xref: /linux/net/mac80211/ibss.c (revision d39d0ed196aa1685bb24771e92f78633c66ac9cb)
1 /*
2  * IBSS mode implementation
3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4  * Copyright 2004, Instant802 Networks, Inc.
5  * Copyright 2005, Devicescape Software, Inc.
6  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8  * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2 as
12  * published by the Free Software Foundation.
13  */
14 
15 #include <linux/delay.h>
16 #include <linux/slab.h>
17 #include <linux/if_ether.h>
18 #include <linux/skbuff.h>
19 #include <linux/if_arp.h>
20 #include <linux/etherdevice.h>
21 #include <linux/rtnetlink.h>
22 #include <net/mac80211.h>
23 #include <asm/unaligned.h>
24 
25 #include "ieee80211_i.h"
26 #include "driver-ops.h"
27 #include "rate.h"
28 
29 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
30 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
31 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
32 
33 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
34 #define IEEE80211_IBSS_MERGE_DELAY 0x400000
35 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
36 
37 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
38 
39 
40 static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
41 					struct ieee80211_mgmt *mgmt,
42 					size_t len)
43 {
44 	u16 auth_alg, auth_transaction, status_code;
45 
46 	lockdep_assert_held(&sdata->u.ibss.mtx);
47 
48 	if (len < 24 + 6)
49 		return;
50 
51 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
52 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
53 	status_code = le16_to_cpu(mgmt->u.auth.status_code);
54 
55 	/*
56 	 * IEEE 802.11 standard does not require authentication in IBSS
57 	 * networks and most implementations do not seem to use it.
58 	 * However, try to reply to authentication attempts if someone
59 	 * has actually implemented this.
60 	 */
61 	if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
62 		ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, NULL, 0,
63 				    sdata->u.ibss.bssid, NULL, 0, 0);
64 }
65 
66 static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
67 				      const u8 *bssid, const int beacon_int,
68 				      struct ieee80211_channel *chan,
69 				      const u32 basic_rates,
70 				      const u16 capability, u64 tsf)
71 {
72 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
73 	struct ieee80211_local *local = sdata->local;
74 	int rates, i;
75 	struct sk_buff *skb;
76 	struct ieee80211_mgmt *mgmt;
77 	u8 *pos;
78 	struct ieee80211_supported_band *sband;
79 	struct cfg80211_bss *bss;
80 	u32 bss_change;
81 	u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
82 
83 	lockdep_assert_held(&ifibss->mtx);
84 
85 	/* Reset own TSF to allow time synchronization work. */
86 	drv_reset_tsf(local);
87 
88 	skb = ifibss->skb;
89 	rcu_assign_pointer(ifibss->presp, NULL);
90 	synchronize_rcu();
91 	skb->data = skb->head;
92 	skb->len = 0;
93 	skb_reset_tail_pointer(skb);
94 	skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
95 
96 	if (memcmp(ifibss->bssid, bssid, ETH_ALEN))
97 		sta_info_flush(sdata->local, sdata);
98 
99 	/* if merging, indicate to driver that we leave the old IBSS */
100 	if (sdata->vif.bss_conf.ibss_joined) {
101 		sdata->vif.bss_conf.ibss_joined = false;
102 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IBSS);
103 	}
104 
105 	memcpy(ifibss->bssid, bssid, ETH_ALEN);
106 
107 	sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
108 
109 	local->oper_channel = chan;
110 	WARN_ON(!ieee80211_set_channel_type(local, sdata, NL80211_CHAN_NO_HT));
111 	ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
112 
113 	sband = local->hw.wiphy->bands[chan->band];
114 
115 	/* build supported rates array */
116 	pos = supp_rates;
117 	for (i = 0; i < sband->n_bitrates; i++) {
118 		int rate = sband->bitrates[i].bitrate;
119 		u8 basic = 0;
120 		if (basic_rates & BIT(i))
121 			basic = 0x80;
122 		*pos++ = basic | (u8) (rate / 5);
123 	}
124 
125 	/* Build IBSS probe response */
126 	mgmt = (void *) skb_put(skb, 24 + sizeof(mgmt->u.beacon));
127 	memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
128 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
129 					  IEEE80211_STYPE_PROBE_RESP);
130 	memset(mgmt->da, 0xff, ETH_ALEN);
131 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
132 	memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
133 	mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
134 	mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
135 	mgmt->u.beacon.capab_info = cpu_to_le16(capability);
136 
137 	pos = skb_put(skb, 2 + ifibss->ssid_len);
138 	*pos++ = WLAN_EID_SSID;
139 	*pos++ = ifibss->ssid_len;
140 	memcpy(pos, ifibss->ssid, ifibss->ssid_len);
141 
142 	rates = sband->n_bitrates;
143 	if (rates > 8)
144 		rates = 8;
145 	pos = skb_put(skb, 2 + rates);
146 	*pos++ = WLAN_EID_SUPP_RATES;
147 	*pos++ = rates;
148 	memcpy(pos, supp_rates, rates);
149 
150 	if (sband->band == IEEE80211_BAND_2GHZ) {
151 		pos = skb_put(skb, 2 + 1);
152 		*pos++ = WLAN_EID_DS_PARAMS;
153 		*pos++ = 1;
154 		*pos++ = ieee80211_frequency_to_channel(chan->center_freq);
155 	}
156 
157 	pos = skb_put(skb, 2 + 2);
158 	*pos++ = WLAN_EID_IBSS_PARAMS;
159 	*pos++ = 2;
160 	/* FIX: set ATIM window based on scan results */
161 	*pos++ = 0;
162 	*pos++ = 0;
163 
164 	if (sband->n_bitrates > 8) {
165 		rates = sband->n_bitrates - 8;
166 		pos = skb_put(skb, 2 + rates);
167 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
168 		*pos++ = rates;
169 		memcpy(pos, &supp_rates[8], rates);
170 	}
171 
172 	if (ifibss->ie_len)
173 		memcpy(skb_put(skb, ifibss->ie_len),
174 		       ifibss->ie, ifibss->ie_len);
175 
176 	rcu_assign_pointer(ifibss->presp, skb);
177 
178 	sdata->vif.bss_conf.beacon_int = beacon_int;
179 	sdata->vif.bss_conf.basic_rates = basic_rates;
180 	bss_change = BSS_CHANGED_BEACON_INT;
181 	bss_change |= ieee80211_reset_erp_info(sdata);
182 	bss_change |= BSS_CHANGED_BSSID;
183 	bss_change |= BSS_CHANGED_BEACON;
184 	bss_change |= BSS_CHANGED_BEACON_ENABLED;
185 	bss_change |= BSS_CHANGED_BASIC_RATES;
186 	bss_change |= BSS_CHANGED_IBSS;
187 	sdata->vif.bss_conf.ibss_joined = true;
188 	ieee80211_bss_info_change_notify(sdata, bss_change);
189 
190 	ieee80211_sta_def_wmm_params(sdata, sband->n_bitrates, supp_rates);
191 
192 	ifibss->state = IEEE80211_IBSS_MLME_JOINED;
193 	mod_timer(&ifibss->timer,
194 		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
195 
196 	bss = cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
197 					mgmt, skb->len, 0, GFP_KERNEL);
198 	cfg80211_put_bss(bss);
199 	cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
200 }
201 
202 static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
203 				    struct ieee80211_bss *bss)
204 {
205 	struct cfg80211_bss *cbss =
206 		container_of((void *)bss, struct cfg80211_bss, priv);
207 	struct ieee80211_supported_band *sband;
208 	u32 basic_rates;
209 	int i, j;
210 	u16 beacon_int = cbss->beacon_interval;
211 
212 	lockdep_assert_held(&sdata->u.ibss.mtx);
213 
214 	if (beacon_int < 10)
215 		beacon_int = 10;
216 
217 	sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
218 
219 	basic_rates = 0;
220 
221 	for (i = 0; i < bss->supp_rates_len; i++) {
222 		int rate = (bss->supp_rates[i] & 0x7f) * 5;
223 		bool is_basic = !!(bss->supp_rates[i] & 0x80);
224 
225 		for (j = 0; j < sband->n_bitrates; j++) {
226 			if (sband->bitrates[j].bitrate == rate) {
227 				if (is_basic)
228 					basic_rates |= BIT(j);
229 				break;
230 			}
231 		}
232 	}
233 
234 	__ieee80211_sta_join_ibss(sdata, cbss->bssid,
235 				  beacon_int,
236 				  cbss->channel,
237 				  basic_rates,
238 				  cbss->capability,
239 				  cbss->tsf);
240 }
241 
242 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
243 				  struct ieee80211_mgmt *mgmt,
244 				  size_t len,
245 				  struct ieee80211_rx_status *rx_status,
246 				  struct ieee802_11_elems *elems,
247 				  bool beacon)
248 {
249 	struct ieee80211_local *local = sdata->local;
250 	int freq;
251 	struct cfg80211_bss *cbss;
252 	struct ieee80211_bss *bss;
253 	struct sta_info *sta;
254 	struct ieee80211_channel *channel;
255 	u64 beacon_timestamp, rx_timestamp;
256 	u32 supp_rates = 0;
257 	enum ieee80211_band band = rx_status->band;
258 
259 	if (elems->ds_params && elems->ds_params_len == 1)
260 		freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
261 	else
262 		freq = rx_status->freq;
263 
264 	channel = ieee80211_get_channel(local->hw.wiphy, freq);
265 
266 	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
267 		return;
268 
269 	if (sdata->vif.type == NL80211_IFTYPE_ADHOC && elems->supp_rates &&
270 	    memcmp(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0) {
271 		supp_rates = ieee80211_sta_get_rates(local, elems, band);
272 
273 		rcu_read_lock();
274 
275 		sta = sta_info_get(sdata, mgmt->sa);
276 		if (sta) {
277 			u32 prev_rates;
278 
279 			prev_rates = sta->sta.supp_rates[band];
280 			/* make sure mandatory rates are always added */
281 			sta->sta.supp_rates[band] = supp_rates |
282 				ieee80211_mandatory_rates(local, band);
283 
284 			if (sta->sta.supp_rates[band] != prev_rates) {
285 #ifdef CONFIG_MAC80211_IBSS_DEBUG
286 				printk(KERN_DEBUG "%s: updated supp_rates set "
287 				    "for %pM based on beacon/probe_response "
288 				    "(0x%x -> 0x%x)\n",
289 				    sdata->name, sta->sta.addr,
290 				    prev_rates, sta->sta.supp_rates[band]);
291 #endif
292 				rate_control_rate_init(sta);
293 			}
294 			rcu_read_unlock();
295 		} else {
296 			rcu_read_unlock();
297 			ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
298 					       supp_rates, GFP_KERNEL);
299 		}
300 	}
301 
302 	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
303 					channel, beacon);
304 	if (!bss)
305 		return;
306 
307 	cbss = container_of((void *)bss, struct cfg80211_bss, priv);
308 
309 	/* was just updated in ieee80211_bss_info_update */
310 	beacon_timestamp = cbss->tsf;
311 
312 	/* check if we need to merge IBSS */
313 
314 	/* we use a fixed BSSID */
315 	if (sdata->u.ibss.fixed_bssid)
316 		goto put_bss;
317 
318 	/* not an IBSS */
319 	if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
320 		goto put_bss;
321 
322 	/* different channel */
323 	if (cbss->channel != local->oper_channel)
324 		goto put_bss;
325 
326 	/* different SSID */
327 	if (elems->ssid_len != sdata->u.ibss.ssid_len ||
328 	    memcmp(elems->ssid, sdata->u.ibss.ssid,
329 				sdata->u.ibss.ssid_len))
330 		goto put_bss;
331 
332 	/* same BSSID */
333 	if (memcmp(cbss->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
334 		goto put_bss;
335 
336 	if (rx_status->flag & RX_FLAG_TSFT) {
337 		/*
338 		 * For correct IBSS merging we need mactime; since mactime is
339 		 * defined as the time the first data symbol of the frame hits
340 		 * the PHY, and the timestamp of the beacon is defined as "the
341 		 * time that the data symbol containing the first bit of the
342 		 * timestamp is transmitted to the PHY plus the transmitting
343 		 * STA's delays through its local PHY from the MAC-PHY
344 		 * interface to its interface with the WM" (802.11 11.1.2)
345 		 * - equals the time this bit arrives at the receiver - we have
346 		 * to take into account the offset between the two.
347 		 *
348 		 * E.g. at 1 MBit that means mactime is 192 usec earlier
349 		 * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
350 		 */
351 		int rate;
352 
353 		if (rx_status->flag & RX_FLAG_HT)
354 			rate = 65; /* TODO: HT rates */
355 		else
356 			rate = local->hw.wiphy->bands[band]->
357 				bitrates[rx_status->rate_idx].bitrate;
358 
359 		rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
360 	} else {
361 		/*
362 		 * second best option: get current TSF
363 		 * (will return -1 if not supported)
364 		 */
365 		rx_timestamp = drv_get_tsf(local);
366 	}
367 
368 #ifdef CONFIG_MAC80211_IBSS_DEBUG
369 	printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
370 	       "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
371 	       mgmt->sa, mgmt->bssid,
372 	       (unsigned long long)rx_timestamp,
373 	       (unsigned long long)beacon_timestamp,
374 	       (unsigned long long)(rx_timestamp - beacon_timestamp),
375 	       jiffies);
376 #endif
377 
378 	/* give slow hardware some time to do the TSF sync */
379 	if (rx_timestamp < IEEE80211_IBSS_MERGE_DELAY)
380 		goto put_bss;
381 
382 	if (beacon_timestamp > rx_timestamp) {
383 #ifdef CONFIG_MAC80211_IBSS_DEBUG
384 		printk(KERN_DEBUG "%s: beacon TSF higher than "
385 		       "local TSF - IBSS merge with BSSID %pM\n",
386 		       sdata->name, mgmt->bssid);
387 #endif
388 		ieee80211_sta_join_ibss(sdata, bss);
389 		supp_rates = ieee80211_sta_get_rates(local, elems, band);
390 		ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
391 				       supp_rates, GFP_KERNEL);
392 	}
393 
394  put_bss:
395 	ieee80211_rx_bss_put(local, bss);
396 }
397 
398 /*
399  * Add a new IBSS station, will also be called by the RX code when,
400  * in IBSS mode, receiving a frame from a yet-unknown station, hence
401  * must be callable in atomic context.
402  */
403 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
404 					u8 *bssid,u8 *addr, u32 supp_rates,
405 					gfp_t gfp)
406 {
407 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
408 	struct ieee80211_local *local = sdata->local;
409 	struct sta_info *sta;
410 	int band = local->hw.conf.channel->band;
411 
412 	/*
413 	 * XXX: Consider removing the least recently used entry and
414 	 * 	allow new one to be added.
415 	 */
416 	if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
417 		if (net_ratelimit())
418 			printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
419 			       sdata->name, addr);
420 		return NULL;
421 	}
422 
423 	if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
424 		return NULL;
425 
426 	if (compare_ether_addr(bssid, sdata->u.ibss.bssid))
427 		return NULL;
428 
429 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
430 	printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
431 	       wiphy_name(local->hw.wiphy), addr, sdata->name);
432 #endif
433 
434 	sta = sta_info_alloc(sdata, addr, gfp);
435 	if (!sta)
436 		return NULL;
437 
438 	set_sta_flags(sta, WLAN_STA_AUTHORIZED);
439 
440 	/* make sure mandatory rates are always added */
441 	sta->sta.supp_rates[band] = supp_rates |
442 			ieee80211_mandatory_rates(local, band);
443 
444 	rate_control_rate_init(sta);
445 
446 	/* If it fails, maybe we raced another insertion? */
447 	if (sta_info_insert(sta))
448 		return sta_info_get(sdata, addr);
449 	return sta;
450 }
451 
452 static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
453 {
454 	struct ieee80211_local *local = sdata->local;
455 	int active = 0;
456 	struct sta_info *sta;
457 
458 	lockdep_assert_held(&sdata->u.ibss.mtx);
459 
460 	rcu_read_lock();
461 
462 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
463 		if (sta->sdata == sdata &&
464 		    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
465 			       jiffies)) {
466 			active++;
467 			break;
468 		}
469 	}
470 
471 	rcu_read_unlock();
472 
473 	return active;
474 }
475 
476 /*
477  * This function is called with state == IEEE80211_IBSS_MLME_JOINED
478  */
479 
480 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
481 {
482 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
483 
484 	lockdep_assert_held(&ifibss->mtx);
485 
486 	mod_timer(&ifibss->timer,
487 		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
488 
489 	ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
490 
491 	if (time_before(jiffies, ifibss->last_scan_completed +
492 		       IEEE80211_IBSS_MERGE_INTERVAL))
493 		return;
494 
495 	if (ieee80211_sta_active_ibss(sdata))
496 		return;
497 
498 	if (ifibss->fixed_channel)
499 		return;
500 
501 	printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
502 	       "IBSS networks with same SSID (merge)\n", sdata->name);
503 
504 	ieee80211_request_internal_scan(sdata,
505 			ifibss->ssid, ifibss->ssid_len,
506 			ifibss->fixed_channel ? ifibss->channel : NULL);
507 }
508 
509 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
510 {
511 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
512 	struct ieee80211_local *local = sdata->local;
513 	struct ieee80211_supported_band *sband;
514 	u8 bssid[ETH_ALEN];
515 	u16 capability;
516 	int i;
517 
518 	lockdep_assert_held(&ifibss->mtx);
519 
520 	if (ifibss->fixed_bssid) {
521 		memcpy(bssid, ifibss->bssid, ETH_ALEN);
522 	} else {
523 		/* Generate random, not broadcast, locally administered BSSID. Mix in
524 		 * own MAC address to make sure that devices that do not have proper
525 		 * random number generator get different BSSID. */
526 		get_random_bytes(bssid, ETH_ALEN);
527 		for (i = 0; i < ETH_ALEN; i++)
528 			bssid[i] ^= sdata->vif.addr[i];
529 		bssid[0] &= ~0x01;
530 		bssid[0] |= 0x02;
531 	}
532 
533 	printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
534 	       sdata->name, bssid);
535 
536 	sband = local->hw.wiphy->bands[ifibss->channel->band];
537 
538 	capability = WLAN_CAPABILITY_IBSS;
539 
540 	if (ifibss->privacy)
541 		capability |= WLAN_CAPABILITY_PRIVACY;
542 	else
543 		sdata->drop_unencrypted = 0;
544 
545 	__ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
546 				  ifibss->channel, ifibss->basic_rates,
547 				  capability, 0);
548 }
549 
550 /*
551  * This function is called with state == IEEE80211_IBSS_MLME_SEARCH
552  */
553 
554 static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
555 {
556 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
557 	struct ieee80211_local *local = sdata->local;
558 	struct cfg80211_bss *cbss;
559 	struct ieee80211_channel *chan = NULL;
560 	const u8 *bssid = NULL;
561 	int active_ibss;
562 	u16 capability;
563 
564 	lockdep_assert_held(&ifibss->mtx);
565 
566 	active_ibss = ieee80211_sta_active_ibss(sdata);
567 #ifdef CONFIG_MAC80211_IBSS_DEBUG
568 	printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
569 	       sdata->name, active_ibss);
570 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
571 
572 	if (active_ibss)
573 		return;
574 
575 	capability = WLAN_CAPABILITY_IBSS;
576 	if (ifibss->privacy)
577 		capability |= WLAN_CAPABILITY_PRIVACY;
578 	if (ifibss->fixed_bssid)
579 		bssid = ifibss->bssid;
580 	if (ifibss->fixed_channel)
581 		chan = ifibss->channel;
582 	if (!is_zero_ether_addr(ifibss->bssid))
583 		bssid = ifibss->bssid;
584 	cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
585 				ifibss->ssid, ifibss->ssid_len,
586 				WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_PRIVACY,
587 				capability);
588 
589 	if (cbss) {
590 		struct ieee80211_bss *bss;
591 
592 		bss = (void *)cbss->priv;
593 #ifdef CONFIG_MAC80211_IBSS_DEBUG
594 		printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
595 		       "%pM\n", cbss->bssid, ifibss->bssid);
596 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
597 
598 		printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
599 		       " based on configured SSID\n",
600 		       sdata->name, cbss->bssid);
601 
602 		ieee80211_sta_join_ibss(sdata, bss);
603 		ieee80211_rx_bss_put(local, bss);
604 		return;
605 	}
606 
607 #ifdef CONFIG_MAC80211_IBSS_DEBUG
608 	printk(KERN_DEBUG "   did not try to join ibss\n");
609 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
610 
611 	/* Selected IBSS not found in current scan results - try to scan */
612 	if (time_after(jiffies, ifibss->last_scan_completed +
613 					IEEE80211_SCAN_INTERVAL)) {
614 		printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
615 		       "join\n", sdata->name);
616 
617 		ieee80211_request_internal_scan(sdata,
618 				ifibss->ssid, ifibss->ssid_len,
619 				ifibss->fixed_channel ? ifibss->channel : NULL);
620 	} else {
621 		int interval = IEEE80211_SCAN_INTERVAL;
622 
623 		if (time_after(jiffies, ifibss->ibss_join_req +
624 			       IEEE80211_IBSS_JOIN_TIMEOUT)) {
625 			if (!(local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)) {
626 				ieee80211_sta_create_ibss(sdata);
627 				return;
628 			}
629 			printk(KERN_DEBUG "%s: IBSS not allowed on"
630 			       " %d MHz\n", sdata->name,
631 			       local->hw.conf.channel->center_freq);
632 
633 			/* No IBSS found - decrease scan interval and continue
634 			 * scanning. */
635 			interval = IEEE80211_SCAN_INTERVAL_SLOW;
636 		}
637 
638 		mod_timer(&ifibss->timer,
639 			  round_jiffies(jiffies + interval));
640 	}
641 }
642 
643 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
644 					struct ieee80211_mgmt *mgmt,
645 					size_t len)
646 {
647 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
648 	struct ieee80211_local *local = sdata->local;
649 	int tx_last_beacon;
650 	struct sk_buff *skb;
651 	struct ieee80211_mgmt *resp;
652 	u8 *pos, *end;
653 
654 	lockdep_assert_held(&ifibss->mtx);
655 
656 	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
657 	    len < 24 + 2 || !ifibss->presp)
658 		return;
659 
660 	tx_last_beacon = drv_tx_last_beacon(local);
661 
662 #ifdef CONFIG_MAC80211_IBSS_DEBUG
663 	printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
664 	       " (tx_last_beacon=%d)\n",
665 	       sdata->name, mgmt->sa, mgmt->da,
666 	       mgmt->bssid, tx_last_beacon);
667 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
668 
669 	if (!tx_last_beacon)
670 		return;
671 
672 	if (memcmp(mgmt->bssid, ifibss->bssid, ETH_ALEN) != 0 &&
673 	    memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
674 		return;
675 
676 	end = ((u8 *) mgmt) + len;
677 	pos = mgmt->u.probe_req.variable;
678 	if (pos[0] != WLAN_EID_SSID ||
679 	    pos + 2 + pos[1] > end) {
680 #ifdef CONFIG_MAC80211_IBSS_DEBUG
681 		printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
682 		       "from %pM\n",
683 		       sdata->name, mgmt->sa);
684 #endif
685 		return;
686 	}
687 	if (pos[1] != 0 &&
688 	    (pos[1] != ifibss->ssid_len ||
689 	     memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
690 		/* Ignore ProbeReq for foreign SSID */
691 		return;
692 	}
693 
694 	/* Reply with ProbeResp */
695 	skb = skb_copy(ifibss->presp, GFP_KERNEL);
696 	if (!skb)
697 		return;
698 
699 	resp = (struct ieee80211_mgmt *) skb->data;
700 	memcpy(resp->da, mgmt->sa, ETH_ALEN);
701 #ifdef CONFIG_MAC80211_IBSS_DEBUG
702 	printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
703 	       sdata->name, resp->da);
704 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
705 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
706 	ieee80211_tx_skb(sdata, skb);
707 }
708 
709 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
710 					 struct ieee80211_mgmt *mgmt,
711 					 size_t len,
712 					 struct ieee80211_rx_status *rx_status)
713 {
714 	size_t baselen;
715 	struct ieee802_11_elems elems;
716 
717 	if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
718 		return; /* ignore ProbeResp to foreign address */
719 
720 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
721 	if (baselen > len)
722 		return;
723 
724 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
725 				&elems);
726 
727 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
728 }
729 
730 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
731 				     struct ieee80211_mgmt *mgmt,
732 				     size_t len,
733 				     struct ieee80211_rx_status *rx_status)
734 {
735 	size_t baselen;
736 	struct ieee802_11_elems elems;
737 
738 	/* Process beacon from the current BSS */
739 	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
740 	if (baselen > len)
741 		return;
742 
743 	ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
744 
745 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
746 }
747 
748 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
749 				   struct sk_buff *skb)
750 {
751 	struct ieee80211_rx_status *rx_status;
752 	struct ieee80211_mgmt *mgmt;
753 	u16 fc;
754 
755 	rx_status = IEEE80211_SKB_RXCB(skb);
756 	mgmt = (struct ieee80211_mgmt *) skb->data;
757 	fc = le16_to_cpu(mgmt->frame_control);
758 
759 	mutex_lock(&sdata->u.ibss.mtx);
760 
761 	switch (fc & IEEE80211_FCTL_STYPE) {
762 	case IEEE80211_STYPE_PROBE_REQ:
763 		ieee80211_rx_mgmt_probe_req(sdata, mgmt, skb->len);
764 		break;
765 	case IEEE80211_STYPE_PROBE_RESP:
766 		ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
767 					     rx_status);
768 		break;
769 	case IEEE80211_STYPE_BEACON:
770 		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
771 					 rx_status);
772 		break;
773 	case IEEE80211_STYPE_AUTH:
774 		ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
775 		break;
776 	}
777 
778 	mutex_unlock(&sdata->u.ibss.mtx);
779 }
780 
781 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
782 {
783 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
784 
785 	mutex_lock(&ifibss->mtx);
786 
787 	/*
788 	 * Work could be scheduled after scan or similar
789 	 * when we aren't even joined (or trying) with a
790 	 * network.
791 	 */
792 	if (!ifibss->ssid_len)
793 		goto out;
794 
795 	switch (ifibss->state) {
796 	case IEEE80211_IBSS_MLME_SEARCH:
797 		ieee80211_sta_find_ibss(sdata);
798 		break;
799 	case IEEE80211_IBSS_MLME_JOINED:
800 		ieee80211_sta_merge_ibss(sdata);
801 		break;
802 	default:
803 		WARN_ON(1);
804 		break;
805 	}
806 
807  out:
808 	mutex_unlock(&ifibss->mtx);
809 }
810 
811 static void ieee80211_ibss_timer(unsigned long data)
812 {
813 	struct ieee80211_sub_if_data *sdata =
814 		(struct ieee80211_sub_if_data *) data;
815 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
816 	struct ieee80211_local *local = sdata->local;
817 
818 	if (local->quiescing) {
819 		ifibss->timer_running = true;
820 		return;
821 	}
822 
823 	ieee80211_queue_work(&local->hw, &sdata->work);
824 }
825 
826 #ifdef CONFIG_PM
827 void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata)
828 {
829 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
830 
831 	if (del_timer_sync(&ifibss->timer))
832 		ifibss->timer_running = true;
833 }
834 
835 void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata)
836 {
837 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
838 
839 	if (ifibss->timer_running) {
840 		add_timer(&ifibss->timer);
841 		ifibss->timer_running = false;
842 	}
843 }
844 #endif
845 
846 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
847 {
848 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
849 
850 	setup_timer(&ifibss->timer, ieee80211_ibss_timer,
851 		    (unsigned long) sdata);
852 	mutex_init(&ifibss->mtx);
853 }
854 
855 /* scan finished notification */
856 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
857 {
858 	struct ieee80211_sub_if_data *sdata;
859 
860 	mutex_lock(&local->iflist_mtx);
861 	list_for_each_entry(sdata, &local->interfaces, list) {
862 		if (!ieee80211_sdata_running(sdata))
863 			continue;
864 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
865 			continue;
866 		sdata->u.ibss.last_scan_completed = jiffies;
867 		ieee80211_queue_work(&local->hw, &sdata->work);
868 	}
869 	mutex_unlock(&local->iflist_mtx);
870 }
871 
872 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
873 			struct cfg80211_ibss_params *params)
874 {
875 	struct sk_buff *skb;
876 
877 	skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
878 			    36 /* bitrates */ +
879 			    34 /* SSID */ +
880 			    3  /* DS params */ +
881 			    4  /* IBSS params */ +
882 			    params->ie_len);
883 	if (!skb)
884 		return -ENOMEM;
885 
886 	mutex_lock(&sdata->u.ibss.mtx);
887 
888 	if (params->bssid) {
889 		memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
890 		sdata->u.ibss.fixed_bssid = true;
891 	} else
892 		sdata->u.ibss.fixed_bssid = false;
893 
894 	sdata->u.ibss.privacy = params->privacy;
895 	sdata->u.ibss.basic_rates = params->basic_rates;
896 
897 	sdata->vif.bss_conf.beacon_int = params->beacon_interval;
898 
899 	sdata->u.ibss.channel = params->channel;
900 	sdata->u.ibss.fixed_channel = params->channel_fixed;
901 
902 	/* fix ourselves to that channel now already */
903 	if (params->channel_fixed) {
904 		sdata->local->oper_channel = params->channel;
905 		WARN_ON(!ieee80211_set_channel_type(sdata->local, sdata,
906 						    NL80211_CHAN_NO_HT));
907 	}
908 
909 	if (params->ie) {
910 		sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
911 					   GFP_KERNEL);
912 		if (sdata->u.ibss.ie)
913 			sdata->u.ibss.ie_len = params->ie_len;
914 	}
915 
916 	sdata->u.ibss.skb = skb;
917 	sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
918 	sdata->u.ibss.ibss_join_req = jiffies;
919 
920 	memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
921 	sdata->u.ibss.ssid_len = params->ssid_len;
922 
923 	ieee80211_recalc_idle(sdata->local);
924 
925 	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
926 
927 	mutex_unlock(&sdata->u.ibss.mtx);
928 
929 	return 0;
930 }
931 
932 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
933 {
934 	struct sk_buff *skb;
935 	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
936 	struct ieee80211_local *local = sdata->local;
937 	struct cfg80211_bss *cbss;
938 	u16 capability;
939 	int active_ibss;
940 
941 	mutex_lock(&sdata->u.ibss.mtx);
942 
943 	active_ibss = ieee80211_sta_active_ibss(sdata);
944 
945 	if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
946 		capability = WLAN_CAPABILITY_IBSS;
947 
948 		if (ifibss->privacy)
949 			capability |= WLAN_CAPABILITY_PRIVACY;
950 
951 		cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->channel,
952 					ifibss->bssid, ifibss->ssid,
953 					ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
954 					WLAN_CAPABILITY_PRIVACY,
955 					capability);
956 
957 		if (cbss) {
958 			cfg80211_unlink_bss(local->hw.wiphy, cbss);
959 			cfg80211_put_bss(cbss);
960 		}
961 	}
962 
963 	sta_info_flush(sdata->local, sdata);
964 
965 	/* remove beacon */
966 	kfree(sdata->u.ibss.ie);
967 	skb = sdata->u.ibss.presp;
968 	rcu_assign_pointer(sdata->u.ibss.presp, NULL);
969 	sdata->vif.bss_conf.ibss_joined = false;
970 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
971 						BSS_CHANGED_IBSS);
972 	synchronize_rcu();
973 	kfree_skb(skb);
974 
975 	skb_queue_purge(&sdata->skb_queue);
976 	memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
977 	sdata->u.ibss.ssid_len = 0;
978 
979 	del_timer_sync(&sdata->u.ibss.timer);
980 
981 	mutex_unlock(&sdata->u.ibss.mtx);
982 
983 	ieee80211_recalc_idle(sdata->local);
984 
985 	return 0;
986 }
987