc(sdata, sdata->u.ibss.bssid,
411 					       IEEE80211_STYPE_DEAUTH,
412 					       WLAN_REASON_UNSPECIFIED, true,
413 					       deauth_frame_buf);
414 		return;
415 	}
416 
417 	/*
418 	 * IEEE 802.11 standard does not require authentication in IBSS
419 	 * networks and most implementations do not seem to use it.
420 	 * However, try to reply to authentication attempts if someone
421 	 * has actually implemented this.
422 	 */
423 	ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, 0, NULL, 0,
424 			    mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0);
425 }
426 
427 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
428 				  struct ieee80211_mgmt *mgmt,
429 				  size_t len,
430 				  struct ieee80211_rx_status *rx_status,
431 				  struct ieee802_11_elems *elems,
432 				  bool beacon)
433 {
434 	struct ieee80211_local *local = sdata->local;
435 	int freq;
436 	struct cfg80211_bss *cbss;
437 	struct ieee80211_bss *bss;
438 	struct sta_info *sta;
439 	struct ieee80211_channel *channel;
440 	u64 beacon_timestamp, rx_timestamp;
441 	u32 supp_rates = 0;
442 	enum ieee80211_band band = rx_status->band;
443 	struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
444 	bool rates_updated = false;
445 
446 	if (elems->ds_params && elems->ds_params_len == 1)
447 		freq = ieee80211_channel_to_frequency(elems->ds_params[0],
448 						      band);
449 	else
450 		freq = rx_status->freq;
451 
452 	channel = ieee80211_get_channel(local->hw.wiphy, freq);
453 
454 	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
455 		return;
456 
457 	if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
458 	    ether_addr_equal(mgmt->bssid, sdata->u.ibss.bssid)) {
459 
460 		rcu_read_lock();
461 		sta = sta_info_get(sdata, mgmt->sa);
462 
463 		if (elems->supp_rates) {
464 			supp_rates = ieee80211_sta_get_rates(local, elems,
465 							     band, NULL);
466 			if (sta) {
467 				u32 prev_rates;
468 
469 				prev_rates = sta->sta.supp_rates[band];
470 				/* make sure mandatory rates are always added */
471 				sta->sta.supp_rates[band] = supp_rates |
472 					ieee80211_mandatory_rates(local, band);
473 
474 				if (sta->sta.supp_rates[band] != prev_rates) {
475 					ibss_dbg(sdata,
476 						 "updated supp_rates set for %pM based on beacon/probe_resp (0x%x -> 0x%x)\n",
477 						 sta->sta.addr, prev_rates,
478 						 sta->sta.supp_rates[band]);
479 					rates_updated = true;
480 				}
481 			} else {
482 				rcu_read_unlock();
483 				sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid,
484 						mgmt->sa, supp_rates, true);
485 			}
486 		}
487 
488 		if (sta && elems->wmm_info)
489 			set_sta_flag(sta, WLAN_STA_WME);
490 
491 		if (sta && elems->ht_operation && elems->ht_cap_elem &&
492 		    sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
493 			/* we both use HT */
494 			struct ieee80211_sta_ht_cap sta_ht_cap_new;
495 			struct cfg80211_chan_def chandef;
496 
497 			ieee80211_ht_oper_to_chandef(channel,
498 						     elems->ht_operation,
499 						     &chandef);
500 
501 			ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
502 							  elems->ht_cap_elem,
503 							  &sta_ht_cap_new);
504 
505 			/*
506 			 * fall back to HT20 if we don't use or use
507 			 * the other extension channel
508 			 */
509 			if (chandef.width != NL80211_CHAN_WIDTH_40 ||
510 			    cfg80211_get_chandef_type(&chandef) !=
511 						sdata->u.ibss.channel_type)
512 				sta_ht_cap_new.cap &=
513 					~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
514 
515 			if (memcmp(&sta->sta.ht_cap, &sta_ht_cap_new,
516 				   sizeof(sta_ht_cap_new))) {
517 				memcpy(&sta->sta.ht_cap, &sta_ht_cap_new,
518 				       sizeof(sta_ht_cap_new));
519 				rates_updated = true;
520 			}
521 		}
522 
523 		if (sta && rates_updated) {
524 			drv_sta_rc_update(local, sdata, &sta->sta,
525 					  IEEE80211_RC_SUPP_RATES_CHANGED);
526 			rate_control_rate_init(sta);
527 		}
528 
529 		rcu_read_unlock();
530 	}
531 
532 	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
533 					channel, beacon);
534 	if (!bss)
535 		return;
536 
537 	cbss = container_of((void *)bss, struct cfg80211_bss, priv);
538 
539 	/* was just updated in ieee80211_bss_info_update */
540 	beacon_timestamp = cbss->tsf;
541 
542 	/* check if we need to merge IBSS */
543 
544 	/* we use a fixed BSSID */
545 	if (sdata->u.ibss.fixed_bssid)
546 		goto put_bss;
547 
548 	/* not an IBSS */
549 	if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
550 		goto put_bss;
551 
552 	/* different channel */
553 	if (sdata->u.ibss.fixed_channel &&
554 	    sdata->u.ibss.channel != cbss->channel)
555 		goto put_bss;
556 
557 	/* different SSID */
558 	if (elems->ssid_len != sdata->u.ibss.ssid_len ||
559 	    memcmp(elems->ssid, sdata->u.ibss.ssid,
560 				sdata->u.ibss.ssid_len))
561 		goto put_bss;
562 
563 	/* same BSSID */
564 	if (ether_addr_equal(cbss->bssid, sdata->u.ibss.bssid))
565 		goto put_bss;
566 
567 	if (ieee80211_have_rx_timestamp(rx_status)) {
568 		/* time when timestamp field was received */
569 		rx_timestamp =
570 			ieee80211_calculate_rx_timestamp(local, rx_status,
571 							 len + FCS_LEN, 24);
572 	} else {
573 		/*
574 		 * second best option: get current TSF
575 		 * (will return -1 if not supported)
576 		 */
577 		rx_timestamp = drv_get_tsf(local, sdata);
578 	}
579 
580 	ibss_dbg(sdata,
581 		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
582 		 mgmt->sa, mgmt->bssid,
583 		 (unsigned long long)rx_timestamp,
584 		 (unsigned long long)beacon_timestamp,
585 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
586 		 jiffies);
587 
588 	if (beacon_timestamp > rx_timestamp) {
589 		ibss_dbg(sdata,
590 			 "beacon TSF higher than local TSF - IBSS merge with BSSID %pM\n",
591 			 mgmt->bssid);
592 		ieee80211_sta_join_ibss(sdata, bss);
593 		supp_rates = ieee80211_sta_get_rates(local, elems, band, NULL);
594 		ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
595 				       supp_rates, true);
596 		rcu_read_unlock();
597 	}
598 
599  put_bss:
600 	ieee80211_rx_bss_put(local, bss);
601 }
602 
603 void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
604 			      const u8 *bssid, const u8 *addr,
605 			      u32 supp_rates)
606 {
607 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
608 	struct ieee80211_local *local = sdata->local;
609 	struct sta_info *sta;
610 	struct ieee80211_chanctx_conf *chanctx_conf;
611 	int band;
612 
613 	/*
614 	 * XXX: Consider removing the least recently used entry and
615 	 * 	allow new one to be added.
616 	 */
617 	if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
618 		net_info_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
619 				    sdata->name, addr);
620 		return;
621 	}
622 
623 	if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
624 		return;
625 
626 	if (!ether_addr_equal(bssid, sdata->u.ibss.bssid))
627 		return;
628 
629 	rcu_read_lock();
630 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
631 	if (WARN_ON_ONCE(!chanctx_conf)) {
632 		rcu_read_unlock();
633 		return;
634 	}
635 	band = chanctx_conf->def.chan->band;
636 	rcu_read_unlock();
637 
638 	sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
639 	if (!sta)
640 		return;
641 
642 	sta->last_rx = jiffies;
643 
644 	/* make sure mandatory rates are always added */
645 	sta->sta.supp_rates[band] = supp_rates |
646 			ieee80211_mandatory_rates(local, band);
647 
648 	spin_lock(&ifibss->incomplete_lock);
649 	list_add(&sta->list, &ifibss->incomplete_stations);
650 	spin_unlock(&ifibss->incomplete_lock);
651 	ieee80211_queue_work(&local->hw, &sdata->work);
652 }
653 
654 static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
655 {
656 	struct ieee80211_local *local = sdata->local;
657 	int active = 0;
658 	struct sta_info *sta;
659 
660 	lockdep_assert_held(&sdata->u.ibss.mtx);
661 
662 	rcu_read_lock();
663 
664 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
665 		if (sta->sdata == sdata &&
666 		    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
667 			       jiffies)) {
668 			active++;
669 			break;
670 		}
671 	}
672 
673 	rcu_read_unlock();
674 
675 	return active;
676 }
677 
678 /*
679  * This function is called with state == IEEE80211_IBSS_MLME_JOINED
680  */
681 
682 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
683 {
684 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
685 
686 	lockdep_assert_held(&ifibss->mtx);
687 
688 	mod_timer(&ifibss->timer,
689 		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
690 
691 	ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
692 
693 	if (time_before(jiffies, ifibss->last_scan_completed +
694 		       IEEE80211_IBSS_MERGE_INTERVAL))
695 		return;
696 
697 	if (ieee80211_sta_active_ibss(sdata))
698 		return;
699 
700 	if (ifibss->fixed_channel)
701 		return;
702 
703 	sdata_info(sdata,
704 		   "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
705 
706 	ieee80211_request_internal_scan(sdata,
707 			ifibss->ssid, ifibss->ssid_len, NULL);
708 }
709 
710 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
711 {
712 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
713 	u8 bssid[ETH_ALEN];
714 	u16 capability;
715 	int i;
716 
717 	lockdep_assert_held(&ifibss->mtx);
718 
719 	if (ifibss->fixed_bssid) {
720 		memcpy(bssid, ifibss->bssid, ETH_ALEN);
721 	} else {
722 		/* Generate random, not broadcast, locally administered BSSID. Mix in
723 		 * own MAC address to make sure that devices that do not have proper
724 		 * random number generator get different BSSID. */
725 		get_random_bytes(bssid, ETH_ALEN);
726 		for (i = 0; i < ETH_ALEN; i++)
727 			bssid[i] ^= sdata->vif.addr[i];
728 		bssid[0] &= ~0x01;
729 		bssid[0] |= 0x02;
730 	}
731 
732 	sdata_info(sdata, "Creating new IBSS network, BSSID %pM\n", bssid);
733 
734 	capability = WLAN_CAPABILITY_IBSS;
735 
736 	if (ifibss->privacy)
737 		capability |= WLAN_CAPABILITY_PRIVACY;
738 	else
739 		sdata->drop_unencrypted = 0;
740 
741 	__ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
742 				  ifibss->channel, ifibss->basic_rates,
743 				  capability, 0, true);
744 }
745 
746 /*
747  * This function is called with state == IEEE80211_IBSS_MLME_SEARCH
748  */
749 
750 static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
751 {
752 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
753 	struct ieee80211_local *local = sdata->local;
754 	struct cfg80211_bss *cbss;
755 	struct ieee80211_channel *chan = NULL;
756 	const u8 *bssid = NULL;
757 	int active_ibss;
758 	u16 capability;
759 
760 	lockdep_assert_held(&ifibss->mtx);
761 
762 	active_ibss = ieee80211_sta_active_ibss(sdata);
763 	ibss_dbg(sdata, "sta_find_ibss (active_ibss=%d)\n", active_ibss);
764 
765 	if (active_ibss)
766 		return;
767 
768 	capability = WLAN_CAPABILITY_IBSS;
769 	if (ifibss->privacy)
770 		capability |= WLAN_CAPABILITY_PRIVACY;
771 	if (ifibss->fixed_bssid)
772 		bssid = ifibss->bssid;
773 	if (ifibss->fixed_channel)
774 		chan = ifibss->channel;
775 	if (!is_zero_ether_addr(ifibss->bssid))
776 		bssid = ifibss->bssid;
777 	cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
778 				ifibss->ssid, ifibss->ssid_len,
779 				WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_PRIVACY,
780 				capability);
781 
782 	if (cbss) {
783 		struct ieee80211_bss *bss;
784 
785 		bss = (void *)cbss->priv;
786 		ibss_dbg(sdata,
787 			 "sta_find_ibss: selected %pM current %pM\n",
788 			 cbss->bssid, ifibss->bssid);
789 		sdata_info(sdata,
790 			   "Selected IBSS BSSID %pM based on configured SSID\n",
791 			   cbss->bssid);
792 
793 		ieee80211_sta_join_ibss(sdata, bss);
794 		ieee80211_rx_bss_put(local, bss);
795 		return;
796 	}
797 
798 	ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
799 
800 	/* Selected IBSS not found in current scan results - try to scan */
801 	if (time_after(jiffies, ifibss->last_scan_completed +
802 					IEEE80211_SCAN_INTERVAL)) {
803 		sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
804 
805 		ieee80211_request_internal_scan(sdata,
806 				ifibss->ssid, ifibss->ssid_len,
807 				ifibss->fixed_channel ? ifibss->channel : NULL);
808 	} else {
809 		int interval = IEEE80211_SCAN_INTERVAL;
810 
811 		if (time_after(jiffies, ifibss->ibss_join_req +
812 			       IEEE80211_IBSS_JOIN_TIMEOUT))
813 			ieee80211_sta_create_ibss(sdata);
814 
815 		mod_timer(&ifibss->timer,
816 			  round_jiffies(jiffies + interval));
817 	}
818 }
819 
820 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
821 					struct sk_buff *req)
822 {
823 	struct ieee80211_mgmt *mgmt = (void *)req->data;
824 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
825 	struct ieee80211_local *local = sdata->local;
826 	int tx_last_beacon, len = req->len;
827 	struct sk_buff *skb;
828 	struct ieee80211_mgmt *resp;
829 	struct sk_buff *presp;
830 	u8 *pos, *end;
831 
832 	lockdep_assert_held(&ifibss->mtx);
833 
834 	presp = rcu_dereference_protected(ifibss->presp,
835 					  lockdep_is_held(&ifibss->mtx));
836 
837 	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
838 	    len < 24 + 2 || !presp)
839 		return;
840 
841 	tx_last_beacon = drv_tx_last_beacon(local);
842 
843 	ibss_dbg(sdata,
844 		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
845 		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
846 
847 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
848 		return;
849 
850 	if (!ether_addr_equal(mgmt->bssid, ifibss->bssid) &&
851 	    !is_broadcast_ether_addr(mgmt->bssid))
852 		return;
853 
854 	end = ((u8 *) mgmt) + len;
855 	pos = mgmt->u.probe_req.variable;
856 	if (pos[0] != WLAN_EID_SSID ||
857 	    pos + 2 + pos[1] > end) {
858 		ibss_dbg(sdata, "Invalid SSID IE in ProbeReq from %pM\n",
859 			 mgmt->sa);
860 		return;
861 	}
862 	if (pos[1] != 0 &&
863 	    (pos[1] != ifibss->ssid_len ||
864 	     memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
865 		/* Ignore ProbeReq for foreign SSID */
866 		return;
867 	}
868 
869 	/* Reply with ProbeResp */
870 	skb = skb_copy(presp, GFP_KERNEL);
871 	if (!skb)
872 		return;
873 
874 	resp = (struct ieee80211_mgmt *) skb->data;
875 	memcpy(resp->da, mgmt->sa, ETH_ALEN);
876 	ibss_dbg(sdata, "Sending ProbeResp to %pM\n", resp->da);
877 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
878 	ieee80211_tx_skb(sdata, skb);
879 }
880 
881 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
882 					 struct ieee80211_mgmt *mgmt,
883 					 size_t len,
884 					 struct ieee80211_rx_status *rx_status)
885 {
886 	size_t baselen;
887 	struct ieee802_11_elems elems;
888 
889 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
890 	if (baselen > len)
891 		return;
892 
893 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
894 				&elems);
895 
896 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
897 }
898 
899 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
900 				     struct ieee80211_mgmt *mgmt,
901 				     size_t len,
902 				     struct ieee80211_rx_status *rx_status)
903 {
904 	size_t baselen;
905 	struct ieee802_11_elems elems;
906 
907 	/* Process beacon from the current BSS */
908 	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
909 	if (baselen > len)
910 		return;
911 
912 	ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
913 
914 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
915 }
916 
917 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
918 				   struct sk_buff *skb)
919 {
920 	struct ieee80211_rx_status *rx_status;
921 	struct ieee80211_mgmt *mgmt;
922 	u16 fc;
923 
924 	rx_status = IEEE80211_SKB_RXCB(skb);
925 	mgmt = (struct ieee80211_mgmt *) skb->data;
926 	fc = le16_to_cpu(mgmt->frame_control);
927 
928 	mutex_lock(&sdata->u.ibss.mtx);
929 
930 	if (!sdata->u.ibss.ssid_len)
931 		goto mgmt_out; /* not ready to merge yet */
932 
933 	switch (fc & IEEE80211_FCTL_STYPE) {
934 	case IEEE80211_STYPE_PROBE_REQ:
935 		ieee80211_rx_mgmt_probe_req(sdata, skb);
936 		break;
937 	case IEEE80211_STYPE_PROBE_RESP:
938 		ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
939 					     rx_status);
940 		break;
941 	case IEEE80211_STYPE_BEACON:
942 		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
943 					 rx_status);
944 		break;
945 	case IEEE80211_STYPE_AUTH:
946 		ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
947 		break;
948 	case IEEE80211_STYPE_DEAUTH:
949 		ieee80211_rx_mgmt_deauth_ibss(sdata, mgmt, skb->len);
950 		break;
951 	}
952 
953  mgmt_out:
954 	mutex_unlock(&sdata->u.ibss.mtx);
955 }
956 
957 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
958 {
959 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
960 	struct sta_info *sta;
961 
962 	mutex_lock(&ifibss->mtx);
963 
964 	/*
965 	 * Work could be scheduled after scan or similar
966 	 * when we aren't even joined (or trying) with a
967 	 * network.
968 	 */
969 	if (!ifibss->ssid_len)
970 		goto out;
971 
972 	spin_lock_bh(&ifibss->incomplete_lock);
973 	while (!list_empty(&ifibss->incomplete_stations)) {
974 		sta = list_first_entry(&ifibss->incomplete_stations,
975 				       struct sta_info, list);
976 		list_del(&sta->list);
977 		spin_unlock_bh(&ifibss->incomplete_lock);
978 
979 		ieee80211_ibss_finish_sta(sta, true);
980 		rcu_read_unlock();
981 		spin_lock_bh(&ifibss->incomplete_lock);
982 	}
983 	spin_unlock_bh(&ifibss->incomplete_lock);
984 
985 	switch (ifibss->state) {
986 	case IEEE80211_IBSS_MLME_SEARCH:
987 		ieee80211_sta_find_ibss(sdata);
988 		break;
989 	case IEEE80211_IBSS_MLME_JOINED:
990 		ieee80211_sta_merge_ibss(sdata);
991 		break;
992 	default:
993 		WARN_ON(1);
994 		break;
995 	}
996 
997  out:
998 	mutex_unlock(&ifibss->mtx);
999 }
1000 
1001 static void ieee80211_ibss_timer(unsigned long data)
1002 {
1003 	struct ieee80211_sub_if_data *sdata =
1004 		(struct ieee80211_sub_if_data *) data;
1005 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1006 	struct ieee80211_local *local = sdata->local;
1007 
1008 	if (local->quiescing) {
1009 		ifibss->timer_running = true;
1010 		return;
1011 	}
1012 
1013 	ieee80211_queue_work(&local->hw, &sdata->work);
1014 }
1015 
1016 #ifdef CONFIG_PM
1017 void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata)
1018 {
1019 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1020 
1021 	if (del_timer_sync(&ifibss->timer))
1022 		ifibss->timer_running = true;
1023 }
1024 
1025 void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata)
1026 {
1027 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1028 
1029 	if (ifibss->timer_running) {
1030 		add_timer(&ifibss->timer);
1031 		ifibss->timer_running = false;
1032 	}
1033 }
1034 #endif
1035 
1036 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
1037 {
1038 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1039 
1040 	setup_timer(&ifibss->timer, ieee80211_ibss_timer,
1041 		    (unsigned long) sdata);
1042 	mutex_init(&ifibss->mtx);
1043 	INIT_LIST_HEAD(&ifibss->incomplete_stations);
1044 	spin_lock_init(&ifibss->incomplete_lock);
1045 }
1046 
1047 /* scan finished notification */
1048 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
1049 {
1050 	struct ieee80211_sub_if_data *sdata;
1051 
1052 	mutex_lock(&local->iflist_mtx);
1053 	list_for_each_entry(sdata, &local->interfaces, list) {
1054 		if (!ieee80211_sdata_running(sdata))
1055 			continue;
1056 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
1057 			continue;
1058 		sdata->u.ibss.last_scan_completed = jiffies;
1059 		ieee80211_queue_work(&local->hw, &sdata->work);
1060 	}
1061 	mutex_unlock(&local->iflist_mtx);
1062 }
1063 
1064 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
1065 			struct cfg80211_ibss_params *params)
1066 {
1067 	struct sk_buff *skb;
1068 	u32 changed = 0;
1069 
1070 	skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
1071 			    sizeof(struct ieee80211_hdr_3addr) +
1072 			    12 /* struct ieee80211_mgmt.u.beacon */ +
1073 			    2 + IEEE80211_MAX_SSID_LEN /* max SSID */ +
1074 			    2 + 8 /* max Supported Rates */ +
1075 			    3 /* max DS params */ +
1076 			    4 /* IBSS params */ +
1077 			    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
1078 			    2 + sizeof(struct ieee80211_ht_cap) +
1079 			    2 + sizeof(struct ieee80211_ht_operation) +
1080 			    params->ie_len);
1081 	if (!skb)
1082 		return -ENOMEM;
1083 
1084 	mutex_lock(&sdata->u.ibss.mtx);
1085 
1086 	if (params->bssid) {
1087 		memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
1088 		sdata->u.ibss.fixed_bssid = true;
1089 	} else
1090 		sdata->u.ibss.fixed_bssid = false;
1091 
1092 	sdata->u.ibss.privacy = params->privacy;
1093 	sdata->u.ibss.control_port = params->control_port;
1094 	sdata->u.ibss.basic_rates = params->basic_rates;
1095 	memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
1096 	       sizeof(params->mcast_rate));
1097 
1098 	sdata->vif.bss_conf.beacon_int = params->beacon_interval;
1099 
1100 	sdata->u.ibss.channel = params->chandef.chan;
1101 	sdata->u.ibss.channel_type =
1102 		cfg80211_get_chandef_type(&params->chandef);
1103 	sdata->u.ibss.fixed_channel = params->channel_fixed;
1104 
1105 	if (params->ie) {
1106 		sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
1107 					   GFP_KERNEL);
1108 		if (sdata->u.ibss.ie)
1109 			sdata->u.ibss.ie_len = params->ie_len;
1110 	}
1111 
1112 	sdata->u.ibss.skb = skb;
1113 	sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
1114 	sdata->u.ibss.ibss_join_req = jiffies;
1115 
1116 	memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
1117 	sdata->u.ibss.ssid_len = params->ssid_len;
1118 
1119 	mutex_unlock(&sdata->u.ibss.mtx);
1120 
1121 	mutex_lock(&sdata->local->mtx);
1122 	ieee80211_recalc_idle(sdata->local);
1123 	mutex_unlock(&sdata->local->mtx);
1124 
1125 	/*
1126 	 * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
1127 	 * reserved, but an HT STA shall protect HT transmissions as though
1128 	 * the HT Protection field were set to non-HT mixed mode.
1129 	 *
1130 	 * In an IBSS, the RIFS Mode field of the HT Operation element is
1131 	 * also reserved, but an HT STA shall operate as though this field
1132 	 * were set to 1.
1133 	 */
1134 
1135 	sdata->vif.bss_conf.ht_operation_mode |=
1136 		  IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED
1137 		| IEEE80211_HT_PARAM_RIFS_MODE;
1138 
1139 	changed |= BSS_CHANGED_HT;
1140 	ieee80211_bss_info_change_notify(sdata, changed);
1141 
1142 	sdata->smps_mode = IEEE80211_SMPS_OFF;
1143 	sdata->needed_rx_chains = sdata->local->rx_chains;
1144 
1145 	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1146 
1147 	return 0;
1148 }
1149 
1150 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
1151 {
1152 	struct sk_buff *skb;
1153 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1154 	struct ieee80211_local *local = sdata->local;
1155 	struct cfg80211_bss *cbss;
1156 	u16 capability;
1157 	int active_ibss;
1158 	struct sta_info *sta;
1159 
1160 	mutex_lock(&sdata->u.ibss.mtx);
1161 
1162 	active_ibss = ieee80211_sta_active_ibss(sdata);
1163 
1164 	if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
1165 		capability = WLAN_CAPABILITY_IBSS;
1166 
1167 		if (ifibss->privacy)
1168 			capability |= WLAN_CAPABILITY_PRIVACY;
1169 
1170 		cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->channel,
1171 					ifibss->bssid, ifibss->ssid,
1172 					ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
1173 					WLAN_CAPABILITY_PRIVACY,
1174 					capability);
1175 
1176 		if (cbss) {
1177 			cfg80211_unlink_bss(local->hw.wiphy, cbss);
1178 			cfg80211_put_bss(cbss);
1179 		}
1180 	}
1181 
1182 	ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
1183 	memset(ifibss->bssid, 0, ETH_ALEN);
1184 	ifibss->ssid_len = 0;
1185 
1186 	sta_info_flush(sdata->local, sdata);
1187 
1188 	spin_lock_bh(&ifibss->incomplete_lock);
1189 	while (!list_empty(&ifibss->incomplete_stations)) {
1190 		sta = list_first_entry(&ifibss->incomplete_stations,
1191 				       struct sta_info, list);
1192 		list_del(&sta->list);
1193 		spin_unlock_bh(&ifibss->incomplete_lock);
1194 
1195 		sta_info_free(local, sta);
1196 		spin_lock_bh(&ifibss->incomplete_lock);
1197 	}
1198 	spin_unlock_bh(&ifibss->incomplete_lock);
1199 
1200 	netif_carrier_off(sdata->dev);
1201 
1202 	/* remove beacon */
1203 	kfree(sdata->u.ibss.ie);
1204 	skb = rcu_dereference_protected(sdata->u.ibss.presp,
1205 					lockdep_is_held(&sdata->u.ibss.mtx));
1206 	RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
1207 	sdata->vif.bss_conf.ibss_joined = false;
1208 	sdata->vif.bss_conf.ibss_creator = false;
1209 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
1210 						BSS_CHANGED_IBSS);
1211 	synchronize_rcu();
1212 	kfree_skb(skb);
1213 
1214 	skb_queue_purge(&sdata->skb_queue);
1215 
1216 	del_timer_sync(&sdata->u.ibss.timer);
1217 
1218 	mutex_unlock(&sdata->u.ibss.mtx);
1219 
1220 	mutex_lock(&local->mtx);
1221 	ieee80211_recalc_idle(sdata->local);
1222 	mutex_unlock(&local->mtx);
1223 
1224 	return 0;
1225 }
1226