1 /*
2 * Intersil Prism2 driver with Host AP (software access point) support
3 * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
4 * <j@w1.fi>
5 * Copyright (c) 2002-2005, Jouni Malinen <j@w1.fi>
6 *
7 * This file is to be included into hostap.c when S/W AP functionality is
8 * compiled.
9 *
10 * AP: FIX:
11 * - if unicast Class 2 (assoc,reassoc,disassoc) frame received from
12 * unauthenticated STA, send deauth. frame (8802.11: 5.5)
13 * - if unicast Class 3 (data with to/from DS,deauth,pspoll) frame received
14 * from authenticated, but unassoc STA, send disassoc frame (8802.11: 5.5)
15 * - if unicast Class 3 received from unauthenticated STA, send deauth. frame
16 * (8802.11: 5.5)
17 */
18
19 #include <linux/proc_fs.h>
20 #include <linux/delay.h>
21 #include <linux/random.h>
22
23 #include "hostap_wlan.h"
24 #include "hostap.h"
25 #include "hostap_ap.h"
26
27 static int other_ap_policy[MAX_PARM_DEVICES] = { AP_OTHER_AP_SKIP_ALL,
28 DEF_INTS };
29 module_param_array(other_ap_policy, int, NULL, 0444);
30 MODULE_PARM_DESC(other_ap_policy, "Other AP beacon monitoring policy (0-3)");
31
32 static int ap_max_inactivity[MAX_PARM_DEVICES] = { AP_MAX_INACTIVITY_SEC,
33 DEF_INTS };
34 module_param_array(ap_max_inactivity, int, NULL, 0444);
35 MODULE_PARM_DESC(ap_max_inactivity, "AP timeout (in seconds) for station "
36 "inactivity");
37
38 static int ap_bridge_packets[MAX_PARM_DEVICES] = { 1, DEF_INTS };
39 module_param_array(ap_bridge_packets, int, NULL, 0444);
40 MODULE_PARM_DESC(ap_bridge_packets, "Bridge packets directly between "
41 "stations");
42
43 static int autom_ap_wds[MAX_PARM_DEVICES] = { 0, DEF_INTS };
44 module_param_array(autom_ap_wds, int, NULL, 0444);
45 MODULE_PARM_DESC(autom_ap_wds, "Add WDS connections to other APs "
46 "automatically");
47
48
49 static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta);
50 static void hostap_event_expired_sta(struct net_device *dev,
51 struct sta_info *sta);
52 static void handle_add_proc_queue(struct work_struct *work);
53
54 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
55 static void handle_wds_oper_queue(struct work_struct *work);
56 static void prism2_send_mgmt(struct net_device *dev,
57 u16 type_subtype, char *body,
58 int body_len, u8 *addr, u16 tx_cb_idx);
59 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
60
61
62 #ifndef PRISM2_NO_PROCFS_DEBUG
ap_debug_proc_read(char * page,char ** start,off_t off,int count,int * eof,void * data)63 static int ap_debug_proc_read(char *page, char **start, off_t off,
64 int count, int *eof, void *data)
65 {
66 char *p = page;
67 struct ap_data *ap = (struct ap_data *) data;
68
69 if (off != 0) {
70 *eof = 1;
71 return 0;
72 }
73
74 p += sprintf(p, "BridgedUnicastFrames=%u\n", ap->bridged_unicast);
75 p += sprintf(p, "BridgedMulticastFrames=%u\n", ap->bridged_multicast);
76 p += sprintf(p, "max_inactivity=%u\n", ap->max_inactivity / HZ);
77 p += sprintf(p, "bridge_packets=%u\n", ap->bridge_packets);
78 p += sprintf(p, "nullfunc_ack=%u\n", ap->nullfunc_ack);
79 p += sprintf(p, "autom_ap_wds=%u\n", ap->autom_ap_wds);
80 p += sprintf(p, "auth_algs=%u\n", ap->local->auth_algs);
81 p += sprintf(p, "tx_drop_nonassoc=%u\n", ap->tx_drop_nonassoc);
82
83 return (p - page);
84 }
85 #endif /* PRISM2_NO_PROCFS_DEBUG */
86
87
ap_sta_hash_add(struct ap_data * ap,struct sta_info * sta)88 static void ap_sta_hash_add(struct ap_data *ap, struct sta_info *sta)
89 {
90 sta->hnext = ap->sta_hash[STA_HASH(sta->addr)];
91 ap->sta_hash[STA_HASH(sta->addr)] = sta;
92 }
93
ap_sta_hash_del(struct ap_data * ap,struct sta_info * sta)94 static void ap_sta_hash_del(struct ap_data *ap, struct sta_info *sta)
95 {
96 struct sta_info *s;
97
98 s = ap->sta_hash[STA_HASH(sta->addr)];
99 if (s == NULL) return;
100 if (memcmp(s->addr, sta->addr, ETH_ALEN) == 0) {
101 ap->sta_hash[STA_HASH(sta->addr)] = s->hnext;
102 return;
103 }
104
105 while (s->hnext != NULL && memcmp(s->hnext->addr, sta->addr, ETH_ALEN)
106 != 0)
107 s = s->hnext;
108 if (s->hnext != NULL)
109 s->hnext = s->hnext->hnext;
110 else
111 printk("AP: could not remove STA %pM from hash table\n",
112 sta->addr);
113 }
114
ap_free_sta(struct ap_data * ap,struct sta_info * sta)115 static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
116 {
117 if (sta->ap && sta->local)
118 hostap_event_expired_sta(sta->local->dev, sta);
119
120 if (ap->proc != NULL) {
121 char name[20];
122 sprintf(name, "%pM", sta->addr);
123 remove_proc_entry(name, ap->proc);
124 }
125
126 if (sta->crypt) {
127 sta->crypt->ops->deinit(sta->crypt->priv);
128 kfree(sta->crypt);
129 sta->crypt = NULL;
130 }
131
132 skb_queue_purge(&sta->tx_buf);
133
134 ap->num_sta--;
135 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
136 if (sta->aid > 0)
137 ap->sta_aid[sta->aid - 1] = NULL;
138
139 if (!sta->ap && sta->u.sta.challenge)
140 kfree(sta->u.sta.challenge);
141 del_timer(&sta->timer);
142 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
143
144 kfree(sta);
145 }
146
147
hostap_set_tim(local_info_t * local,int aid,int set)148 static void hostap_set_tim(local_info_t *local, int aid, int set)
149 {
150 if (local->func->set_tim)
151 local->func->set_tim(local->dev, aid, set);
152 }
153
154
hostap_event_new_sta(struct net_device * dev,struct sta_info * sta)155 static void hostap_event_new_sta(struct net_device *dev, struct sta_info *sta)
156 {
157 union iwreq_data wrqu;
158 memset(&wrqu, 0, sizeof(wrqu));
159 memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN);
160 wrqu.addr.sa_family = ARPHRD_ETHER;
161 wireless_send_event(dev, IWEVREGISTERED, &wrqu, NULL);
162 }
163
164
hostap_event_expired_sta(struct net_device * dev,struct sta_info * sta)165 static void hostap_event_expired_sta(struct net_device *dev,
166 struct sta_info *sta)
167 {
168 union iwreq_data wrqu;
169 memset(&wrqu, 0, sizeof(wrqu));
170 memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN);
171 wrqu.addr.sa_family = ARPHRD_ETHER;
172 wireless_send_event(dev, IWEVEXPIRED, &wrqu, NULL);
173 }
174
175
176 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
177
ap_handle_timer(unsigned long data)178 static void ap_handle_timer(unsigned long data)
179 {
180 struct sta_info *sta = (struct sta_info *) data;
181 local_info_t *local;
182 struct ap_data *ap;
183 unsigned long next_time = 0;
184 int was_assoc;
185
186 if (sta == NULL || sta->local == NULL || sta->local->ap == NULL) {
187 PDEBUG(DEBUG_AP, "ap_handle_timer() called with NULL data\n");
188 return;
189 }
190
191 local = sta->local;
192 ap = local->ap;
193 was_assoc = sta->flags & WLAN_STA_ASSOC;
194
195 if (atomic_read(&sta->users) != 0)
196 next_time = jiffies + HZ;
197 else if ((sta->flags & WLAN_STA_PERM) && !(sta->flags & WLAN_STA_AUTH))
198 next_time = jiffies + ap->max_inactivity;
199
200 if (time_before(jiffies, sta->last_rx + ap->max_inactivity)) {
201 /* station activity detected; reset timeout state */
202 sta->timeout_next = STA_NULLFUNC;
203 next_time = sta->last_rx + ap->max_inactivity;
204 } else if (sta->timeout_next == STA_DISASSOC &&
205 !(sta->flags & WLAN_STA_PENDING_POLL)) {
206 /* STA ACKed data nullfunc frame poll */
207 sta->timeout_next = STA_NULLFUNC;
208 next_time = jiffies + ap->max_inactivity;
209 }
210
211 if (next_time) {
212 sta->timer.expires = next_time;
213 add_timer(&sta->timer);
214 return;
215 }
216
217 if (sta->ap)
218 sta->timeout_next = STA_DEAUTH;
219
220 if (sta->timeout_next == STA_DEAUTH && !(sta->flags & WLAN_STA_PERM)) {
221 spin_lock(&ap->sta_table_lock);
222 ap_sta_hash_del(ap, sta);
223 list_del(&sta->list);
224 spin_unlock(&ap->sta_table_lock);
225 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
226 } else if (sta->timeout_next == STA_DISASSOC)
227 sta->flags &= ~WLAN_STA_ASSOC;
228
229 if (was_assoc && !(sta->flags & WLAN_STA_ASSOC) && !sta->ap)
230 hostap_event_expired_sta(local->dev, sta);
231
232 if (sta->timeout_next == STA_DEAUTH && sta->aid > 0 &&
233 !skb_queue_empty(&sta->tx_buf)) {
234 hostap_set_tim(local, sta->aid, 0);
235 sta->flags &= ~WLAN_STA_TIM;
236 }
237
238 if (sta->ap) {
239 if (ap->autom_ap_wds) {
240 PDEBUG(DEBUG_AP, "%s: removing automatic WDS "
241 "connection to AP %pM\n",
242 local->dev->name, sta->addr);
243 hostap_wds_link_oper(local, sta->addr, WDS_DEL);
244 }
245 } else if (sta->timeout_next == STA_NULLFUNC) {
246 /* send data frame to poll STA and check whether this frame
247 * is ACKed */
248 /* FIX: IEEE80211_STYPE_NULLFUNC would be more appropriate, but
249 * it is apparently not retried so TX Exc events are not
250 * received for it */
251 sta->flags |= WLAN_STA_PENDING_POLL;
252 prism2_send_mgmt(local->dev, IEEE80211_FTYPE_DATA |
253 IEEE80211_STYPE_DATA, NULL, 0,
254 sta->addr, ap->tx_callback_poll);
255 } else {
256 int deauth = sta->timeout_next == STA_DEAUTH;
257 __le16 resp;
258 PDEBUG(DEBUG_AP, "%s: sending %s info to STA %pM"
259 "(last=%lu, jiffies=%lu)\n",
260 local->dev->name,
261 deauth ? "deauthentication" : "disassociation",
262 sta->addr, sta->last_rx, jiffies);
263
264 resp = cpu_to_le16(deauth ? WLAN_REASON_PREV_AUTH_NOT_VALID :
265 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
266 prism2_send_mgmt(local->dev, IEEE80211_FTYPE_MGMT |
267 (deauth ? IEEE80211_STYPE_DEAUTH :
268 IEEE80211_STYPE_DISASSOC),
269 (char *) &resp, 2, sta->addr, 0);
270 }
271
272 if (sta->timeout_next == STA_DEAUTH) {
273 if (sta->flags & WLAN_STA_PERM) {
274 PDEBUG(DEBUG_AP, "%s: STA %pM"
275 " would have been removed, "
276 "but it has 'perm' flag\n",
277 local->dev->name, sta->addr);
278 } else
279 ap_free_sta(ap, sta);
280 return;
281 }
282
283 if (sta->timeout_next == STA_NULLFUNC) {
284 sta->timeout_next = STA_DISASSOC;
285 sta->timer.expires = jiffies + AP_DISASSOC_DELAY;
286 } else {
287 sta->timeout_next = STA_DEAUTH;
288 sta->timer.expires = jiffies + AP_DEAUTH_DELAY;
289 }
290
291 add_timer(&sta->timer);
292 }
293
294
hostap_deauth_all_stas(struct net_device * dev,struct ap_data * ap,int resend)295 void hostap_deauth_all_stas(struct net_device *dev, struct ap_data *ap,
296 int resend)
297 {
298 u8 addr[ETH_ALEN];
299 __le16 resp;
300 int i;
301
302 PDEBUG(DEBUG_AP, "%s: Deauthenticate all stations\n", dev->name);
303 memset(addr, 0xff, ETH_ALEN);
304
305 resp = cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
306
307 /* deauth message sent; try to resend it few times; the message is
308 * broadcast, so it may be delayed until next DTIM; there is not much
309 * else we can do at this point since the driver is going to be shut
310 * down */
311 for (i = 0; i < 5; i++) {
312 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
313 IEEE80211_STYPE_DEAUTH,
314 (char *) &resp, 2, addr, 0);
315
316 if (!resend || ap->num_sta <= 0)
317 return;
318
319 mdelay(50);
320 }
321 }
322
323
ap_control_proc_read(char * page,char ** start,off_t off,int count,int * eof,void * data)324 static int ap_control_proc_read(char *page, char **start, off_t off,
325 int count, int *eof, void *data)
326 {
327 char *p = page;
328 struct ap_data *ap = (struct ap_data *) data;
329 char *policy_txt;
330 struct mac_entry *entry;
331
332 if (off != 0) {
333 *eof = 1;
334 return 0;
335 }
336
337 switch (ap->mac_restrictions.policy) {
338 case MAC_POLICY_OPEN:
339 policy_txt = "open";
340 break;
341 case MAC_POLICY_ALLOW:
342 policy_txt = "allow";
343 break;
344 case MAC_POLICY_DENY:
345 policy_txt = "deny";
346 break;
347 default:
348 policy_txt = "unknown";
349 break;
350 };
351 p += sprintf(p, "MAC policy: %s\n", policy_txt);
352 p += sprintf(p, "MAC entries: %u\n", ap->mac_restrictions.entries);
353 p += sprintf(p, "MAC list:\n");
354 spin_lock_bh(&ap->mac_restrictions.lock);
355 list_for_each_entry(entry, &ap->mac_restrictions.mac_list, list) {
356 if (p - page > PAGE_SIZE - 80) {
357 p += sprintf(p, "All entries did not fit one page.\n");
358 break;
359 }
360
361 p += sprintf(p, "%pM\n", entry->addr);
362 }
363 spin_unlock_bh(&ap->mac_restrictions.lock);
364
365 return (p - page);
366 }
367
368
ap_control_add_mac(struct mac_restrictions * mac_restrictions,u8 * mac)369 int ap_control_add_mac(struct mac_restrictions *mac_restrictions, u8 *mac)
370 {
371 struct mac_entry *entry;
372
373 entry = kmalloc(sizeof(struct mac_entry), GFP_KERNEL);
374 if (entry == NULL)
375 return -1;
376
377 memcpy(entry->addr, mac, ETH_ALEN);
378
379 spin_lock_bh(&mac_restrictions->lock);
380 list_add_tail(&entry->list, &mac_restrictions->mac_list);
381 mac_restrictions->entries++;
382 spin_unlock_bh(&mac_restrictions->lock);
383
384 return 0;
385 }
386
387
ap_control_del_mac(struct mac_restrictions * mac_restrictions,u8 * mac)388 int ap_control_del_mac(struct mac_restrictions *mac_restrictions, u8 *mac)
389 {
390 struct list_head *ptr;
391 struct mac_entry *entry;
392
393 spin_lock_bh(&mac_restrictions->lock);
394 for (ptr = mac_restrictions->mac_list.next;
395 ptr != &mac_restrictions->mac_list; ptr = ptr->next) {
396 entry = list_entry(ptr, struct mac_entry, list);
397
398 if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
399 list_del(ptr);
400 kfree(entry);
401 mac_restrictions->entries--;
402 spin_unlock_bh(&mac_restrictions->lock);
403 return 0;
404 }
405 }
406 spin_unlock_bh(&mac_restrictions->lock);
407 return -1;
408 }
409
410
ap_control_mac_deny(struct mac_restrictions * mac_restrictions,u8 * mac)411 static int ap_control_mac_deny(struct mac_restrictions *mac_restrictions,
412 u8 *mac)
413 {
414 struct mac_entry *entry;
415 int found = 0;
416
417 if (mac_restrictions->policy == MAC_POLICY_OPEN)
418 return 0;
419
420 spin_lock_bh(&mac_restrictions->lock);
421 list_for_each_entry(entry, &mac_restrictions->mac_list, list) {
422 if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
423 found = 1;
424 break;
425 }
426 }
427 spin_unlock_bh(&mac_restrictions->lock);
428
429 if (mac_restrictions->policy == MAC_POLICY_ALLOW)
430 return !found;
431 else
432 return found;
433 }
434
435
ap_control_flush_macs(struct mac_restrictions * mac_restrictions)436 void ap_control_flush_macs(struct mac_restrictions *mac_restrictions)
437 {
438 struct list_head *ptr, *n;
439 struct mac_entry *entry;
440
441 if (mac_restrictions->entries == 0)
442 return;
443
444 spin_lock_bh(&mac_restrictions->lock);
445 for (ptr = mac_restrictions->mac_list.next, n = ptr->next;
446 ptr != &mac_restrictions->mac_list;
447 ptr = n, n = ptr->next) {
448 entry = list_entry(ptr, struct mac_entry, list);
449 list_del(ptr);
450 kfree(entry);
451 }
452 mac_restrictions->entries = 0;
453 spin_unlock_bh(&mac_restrictions->lock);
454 }
455
456
ap_control_kick_mac(struct ap_data * ap,struct net_device * dev,u8 * mac)457 int ap_control_kick_mac(struct ap_data *ap, struct net_device *dev, u8 *mac)
458 {
459 struct sta_info *sta;
460 __le16 resp;
461
462 spin_lock_bh(&ap->sta_table_lock);
463 sta = ap_get_sta(ap, mac);
464 if (sta) {
465 ap_sta_hash_del(ap, sta);
466 list_del(&sta->list);
467 }
468 spin_unlock_bh(&ap->sta_table_lock);
469
470 if (!sta)
471 return -EINVAL;
472
473 resp = cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
474 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_DEAUTH,
475 (char *) &resp, 2, sta->addr, 0);
476
477 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
478 hostap_event_expired_sta(dev, sta);
479
480 ap_free_sta(ap, sta);
481
482 return 0;
483 }
484
485 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
486
487
ap_control_kickall(struct ap_data * ap)488 void ap_control_kickall(struct ap_data *ap)
489 {
490 struct list_head *ptr, *n;
491 struct sta_info *sta;
492
493 spin_lock_bh(&ap->sta_table_lock);
494 for (ptr = ap->sta_list.next, n = ptr->next; ptr != &ap->sta_list;
495 ptr = n, n = ptr->next) {
496 sta = list_entry(ptr, struct sta_info, list);
497 ap_sta_hash_del(ap, sta);
498 list_del(&sta->list);
499 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
500 hostap_event_expired_sta(sta->local->dev, sta);
501 ap_free_sta(ap, sta);
502 }
503 spin_unlock_bh(&ap->sta_table_lock);
504 }
505
506
507 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
508
509 #define PROC_LIMIT (PAGE_SIZE - 80)
510
prism2_ap_proc_read(char * page,char ** start,off_t off,int count,int * eof,void * data)511 static int prism2_ap_proc_read(char *page, char **start, off_t off,
512 int count, int *eof, void *data)
513 {
514 char *p = page;
515 struct ap_data *ap = (struct ap_data *) data;
516 struct sta_info *sta;
517 int i;
518
519 if (off > PROC_LIMIT) {
520 *eof = 1;
521 return 0;
522 }
523
524 p += sprintf(p, "# BSSID CHAN SIGNAL NOISE RATE SSID FLAGS\n");
525 spin_lock_bh(&ap->sta_table_lock);
526 list_for_each_entry(sta, &ap->sta_list, list) {
527 if (!sta->ap)
528 continue;
529
530 p += sprintf(p, "%pM %d %d %d %d '",
531 sta->addr,
532 sta->u.ap.channel, sta->last_rx_signal,
533 sta->last_rx_silence, sta->last_rx_rate);
534 for (i = 0; i < sta->u.ap.ssid_len; i++)
535 p += sprintf(p, ((sta->u.ap.ssid[i] >= 32 &&
536 sta->u.ap.ssid[i] < 127) ?
537 "%c" : "<%02x>"),
538 sta->u.ap.ssid[i]);
539 p += sprintf(p, "'");
540 if (sta->capability & WLAN_CAPABILITY_ESS)
541 p += sprintf(p, " [ESS]");
542 if (sta->capability & WLAN_CAPABILITY_IBSS)
543 p += sprintf(p, " [IBSS]");
544 if (sta->capability & WLAN_CAPABILITY_PRIVACY)
545 p += sprintf(p, " [WEP]");
546 p += sprintf(p, "\n");
547
548 if ((p - page) > PROC_LIMIT) {
549 printk(KERN_DEBUG "hostap: ap proc did not fit\n");
550 break;
551 }
552 }
553 spin_unlock_bh(&ap->sta_table_lock);
554
555 if ((p - page) <= off) {
556 *eof = 1;
557 return 0;
558 }
559
560 *start = page + off;
561
562 return (p - page - off);
563 }
564 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
565
566
hostap_check_sta_fw_version(struct ap_data * ap,int sta_fw_ver)567 void hostap_check_sta_fw_version(struct ap_data *ap, int sta_fw_ver)
568 {
569 if (!ap)
570 return;
571
572 if (sta_fw_ver == PRISM2_FW_VER(0,8,0)) {
573 PDEBUG(DEBUG_AP, "Using data::nullfunc ACK workaround - "
574 "firmware upgrade recommended\n");
575 ap->nullfunc_ack = 1;
576 } else
577 ap->nullfunc_ack = 0;
578
579 if (sta_fw_ver == PRISM2_FW_VER(1,4,2)) {
580 printk(KERN_WARNING "%s: Warning: secondary station firmware "
581 "version 1.4.2 does not seem to work in Host AP mode\n",
582 ap->local->dev->name);
583 }
584 }
585
586
587 /* Called only as a tasklet (software IRQ) */
hostap_ap_tx_cb(struct sk_buff * skb,int ok,void * data)588 static void hostap_ap_tx_cb(struct sk_buff *skb, int ok, void *data)
589 {
590 struct ap_data *ap = data;
591 u16 fc;
592 struct ieee80211_hdr_4addr *hdr;
593
594 if (!ap->local->hostapd || !ap->local->apdev) {
595 dev_kfree_skb(skb);
596 return;
597 }
598
599 hdr = (struct ieee80211_hdr_4addr *) skb->data;
600 fc = le16_to_cpu(hdr->frame_ctl);
601
602 /* Pass the TX callback frame to the hostapd; use 802.11 header version
603 * 1 to indicate failure (no ACK) and 2 success (frame ACKed) */
604
605 fc &= ~IEEE80211_FCTL_VERS;
606 fc |= ok ? BIT(1) : BIT(0);
607 hdr->frame_ctl = cpu_to_le16(fc);
608
609 skb->dev = ap->local->apdev;
610 skb_pull(skb, hostap_80211_get_hdrlen(fc));
611 skb->pkt_type = PACKET_OTHERHOST;
612 skb->protocol = __constant_htons(ETH_P_802_2);
613 memset(skb->cb, 0, sizeof(skb->cb));
614 netif_rx(skb);
615 }
616
617
618 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
619 /* Called only as a tasklet (software IRQ) */
hostap_ap_tx_cb_auth(struct sk_buff * skb,int ok,void * data)620 static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data)
621 {
622 struct ap_data *ap = data;
623 struct net_device *dev = ap->local->dev;
624 struct ieee80211_hdr_4addr *hdr;
625 u16 fc, auth_alg, auth_transaction, status;
626 __le16 *pos;
627 struct sta_info *sta = NULL;
628 char *txt = NULL;
629
630 if (ap->local->hostapd) {
631 dev_kfree_skb(skb);
632 return;
633 }
634
635 hdr = (struct ieee80211_hdr_4addr *) skb->data;
636 fc = le16_to_cpu(hdr->frame_ctl);
637 if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
638 WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_AUTH ||
639 skb->len < IEEE80211_MGMT_HDR_LEN + 6) {
640 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_auth received invalid "
641 "frame\n", dev->name);
642 dev_kfree_skb(skb);
643 return;
644 }
645
646 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
647 auth_alg = le16_to_cpu(*pos++);
648 auth_transaction = le16_to_cpu(*pos++);
649 status = le16_to_cpu(*pos++);
650
651 if (!ok) {
652 txt = "frame was not ACKed";
653 goto done;
654 }
655
656 spin_lock(&ap->sta_table_lock);
657 sta = ap_get_sta(ap, hdr->addr1);
658 if (sta)
659 atomic_inc(&sta->users);
660 spin_unlock(&ap->sta_table_lock);
661
662 if (!sta) {
663 txt = "STA not found";
664 goto done;
665 }
666
667 if (status == WLAN_STATUS_SUCCESS &&
668 ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
669 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
670 txt = "STA authenticated";
671 sta->flags |= WLAN_STA_AUTH;
672 sta->last_auth = jiffies;
673 } else if (status != WLAN_STATUS_SUCCESS)
674 txt = "authentication failed";
675
676 done:
677 if (sta)
678 atomic_dec(&sta->users);
679 if (txt) {
680 PDEBUG(DEBUG_AP, "%s: %pM auth_cb - alg=%d "
681 "trans#=%d status=%d - %s\n",
682 dev->name, hdr->addr1,
683 auth_alg, auth_transaction, status, txt);
684 }
685 dev_kfree_skb(skb);
686 }
687
688
689 /* Called only as a tasklet (software IRQ) */
hostap_ap_tx_cb_assoc(struct sk_buff * skb,int ok,void * data)690 static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
691 {
692 struct ap_data *ap = data;
693 struct net_device *dev = ap->local->dev;
694 struct ieee80211_hdr_4addr *hdr;
695 u16 fc, status;
696 __le16 *pos;
697 struct sta_info *sta = NULL;
698 char *txt = NULL;
699
700 if (ap->local->hostapd) {
701 dev_kfree_skb(skb);
702 return;
703 }
704
705 hdr = (struct ieee80211_hdr_4addr *) skb->data;
706 fc = le16_to_cpu(hdr->frame_ctl);
707 if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
708 (WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_ASSOC_RESP &&
709 WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_REASSOC_RESP) ||
710 skb->len < IEEE80211_MGMT_HDR_LEN + 4) {
711 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_assoc received invalid "
712 "frame\n", dev->name);
713 dev_kfree_skb(skb);
714 return;
715 }
716
717 if (!ok) {
718 txt = "frame was not ACKed";
719 goto done;
720 }
721
722 spin_lock(&ap->sta_table_lock);
723 sta = ap_get_sta(ap, hdr->addr1);
724 if (sta)
725 atomic_inc(&sta->users);
726 spin_unlock(&ap->sta_table_lock);
727
728 if (!sta) {
729 txt = "STA not found";
730 goto done;
731 }
732
733 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
734 pos++;
735 status = le16_to_cpu(*pos++);
736 if (status == WLAN_STATUS_SUCCESS) {
737 if (!(sta->flags & WLAN_STA_ASSOC))
738 hostap_event_new_sta(dev, sta);
739 txt = "STA associated";
740 sta->flags |= WLAN_STA_ASSOC;
741 sta->last_assoc = jiffies;
742 } else
743 txt = "association failed";
744
745 done:
746 if (sta)
747 atomic_dec(&sta->users);
748 if (txt) {
749 PDEBUG(DEBUG_AP, "%s: %pM assoc_cb - %s\n",
750 dev->name, hdr->addr1, txt);
751 }
752 dev_kfree_skb(skb);
753 }
754
755 /* Called only as a tasklet (software IRQ); TX callback for poll frames used
756 * in verifying whether the STA is still present. */
hostap_ap_tx_cb_poll(struct sk_buff * skb,int ok,void * data)757 static void hostap_ap_tx_cb_poll(struct sk_buff *skb, int ok, void *data)
758 {
759 struct ap_data *ap = data;
760 struct ieee80211_hdr_4addr *hdr;
761 struct sta_info *sta;
762
763 if (skb->len < 24)
764 goto fail;
765 hdr = (struct ieee80211_hdr_4addr *) skb->data;
766 if (ok) {
767 spin_lock(&ap->sta_table_lock);
768 sta = ap_get_sta(ap, hdr->addr1);
769 if (sta)
770 sta->flags &= ~WLAN_STA_PENDING_POLL;
771 spin_unlock(&ap->sta_table_lock);
772 } else {
773 PDEBUG(DEBUG_AP,
774 "%s: STA %pM did not ACK activity poll frame\n",
775 ap->local->dev->name, hdr->addr1);
776 }
777
778 fail:
779 dev_kfree_skb(skb);
780 }
781 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
782
783
hostap_init_data(local_info_t * local)784 void hostap_init_data(local_info_t *local)
785 {
786 struct ap_data *ap = local->ap;
787
788 if (ap == NULL) {
789 printk(KERN_WARNING "hostap_init_data: ap == NULL\n");
790 return;
791 }
792 memset(ap, 0, sizeof(struct ap_data));
793 ap->local = local;
794
795 ap->ap_policy = GET_INT_PARM(other_ap_policy, local->card_idx);
796 ap->bridge_packets = GET_INT_PARM(ap_bridge_packets, local->card_idx);
797 ap->max_inactivity =
798 GET_INT_PARM(ap_max_inactivity, local->card_idx) * HZ;
799 ap->autom_ap_wds = GET_INT_PARM(autom_ap_wds, local->card_idx);
800
801 spin_lock_init(&ap->sta_table_lock);
802 INIT_LIST_HEAD(&ap->sta_list);
803
804 /* Initialize task queue structure for AP management */
805 INIT_WORK(&local->ap->add_sta_proc_queue, handle_add_proc_queue);
806
807 ap->tx_callback_idx =
808 hostap_tx_callback_register(local, hostap_ap_tx_cb, ap);
809 if (ap->tx_callback_idx == 0)
810 printk(KERN_WARNING "%s: failed to register TX callback for "
811 "AP\n", local->dev->name);
812 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
813 INIT_WORK(&local->ap->wds_oper_queue, handle_wds_oper_queue);
814
815 ap->tx_callback_auth =
816 hostap_tx_callback_register(local, hostap_ap_tx_cb_auth, ap);
817 ap->tx_callback_assoc =
818 hostap_tx_callback_register(local, hostap_ap_tx_cb_assoc, ap);
819 ap->tx_callback_poll =
820 hostap_tx_callback_register(local, hostap_ap_tx_cb_poll, ap);
821 if (ap->tx_callback_auth == 0 || ap->tx_callback_assoc == 0 ||
822 ap->tx_callback_poll == 0)
823 printk(KERN_WARNING "%s: failed to register TX callback for "
824 "AP\n", local->dev->name);
825
826 spin_lock_init(&ap->mac_restrictions.lock);
827 INIT_LIST_HEAD(&ap->mac_restrictions.mac_list);
828 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
829
830 ap->initialized = 1;
831 }
832
833
hostap_init_ap_proc(local_info_t * local)834 void hostap_init_ap_proc(local_info_t *local)
835 {
836 struct ap_data *ap = local->ap;
837
838 ap->proc = local->proc;
839 if (ap->proc == NULL)
840 return;
841
842 #ifndef PRISM2_NO_PROCFS_DEBUG
843 create_proc_read_entry("ap_debug", 0, ap->proc,
844 ap_debug_proc_read, ap);
845 #endif /* PRISM2_NO_PROCFS_DEBUG */
846
847 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
848 create_proc_read_entry("ap_control", 0, ap->proc,
849 ap_control_proc_read, ap);
850 create_proc_read_entry("ap", 0, ap->proc,
851 prism2_ap_proc_read, ap);
852 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
853
854 }
855
856
hostap_free_data(struct ap_data * ap)857 void hostap_free_data(struct ap_data *ap)
858 {
859 struct sta_info *n, *sta;
860
861 if (ap == NULL || !ap->initialized) {
862 printk(KERN_DEBUG "hostap_free_data: ap has not yet been "
863 "initialized - skip resource freeing\n");
864 return;
865 }
866
867 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
868 if (ap->crypt)
869 ap->crypt->deinit(ap->crypt_priv);
870 ap->crypt = ap->crypt_priv = NULL;
871 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
872
873 list_for_each_entry_safe(sta, n, &ap->sta_list, list) {
874 ap_sta_hash_del(ap, sta);
875 list_del(&sta->list);
876 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
877 hostap_event_expired_sta(sta->local->dev, sta);
878 ap_free_sta(ap, sta);
879 }
880
881 #ifndef PRISM2_NO_PROCFS_DEBUG
882 if (ap->proc != NULL) {
883 remove_proc_entry("ap_debug", ap->proc);
884 }
885 #endif /* PRISM2_NO_PROCFS_DEBUG */
886
887 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
888 if (ap->proc != NULL) {
889 remove_proc_entry("ap", ap->proc);
890 remove_proc_entry("ap_control", ap->proc);
891 }
892 ap_control_flush_macs(&ap->mac_restrictions);
893 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
894
895 ap->initialized = 0;
896 }
897
898
899 /* caller should have mutex for AP STA list handling */
ap_get_sta(struct ap_data * ap,u8 * sta)900 static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta)
901 {
902 struct sta_info *s;
903
904 s = ap->sta_hash[STA_HASH(sta)];
905 while (s != NULL && memcmp(s->addr, sta, ETH_ALEN) != 0)
906 s = s->hnext;
907 return s;
908 }
909
910
911 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
912
913 /* Called from timer handler and from scheduled AP queue handlers */
prism2_send_mgmt(struct net_device * dev,u16 type_subtype,char * body,int body_len,u8 * addr,u16 tx_cb_idx)914 static void prism2_send_mgmt(struct net_device *dev,
915 u16 type_subtype, char *body,
916 int body_len, u8 *addr, u16 tx_cb_idx)
917 {
918 struct hostap_interface *iface;
919 local_info_t *local;
920 struct ieee80211_hdr_4addr *hdr;
921 u16 fc;
922 struct sk_buff *skb;
923 struct hostap_skb_tx_data *meta;
924 int hdrlen;
925
926 iface = netdev_priv(dev);
927 local = iface->local;
928 dev = local->dev; /* always use master radio device */
929 iface = netdev_priv(dev);
930
931 if (!(dev->flags & IFF_UP)) {
932 PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt - device is not UP - "
933 "cannot send frame\n", dev->name);
934 return;
935 }
936
937 skb = dev_alloc_skb(sizeof(*hdr) + body_len);
938 if (skb == NULL) {
939 PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt failed to allocate "
940 "skb\n", dev->name);
941 return;
942 }
943
944 fc = type_subtype;
945 hdrlen = hostap_80211_get_hdrlen(fc);
946 hdr = (struct ieee80211_hdr_4addr *) skb_put(skb, hdrlen);
947 if (body)
948 memcpy(skb_put(skb, body_len), body, body_len);
949
950 memset(hdr, 0, hdrlen);
951
952 /* FIX: ctrl::ack sending used special HFA384X_TX_CTRL_802_11
953 * tx_control instead of using local->tx_control */
954
955
956 memcpy(hdr->addr1, addr, ETH_ALEN); /* DA / RA */
957 if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) {
958 fc |= IEEE80211_FCTL_FROMDS;
959 memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* BSSID */
960 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* SA */
961 } else if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_CTL) {
962 /* control:ACK does not have addr2 or addr3 */
963 memset(hdr->addr2, 0, ETH_ALEN);
964 memset(hdr->addr3, 0, ETH_ALEN);
965 } else {
966 memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* SA */
967 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* BSSID */
968 }
969
970 hdr->frame_ctl = cpu_to_le16(fc);
971
972 meta = (struct hostap_skb_tx_data *) skb->cb;
973 memset(meta, 0, sizeof(*meta));
974 meta->magic = HOSTAP_SKB_TX_DATA_MAGIC;
975 meta->iface = iface;
976 meta->tx_cb_idx = tx_cb_idx;
977
978 skb->dev = dev;
979 skb_reset_mac_header(skb);
980 skb_reset_network_header(skb);
981 dev_queue_xmit(skb);
982 }
983 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
984
985
prism2_sta_proc_read(char * page,char ** start,off_t off,int count,int * eof,void * data)986 static int prism2_sta_proc_read(char *page, char **start, off_t off,
987 int count, int *eof, void *data)
988 {
989 char *p = page;
990 struct sta_info *sta = (struct sta_info *) data;
991 int i;
992
993 /* FIX: possible race condition.. the STA data could have just expired,
994 * but proc entry was still here so that the read could have started;
995 * some locking should be done here.. */
996
997 if (off != 0) {
998 *eof = 1;
999 return 0;
1000 }
1001
1002 p += sprintf(p, "%s=%pM\nusers=%d\naid=%d\n"
1003 "flags=0x%04x%s%s%s%s%s%s%s\n"
1004 "capability=0x%02x\nlisten_interval=%d\nsupported_rates=",
1005 sta->ap ? "AP" : "STA",
1006 sta->addr, atomic_read(&sta->users), sta->aid,
1007 sta->flags,
1008 sta->flags & WLAN_STA_AUTH ? " AUTH" : "",
1009 sta->flags & WLAN_STA_ASSOC ? " ASSOC" : "",
1010 sta->flags & WLAN_STA_PS ? " PS" : "",
1011 sta->flags & WLAN_STA_TIM ? " TIM" : "",
1012 sta->flags & WLAN_STA_PERM ? " PERM" : "",
1013 sta->flags & WLAN_STA_AUTHORIZED ? " AUTHORIZED" : "",
1014 sta->flags & WLAN_STA_PENDING_POLL ? " POLL" : "",
1015 sta->capability, sta->listen_interval);
1016 /* supported_rates: 500 kbit/s units with msb ignored */
1017 for (i = 0; i < sizeof(sta->supported_rates); i++)
1018 if (sta->supported_rates[i] != 0)
1019 p += sprintf(p, "%d%sMbps ",
1020 (sta->supported_rates[i] & 0x7f) / 2,
1021 sta->supported_rates[i] & 1 ? ".5" : "");
1022 p += sprintf(p, "\njiffies=%lu\nlast_auth=%lu\nlast_assoc=%lu\n"
1023 "last_rx=%lu\nlast_tx=%lu\nrx_packets=%lu\n"
1024 "tx_packets=%lu\n"
1025 "rx_bytes=%lu\ntx_bytes=%lu\nbuffer_count=%d\n"
1026 "last_rx: silence=%d dBm signal=%d dBm rate=%d%s Mbps\n"
1027 "tx_rate=%d\ntx[1M]=%d\ntx[2M]=%d\ntx[5.5M]=%d\n"
1028 "tx[11M]=%d\n"
1029 "rx[1M]=%d\nrx[2M]=%d\nrx[5.5M]=%d\nrx[11M]=%d\n",
1030 jiffies, sta->last_auth, sta->last_assoc, sta->last_rx,
1031 sta->last_tx,
1032 sta->rx_packets, sta->tx_packets, sta->rx_bytes,
1033 sta->tx_bytes, skb_queue_len(&sta->tx_buf),
1034 sta->last_rx_silence,
1035 sta->last_rx_signal, sta->last_rx_rate / 10,
1036 sta->last_rx_rate % 10 ? ".5" : "",
1037 sta->tx_rate, sta->tx_count[0], sta->tx_count[1],
1038 sta->tx_count[2], sta->tx_count[3], sta->rx_count[0],
1039 sta->rx_count[1], sta->rx_count[2], sta->rx_count[3]);
1040 if (sta->crypt && sta->crypt->ops && sta->crypt->ops->print_stats)
1041 p = sta->crypt->ops->print_stats(p, sta->crypt->priv);
1042 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1043 if (sta->ap) {
1044 if (sta->u.ap.channel >= 0)
1045 p += sprintf(p, "channel=%d\n", sta->u.ap.channel);
1046 p += sprintf(p, "ssid=");
1047 for (i = 0; i < sta->u.ap.ssid_len; i++)
1048 p += sprintf(p, ((sta->u.ap.ssid[i] >= 32 &&
1049 sta->u.ap.ssid[i] < 127) ?
1050 "%c" : "<%02x>"),
1051 sta->u.ap.ssid[i]);
1052 p += sprintf(p, "\n");
1053 }
1054 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
1055
1056 return (p - page);
1057 }
1058
1059
handle_add_proc_queue(struct work_struct * work)1060 static void handle_add_proc_queue(struct work_struct *work)
1061 {
1062 struct ap_data *ap = container_of(work, struct ap_data,
1063 add_sta_proc_queue);
1064 struct sta_info *sta;
1065 char name[20];
1066 struct add_sta_proc_data *entry, *prev;
1067
1068 entry = ap->add_sta_proc_entries;
1069 ap->add_sta_proc_entries = NULL;
1070
1071 while (entry) {
1072 spin_lock_bh(&ap->sta_table_lock);
1073 sta = ap_get_sta(ap, entry->addr);
1074 if (sta)
1075 atomic_inc(&sta->users);
1076 spin_unlock_bh(&ap->sta_table_lock);
1077
1078 if (sta) {
1079 sprintf(name, "%pM", sta->addr);
1080 sta->proc = create_proc_read_entry(
1081 name, 0, ap->proc,
1082 prism2_sta_proc_read, sta);
1083
1084 atomic_dec(&sta->users);
1085 }
1086
1087 prev = entry;
1088 entry = entry->next;
1089 kfree(prev);
1090 }
1091 }
1092
1093
ap_add_sta(struct ap_data * ap,u8 * addr)1094 static struct sta_info * ap_add_sta(struct ap_data *ap, u8 *addr)
1095 {
1096 struct sta_info *sta;
1097
1098 sta = kzalloc(sizeof(struct sta_info), GFP_ATOMIC);
1099 if (sta == NULL) {
1100 PDEBUG(DEBUG_AP, "AP: kmalloc failed\n");
1101 return NULL;
1102 }
1103
1104 /* initialize STA info data */
1105 sta->local = ap->local;
1106 skb_queue_head_init(&sta->tx_buf);
1107 memcpy(sta->addr, addr, ETH_ALEN);
1108
1109 atomic_inc(&sta->users);
1110 spin_lock_bh(&ap->sta_table_lock);
1111 list_add(&sta->list, &ap->sta_list);
1112 ap->num_sta++;
1113 ap_sta_hash_add(ap, sta);
1114 spin_unlock_bh(&ap->sta_table_lock);
1115
1116 if (ap->proc) {
1117 struct add_sta_proc_data *entry;
1118 /* schedule a non-interrupt context process to add a procfs
1119 * entry for the STA since procfs code use GFP_KERNEL */
1120 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
1121 if (entry) {
1122 memcpy(entry->addr, sta->addr, ETH_ALEN);
1123 entry->next = ap->add_sta_proc_entries;
1124 ap->add_sta_proc_entries = entry;
1125 schedule_work(&ap->add_sta_proc_queue);
1126 } else
1127 printk(KERN_DEBUG "Failed to add STA proc data\n");
1128 }
1129
1130 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1131 init_timer(&sta->timer);
1132 sta->timer.expires = jiffies + ap->max_inactivity;
1133 sta->timer.data = (unsigned long) sta;
1134 sta->timer.function = ap_handle_timer;
1135 if (!ap->local->hostapd)
1136 add_timer(&sta->timer);
1137 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
1138
1139 return sta;
1140 }
1141
1142
ap_tx_rate_ok(int rateidx,struct sta_info * sta,local_info_t * local)1143 static int ap_tx_rate_ok(int rateidx, struct sta_info *sta,
1144 local_info_t *local)
1145 {
1146 if (rateidx > sta->tx_max_rate ||
1147 !(sta->tx_supp_rates & (1 << rateidx)))
1148 return 0;
1149
1150 if (local->tx_rate_control != 0 &&
1151 !(local->tx_rate_control & (1 << rateidx)))
1152 return 0;
1153
1154 return 1;
1155 }
1156
1157
prism2_check_tx_rates(struct sta_info * sta)1158 static void prism2_check_tx_rates(struct sta_info *sta)
1159 {
1160 int i;
1161
1162 sta->tx_supp_rates = 0;
1163 for (i = 0; i < sizeof(sta->supported_rates); i++) {
1164 if ((sta->supported_rates[i] & 0x7f) == 2)
1165 sta->tx_supp_rates |= WLAN_RATE_1M;
1166 if ((sta->supported_rates[i] & 0x7f) == 4)
1167 sta->tx_supp_rates |= WLAN_RATE_2M;
1168 if ((sta->supported_rates[i] & 0x7f) == 11)
1169 sta->tx_supp_rates |= WLAN_RATE_5M5;
1170 if ((sta->supported_rates[i] & 0x7f) == 22)
1171 sta->tx_supp_rates |= WLAN_RATE_11M;
1172 }
1173 sta->tx_max_rate = sta->tx_rate = sta->tx_rate_idx = 0;
1174 if (sta->tx_supp_rates & WLAN_RATE_1M) {
1175 sta->tx_max_rate = 0;
1176 if (ap_tx_rate_ok(0, sta, sta->local)) {
1177 sta->tx_rate = 10;
1178 sta->tx_rate_idx = 0;
1179 }
1180 }
1181 if (sta->tx_supp_rates & WLAN_RATE_2M) {
1182 sta->tx_max_rate = 1;
1183 if (ap_tx_rate_ok(1, sta, sta->local)) {
1184 sta->tx_rate = 20;
1185 sta->tx_rate_idx = 1;
1186 }
1187 }
1188 if (sta->tx_supp_rates & WLAN_RATE_5M5) {
1189 sta->tx_max_rate = 2;
1190 if (ap_tx_rate_ok(2, sta, sta->local)) {
1191 sta->tx_rate = 55;
1192 sta->tx_rate_idx = 2;
1193 }
1194 }
1195 if (sta->tx_supp_rates & WLAN_RATE_11M) {
1196 sta->tx_max_rate = 3;
1197 if (ap_tx_rate_ok(3, sta, sta->local)) {
1198 sta->tx_rate = 110;
1199 sta->tx_rate_idx = 3;
1200 }
1201 }
1202 }
1203
1204
1205 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1206
ap_crypt_init(struct ap_data * ap)1207 static void ap_crypt_init(struct ap_data *ap)
1208 {
1209 ap->crypt = lib80211_get_crypto_ops("WEP");
1210
1211 if (ap->crypt) {
1212 if (ap->crypt->init) {
1213 ap->crypt_priv = ap->crypt->init(0);
1214 if (ap->crypt_priv == NULL)
1215 ap->crypt = NULL;
1216 else {
1217 u8 key[WEP_KEY_LEN];
1218 get_random_bytes(key, WEP_KEY_LEN);
1219 ap->crypt->set_key(key, WEP_KEY_LEN, NULL,
1220 ap->crypt_priv);
1221 }
1222 }
1223 }
1224
1225 if (ap->crypt == NULL) {
1226 printk(KERN_WARNING "AP could not initialize WEP: load module "
1227 "lib80211_crypt_wep.ko\n");
1228 }
1229 }
1230
1231
1232 /* Generate challenge data for shared key authentication. IEEE 802.11 specifies
1233 * that WEP algorithm is used for generating challange. This should be unique,
1234 * but otherwise there is not really need for randomness etc. Initialize WEP
1235 * with pseudo random key and then use increasing IV to get unique challenge
1236 * streams.
1237 *
1238 * Called only as a scheduled task for pending AP frames.
1239 */
ap_auth_make_challenge(struct ap_data * ap)1240 static char * ap_auth_make_challenge(struct ap_data *ap)
1241 {
1242 char *tmpbuf;
1243 struct sk_buff *skb;
1244
1245 if (ap->crypt == NULL) {
1246 ap_crypt_init(ap);
1247 if (ap->crypt == NULL)
1248 return NULL;
1249 }
1250
1251 tmpbuf = kmalloc(WLAN_AUTH_CHALLENGE_LEN, GFP_ATOMIC);
1252 if (tmpbuf == NULL) {
1253 PDEBUG(DEBUG_AP, "AP: kmalloc failed for challenge\n");
1254 return NULL;
1255 }
1256
1257 skb = dev_alloc_skb(WLAN_AUTH_CHALLENGE_LEN +
1258 ap->crypt->extra_mpdu_prefix_len +
1259 ap->crypt->extra_mpdu_postfix_len);
1260 if (skb == NULL) {
1261 kfree(tmpbuf);
1262 return NULL;
1263 }
1264
1265 skb_reserve(skb, ap->crypt->extra_mpdu_prefix_len);
1266 memset(skb_put(skb, WLAN_AUTH_CHALLENGE_LEN), 0,
1267 WLAN_AUTH_CHALLENGE_LEN);
1268 if (ap->crypt->encrypt_mpdu(skb, 0, ap->crypt_priv)) {
1269 dev_kfree_skb(skb);
1270 kfree(tmpbuf);
1271 return NULL;
1272 }
1273
1274 skb_copy_from_linear_data_offset(skb, ap->crypt->extra_mpdu_prefix_len,
1275 tmpbuf, WLAN_AUTH_CHALLENGE_LEN);
1276 dev_kfree_skb(skb);
1277
1278 return tmpbuf;
1279 }
1280
1281
1282 /* Called only as a scheduled task for pending AP frames. */
handle_authen(local_info_t * local,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats)1283 static void handle_authen(local_info_t *local, struct sk_buff *skb,
1284 struct hostap_80211_rx_status *rx_stats)
1285 {
1286 struct net_device *dev = local->dev;
1287 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
1288 size_t hdrlen;
1289 struct ap_data *ap = local->ap;
1290 char body[8 + WLAN_AUTH_CHALLENGE_LEN], *challenge = NULL;
1291 int len, olen;
1292 u16 auth_alg, auth_transaction, status_code;
1293 __le16 *pos;
1294 u16 resp = WLAN_STATUS_SUCCESS, fc;
1295 struct sta_info *sta = NULL;
1296 struct lib80211_crypt_data *crypt;
1297 char *txt = "";
1298
1299 len = skb->len - IEEE80211_MGMT_HDR_LEN;
1300
1301 fc = le16_to_cpu(hdr->frame_ctl);
1302 hdrlen = hostap_80211_get_hdrlen(fc);
1303
1304 if (len < 6) {
1305 PDEBUG(DEBUG_AP, "%s: handle_authen - too short payload "
1306 "(len=%d) from %pM\n", dev->name, len, hdr->addr2);
1307 return;
1308 }
1309
1310 spin_lock_bh(&local->ap->sta_table_lock);
1311 sta = ap_get_sta(local->ap, hdr->addr2);
1312 if (sta)
1313 atomic_inc(&sta->users);
1314 spin_unlock_bh(&local->ap->sta_table_lock);
1315
1316 if (sta && sta->crypt)
1317 crypt = sta->crypt;
1318 else {
1319 int idx = 0;
1320 if (skb->len >= hdrlen + 3)
1321 idx = skb->data[hdrlen + 3] >> 6;
1322 crypt = local->crypt_info.crypt[idx];
1323 }
1324
1325 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
1326 auth_alg = __le16_to_cpu(*pos);
1327 pos++;
1328 auth_transaction = __le16_to_cpu(*pos);
1329 pos++;
1330 status_code = __le16_to_cpu(*pos);
1331 pos++;
1332
1333 if (memcmp(dev->dev_addr, hdr->addr2, ETH_ALEN) == 0 ||
1334 ap_control_mac_deny(&ap->mac_restrictions, hdr->addr2)) {
1335 txt = "authentication denied";
1336 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1337 goto fail;
1338 }
1339
1340 if (((local->auth_algs & PRISM2_AUTH_OPEN) &&
1341 auth_alg == WLAN_AUTH_OPEN) ||
1342 ((local->auth_algs & PRISM2_AUTH_SHARED_KEY) &&
1343 crypt && auth_alg == WLAN_AUTH_SHARED_KEY)) {
1344 } else {
1345 txt = "unsupported algorithm";
1346 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1347 goto fail;
1348 }
1349
1350 if (len >= 8) {
1351 u8 *u = (u8 *) pos;
1352 if (*u == WLAN_EID_CHALLENGE) {
1353 if (*(u + 1) != WLAN_AUTH_CHALLENGE_LEN) {
1354 txt = "invalid challenge len";
1355 resp = WLAN_STATUS_CHALLENGE_FAIL;
1356 goto fail;
1357 }
1358 if (len - 8 < WLAN_AUTH_CHALLENGE_LEN) {
1359 txt = "challenge underflow";
1360 resp = WLAN_STATUS_CHALLENGE_FAIL;
1361 goto fail;
1362 }
1363 challenge = (char *) (u + 2);
1364 }
1365 }
1366
1367 if (sta && sta->ap) {
1368 if (time_after(jiffies, sta->u.ap.last_beacon +
1369 (10 * sta->listen_interval * HZ) / 1024)) {
1370 PDEBUG(DEBUG_AP, "%s: no beacons received for a while,"
1371 " assuming AP %pM is now STA\n",
1372 dev->name, sta->addr);
1373 sta->ap = 0;
1374 sta->flags = 0;
1375 sta->u.sta.challenge = NULL;
1376 } else {
1377 txt = "AP trying to authenticate?";
1378 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1379 goto fail;
1380 }
1381 }
1382
1383 if ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1) ||
1384 (auth_alg == WLAN_AUTH_SHARED_KEY &&
1385 (auth_transaction == 1 ||
1386 (auth_transaction == 3 && sta != NULL &&
1387 sta->u.sta.challenge != NULL)))) {
1388 } else {
1389 txt = "unknown authentication transaction number";
1390 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1391 goto fail;
1392 }
1393
1394 if (sta == NULL) {
1395 txt = "new STA";
1396
1397 if (local->ap->num_sta >= MAX_STA_COUNT) {
1398 /* FIX: might try to remove some old STAs first? */
1399 txt = "no more room for new STAs";
1400 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1401 goto fail;
1402 }
1403
1404 sta = ap_add_sta(local->ap, hdr->addr2);
1405 if (sta == NULL) {
1406 txt = "ap_add_sta failed";
1407 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1408 goto fail;
1409 }
1410 }
1411
1412 switch (auth_alg) {
1413 case WLAN_AUTH_OPEN:
1414 txt = "authOK";
1415 /* IEEE 802.11 standard is not completely clear about
1416 * whether STA is considered authenticated after
1417 * authentication OK frame has been send or after it
1418 * has been ACKed. In order to reduce interoperability
1419 * issues, mark the STA authenticated before ACK. */
1420 sta->flags |= WLAN_STA_AUTH;
1421 break;
1422
1423 case WLAN_AUTH_SHARED_KEY:
1424 if (auth_transaction == 1) {
1425 if (sta->u.sta.challenge == NULL) {
1426 sta->u.sta.challenge =
1427 ap_auth_make_challenge(local->ap);
1428 if (sta->u.sta.challenge == NULL) {
1429 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1430 goto fail;
1431 }
1432 }
1433 } else {
1434 if (sta->u.sta.challenge == NULL ||
1435 challenge == NULL ||
1436 memcmp(sta->u.sta.challenge, challenge,
1437 WLAN_AUTH_CHALLENGE_LEN) != 0 ||
1438 !(fc & IEEE80211_FCTL_PROTECTED)) {
1439 txt = "challenge response incorrect";
1440 resp = WLAN_STATUS_CHALLENGE_FAIL;
1441 goto fail;
1442 }
1443
1444 txt = "challenge OK - authOK";
1445 /* IEEE 802.11 standard is not completely clear about
1446 * whether STA is considered authenticated after
1447 * authentication OK frame has been send or after it
1448 * has been ACKed. In order to reduce interoperability
1449 * issues, mark the STA authenticated before ACK. */
1450 sta->flags |= WLAN_STA_AUTH;
1451 kfree(sta->u.sta.challenge);
1452 sta->u.sta.challenge = NULL;
1453 }
1454 break;
1455 }
1456
1457 fail:
1458 pos = (__le16 *) body;
1459 *pos = cpu_to_le16(auth_alg);
1460 pos++;
1461 *pos = cpu_to_le16(auth_transaction + 1);
1462 pos++;
1463 *pos = cpu_to_le16(resp); /* status_code */
1464 pos++;
1465 olen = 6;
1466
1467 if (resp == WLAN_STATUS_SUCCESS && sta != NULL &&
1468 sta->u.sta.challenge != NULL &&
1469 auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 1) {
1470 u8 *tmp = (u8 *) pos;
1471 *tmp++ = WLAN_EID_CHALLENGE;
1472 *tmp++ = WLAN_AUTH_CHALLENGE_LEN;
1473 pos++;
1474 memcpy(pos, sta->u.sta.challenge, WLAN_AUTH_CHALLENGE_LEN);
1475 olen += 2 + WLAN_AUTH_CHALLENGE_LEN;
1476 }
1477
1478 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH,
1479 body, olen, hdr->addr2, ap->tx_callback_auth);
1480
1481 if (sta) {
1482 sta->last_rx = jiffies;
1483 atomic_dec(&sta->users);
1484 }
1485
1486 if (resp) {
1487 PDEBUG(DEBUG_AP, "%s: %pM auth (alg=%d "
1488 "trans#=%d stat=%d len=%d fc=%04x) ==> %d (%s)\n",
1489 dev->name, hdr->addr2,
1490 auth_alg, auth_transaction, status_code, len,
1491 fc, resp, txt);
1492 }
1493 }
1494
1495
1496 /* Called only as a scheduled task for pending AP frames. */
handle_assoc(local_info_t * local,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats,int reassoc)1497 static void handle_assoc(local_info_t *local, struct sk_buff *skb,
1498 struct hostap_80211_rx_status *rx_stats, int reassoc)
1499 {
1500 struct net_device *dev = local->dev;
1501 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
1502 char body[12], *p, *lpos;
1503 int len, left;
1504 __le16 *pos;
1505 u16 resp = WLAN_STATUS_SUCCESS;
1506 struct sta_info *sta = NULL;
1507 int send_deauth = 0;
1508 char *txt = "";
1509 u8 prev_ap[ETH_ALEN];
1510
1511 left = len = skb->len - IEEE80211_MGMT_HDR_LEN;
1512
1513 if (len < (reassoc ? 10 : 4)) {
1514 PDEBUG(DEBUG_AP, "%s: handle_assoc - too short payload "
1515 "(len=%d, reassoc=%d) from %pM\n",
1516 dev->name, len, reassoc, hdr->addr2);
1517 return;
1518 }
1519
1520 spin_lock_bh(&local->ap->sta_table_lock);
1521 sta = ap_get_sta(local->ap, hdr->addr2);
1522 if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
1523 spin_unlock_bh(&local->ap->sta_table_lock);
1524 txt = "trying to associate before authentication";
1525 send_deauth = 1;
1526 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1527 sta = NULL; /* do not decrement sta->users */
1528 goto fail;
1529 }
1530 atomic_inc(&sta->users);
1531 spin_unlock_bh(&local->ap->sta_table_lock);
1532
1533 pos = (__le16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
1534 sta->capability = __le16_to_cpu(*pos);
1535 pos++; left -= 2;
1536 sta->listen_interval = __le16_to_cpu(*pos);
1537 pos++; left -= 2;
1538
1539 if (reassoc) {
1540 memcpy(prev_ap, pos, ETH_ALEN);
1541 pos++; pos++; pos++; left -= 6;
1542 } else
1543 memset(prev_ap, 0, ETH_ALEN);
1544
1545 if (left >= 2) {
1546 unsigned int ileft;
1547 unsigned char *u = (unsigned char *) pos;
1548
1549 if (*u == WLAN_EID_SSID) {
1550 u++; left--;
1551 ileft = *u;
1552 u++; left--;
1553
1554 if (ileft > left || ileft > MAX_SSID_LEN) {
1555 txt = "SSID overflow";
1556 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1557 goto fail;
1558 }
1559
1560 if (ileft != strlen(local->essid) ||
1561 memcmp(local->essid, u, ileft) != 0) {
1562 txt = "not our SSID";
1563 resp = WLAN_STATUS_ASSOC_DENIED_UNSPEC;
1564 goto fail;
1565 }
1566
1567 u += ileft;
1568 left -= ileft;
1569 }
1570
1571 if (left >= 2 && *u == WLAN_EID_SUPP_RATES) {
1572 u++; left--;
1573 ileft = *u;
1574 u++; left--;
1575
1576 if (ileft > left || ileft == 0 ||
1577 ileft > WLAN_SUPP_RATES_MAX) {
1578 txt = "SUPP_RATES len error";
1579 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1580 goto fail;
1581 }
1582
1583 memset(sta->supported_rates, 0,
1584 sizeof(sta->supported_rates));
1585 memcpy(sta->supported_rates, u, ileft);
1586 prism2_check_tx_rates(sta);
1587
1588 u += ileft;
1589 left -= ileft;
1590 }
1591
1592 if (left > 0) {
1593 PDEBUG(DEBUG_AP, "%s: assoc from %pM"
1594 " with extra data (%d bytes) [",
1595 dev->name, hdr->addr2, left);
1596 while (left > 0) {
1597 PDEBUG2(DEBUG_AP, "<%02x>", *u);
1598 u++; left--;
1599 }
1600 PDEBUG2(DEBUG_AP, "]\n");
1601 }
1602 } else {
1603 txt = "frame underflow";
1604 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1605 goto fail;
1606 }
1607
1608 /* get a unique AID */
1609 if (sta->aid > 0)
1610 txt = "OK, old AID";
1611 else {
1612 spin_lock_bh(&local->ap->sta_table_lock);
1613 for (sta->aid = 1; sta->aid <= MAX_AID_TABLE_SIZE; sta->aid++)
1614 if (local->ap->sta_aid[sta->aid - 1] == NULL)
1615 break;
1616 if (sta->aid > MAX_AID_TABLE_SIZE) {
1617 sta->aid = 0;
1618 spin_unlock_bh(&local->ap->sta_table_lock);
1619 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1620 txt = "no room for more AIDs";
1621 } else {
1622 local->ap->sta_aid[sta->aid - 1] = sta;
1623 spin_unlock_bh(&local->ap->sta_table_lock);
1624 txt = "OK, new AID";
1625 }
1626 }
1627
1628 fail:
1629 pos = (__le16 *) body;
1630
1631 if (send_deauth) {
1632 *pos = cpu_to_le16(WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH);
1633 pos++;
1634 } else {
1635 /* FIX: CF-Pollable and CF-PollReq should be set to match the
1636 * values in beacons/probe responses */
1637 /* FIX: how about privacy and WEP? */
1638 /* capability */
1639 *pos = cpu_to_le16(WLAN_CAPABILITY_ESS);
1640 pos++;
1641
1642 /* status_code */
1643 *pos = cpu_to_le16(resp);
1644 pos++;
1645
1646 *pos = cpu_to_le16((sta && sta->aid > 0 ? sta->aid : 0) |
1647 BIT(14) | BIT(15)); /* AID */
1648 pos++;
1649
1650 /* Supported rates (Information element) */
1651 p = (char *) pos;
1652 *p++ = WLAN_EID_SUPP_RATES;
1653 lpos = p;
1654 *p++ = 0; /* len */
1655 if (local->tx_rate_control & WLAN_RATE_1M) {
1656 *p++ = local->basic_rates & WLAN_RATE_1M ? 0x82 : 0x02;
1657 (*lpos)++;
1658 }
1659 if (local->tx_rate_control & WLAN_RATE_2M) {
1660 *p++ = local->basic_rates & WLAN_RATE_2M ? 0x84 : 0x04;
1661 (*lpos)++;
1662 }
1663 if (local->tx_rate_control & WLAN_RATE_5M5) {
1664 *p++ = local->basic_rates & WLAN_RATE_5M5 ?
1665 0x8b : 0x0b;
1666 (*lpos)++;
1667 }
1668 if (local->tx_rate_control & WLAN_RATE_11M) {
1669 *p++ = local->basic_rates & WLAN_RATE_11M ?
1670 0x96 : 0x16;
1671 (*lpos)++;
1672 }
1673 pos = (__le16 *) p;
1674 }
1675
1676 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
1677 (send_deauth ? IEEE80211_STYPE_DEAUTH :
1678 (reassoc ? IEEE80211_STYPE_REASSOC_RESP :
1679 IEEE80211_STYPE_ASSOC_RESP)),
1680 body, (u8 *) pos - (u8 *) body,
1681 hdr->addr2,
1682 send_deauth ? 0 : local->ap->tx_callback_assoc);
1683
1684 if (sta) {
1685 if (resp == WLAN_STATUS_SUCCESS) {
1686 sta->last_rx = jiffies;
1687 /* STA will be marked associated from TX callback, if
1688 * AssocResp is ACKed */
1689 }
1690 atomic_dec(&sta->users);
1691 }
1692
1693 #if 0
1694 PDEBUG(DEBUG_AP, "%s: %pM %sassoc (len=%d "
1695 "prev_ap=%pM) => %d(%d) (%s)\n",
1696 dev->name,
1697 hdr->addr2,
1698 reassoc ? "re" : "", len,
1699 prev_ap,
1700 resp, send_deauth, txt);
1701 #endif
1702 }
1703
1704
1705 /* Called only as a scheduled task for pending AP frames. */
handle_deauth(local_info_t * local,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats)1706 static void handle_deauth(local_info_t *local, struct sk_buff *skb,
1707 struct hostap_80211_rx_status *rx_stats)
1708 {
1709 struct net_device *dev = local->dev;
1710 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
1711 char *body = (char *) (skb->data + IEEE80211_MGMT_HDR_LEN);
1712 int len;
1713 u16 reason_code;
1714 __le16 *pos;
1715 struct sta_info *sta = NULL;
1716
1717 len = skb->len - IEEE80211_MGMT_HDR_LEN;
1718
1719 if (len < 2) {
1720 printk("handle_deauth - too short payload (len=%d)\n", len);
1721 return;
1722 }
1723
1724 pos = (__le16 *) body;
1725 reason_code = le16_to_cpu(*pos);
1726
1727 PDEBUG(DEBUG_AP, "%s: deauthentication: %pM len=%d, "
1728 "reason_code=%d\n", dev->name, hdr->addr2,
1729 len, reason_code);
1730
1731 spin_lock_bh(&local->ap->sta_table_lock);
1732 sta = ap_get_sta(local->ap, hdr->addr2);
1733 if (sta != NULL) {
1734 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
1735 hostap_event_expired_sta(local->dev, sta);
1736 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
1737 }
1738 spin_unlock_bh(&local->ap->sta_table_lock);
1739 if (sta == NULL) {
1740 printk("%s: deauthentication from %pM, "
1741 "reason_code=%d, but STA not authenticated\n", dev->name,
1742 hdr->addr2, reason_code);
1743 }
1744 }
1745
1746
1747 /* Called only as a scheduled task for pending AP frames. */
handle_disassoc(local_info_t * local,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats)1748 static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
1749 struct hostap_80211_rx_status *rx_stats)
1750 {
1751 struct net_device *dev = local->dev;
1752 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
1753 char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
1754 int len;
1755 u16 reason_code;
1756 __le16 *pos;
1757 struct sta_info *sta = NULL;
1758
1759 len = skb->len - IEEE80211_MGMT_HDR_LEN;
1760
1761 if (len < 2) {
1762 printk("handle_disassoc - too short payload (len=%d)\n", len);
1763 return;
1764 }
1765
1766 pos = (__le16 *) body;
1767 reason_code = le16_to_cpu(*pos);
1768
1769 PDEBUG(DEBUG_AP, "%s: disassociation: %pM len=%d, "
1770 "reason_code=%d\n", dev->name, hdr->addr2,
1771 len, reason_code);
1772
1773 spin_lock_bh(&local->ap->sta_table_lock);
1774 sta = ap_get_sta(local->ap, hdr->addr2);
1775 if (sta != NULL) {
1776 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
1777 hostap_event_expired_sta(local->dev, sta);
1778 sta->flags &= ~WLAN_STA_ASSOC;
1779 }
1780 spin_unlock_bh(&local->ap->sta_table_lock);
1781 if (sta == NULL) {
1782 printk("%s: disassociation from %pM, "
1783 "reason_code=%d, but STA not authenticated\n",
1784 dev->name, hdr->addr2, reason_code);
1785 }
1786 }
1787
1788
1789 /* Called only as a scheduled task for pending AP frames. */
ap_handle_data_nullfunc(local_info_t * local,struct ieee80211_hdr_4addr * hdr)1790 static void ap_handle_data_nullfunc(local_info_t *local,
1791 struct ieee80211_hdr_4addr *hdr)
1792 {
1793 struct net_device *dev = local->dev;
1794
1795 /* some STA f/w's seem to require control::ACK frame for
1796 * data::nullfunc, but at least Prism2 station f/w version 0.8.0 does
1797 * not send this..
1798 * send control::ACK for the data::nullfunc */
1799
1800 printk(KERN_DEBUG "Sending control::ACK for data::nullfunc\n");
1801 prism2_send_mgmt(dev, IEEE80211_FTYPE_CTL | IEEE80211_STYPE_ACK,
1802 NULL, 0, hdr->addr2, 0);
1803 }
1804
1805
1806 /* Called only as a scheduled task for pending AP frames. */
ap_handle_dropped_data(local_info_t * local,struct ieee80211_hdr_4addr * hdr)1807 static void ap_handle_dropped_data(local_info_t *local,
1808 struct ieee80211_hdr_4addr *hdr)
1809 {
1810 struct net_device *dev = local->dev;
1811 struct sta_info *sta;
1812 __le16 reason;
1813
1814 spin_lock_bh(&local->ap->sta_table_lock);
1815 sta = ap_get_sta(local->ap, hdr->addr2);
1816 if (sta)
1817 atomic_inc(&sta->users);
1818 spin_unlock_bh(&local->ap->sta_table_lock);
1819
1820 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC)) {
1821 PDEBUG(DEBUG_AP, "ap_handle_dropped_data: STA is now okay?\n");
1822 atomic_dec(&sta->users);
1823 return;
1824 }
1825
1826 reason = cpu_to_le16(WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
1827 prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
1828 ((sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) ?
1829 IEEE80211_STYPE_DEAUTH : IEEE80211_STYPE_DISASSOC),
1830 (char *) &reason, sizeof(reason), hdr->addr2, 0);
1831
1832 if (sta)
1833 atomic_dec(&sta->users);
1834 }
1835
1836 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
1837
1838
1839 /* Called only as a scheduled task for pending AP frames. */
pspoll_send_buffered(local_info_t * local,struct sta_info * sta,struct sk_buff * skb)1840 static void pspoll_send_buffered(local_info_t *local, struct sta_info *sta,
1841 struct sk_buff *skb)
1842 {
1843 struct hostap_skb_tx_data *meta;
1844
1845 if (!(sta->flags & WLAN_STA_PS)) {
1846 /* Station has moved to non-PS mode, so send all buffered
1847 * frames using normal device queue. */
1848 dev_queue_xmit(skb);
1849 return;
1850 }
1851
1852 /* add a flag for hostap_handle_sta_tx() to know that this skb should
1853 * be passed through even though STA is using PS */
1854 meta = (struct hostap_skb_tx_data *) skb->cb;
1855 meta->flags |= HOSTAP_TX_FLAGS_BUFFERED_FRAME;
1856 if (!skb_queue_empty(&sta->tx_buf)) {
1857 /* indicate to STA that more frames follow */
1858 meta->flags |= HOSTAP_TX_FLAGS_ADD_MOREDATA;
1859 }
1860 dev_queue_xmit(skb);
1861 }
1862
1863
1864 /* Called only as a scheduled task for pending AP frames. */
handle_pspoll(local_info_t * local,struct ieee80211_hdr_4addr * hdr,struct hostap_80211_rx_status * rx_stats)1865 static void handle_pspoll(local_info_t *local,
1866 struct ieee80211_hdr_4addr *hdr,
1867 struct hostap_80211_rx_status *rx_stats)
1868 {
1869 struct net_device *dev = local->dev;
1870 struct sta_info *sta;
1871 u16 aid;
1872 struct sk_buff *skb;
1873
1874 PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=%pM, TA=%pM PWRMGT=%d\n",
1875 hdr->addr1, hdr->addr2,
1876 !!(le16_to_cpu(hdr->frame_ctl) & IEEE80211_FCTL_PM));
1877
1878 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
1879 PDEBUG(DEBUG_AP,
1880 "handle_pspoll - addr1(BSSID)=%pM not own MAC\n",
1881 hdr->addr1);
1882 return;
1883 }
1884
1885 aid = le16_to_cpu(hdr->duration_id);
1886 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14))) {
1887 PDEBUG(DEBUG_PS, " PSPOLL and AID[15:14] not set\n");
1888 return;
1889 }
1890 aid &= ~(BIT(15) | BIT(14));
1891 if (aid == 0 || aid > MAX_AID_TABLE_SIZE) {
1892 PDEBUG(DEBUG_PS, " invalid aid=%d\n", aid);
1893 return;
1894 }
1895 PDEBUG(DEBUG_PS2, " aid=%d\n", aid);
1896
1897 spin_lock_bh(&local->ap->sta_table_lock);
1898 sta = ap_get_sta(local->ap, hdr->addr2);
1899 if (sta)
1900 atomic_inc(&sta->users);
1901 spin_unlock_bh(&local->ap->sta_table_lock);
1902
1903 if (sta == NULL) {
1904 PDEBUG(DEBUG_PS, " STA not found\n");
1905 return;
1906 }
1907 if (sta->aid != aid) {
1908 PDEBUG(DEBUG_PS, " received aid=%i does not match with "
1909 "assoc.aid=%d\n", aid, sta->aid);
1910 return;
1911 }
1912
1913 /* FIX: todo:
1914 * - add timeout for buffering (clear aid in TIM vector if buffer timed
1915 * out (expiry time must be longer than ListenInterval for
1916 * the corresponding STA; "8802-11: 11.2.1.9 AP aging function"
1917 * - what to do, if buffered, pspolled, and sent frame is not ACKed by
1918 * sta; store buffer for later use and leave TIM aid bit set? use
1919 * TX event to check whether frame was ACKed?
1920 */
1921
1922 while ((skb = skb_dequeue(&sta->tx_buf)) != NULL) {
1923 /* send buffered frame .. */
1924 PDEBUG(DEBUG_PS2, "Sending buffered frame to STA after PS POLL"
1925 " (buffer_count=%d)\n", skb_queue_len(&sta->tx_buf));
1926
1927 pspoll_send_buffered(local, sta, skb);
1928
1929 if (sta->flags & WLAN_STA_PS) {
1930 /* send only one buffered packet per PS Poll */
1931 /* FIX: should ignore further PS Polls until the
1932 * buffered packet that was just sent is acknowledged
1933 * (Tx or TxExc event) */
1934 break;
1935 }
1936 }
1937
1938 if (skb_queue_empty(&sta->tx_buf)) {
1939 /* try to clear aid from TIM */
1940 if (!(sta->flags & WLAN_STA_TIM))
1941 PDEBUG(DEBUG_PS2, "Re-unsetting TIM for aid %d\n",
1942 aid);
1943 hostap_set_tim(local, aid, 0);
1944 sta->flags &= ~WLAN_STA_TIM;
1945 }
1946
1947 atomic_dec(&sta->users);
1948 }
1949
1950
1951 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
1952
handle_wds_oper_queue(struct work_struct * work)1953 static void handle_wds_oper_queue(struct work_struct *work)
1954 {
1955 struct ap_data *ap = container_of(work, struct ap_data,
1956 wds_oper_queue);
1957 local_info_t *local = ap->local;
1958 struct wds_oper_data *entry, *prev;
1959
1960 spin_lock_bh(&local->lock);
1961 entry = local->ap->wds_oper_entries;
1962 local->ap->wds_oper_entries = NULL;
1963 spin_unlock_bh(&local->lock);
1964
1965 while (entry) {
1966 PDEBUG(DEBUG_AP, "%s: %s automatic WDS connection "
1967 "to AP %pM\n",
1968 local->dev->name,
1969 entry->type == WDS_ADD ? "adding" : "removing",
1970 entry->addr);
1971 if (entry->type == WDS_ADD)
1972 prism2_wds_add(local, entry->addr, 0);
1973 else if (entry->type == WDS_DEL)
1974 prism2_wds_del(local, entry->addr, 0, 1);
1975
1976 prev = entry;
1977 entry = entry->next;
1978 kfree(prev);
1979 }
1980 }
1981
1982
1983 /* Called only as a scheduled task for pending AP frames. */
handle_beacon(local_info_t * local,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats)1984 static void handle_beacon(local_info_t *local, struct sk_buff *skb,
1985 struct hostap_80211_rx_status *rx_stats)
1986 {
1987 struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
1988 char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
1989 int len, left;
1990 u16 beacon_int, capability;
1991 __le16 *pos;
1992 char *ssid = NULL;
1993 unsigned char *supp_rates = NULL;
1994 int ssid_len = 0, supp_rates_len = 0;
1995 struct sta_info *sta = NULL;
1996 int new_sta = 0, channel = -1;
1997
1998 len = skb->len - IEEE80211_MGMT_HDR_LEN;
1999
2000 if (len < 8 + 2 + 2) {
2001 printk(KERN_DEBUG "handle_beacon - too short payload "
2002 "(len=%d)\n", len);
2003 return;
2004 }
2005
2006 pos = (__le16 *) body;
2007 left = len;
2008
2009 /* Timestamp (8 octets) */
2010 pos += 4; left -= 8;
2011 /* Beacon interval (2 octets) */
2012 beacon_int = le16_to_cpu(*pos);
2013 pos++; left -= 2;
2014 /* Capability information (2 octets) */
2015 capability = le16_to_cpu(*pos);
2016 pos++; left -= 2;
2017
2018 if (local->ap->ap_policy != AP_OTHER_AP_EVEN_IBSS &&
2019 capability & WLAN_CAPABILITY_IBSS)
2020 return;
2021
2022 if (left >= 2) {
2023 unsigned int ileft;
2024 unsigned char *u = (unsigned char *) pos;
2025
2026 if (*u == WLAN_EID_SSID) {
2027 u++; left--;
2028 ileft = *u;
2029 u++; left--;
2030
2031 if (ileft > left || ileft > MAX_SSID_LEN) {
2032 PDEBUG(DEBUG_AP, "SSID: overflow\n");
2033 return;
2034 }
2035
2036 if (local->ap->ap_policy == AP_OTHER_AP_SAME_SSID &&
2037 (ileft != strlen(local->essid) ||
2038 memcmp(local->essid, u, ileft) != 0)) {
2039 /* not our SSID */
2040 return;
2041 }
2042
2043 ssid = u;
2044 ssid_len = ileft;
2045
2046 u += ileft;
2047 left -= ileft;
2048 }
2049
2050 if (*u == WLAN_EID_SUPP_RATES) {
2051 u++; left--;
2052 ileft = *u;
2053 u++; left--;
2054
2055 if (ileft > left || ileft == 0 || ileft > 8) {
2056 PDEBUG(DEBUG_AP, " - SUPP_RATES len error\n");
2057 return;
2058 }
2059
2060 supp_rates = u;
2061 supp_rates_len = ileft;
2062
2063 u += ileft;
2064 left -= ileft;
2065 }
2066
2067 if (*u == WLAN_EID_DS_PARAMS) {
2068 u++; left--;
2069 ileft = *u;
2070 u++; left--;
2071
2072 if (ileft > left || ileft != 1) {
2073 PDEBUG(DEBUG_AP, " - DS_PARAMS len error\n");
2074 return;
2075 }
2076
2077 channel = *u;
2078
2079 u += ileft;
2080 left -= ileft;
2081 }
2082 }
2083
2084 spin_lock_bh(&local->ap->sta_table_lock);
2085 sta = ap_get_sta(local->ap, hdr->addr2);
2086 if (sta != NULL)
2087 atomic_inc(&sta->users);
2088 spin_unlock_bh(&local->ap->sta_table_lock);
2089
2090 if (sta == NULL) {
2091 /* add new AP */
2092 new_sta = 1;
2093 sta = ap_add_sta(local->ap, hdr->addr2);
2094 if (sta == NULL) {
2095 printk(KERN_INFO "prism2: kmalloc failed for AP "
2096 "data structure\n");
2097 return;
2098 }
2099 hostap_event_new_sta(local->dev, sta);
2100
2101 /* mark APs authentication and associated for pseudo ad-hoc
2102 * style communication */
2103 sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
2104
2105 if (local->ap->autom_ap_wds) {
2106 hostap_wds_link_oper(local, sta->addr, WDS_ADD);
2107 }
2108 }
2109
2110 sta->ap = 1;
2111 if (ssid) {
2112 sta->u.ap.ssid_len = ssid_len;
2113 memcpy(sta->u.ap.ssid, ssid, ssid_len);
2114 sta->u.ap.ssid[ssid_len] = '\0';
2115 } else {
2116 sta->u.ap.ssid_len = 0;
2117 sta->u.ap.ssid[0] = '\0';
2118 }
2119 sta->u.ap.channel = channel;
2120 sta->rx_packets++;
2121 sta->rx_bytes += len;
2122 sta->u.ap.last_beacon = sta->last_rx = jiffies;
2123 sta->capability = capability;
2124 sta->listen_interval = beacon_int;
2125
2126 atomic_dec(&sta->users);
2127
2128 if (new_sta) {
2129 memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
2130 memcpy(sta->supported_rates, supp_rates, supp_rates_len);
2131 prism2_check_tx_rates(sta);
2132 }
2133 }
2134
2135 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2136
2137
2138 /* Called only as a tasklet. */
handle_ap_item(local_info_t * local,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats)2139 static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
2140 struct hostap_80211_rx_status *rx_stats)
2141 {
2142 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2143 struct net_device *dev = local->dev;
2144 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2145 u16 fc, type, stype;
2146 struct ieee80211_hdr_4addr *hdr;
2147
2148 /* FIX: should give skb->len to handler functions and check that the
2149 * buffer is long enough */
2150 hdr = (struct ieee80211_hdr_4addr *) skb->data;
2151 fc = le16_to_cpu(hdr->frame_ctl);
2152 type = WLAN_FC_GET_TYPE(fc);
2153 stype = WLAN_FC_GET_STYPE(fc);
2154
2155 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2156 if (!local->hostapd && type == IEEE80211_FTYPE_DATA) {
2157 PDEBUG(DEBUG_AP, "handle_ap_item - data frame\n");
2158
2159 if (!(fc & IEEE80211_FCTL_TODS) ||
2160 (fc & IEEE80211_FCTL_FROMDS)) {
2161 if (stype == IEEE80211_STYPE_NULLFUNC) {
2162 /* no ToDS nullfunc seems to be used to check
2163 * AP association; so send reject message to
2164 * speed up re-association */
2165 ap_handle_dropped_data(local, hdr);
2166 goto done;
2167 }
2168 PDEBUG(DEBUG_AP, " not ToDS frame (fc=0x%04x)\n",
2169 fc);
2170 goto done;
2171 }
2172
2173 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
2174 PDEBUG(DEBUG_AP, "handle_ap_item - addr1(BSSID)=%pM"
2175 " not own MAC\n", hdr->addr1);
2176 goto done;
2177 }
2178
2179 if (local->ap->nullfunc_ack &&
2180 stype == IEEE80211_STYPE_NULLFUNC)
2181 ap_handle_data_nullfunc(local, hdr);
2182 else
2183 ap_handle_dropped_data(local, hdr);
2184 goto done;
2185 }
2186
2187 if (type == IEEE80211_FTYPE_MGMT && stype == IEEE80211_STYPE_BEACON) {
2188 handle_beacon(local, skb, rx_stats);
2189 goto done;
2190 }
2191 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2192
2193 if (type == IEEE80211_FTYPE_CTL && stype == IEEE80211_STYPE_PSPOLL) {
2194 handle_pspoll(local, hdr, rx_stats);
2195 goto done;
2196 }
2197
2198 if (local->hostapd) {
2199 PDEBUG(DEBUG_AP, "Unknown frame in AP queue: type=0x%02x "
2200 "subtype=0x%02x\n", type, stype);
2201 goto done;
2202 }
2203
2204 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2205 if (type != IEEE80211_FTYPE_MGMT) {
2206 PDEBUG(DEBUG_AP, "handle_ap_item - not a management frame?\n");
2207 goto done;
2208 }
2209
2210 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
2211 PDEBUG(DEBUG_AP, "handle_ap_item - addr1(DA)=%pM"
2212 " not own MAC\n", hdr->addr1);
2213 goto done;
2214 }
2215
2216 if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN)) {
2217 PDEBUG(DEBUG_AP, "handle_ap_item - addr3(BSSID)=%pM"
2218 " not own MAC\n", hdr->addr3);
2219 goto done;
2220 }
2221
2222 switch (stype) {
2223 case IEEE80211_STYPE_ASSOC_REQ:
2224 handle_assoc(local, skb, rx_stats, 0);
2225 break;
2226 case IEEE80211_STYPE_ASSOC_RESP:
2227 PDEBUG(DEBUG_AP, "==> ASSOC RESP (ignored)\n");
2228 break;
2229 case IEEE80211_STYPE_REASSOC_REQ:
2230 handle_assoc(local, skb, rx_stats, 1);
2231 break;
2232 case IEEE80211_STYPE_REASSOC_RESP:
2233 PDEBUG(DEBUG_AP, "==> REASSOC RESP (ignored)\n");
2234 break;
2235 case IEEE80211_STYPE_ATIM:
2236 PDEBUG(DEBUG_AP, "==> ATIM (ignored)\n");
2237 break;
2238 case IEEE80211_STYPE_DISASSOC:
2239 handle_disassoc(local, skb, rx_stats);
2240 break;
2241 case IEEE80211_STYPE_AUTH:
2242 handle_authen(local, skb, rx_stats);
2243 break;
2244 case IEEE80211_STYPE_DEAUTH:
2245 handle_deauth(local, skb, rx_stats);
2246 break;
2247 default:
2248 PDEBUG(DEBUG_AP, "Unknown mgmt frame subtype 0x%02x\n",
2249 stype >> 4);
2250 break;
2251 }
2252 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2253
2254 done:
2255 dev_kfree_skb(skb);
2256 }
2257
2258
2259 /* Called only as a tasklet (software IRQ) */
hostap_rx(struct net_device * dev,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats)2260 void hostap_rx(struct net_device *dev, struct sk_buff *skb,
2261 struct hostap_80211_rx_status *rx_stats)
2262 {
2263 struct hostap_interface *iface;
2264 local_info_t *local;
2265 u16 fc;
2266 struct ieee80211_hdr_4addr *hdr;
2267
2268 iface = netdev_priv(dev);
2269 local = iface->local;
2270
2271 if (skb->len < 16)
2272 goto drop;
2273
2274 local->stats.rx_packets++;
2275
2276 hdr = (struct ieee80211_hdr_4addr *) skb->data;
2277 fc = le16_to_cpu(hdr->frame_ctl);
2278
2279 if (local->ap->ap_policy == AP_OTHER_AP_SKIP_ALL &&
2280 WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_MGMT &&
2281 WLAN_FC_GET_STYPE(fc) == IEEE80211_STYPE_BEACON)
2282 goto drop;
2283
2284 skb->protocol = __constant_htons(ETH_P_HOSTAP);
2285 handle_ap_item(local, skb, rx_stats);
2286 return;
2287
2288 drop:
2289 dev_kfree_skb(skb);
2290 }
2291
2292
2293 /* Called only as a tasklet (software IRQ) */
schedule_packet_send(local_info_t * local,struct sta_info * sta)2294 static void schedule_packet_send(local_info_t *local, struct sta_info *sta)
2295 {
2296 struct sk_buff *skb;
2297 struct ieee80211_hdr_4addr *hdr;
2298 struct hostap_80211_rx_status rx_stats;
2299
2300 if (skb_queue_empty(&sta->tx_buf))
2301 return;
2302
2303 skb = dev_alloc_skb(16);
2304 if (skb == NULL) {
2305 printk(KERN_DEBUG "%s: schedule_packet_send: skb alloc "
2306 "failed\n", local->dev->name);
2307 return;
2308 }
2309
2310 hdr = (struct ieee80211_hdr_4addr *) skb_put(skb, 16);
2311
2312 /* Generate a fake pspoll frame to start packet delivery */
2313 hdr->frame_ctl = __constant_cpu_to_le16(
2314 IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
2315 memcpy(hdr->addr1, local->dev->dev_addr, ETH_ALEN);
2316 memcpy(hdr->addr2, sta->addr, ETH_ALEN);
2317 hdr->duration_id = cpu_to_le16(sta->aid | BIT(15) | BIT(14));
2318
2319 PDEBUG(DEBUG_PS2,
2320 "%s: Scheduling buffered packet delivery for STA %pM\n",
2321 local->dev->name, sta->addr);
2322
2323 skb->dev = local->dev;
2324
2325 memset(&rx_stats, 0, sizeof(rx_stats));
2326 hostap_rx(local->dev, skb, &rx_stats);
2327 }
2328
2329
prism2_ap_get_sta_qual(local_info_t * local,struct sockaddr addr[],struct iw_quality qual[],int buf_size,int aplist)2330 int prism2_ap_get_sta_qual(local_info_t *local, struct sockaddr addr[],
2331 struct iw_quality qual[], int buf_size,
2332 int aplist)
2333 {
2334 struct ap_data *ap = local->ap;
2335 struct list_head *ptr;
2336 int count = 0;
2337
2338 spin_lock_bh(&ap->sta_table_lock);
2339
2340 for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list;
2341 ptr = ptr->next) {
2342 struct sta_info *sta = (struct sta_info *) ptr;
2343
2344 if (aplist && !sta->ap)
2345 continue;
2346 addr[count].sa_family = ARPHRD_ETHER;
2347 memcpy(addr[count].sa_data, sta->addr, ETH_ALEN);
2348 if (sta->last_rx_silence == 0)
2349 qual[count].qual = sta->last_rx_signal < 27 ?
2350 0 : (sta->last_rx_signal - 27) * 92 / 127;
2351 else
2352 qual[count].qual = sta->last_rx_signal -
2353 sta->last_rx_silence - 35;
2354 qual[count].level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
2355 qual[count].noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
2356 qual[count].updated = sta->last_rx_updated;
2357
2358 sta->last_rx_updated = IW_QUAL_DBM;
2359
2360 count++;
2361 if (count >= buf_size)
2362 break;
2363 }
2364 spin_unlock_bh(&ap->sta_table_lock);
2365
2366 return count;
2367 }
2368
2369
2370 /* Translate our list of Access Points & Stations to a card independant
2371 * format that the Wireless Tools will understand - Jean II */
prism2_ap_translate_scan(struct net_device * dev,struct iw_request_info * info,char * buffer)2372 int prism2_ap_translate_scan(struct net_device *dev,
2373 struct iw_request_info *info, char *buffer)
2374 {
2375 struct hostap_interface *iface;
2376 local_info_t *local;
2377 struct ap_data *ap;
2378 struct list_head *ptr;
2379 struct iw_event iwe;
2380 char *current_ev = buffer;
2381 char *end_buf = buffer + IW_SCAN_MAX_DATA;
2382 #if !defined(PRISM2_NO_KERNEL_IEEE80211_MGMT)
2383 char buf[64];
2384 #endif
2385
2386 iface = netdev_priv(dev);
2387 local = iface->local;
2388 ap = local->ap;
2389
2390 spin_lock_bh(&ap->sta_table_lock);
2391
2392 for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list;
2393 ptr = ptr->next) {
2394 struct sta_info *sta = (struct sta_info *) ptr;
2395
2396 /* First entry *MUST* be the AP MAC address */
2397 memset(&iwe, 0, sizeof(iwe));
2398 iwe.cmd = SIOCGIWAP;
2399 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2400 memcpy(iwe.u.ap_addr.sa_data, sta->addr, ETH_ALEN);
2401 iwe.len = IW_EV_ADDR_LEN;
2402 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
2403 &iwe, IW_EV_ADDR_LEN);
2404
2405 /* Use the mode to indicate if it's a station or
2406 * an Access Point */
2407 memset(&iwe, 0, sizeof(iwe));
2408 iwe.cmd = SIOCGIWMODE;
2409 if (sta->ap)
2410 iwe.u.mode = IW_MODE_MASTER;
2411 else
2412 iwe.u.mode = IW_MODE_INFRA;
2413 iwe.len = IW_EV_UINT_LEN;
2414 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
2415 &iwe, IW_EV_UINT_LEN);
2416
2417 /* Some quality */
2418 memset(&iwe, 0, sizeof(iwe));
2419 iwe.cmd = IWEVQUAL;
2420 if (sta->last_rx_silence == 0)
2421 iwe.u.qual.qual = sta->last_rx_signal < 27 ?
2422 0 : (sta->last_rx_signal - 27) * 92 / 127;
2423 else
2424 iwe.u.qual.qual = sta->last_rx_signal -
2425 sta->last_rx_silence - 35;
2426 iwe.u.qual.level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
2427 iwe.u.qual.noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
2428 iwe.u.qual.updated = sta->last_rx_updated;
2429 iwe.len = IW_EV_QUAL_LEN;
2430 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
2431 &iwe, IW_EV_QUAL_LEN);
2432
2433 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2434 if (sta->ap) {
2435 memset(&iwe, 0, sizeof(iwe));
2436 iwe.cmd = SIOCGIWESSID;
2437 iwe.u.data.length = sta->u.ap.ssid_len;
2438 iwe.u.data.flags = 1;
2439 current_ev = iwe_stream_add_point(info, current_ev,
2440 end_buf, &iwe,
2441 sta->u.ap.ssid);
2442
2443 memset(&iwe, 0, sizeof(iwe));
2444 iwe.cmd = SIOCGIWENCODE;
2445 if (sta->capability & WLAN_CAPABILITY_PRIVACY)
2446 iwe.u.data.flags =
2447 IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2448 else
2449 iwe.u.data.flags = IW_ENCODE_DISABLED;
2450 current_ev = iwe_stream_add_point(info, current_ev,
2451 end_buf, &iwe,
2452 sta->u.ap.ssid);
2453
2454 if (sta->u.ap.channel > 0 &&
2455 sta->u.ap.channel <= FREQ_COUNT) {
2456 memset(&iwe, 0, sizeof(iwe));
2457 iwe.cmd = SIOCGIWFREQ;
2458 iwe.u.freq.m = freq_list[sta->u.ap.channel - 1]
2459 * 100000;
2460 iwe.u.freq.e = 1;
2461 current_ev = iwe_stream_add_event(
2462 info, current_ev, end_buf, &iwe,
2463 IW_EV_FREQ_LEN);
2464 }
2465
2466 memset(&iwe, 0, sizeof(iwe));
2467 iwe.cmd = IWEVCUSTOM;
2468 sprintf(buf, "beacon_interval=%d",
2469 sta->listen_interval);
2470 iwe.u.data.length = strlen(buf);
2471 current_ev = iwe_stream_add_point(info, current_ev,
2472 end_buf, &iwe, buf);
2473 }
2474 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2475
2476 sta->last_rx_updated = IW_QUAL_DBM;
2477
2478 /* To be continued, we should make good use of IWEVCUSTOM */
2479 }
2480
2481 spin_unlock_bh(&ap->sta_table_lock);
2482
2483 return current_ev - buffer;
2484 }
2485
2486
prism2_hostapd_add_sta(struct ap_data * ap,struct prism2_hostapd_param * param)2487 static int prism2_hostapd_add_sta(struct ap_data *ap,
2488 struct prism2_hostapd_param *param)
2489 {
2490 struct sta_info *sta;
2491
2492 spin_lock_bh(&ap->sta_table_lock);
2493 sta = ap_get_sta(ap, param->sta_addr);
2494 if (sta)
2495 atomic_inc(&sta->users);
2496 spin_unlock_bh(&ap->sta_table_lock);
2497
2498 if (sta == NULL) {
2499 sta = ap_add_sta(ap, param->sta_addr);
2500 if (sta == NULL)
2501 return -1;
2502 }
2503
2504 if (!(sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
2505 hostap_event_new_sta(sta->local->dev, sta);
2506
2507 sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
2508 sta->last_rx = jiffies;
2509 sta->aid = param->u.add_sta.aid;
2510 sta->capability = param->u.add_sta.capability;
2511 sta->tx_supp_rates = param->u.add_sta.tx_supp_rates;
2512 if (sta->tx_supp_rates & WLAN_RATE_1M)
2513 sta->supported_rates[0] = 2;
2514 if (sta->tx_supp_rates & WLAN_RATE_2M)
2515 sta->supported_rates[1] = 4;
2516 if (sta->tx_supp_rates & WLAN_RATE_5M5)
2517 sta->supported_rates[2] = 11;
2518 if (sta->tx_supp_rates & WLAN_RATE_11M)
2519 sta->supported_rates[3] = 22;
2520 prism2_check_tx_rates(sta);
2521 atomic_dec(&sta->users);
2522 return 0;
2523 }
2524
2525
prism2_hostapd_remove_sta(struct ap_data * ap,struct prism2_hostapd_param * param)2526 static int prism2_hostapd_remove_sta(struct ap_data *ap,
2527 struct prism2_hostapd_param *param)
2528 {
2529 struct sta_info *sta;
2530
2531 spin_lock_bh(&ap->sta_table_lock);
2532 sta = ap_get_sta(ap, param->sta_addr);
2533 if (sta) {
2534 ap_sta_hash_del(ap, sta);
2535 list_del(&sta->list);
2536 }
2537 spin_unlock_bh(&ap->sta_table_lock);
2538
2539 if (!sta)
2540 return -ENOENT;
2541
2542 if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
2543 hostap_event_expired_sta(sta->local->dev, sta);
2544 ap_free_sta(ap, sta);
2545
2546 return 0;
2547 }
2548
2549
prism2_hostapd_get_info_sta(struct ap_data * ap,struct prism2_hostapd_param * param)2550 static int prism2_hostapd_get_info_sta(struct ap_data *ap,
2551 struct prism2_hostapd_param *param)
2552 {
2553 struct sta_info *sta;
2554
2555 spin_lock_bh(&ap->sta_table_lock);
2556 sta = ap_get_sta(ap, param->sta_addr);
2557 if (sta)
2558 atomic_inc(&sta->users);
2559 spin_unlock_bh(&ap->sta_table_lock);
2560
2561 if (!sta)
2562 return -ENOENT;
2563
2564 param->u.get_info_sta.inactive_sec = (jiffies - sta->last_rx) / HZ;
2565
2566 atomic_dec(&sta->users);
2567
2568 return 1;
2569 }
2570
2571
prism2_hostapd_set_flags_sta(struct ap_data * ap,struct prism2_hostapd_param * param)2572 static int prism2_hostapd_set_flags_sta(struct ap_data *ap,
2573 struct prism2_hostapd_param *param)
2574 {
2575 struct sta_info *sta;
2576
2577 spin_lock_bh(&ap->sta_table_lock);
2578 sta = ap_get_sta(ap, param->sta_addr);
2579 if (sta) {
2580 sta->flags |= param->u.set_flags_sta.flags_or;
2581 sta->flags &= param->u.set_flags_sta.flags_and;
2582 }
2583 spin_unlock_bh(&ap->sta_table_lock);
2584
2585 if (!sta)
2586 return -ENOENT;
2587
2588 return 0;
2589 }
2590
2591
prism2_hostapd_sta_clear_stats(struct ap_data * ap,struct prism2_hostapd_param * param)2592 static int prism2_hostapd_sta_clear_stats(struct ap_data *ap,
2593 struct prism2_hostapd_param *param)
2594 {
2595 struct sta_info *sta;
2596 int rate;
2597
2598 spin_lock_bh(&ap->sta_table_lock);
2599 sta = ap_get_sta(ap, param->sta_addr);
2600 if (sta) {
2601 sta->rx_packets = sta->tx_packets = 0;
2602 sta->rx_bytes = sta->tx_bytes = 0;
2603 for (rate = 0; rate < WLAN_RATE_COUNT; rate++) {
2604 sta->tx_count[rate] = 0;
2605 sta->rx_count[rate] = 0;
2606 }
2607 }
2608 spin_unlock_bh(&ap->sta_table_lock);
2609
2610 if (!sta)
2611 return -ENOENT;
2612
2613 return 0;
2614 }
2615
2616
prism2_hostapd(struct ap_data * ap,struct prism2_hostapd_param * param)2617 int prism2_hostapd(struct ap_data *ap, struct prism2_hostapd_param *param)
2618 {
2619 switch (param->cmd) {
2620 case PRISM2_HOSTAPD_FLUSH:
2621 ap_control_kickall(ap);
2622 return 0;
2623 case PRISM2_HOSTAPD_ADD_STA:
2624 return prism2_hostapd_add_sta(ap, param);
2625 case PRISM2_HOSTAPD_REMOVE_STA:
2626 return prism2_hostapd_remove_sta(ap, param);
2627 case PRISM2_HOSTAPD_GET_INFO_STA:
2628 return prism2_hostapd_get_info_sta(ap, param);
2629 case PRISM2_HOSTAPD_SET_FLAGS_STA:
2630 return prism2_hostapd_set_flags_sta(ap, param);
2631 case PRISM2_HOSTAPD_STA_CLEAR_STATS:
2632 return prism2_hostapd_sta_clear_stats(ap, param);
2633 default:
2634 printk(KERN_WARNING "prism2_hostapd: unknown cmd=%d\n",
2635 param->cmd);
2636 return -EOPNOTSUPP;
2637 }
2638 }
2639
2640
2641 /* Update station info for host-based TX rate control and return current
2642 * TX rate */
ap_update_sta_tx_rate(struct sta_info * sta,struct net_device * dev)2643 static int ap_update_sta_tx_rate(struct sta_info *sta, struct net_device *dev)
2644 {
2645 int ret = sta->tx_rate;
2646 struct hostap_interface *iface;
2647 local_info_t *local;
2648
2649 iface = netdev_priv(dev);
2650 local = iface->local;
2651
2652 sta->tx_count[sta->tx_rate_idx]++;
2653 sta->tx_since_last_failure++;
2654 sta->tx_consecutive_exc = 0;
2655 if (sta->tx_since_last_failure >= WLAN_RATE_UPDATE_COUNT &&
2656 sta->tx_rate_idx < sta->tx_max_rate) {
2657 /* use next higher rate */
2658 int old_rate, new_rate;
2659 old_rate = new_rate = sta->tx_rate_idx;
2660 while (new_rate < sta->tx_max_rate) {
2661 new_rate++;
2662 if (ap_tx_rate_ok(new_rate, sta, local)) {
2663 sta->tx_rate_idx = new_rate;
2664 break;
2665 }
2666 }
2667 if (old_rate != sta->tx_rate_idx) {
2668 switch (sta->tx_rate_idx) {
2669 case 0: sta->tx_rate = 10; break;
2670 case 1: sta->tx_rate = 20; break;
2671 case 2: sta->tx_rate = 55; break;
2672 case 3: sta->tx_rate = 110; break;
2673 default: sta->tx_rate = 0; break;
2674 }
2675 PDEBUG(DEBUG_AP, "%s: STA %pM TX rate raised to %d\n",
2676 dev->name, sta->addr, sta->tx_rate);
2677 }
2678 sta->tx_since_last_failure = 0;
2679 }
2680
2681 return ret;
2682 }
2683
2684
2685 /* Called only from software IRQ. Called for each TX frame prior possible
2686 * encryption and transmit. */
hostap_handle_sta_tx(local_info_t * local,struct hostap_tx_data * tx)2687 ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
2688 {
2689 struct sta_info *sta = NULL;
2690 struct sk_buff *skb = tx->skb;
2691 int set_tim, ret;
2692 struct ieee80211_hdr_4addr *hdr;
2693 struct hostap_skb_tx_data *meta;
2694
2695 meta = (struct hostap_skb_tx_data *) skb->cb;
2696 ret = AP_TX_CONTINUE;
2697 if (local->ap == NULL || skb->len < 10 ||
2698 meta->iface->type == HOSTAP_INTERFACE_STA)
2699 goto out;
2700
2701 hdr = (struct ieee80211_hdr_4addr *) skb->data;
2702
2703 if (hdr->addr1[0] & 0x01) {
2704 /* broadcast/multicast frame - no AP related processing */
2705 if (local->ap->num_sta <= 0)
2706 ret = AP_TX_DROP;
2707 goto out;
2708 }
2709
2710 /* unicast packet - check whether destination STA is associated */
2711 spin_lock(&local->ap->sta_table_lock);
2712 sta = ap_get_sta(local->ap, hdr->addr1);
2713 if (sta)
2714 atomic_inc(&sta->users);
2715 spin_unlock(&local->ap->sta_table_lock);
2716
2717 if (local->iw_mode == IW_MODE_MASTER && sta == NULL &&
2718 !(meta->flags & HOSTAP_TX_FLAGS_WDS) &&
2719 meta->iface->type != HOSTAP_INTERFACE_MASTER &&
2720 meta->iface->type != HOSTAP_INTERFACE_AP) {
2721 #if 0
2722 /* This can happen, e.g., when wlan0 is added to a bridge and
2723 * bridging code does not know which port is the correct target
2724 * for a unicast frame. In this case, the packet is send to all
2725 * ports of the bridge. Since this is a valid scenario, do not
2726 * print out any errors here. */
2727 if (net_ratelimit()) {
2728 printk(KERN_DEBUG "AP: drop packet to non-associated "
2729 "STA %pM\n", hdr->addr1);
2730 }
2731 #endif
2732 local->ap->tx_drop_nonassoc++;
2733 ret = AP_TX_DROP;
2734 goto out;
2735 }
2736
2737 if (sta == NULL)
2738 goto out;
2739
2740 if (!(sta->flags & WLAN_STA_AUTHORIZED))
2741 ret = AP_TX_CONTINUE_NOT_AUTHORIZED;
2742
2743 /* Set tx_rate if using host-based TX rate control */
2744 if (!local->fw_tx_rate_control)
2745 local->ap->last_tx_rate = meta->rate =
2746 ap_update_sta_tx_rate(sta, local->dev);
2747
2748 if (local->iw_mode != IW_MODE_MASTER)
2749 goto out;
2750
2751 if (!(sta->flags & WLAN_STA_PS))
2752 goto out;
2753
2754 if (meta->flags & HOSTAP_TX_FLAGS_ADD_MOREDATA) {
2755 /* indicate to STA that more frames follow */
2756 hdr->frame_ctl |=
2757 __constant_cpu_to_le16(IEEE80211_FCTL_MOREDATA);
2758 }
2759
2760 if (meta->flags & HOSTAP_TX_FLAGS_BUFFERED_FRAME) {
2761 /* packet was already buffered and now send due to
2762 * PS poll, so do not rebuffer it */
2763 goto out;
2764 }
2765
2766 if (skb_queue_len(&sta->tx_buf) >= STA_MAX_TX_BUFFER) {
2767 PDEBUG(DEBUG_PS, "%s: No more space in STA (%pM)'s"
2768 "PS mode buffer\n",
2769 local->dev->name, sta->addr);
2770 /* Make sure that TIM is set for the station (it might not be
2771 * after AP wlan hw reset). */
2772 /* FIX: should fix hw reset to restore bits based on STA
2773 * buffer state.. */
2774 hostap_set_tim(local, sta->aid, 1);
2775 sta->flags |= WLAN_STA_TIM;
2776 ret = AP_TX_DROP;
2777 goto out;
2778 }
2779
2780 /* STA in PS mode, buffer frame for later delivery */
2781 set_tim = skb_queue_empty(&sta->tx_buf);
2782 skb_queue_tail(&sta->tx_buf, skb);
2783 /* FIX: could save RX time to skb and expire buffered frames after
2784 * some time if STA does not poll for them */
2785
2786 if (set_tim) {
2787 if (sta->flags & WLAN_STA_TIM)
2788 PDEBUG(DEBUG_PS2, "Re-setting TIM for aid %d\n",
2789 sta->aid);
2790 hostap_set_tim(local, sta->aid, 1);
2791 sta->flags |= WLAN_STA_TIM;
2792 }
2793
2794 ret = AP_TX_BUFFERED;
2795
2796 out:
2797 if (sta != NULL) {
2798 if (ret == AP_TX_CONTINUE ||
2799 ret == AP_TX_CONTINUE_NOT_AUTHORIZED) {
2800 sta->tx_packets++;
2801 sta->tx_bytes += skb->len;
2802 sta->last_tx = jiffies;
2803 }
2804
2805 if ((ret == AP_TX_CONTINUE ||
2806 ret == AP_TX_CONTINUE_NOT_AUTHORIZED) &&
2807 sta->crypt && tx->host_encrypt) {
2808 tx->crypt = sta->crypt;
2809 tx->sta_ptr = sta; /* hostap_handle_sta_release() will
2810 * be called to release sta info
2811 * later */
2812 } else
2813 atomic_dec(&sta->users);
2814 }
2815
2816 return ret;
2817 }
2818
2819
hostap_handle_sta_release(void * ptr)2820 void hostap_handle_sta_release(void *ptr)
2821 {
2822 struct sta_info *sta = ptr;
2823 atomic_dec(&sta->users);
2824 }
2825
2826
2827 /* Called only as a tasklet (software IRQ) */
hostap_handle_sta_tx_exc(local_info_t * local,struct sk_buff * skb)2828 void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb)
2829 {
2830 struct sta_info *sta;
2831 struct ieee80211_hdr_4addr *hdr;
2832 struct hostap_skb_tx_data *meta;
2833
2834 hdr = (struct ieee80211_hdr_4addr *) skb->data;
2835 meta = (struct hostap_skb_tx_data *) skb->cb;
2836
2837 spin_lock(&local->ap->sta_table_lock);
2838 sta = ap_get_sta(local->ap, hdr->addr1);
2839 if (!sta) {
2840 spin_unlock(&local->ap->sta_table_lock);
2841 PDEBUG(DEBUG_AP, "%s: Could not find STA %pM"
2842 " for this TX error (@%lu)\n",
2843 local->dev->name, hdr->addr1, jiffies);
2844 return;
2845 }
2846
2847 sta->tx_since_last_failure = 0;
2848 sta->tx_consecutive_exc++;
2849
2850 if (sta->tx_consecutive_exc >= WLAN_RATE_DECREASE_THRESHOLD &&
2851 sta->tx_rate_idx > 0 && meta->rate <= sta->tx_rate) {
2852 /* use next lower rate */
2853 int old, rate;
2854 old = rate = sta->tx_rate_idx;
2855 while (rate > 0) {
2856 rate--;
2857 if (ap_tx_rate_ok(rate, sta, local)) {
2858 sta->tx_rate_idx = rate;
2859 break;
2860 }
2861 }
2862 if (old != sta->tx_rate_idx) {
2863 switch (sta->tx_rate_idx) {
2864 case 0: sta->tx_rate = 10; break;
2865 case 1: sta->tx_rate = 20; break;
2866 case 2: sta->tx_rate = 55; break;
2867 case 3: sta->tx_rate = 110; break;
2868 default: sta->tx_rate = 0; break;
2869 }
2870 PDEBUG(DEBUG_AP,
2871 "%s: STA %pM TX rate lowered to %d\n",
2872 local->dev->name, sta->addr, sta->tx_rate);
2873 }
2874 sta->tx_consecutive_exc = 0;
2875 }
2876 spin_unlock(&local->ap->sta_table_lock);
2877 }
2878
2879
hostap_update_sta_ps2(local_info_t * local,struct sta_info * sta,int pwrmgt,int type,int stype)2880 static void hostap_update_sta_ps2(local_info_t *local, struct sta_info *sta,
2881 int pwrmgt, int type, int stype)
2882 {
2883 if (pwrmgt && !(sta->flags & WLAN_STA_PS)) {
2884 sta->flags |= WLAN_STA_PS;
2885 PDEBUG(DEBUG_PS2, "STA %pM changed to use PS "
2886 "mode (type=0x%02X, stype=0x%02X)\n",
2887 sta->addr, type >> 2, stype >> 4);
2888 } else if (!pwrmgt && (sta->flags & WLAN_STA_PS)) {
2889 sta->flags &= ~WLAN_STA_PS;
2890 PDEBUG(DEBUG_PS2, "STA %pM changed to not use "
2891 "PS mode (type=0x%02X, stype=0x%02X)\n",
2892 sta->addr, type >> 2, stype >> 4);
2893 if (type != IEEE80211_FTYPE_CTL ||
2894 stype != IEEE80211_STYPE_PSPOLL)
2895 schedule_packet_send(local, sta);
2896 }
2897 }
2898
2899
2900 /* Called only as a tasklet (software IRQ). Called for each RX frame to update
2901 * STA power saving state. pwrmgt is a flag from 802.11 frame_ctl field. */
hostap_update_sta_ps(local_info_t * local,struct ieee80211_hdr_4addr * hdr)2902 int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr_4addr *hdr)
2903 {
2904 struct sta_info *sta;
2905 u16 fc;
2906
2907 spin_lock(&local->ap->sta_table_lock);
2908 sta = ap_get_sta(local->ap, hdr->addr2);
2909 if (sta)
2910 atomic_inc(&sta->users);
2911 spin_unlock(&local->ap->sta_table_lock);
2912
2913 if (!sta)
2914 return -1;
2915
2916 fc = le16_to_cpu(hdr->frame_ctl);
2917 hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM,
2918 WLAN_FC_GET_TYPE(fc), WLAN_FC_GET_STYPE(fc));
2919
2920 atomic_dec(&sta->users);
2921 return 0;
2922 }
2923
2924
2925 /* Called only as a tasklet (software IRQ). Called for each RX frame after
2926 * getting RX header and payload from hardware. */
hostap_handle_sta_rx(local_info_t * local,struct net_device * dev,struct sk_buff * skb,struct hostap_80211_rx_status * rx_stats,int wds)2927 ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
2928 struct sk_buff *skb,
2929 struct hostap_80211_rx_status *rx_stats,
2930 int wds)
2931 {
2932 int ret;
2933 struct sta_info *sta;
2934 u16 fc, type, stype;
2935 struct ieee80211_hdr_4addr *hdr;
2936
2937 if (local->ap == NULL)
2938 return AP_RX_CONTINUE;
2939
2940 hdr = (struct ieee80211_hdr_4addr *) skb->data;
2941
2942 fc = le16_to_cpu(hdr->frame_ctl);
2943 type = WLAN_FC_GET_TYPE(fc);
2944 stype = WLAN_FC_GET_STYPE(fc);
2945
2946 spin_lock(&local->ap->sta_table_lock);
2947 sta = ap_get_sta(local->ap, hdr->addr2);
2948 if (sta)
2949 atomic_inc(&sta->users);
2950 spin_unlock(&local->ap->sta_table_lock);
2951
2952 if (sta && !(sta->flags & WLAN_STA_AUTHORIZED))
2953 ret = AP_RX_CONTINUE_NOT_AUTHORIZED;
2954 else
2955 ret = AP_RX_CONTINUE;
2956
2957
2958 if (fc & IEEE80211_FCTL_TODS) {
2959 if (!wds && (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
2960 if (local->hostapd) {
2961 prism2_rx_80211(local->apdev, skb, rx_stats,
2962 PRISM2_RX_NON_ASSOC);
2963 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2964 } else {
2965 printk(KERN_DEBUG "%s: dropped received packet"
2966 " from non-associated STA %pM"
2967 " (type=0x%02x, subtype=0x%02x)\n",
2968 dev->name, hdr->addr2,
2969 type >> 2, stype >> 4);
2970 hostap_rx(dev, skb, rx_stats);
2971 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
2972 }
2973 ret = AP_RX_EXIT;
2974 goto out;
2975 }
2976 } else if (fc & IEEE80211_FCTL_FROMDS) {
2977 if (!wds) {
2978 /* FromDS frame - not for us; probably
2979 * broadcast/multicast in another BSS - drop */
2980 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
2981 printk(KERN_DEBUG "Odd.. FromDS packet "
2982 "received with own BSSID\n");
2983 hostap_dump_rx_80211(dev->name, skb, rx_stats);
2984 }
2985 ret = AP_RX_DROP;
2986 goto out;
2987 }
2988 } else if (stype == IEEE80211_STYPE_NULLFUNC && sta == NULL &&
2989 memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
2990
2991 if (local->hostapd) {
2992 prism2_rx_80211(local->apdev, skb, rx_stats,
2993 PRISM2_RX_NON_ASSOC);
2994 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
2995 } else {
2996 /* At least Lucent f/w seems to send data::nullfunc
2997 * frames with no ToDS flag when the current AP returns
2998 * after being unavailable for some time. Speed up
2999 * re-association by informing the station about it not
3000 * being associated. */
3001 printk(KERN_DEBUG "%s: rejected received nullfunc frame"
3002 " without ToDS from not associated STA %pM\n",
3003 dev->name, hdr->addr2);
3004 hostap_rx(dev, skb, rx_stats);
3005 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
3006 }
3007 ret = AP_RX_EXIT;
3008 goto out;
3009 } else if (stype == IEEE80211_STYPE_NULLFUNC) {
3010 /* At least Lucent cards seem to send periodic nullfunc
3011 * frames with ToDS. Let these through to update SQ
3012 * stats and PS state. Nullfunc frames do not contain
3013 * any data and they will be dropped below. */
3014 } else {
3015 /* If BSSID (Addr3) is foreign, this frame is a normal
3016 * broadcast frame from an IBSS network. Drop it silently.
3017 * If BSSID is own, report the dropping of this frame. */
3018 if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
3019 printk(KERN_DEBUG "%s: dropped received packet from %pM"
3020 " with no ToDS flag "
3021 "(type=0x%02x, subtype=0x%02x)\n", dev->name,
3022 hdr->addr2, type >> 2, stype >> 4);
3023 hostap_dump_rx_80211(dev->name, skb, rx_stats);
3024 }
3025 ret = AP_RX_DROP;
3026 goto out;
3027 }
3028
3029 if (sta) {
3030 hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM,
3031 type, stype);
3032
3033 sta->rx_packets++;
3034 sta->rx_bytes += skb->len;
3035 sta->last_rx = jiffies;
3036 }
3037
3038 if (local->ap->nullfunc_ack && stype == IEEE80211_STYPE_NULLFUNC &&
3039 fc & IEEE80211_FCTL_TODS) {
3040 if (local->hostapd) {
3041 prism2_rx_80211(local->apdev, skb, rx_stats,
3042 PRISM2_RX_NULLFUNC_ACK);
3043 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
3044 } else {
3045 /* some STA f/w's seem to require control::ACK frame
3046 * for data::nullfunc, but Prism2 f/w 0.8.0 (at least
3047 * from Compaq) does not send this.. Try to generate
3048 * ACK for these frames from the host driver to make
3049 * power saving work with, e.g., Lucent WaveLAN f/w */
3050 hostap_rx(dev, skb, rx_stats);
3051 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
3052 }
3053 ret = AP_RX_EXIT;
3054 goto out;
3055 }
3056
3057 out:
3058 if (sta)
3059 atomic_dec(&sta->users);
3060
3061 return ret;
3062 }
3063
3064
3065 /* Called only as a tasklet (software IRQ) */
hostap_handle_sta_crypto(local_info_t * local,struct ieee80211_hdr_4addr * hdr,struct lib80211_crypt_data ** crypt,void ** sta_ptr)3066 int hostap_handle_sta_crypto(local_info_t *local,
3067 struct ieee80211_hdr_4addr *hdr,
3068 struct lib80211_crypt_data **crypt,
3069 void **sta_ptr)
3070 {
3071 struct sta_info *sta;
3072
3073 spin_lock(&local->ap->sta_table_lock);
3074 sta = ap_get_sta(local->ap, hdr->addr2);
3075 if (sta)
3076 atomic_inc(&sta->users);
3077 spin_unlock(&local->ap->sta_table_lock);
3078
3079 if (!sta)
3080 return -1;
3081
3082 if (sta->crypt) {
3083 *crypt = sta->crypt;
3084 *sta_ptr = sta;
3085 /* hostap_handle_sta_release() will be called to release STA
3086 * info */
3087 } else
3088 atomic_dec(&sta->users);
3089
3090 return 0;
3091 }
3092
3093
3094 /* Called only as a tasklet (software IRQ) */
hostap_is_sta_assoc(struct ap_data * ap,u8 * sta_addr)3095 int hostap_is_sta_assoc(struct ap_data *ap, u8 *sta_addr)
3096 {
3097 struct sta_info *sta;
3098 int ret = 0;
3099
3100 spin_lock(&ap->sta_table_lock);
3101 sta = ap_get_sta(ap, sta_addr);
3102 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap)
3103 ret = 1;
3104 spin_unlock(&ap->sta_table_lock);
3105
3106 return ret;
3107 }
3108
3109
3110 /* Called only as a tasklet (software IRQ) */
hostap_is_sta_authorized(struct ap_data * ap,u8 * sta_addr)3111 int hostap_is_sta_authorized(struct ap_data *ap, u8 *sta_addr)
3112 {
3113 struct sta_info *sta;
3114 int ret = 0;
3115
3116 spin_lock(&ap->sta_table_lock);
3117 sta = ap_get_sta(ap, sta_addr);
3118 if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap &&
3119 ((sta->flags & WLAN_STA_AUTHORIZED) ||
3120 ap->local->ieee_802_1x == 0))
3121 ret = 1;
3122 spin_unlock(&ap->sta_table_lock);
3123
3124 return ret;
3125 }
3126
3127
3128 /* Called only as a tasklet (software IRQ) */
hostap_add_sta(struct ap_data * ap,u8 * sta_addr)3129 int hostap_add_sta(struct ap_data *ap, u8 *sta_addr)
3130 {
3131 struct sta_info *sta;
3132 int ret = 1;
3133
3134 if (!ap)
3135 return -1;
3136
3137 spin_lock(&ap->sta_table_lock);
3138 sta = ap_get_sta(ap, sta_addr);
3139 if (sta)
3140 ret = 0;
3141 spin_unlock(&ap->sta_table_lock);
3142
3143 if (ret == 1) {
3144 sta = ap_add_sta(ap, sta_addr);
3145 if (!sta)
3146 return -1;
3147 sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
3148 sta->ap = 1;
3149 memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
3150 /* No way of knowing which rates are supported since we did not
3151 * get supported rates element from beacon/assoc req. Assume
3152 * that remote end supports all 802.11b rates. */
3153 sta->supported_rates[0] = 0x82;
3154 sta->supported_rates[1] = 0x84;
3155 sta->supported_rates[2] = 0x0b;
3156 sta->supported_rates[3] = 0x16;
3157 sta->tx_supp_rates = WLAN_RATE_1M | WLAN_RATE_2M |
3158 WLAN_RATE_5M5 | WLAN_RATE_11M;
3159 sta->tx_rate = 110;
3160 sta->tx_max_rate = sta->tx_rate_idx = 3;
3161 }
3162
3163 return ret;
3164 }
3165
3166
3167 /* Called only as a tasklet (software IRQ) */
hostap_update_rx_stats(struct ap_data * ap,struct ieee80211_hdr_4addr * hdr,struct hostap_80211_rx_status * rx_stats)3168 int hostap_update_rx_stats(struct ap_data *ap,
3169 struct ieee80211_hdr_4addr *hdr,
3170 struct hostap_80211_rx_status *rx_stats)
3171 {
3172 struct sta_info *sta;
3173
3174 if (!ap)
3175 return -1;
3176
3177 spin_lock(&ap->sta_table_lock);
3178 sta = ap_get_sta(ap, hdr->addr2);
3179 if (sta) {
3180 sta->last_rx_silence = rx_stats->noise;
3181 sta->last_rx_signal = rx_stats->signal;
3182 sta->last_rx_rate = rx_stats->rate;
3183 sta->last_rx_updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
3184 if (rx_stats->rate == 10)
3185 sta->rx_count[0]++;
3186 else if (rx_stats->rate == 20)
3187 sta->rx_count[1]++;
3188 else if (rx_stats->rate == 55)
3189 sta->rx_count[2]++;
3190 else if (rx_stats->rate == 110)
3191 sta->rx_count[3]++;
3192 }
3193 spin_unlock(&ap->sta_table_lock);
3194
3195 return sta ? 0 : -1;
3196 }
3197
3198
hostap_update_rates(local_info_t * local)3199 void hostap_update_rates(local_info_t *local)
3200 {
3201 struct sta_info *sta;
3202 struct ap_data *ap = local->ap;
3203
3204 if (!ap)
3205 return;
3206
3207 spin_lock_bh(&ap->sta_table_lock);
3208 list_for_each_entry(sta, &ap->sta_list, list) {
3209 prism2_check_tx_rates(sta);
3210 }
3211 spin_unlock_bh(&ap->sta_table_lock);
3212 }
3213
3214
ap_crypt_get_ptrs(struct ap_data * ap,u8 * addr,int permanent,struct lib80211_crypt_data *** crypt)3215 void * ap_crypt_get_ptrs(struct ap_data *ap, u8 *addr, int permanent,
3216 struct lib80211_crypt_data ***crypt)
3217 {
3218 struct sta_info *sta;
3219
3220 spin_lock_bh(&ap->sta_table_lock);
3221 sta = ap_get_sta(ap, addr);
3222 if (sta)
3223 atomic_inc(&sta->users);
3224 spin_unlock_bh(&ap->sta_table_lock);
3225
3226 if (!sta && permanent)
3227 sta = ap_add_sta(ap, addr);
3228
3229 if (!sta)
3230 return NULL;
3231
3232 if (permanent)
3233 sta->flags |= WLAN_STA_PERM;
3234
3235 *crypt = &sta->crypt;
3236
3237 return sta;
3238 }
3239
3240
hostap_add_wds_links(local_info_t * local)3241 void hostap_add_wds_links(local_info_t *local)
3242 {
3243 struct ap_data *ap = local->ap;
3244 struct sta_info *sta;
3245
3246 spin_lock_bh(&ap->sta_table_lock);
3247 list_for_each_entry(sta, &ap->sta_list, list) {
3248 if (sta->ap)
3249 hostap_wds_link_oper(local, sta->addr, WDS_ADD);
3250 }
3251 spin_unlock_bh(&ap->sta_table_lock);
3252
3253 schedule_work(&local->ap->wds_oper_queue);
3254 }
3255
3256
hostap_wds_link_oper(local_info_t * local,u8 * addr,wds_oper_type type)3257 void hostap_wds_link_oper(local_info_t *local, u8 *addr, wds_oper_type type)
3258 {
3259 struct wds_oper_data *entry;
3260
3261 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
3262 if (!entry)
3263 return;
3264 memcpy(entry->addr, addr, ETH_ALEN);
3265 entry->type = type;
3266 spin_lock_bh(&local->lock);
3267 entry->next = local->ap->wds_oper_entries;
3268 local->ap->wds_oper_entries = entry;
3269 spin_unlock_bh(&local->lock);
3270
3271 schedule_work(&local->ap->wds_oper_queue);
3272 }
3273
3274
3275 EXPORT_SYMBOL(hostap_init_data);
3276 EXPORT_SYMBOL(hostap_init_ap_proc);
3277 EXPORT_SYMBOL(hostap_free_data);
3278 EXPORT_SYMBOL(hostap_check_sta_fw_version);
3279 EXPORT_SYMBOL(hostap_handle_sta_tx_exc);
3280 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
3281 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
3282