1/*
   2 * IBSS mode implementation
   3 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   4 * Copyright 2004, Instant802 Networks, Inc.
   5 * Copyright 2005, Devicescape Software, Inc.
   6 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
   7 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8 * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
   9 * Copyright 2013-2014  Intel Mobile Communications GmbH
  10 * Copyright(c) 2016 Intel Deutschland GmbH
  11 *
  12 * This program is free software; you can redistribute it and/or modify
  13 * it under the terms of the GNU General Public License version 2 as
  14 * published by the Free Software Foundation.
  15 */
  16
  17#include <linux/delay.h>
  18#include <linux/slab.h>
  19#include <linux/if_ether.h>
  20#include <linux/skbuff.h>
  21#include <linux/if_arp.h>
  22#include <linux/etherdevice.h>
  23#include <linux/rtnetlink.h>
  24#include <net/mac80211.h>
  25
  26#include "ieee80211_i.h"
  27#include "driver-ops.h"
  28#include "rate.h"
  29
  30#define IEEE80211_SCAN_INTERVAL (2 * HZ)
  31#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
  32
  33#define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  34#define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  35#define IEEE80211_IBSS_RSN_INACTIVITY_LIMIT (10 * HZ)
  36
  37#define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  38
  39static struct beacon_data *
  40ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
  41			   const int beacon_int, const u32 basic_rates,
  42			   const u16 capability, u64 tsf,
  43			   struct cfg80211_chan_def *chandef,
  44			   bool *have_higher_than_11mbit,
  45			   struct cfg80211_csa_settings *csa_settings)
  46{
  47	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
  48	struct ieee80211_local *local = sdata->local;
  49	int rates_n = 0, i, ri;
  50	struct ieee80211_mgmt *mgmt;
  51	u8 *pos;
  52	struct ieee80211_supported_band *sband;
  53	u32 rate_flags, rates = 0, rates_added = 0;
  54	struct beacon_data *presp;
  55	int frame_len;
  56	int shift;
  57
  58	/* Build IBSS probe response */
  59	frame_len = sizeof(struct ieee80211_hdr_3addr) +
  60		    12 /* struct ieee80211_mgmt.u.beacon */ +
  61		    2 + IEEE80211_MAX_SSID_LEN /* max SSID */ +
  62		    2 + 8 /* max Supported Rates */ +
  63		    3 /* max DS params */ +
  64		    4 /* IBSS params */ +
  65		    5 /* Channel Switch Announcement */ +
  66		    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
  67		    2 + sizeof(struct ieee80211_ht_cap) +
  68		    2 + sizeof(struct ieee80211_ht_operation) +
 
 
  69		    ifibss->ie_len;
  70	presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
  71	if (!presp)
  72		return NULL;
  73
  74	presp->head = (void *)(presp + 1);
  75
  76	mgmt = (void *) presp->head;
  77	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  78					  IEEE80211_STYPE_PROBE_RESP);
  79	eth_broadcast_addr(mgmt->da);
  80	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  81	memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
  82	mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
  83	mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
  84	mgmt->u.beacon.capab_info = cpu_to_le16(capability);
  85
  86	pos = (u8 *)mgmt + offsetof(struct ieee80211_mgmt, u.beacon.variable);
  87
  88	*pos++ = WLAN_EID_SSID;
  89	*pos++ = ifibss->ssid_len;
  90	memcpy(pos, ifibss->ssid, ifibss->ssid_len);
  91	pos += ifibss->ssid_len;
  92
  93	sband = local->hw.wiphy->bands[chandef->chan->band];
  94	rate_flags = ieee80211_chandef_rate_flags(chandef);
  95	shift = ieee80211_chandef_get_shift(chandef);
  96	rates_n = 0;
  97	if (have_higher_than_11mbit)
  98		*have_higher_than_11mbit = false;
  99
 100	for (i = 0; i < sband->n_bitrates; i++) {
 101		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
 102			continue;
 103		if (sband->bitrates[i].bitrate > 110 &&
 104		    have_higher_than_11mbit)
 105			*have_higher_than_11mbit = true;
 106
 107		rates |= BIT(i);
 108		rates_n++;
 109	}
 110
 111	*pos++ = WLAN_EID_SUPP_RATES;
 112	*pos++ = min_t(int, 8, rates_n);
 113	for (ri = 0; ri < sband->n_bitrates; ri++) {
 114		int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
 115					5 * (1 << shift));
 116		u8 basic = 0;
 117		if (!(rates & BIT(ri)))
 118			continue;
 119
 120		if (basic_rates & BIT(ri))
 121			basic = 0x80;
 122		*pos++ = basic | (u8) rate;
 123		if (++rates_added == 8) {
 124			ri++; /* continue at next rate for EXT_SUPP_RATES */
 125			break;
 126		}
 127	}
 128
 129	if (sband->band == NL80211_BAND_2GHZ) {
 130		*pos++ = WLAN_EID_DS_PARAMS;
 131		*pos++ = 1;
 132		*pos++ = ieee80211_frequency_to_channel(
 133				chandef->chan->center_freq);
 134	}
 135
 136	*pos++ = WLAN_EID_IBSS_PARAMS;
 137	*pos++ = 2;
 138	/* FIX: set ATIM window based on scan results */
 139	*pos++ = 0;
 140	*pos++ = 0;
 141
 142	if (csa_settings) {
 143		*pos++ = WLAN_EID_CHANNEL_SWITCH;
 144		*pos++ = 3;
 145		*pos++ = csa_settings->block_tx ? 1 : 0;
 146		*pos++ = ieee80211_frequency_to_channel(
 147				csa_settings->chandef.chan->center_freq);
 148		presp->csa_counter_offsets[0] = (pos - presp->head);
 149		*pos++ = csa_settings->count;
 150		presp->csa_current_counter = csa_settings->count;
 151	}
 152
 153	/* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
 154	if (rates_n > 8) {
 155		*pos++ = WLAN_EID_EXT_SUPP_RATES;
 156		*pos++ = rates_n - 8;
 157		for (; ri < sband->n_bitrates; ri++) {
 158			int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
 159						5 * (1 << shift));
 160			u8 basic = 0;
 161			if (!(rates & BIT(ri)))
 162				continue;
 163
 164			if (basic_rates & BIT(ri))
 165				basic = 0x80;
 166			*pos++ = basic | (u8) rate;
 167		}
 168	}
 169
 170	if (ifibss->ie_len) {
 171		memcpy(pos, ifibss->ie, ifibss->ie_len);
 172		pos += ifibss->ie_len;
 173	}
 174
 175	/* add HT capability and information IEs */
 176	if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
 177	    chandef->width != NL80211_CHAN_WIDTH_5 &&
 178	    chandef->width != NL80211_CHAN_WIDTH_10 &&
 179	    sband->ht_cap.ht_supported) {
 180		struct ieee80211_sta_ht_cap ht_cap;
 181
 182		memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 183		ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 184
 185		pos = ieee80211_ie_build_ht_cap(pos, &ht_cap, ht_cap.cap);
 186		/*
 187		 * Note: According to 802.11n-2009 9.13.3.1, HT Protection
 188		 * field and RIFS Mode are reserved in IBSS mode, therefore
 189		 * keep them at 0
 190		 */
 191		pos = ieee80211_ie_build_ht_oper(pos, &sband->ht_cap,
 192						 chandef, 0, false);
 193
 194		/* add VHT capability and information IEs */
 195		if (chandef->width != NL80211_CHAN_WIDTH_20 &&
 196		    chandef->width != NL80211_CHAN_WIDTH_40 &&
 197		    sband->vht_cap.vht_supported) {
 198			pos = ieee80211_ie_build_vht_cap(pos, &sband->vht_cap,
 199							 sband->vht_cap.cap);
 200			pos = ieee80211_ie_build_vht_oper(pos, &sband->vht_cap,
 201							  chandef);
 202		}
 203	}
 204
 205	if (local->hw.queues >= IEEE80211_NUM_ACS)
 206		pos = ieee80211_add_wmm_info_ie(pos, 0); /* U-APSD not in use */
 207
 208	presp->head_len = pos - presp->head;
 209	if (WARN_ON(presp->head_len > frame_len))
 210		goto error;
 211
 212	return presp;
 213error:
 214	kfree(presp);
 215	return NULL;
 216}
 217
 218static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 219				      const u8 *bssid, const int beacon_int,
 220				      struct cfg80211_chan_def *req_chandef,
 221				      const u32 basic_rates,
 222				      const u16 capability, u64 tsf,
 223				      bool creator)
 224{
 225	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 226	struct ieee80211_local *local = sdata->local;
 227	struct ieee80211_mgmt *mgmt;
 228	struct cfg80211_bss *bss;
 229	u32 bss_change;
 230	struct cfg80211_chan_def chandef;
 231	struct ieee80211_channel *chan;
 232	struct beacon_data *presp;
 233	struct cfg80211_inform_bss bss_meta = {};
 234	bool have_higher_than_11mbit;
 235	bool radar_required;
 236	int err;
 237
 238	sdata_assert_lock(sdata);
 239
 240	/* Reset own TSF to allow time synchronization work. */
 241	drv_reset_tsf(local, sdata);
 242
 243	if (!ether_addr_equal(ifibss->bssid, bssid))
 244		sta_info_flush(sdata);
 245
 246	/* if merging, indicate to driver that we leave the old IBSS */
 247	if (sdata->vif.bss_conf.ibss_joined) {
 248		sdata->vif.bss_conf.ibss_joined = false;
 249		sdata->vif.bss_conf.ibss_creator = false;
 250		sdata->vif.bss_conf.enable_beacon = false;
 251		netif_carrier_off(sdata->dev);
 252		ieee80211_bss_info_change_notify(sdata,
 253						 BSS_CHANGED_IBSS |
 254						 BSS_CHANGED_BEACON_ENABLED);
 255		drv_leave_ibss(local, sdata);
 256	}
 257
 258	presp = rcu_dereference_protected(ifibss->presp,
 259					  lockdep_is_held(&sdata->wdev.mtx));
 260	RCU_INIT_POINTER(ifibss->presp, NULL);
 261	if (presp)
 262		kfree_rcu(presp, rcu_head);
 263
 264	/* make a copy of the chandef, it could be modified below. */
 265	chandef = *req_chandef;
 266	chan = chandef.chan;
 267	if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef,
 268				     NL80211_IFTYPE_ADHOC)) {
 269		if (chandef.width == NL80211_CHAN_WIDTH_5 ||
 270		    chandef.width == NL80211_CHAN_WIDTH_10 ||
 271		    chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
 272		    chandef.width == NL80211_CHAN_WIDTH_20) {
 273			sdata_info(sdata,
 274				   "Failed to join IBSS, beacons forbidden\n");
 275			return;
 276		}
 277		chandef.width = NL80211_CHAN_WIDTH_20;
 278		chandef.center_freq1 = chan->center_freq;
 279		/* check again for downgraded chandef */
 280		if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef,
 281					     NL80211_IFTYPE_ADHOC)) {
 282			sdata_info(sdata,
 283				   "Failed to join IBSS, beacons forbidden\n");
 284			return;
 285		}
 286	}
 287
 288	err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
 289					    &chandef, NL80211_IFTYPE_ADHOC);
 290	if (err < 0) {
 291		sdata_info(sdata,
 292			   "Failed to join IBSS, invalid chandef\n");
 293		return;
 294	}
 295	if (err > 0 && !ifibss->userspace_handles_dfs) {
 296		sdata_info(sdata,
 297			   "Failed to join IBSS, DFS channel without control program\n");
 298		return;
 299	}
 300
 301	radar_required = err;
 302
 303	mutex_lock(&local->mtx);
 304	if (ieee80211_vif_use_channel(sdata, &chandef,
 305				      ifibss->fixed_channel ?
 306					IEEE80211_CHANCTX_SHARED :
 307					IEEE80211_CHANCTX_EXCLUSIVE)) {
 308		sdata_info(sdata, "Failed to join IBSS, no channel context\n");
 309		mutex_unlock(&local->mtx);
 310		return;
 311	}
 312	sdata->radar_required = radar_required;
 313	mutex_unlock(&local->mtx);
 314
 315	memcpy(ifibss->bssid, bssid, ETH_ALEN);
 316
 317	presp = ieee80211_ibss_build_presp(sdata, beacon_int, basic_rates,
 318					   capability, tsf, &chandef,
 319					   &have_higher_than_11mbit, NULL);
 320	if (!presp)
 321		return;
 322
 323	rcu_assign_pointer(ifibss->presp, presp);
 324	mgmt = (void *)presp->head;
 325
 326	sdata->vif.bss_conf.enable_beacon = true;
 327	sdata->vif.bss_conf.beacon_int = beacon_int;
 328	sdata->vif.bss_conf.basic_rates = basic_rates;
 329	sdata->vif.bss_conf.ssid_len = ifibss->ssid_len;
 330	memcpy(sdata->vif.bss_conf.ssid, ifibss->ssid, ifibss->ssid_len);
 331	bss_change = BSS_CHANGED_BEACON_INT;
 332	bss_change |= ieee80211_reset_erp_info(sdata);
 333	bss_change |= BSS_CHANGED_BSSID;
 334	bss_change |= BSS_CHANGED_BEACON;
 335	bss_change |= BSS_CHANGED_BEACON_ENABLED;
 336	bss_change |= BSS_CHANGED_BASIC_RATES;
 337	bss_change |= BSS_CHANGED_HT;
 338	bss_change |= BSS_CHANGED_IBSS;
 339	bss_change |= BSS_CHANGED_SSID;
 340
 341	/*
 342	 * In 5 GHz/802.11a, we can always use short slot time.
 343	 * (IEEE 802.11-2012 18.3.8.7)
 344	 *
 345	 * In 2.4GHz, we must always use long slots in IBSS for compatibility
 346	 * reasons.
 347	 * (IEEE 802.11-2012 19.4.5)
 348	 *
 349	 * HT follows these specifications (IEEE 802.11-2012 20.3.18)
 350	 */
 351	sdata->vif.bss_conf.use_short_slot = chan->band == NL80211_BAND_5GHZ;
 352	bss_change |= BSS_CHANGED_ERP_SLOT;
 353
 354	/* cf. IEEE 802.11 9.2.12 */
 355	if (chan->band == NL80211_BAND_2GHZ && have_higher_than_11mbit)
 356		sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
 357	else
 358		sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 359
 360	ieee80211_set_wmm_default(sdata, true, false);
 361
 362	sdata->vif.bss_conf.ibss_joined = true;
 363	sdata->vif.bss_conf.ibss_creator = creator;
 364
 365	err = drv_join_ibss(local, sdata);
 366	if (err) {
 367		sdata->vif.bss_conf.ibss_joined = false;
 368		sdata->vif.bss_conf.ibss_creator = false;
 369		sdata->vif.bss_conf.enable_beacon = false;
 370		sdata->vif.bss_conf.ssid_len = 0;
 371		RCU_INIT_POINTER(ifibss->presp, NULL);
 372		kfree_rcu(presp, rcu_head);
 373		mutex_lock(&local->mtx);
 374		ieee80211_vif_release_channel(sdata);
 375		mutex_unlock(&local->mtx);
 376		sdata_info(sdata, "Failed to join IBSS, driver failure: %d\n",
 377			   err);
 378		return;
 379	}
 380
 381	ieee80211_bss_info_change_notify(sdata, bss_change);
 382
 383	ifibss->state = IEEE80211_IBSS_MLME_JOINED;
 384	mod_timer(&ifibss->timer,
 385		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 386
 387	bss_meta.chan = chan;
 388	bss_meta.scan_width = cfg80211_chandef_to_scan_width(&chandef);
 389	bss = cfg80211_inform_bss_frame_data(local->hw.wiphy, &bss_meta, mgmt,
 390					     presp->head_len, GFP_KERNEL);
 391
 392	cfg80211_put_bss(local->hw.wiphy, bss);
 393	netif_carrier_on(sdata->dev);
 394	cfg80211_ibss_joined(sdata->dev, ifibss->bssid, chan, GFP_KERNEL);
 395}
 396
 397static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 398				    struct ieee80211_bss *bss)
 399{
 400	struct cfg80211_bss *cbss =
 401		container_of((void *)bss, struct cfg80211_bss, priv);
 402	struct ieee80211_supported_band *sband;
 403	struct cfg80211_chan_def chandef;
 404	u32 basic_rates;
 405	int i, j;
 406	u16 beacon_int = cbss->beacon_interval;
 407	const struct cfg80211_bss_ies *ies;
 408	enum nl80211_channel_type chan_type;
 409	u64 tsf;
 410	u32 rate_flags;
 411	int shift;
 412
 413	sdata_assert_lock(sdata);
 414
 415	if (beacon_int < 10)
 416		beacon_int = 10;
 417
 418	switch (sdata->u.ibss.chandef.width) {
 419	case NL80211_CHAN_WIDTH_20_NOHT:
 420	case NL80211_CHAN_WIDTH_20:
 421	case NL80211_CHAN_WIDTH_40:
 422		chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
 423		cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
 424		break;
 425	case NL80211_CHAN_WIDTH_5:
 426	case NL80211_CHAN_WIDTH_10:
 427		cfg80211_chandef_create(&chandef, cbss->channel,
 428					NL80211_CHAN_WIDTH_20_NOHT);
 429		chandef.width = sdata->u.ibss.chandef.width;
 430		break;
 431	case NL80211_CHAN_WIDTH_80:
 432	case NL80211_CHAN_WIDTH_80P80:
 433	case NL80211_CHAN_WIDTH_160:
 434		chandef = sdata->u.ibss.chandef;
 435		chandef.chan = cbss->channel;
 436		break;
 437	default:
 438		/* fall back to 20 MHz for unsupported modes */
 439		cfg80211_chandef_create(&chandef, cbss->channel,
 440					NL80211_CHAN_WIDTH_20_NOHT);
 441		break;
 442	}
 443
 444	sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
 445	rate_flags = ieee80211_chandef_rate_flags(&sdata->u.ibss.chandef);
 446	shift = ieee80211_vif_get_shift(&sdata->vif);
 447
 448	basic_rates = 0;
 449
 450	for (i = 0; i < bss->supp_rates_len; i++) {
 451		int rate = bss->supp_rates[i] & 0x7f;
 452		bool is_basic = !!(bss->supp_rates[i] & 0x80);
 453
 454		for (j = 0; j < sband->n_bitrates; j++) {
 455			int brate;
 456			if ((rate_flags & sband->bitrates[j].flags)
 457			    != rate_flags)
 458				continue;
 459
 460			brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
 461					     5 * (1 << shift));
 462			if (brate == rate) {
 463				if (is_basic)
 464					basic_rates |= BIT(j);
 465				break;
 466			}
 467		}
 468	}
 469
 470	rcu_read_lock();
 471	ies = rcu_dereference(cbss->ies);
 472	tsf = ies->tsf;
 473	rcu_read_unlock();
 474
 475	__ieee80211_sta_join_ibss(sdata, cbss->bssid,
 476				  beacon_int,
 477				  &chandef,
 478				  basic_rates,
 479				  cbss->capability,
 480				  tsf, false);
 481}
 482
 483int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
 484			      struct cfg80211_csa_settings *csa_settings)
 485{
 486	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 487	struct beacon_data *presp, *old_presp;
 488	struct cfg80211_bss *cbss;
 489	const struct cfg80211_bss_ies *ies;
 490	u16 capability = 0;
 491	u64 tsf;
 492	int ret = 0;
 493
 494	sdata_assert_lock(sdata);
 495
 496	if (ifibss->privacy)
 497		capability = WLAN_CAPABILITY_PRIVACY;
 498
 499	cbss = cfg80211_get_bss(sdata->local->hw.wiphy, ifibss->chandef.chan,
 500				ifibss->bssid, ifibss->ssid,
 501				ifibss->ssid_len, IEEE80211_BSS_TYPE_IBSS,
 502				IEEE80211_PRIVACY(ifibss->privacy));
 503
 504	if (WARN_ON(!cbss)) {
 505		ret = -EINVAL;
 506		goto out;
 507	}
 508
 509	rcu_read_lock();
 510	ies = rcu_dereference(cbss->ies);
 511	tsf = ies->tsf;
 512	rcu_read_unlock();
 513	cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
 514
 515	old_presp = rcu_dereference_protected(ifibss->presp,
 516					  lockdep_is_held(&sdata->wdev.mtx));
 517
 518	presp = ieee80211_ibss_build_presp(sdata,
 519					   sdata->vif.bss_conf.beacon_int,
 520					   sdata->vif.bss_conf.basic_rates,
 521					   capability, tsf, &ifibss->chandef,
 522					   NULL, csa_settings);
 523	if (!presp) {
 524		ret = -ENOMEM;
 525		goto out;
 526	}
 527
 528	rcu_assign_pointer(ifibss->presp, presp);
 529	if (old_presp)
 530		kfree_rcu(old_presp, rcu_head);
 531
 532	return BSS_CHANGED_BEACON;
 533 out:
 534	return ret;
 535}
 536
 537int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
 538{
 539	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 540	struct cfg80211_bss *cbss;
 541	int err, changed = 0;
 542
 543	sdata_assert_lock(sdata);
 544
 545	/* update cfg80211 bss information with the new channel */
 546	if (!is_zero_ether_addr(ifibss->bssid)) {
 547		cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
 548					ifibss->chandef.chan,
 549					ifibss->bssid, ifibss->ssid,
 550					ifibss->ssid_len,
 551					IEEE80211_BSS_TYPE_IBSS,
 552					IEEE80211_PRIVACY(ifibss->privacy));
 553		/* XXX: should not really modify cfg80211 data */
 554		if (cbss) {
 555			cbss->channel = sdata->csa_chandef.chan;
 556			cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
 557		}
 558	}
 559
 560	ifibss->chandef = sdata->csa_chandef;
 561
 562	/* generate the beacon */
 563	err = ieee80211_ibss_csa_beacon(sdata, NULL);
 564	if (err < 0)
 565		return err;
 566
 567	changed |= err;
 568
 569	return changed;
 570}
 571
 572void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata)
 573{
 574	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 575
 576	cancel_work_sync(&ifibss->csa_connection_drop_work);
 577}
 578
 579static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
 580	__acquires(RCU)
 581{
 582	struct ieee80211_sub_if_data *sdata = sta->sdata;
 583	u8 addr[ETH_ALEN];
 584
 585	memcpy(addr, sta->sta.addr, ETH_ALEN);
 586
 587	ibss_dbg(sdata, "Adding new IBSS station %pM\n", addr);
 588
 589	sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 590	sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 591	/* authorize the station only if the network is not RSN protected. If
 592	 * not wait for the userspace to authorize it */
 593	if (!sta->sdata->u.ibss.control_port)
 594		sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 595
 596	rate_control_rate_init(sta);
 597
 598	/* If it fails, maybe we raced another insertion? */
 599	if (sta_info_insert_rcu(sta))
 600		return sta_info_get(sdata, addr);
 601	return sta;
 602}
 603
 604static struct sta_info *
 605ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
 606		       const u8 *addr, u32 supp_rates)
 607	__acquires(RCU)
 608{
 609	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 610	struct ieee80211_local *local = sdata->local;
 611	struct sta_info *sta;
 612	struct ieee80211_chanctx_conf *chanctx_conf;
 613	struct ieee80211_supported_band *sband;
 614	enum nl80211_bss_scan_width scan_width;
 615	int band;
 616
 617	/*
 618	 * XXX: Consider removing the least recently used entry and
 619	 * 	allow new one to be added.
 620	 */
 621	if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
 622		net_info_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
 623				    sdata->name, addr);
 624		rcu_read_lock();
 625		return NULL;
 626	}
 627
 628	if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH) {
 629		rcu_read_lock();
 630		return NULL;
 631	}
 632
 633	if (!ether_addr_equal(bssid, sdata->u.ibss.bssid)) {
 634		rcu_read_lock();
 635		return NULL;
 636	}
 637
 638	rcu_read_lock();
 639	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 640	if (WARN_ON_ONCE(!chanctx_conf))
 641		return NULL;
 642	band = chanctx_conf->def.chan->band;
 643	scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
 644	rcu_read_unlock();
 645
 646	sta = sta_info_alloc(sdata, addr, GFP_KERNEL);
 647	if (!sta) {
 648		rcu_read_lock();
 649		return NULL;
 650	}
 651
 652	/* make sure mandatory rates are always added */
 653	sband = local->hw.wiphy->bands[band];
 654	sta->sta.supp_rates[band] = supp_rates |
 655			ieee80211_mandatory_rates(sband, scan_width);
 656
 657	return ieee80211_ibss_finish_sta(sta);
 658}
 659
 660static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
 661{
 662	struct ieee80211_local *local = sdata->local;
 663	int active = 0;
 664	struct sta_info *sta;
 665
 666	sdata_assert_lock(sdata);
 667
 668	rcu_read_lock();
 669
 670	list_for_each_entry_rcu(sta, &local->sta_list, list) {
 671		unsigned long last_active = ieee80211_sta_last_active(sta);
 672
 673		if (sta->sdata == sdata &&
 674		    time_is_after_jiffies(last_active +
 675					  IEEE80211_IBSS_MERGE_INTERVAL)) {
 676			active++;
 677			break;
 678		}
 679	}
 680
 681	rcu_read_unlock();
 682
 683	return active;
 684}
 685
 686static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
 687{
 688	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 689	struct ieee80211_local *local = sdata->local;
 690	struct cfg80211_bss *cbss;
 691	struct beacon_data *presp;
 692	struct sta_info *sta;
 693
 694	if (!is_zero_ether_addr(ifibss->bssid)) {
 695		cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
 696					ifibss->bssid, ifibss->ssid,
 697					ifibss->ssid_len,
 698					IEEE80211_BSS_TYPE_IBSS,
 699					IEEE80211_PRIVACY(ifibss->privacy));
 700
 701		if (cbss) {
 702			cfg80211_unlink_bss(local->hw.wiphy, cbss);
 703			cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
 704		}
 705	}
 706
 707	ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
 708
 709	sta_info_flush(sdata);
 710
 711	spin_lock_bh(&ifibss->incomplete_lock);
 712	while (!list_empty(&ifibss->incomplete_stations)) {
 713		sta = list_first_entry(&ifibss->incomplete_stations,
 714				       struct sta_info, list);
 715		list_del(&sta->list);
 716		spin_unlock_bh(&ifibss->incomplete_lock);
 717
 718		sta_info_free(local, sta);
 719		spin_lock_bh(&ifibss->incomplete_lock);
 720	}
 721	spin_unlock_bh(&ifibss->incomplete_lock);
 722
 723	netif_carrier_off(sdata->dev);
 724
 725	sdata->vif.bss_conf.ibss_joined = false;
 726	sdata->vif.bss_conf.ibss_creator = false;
 727	sdata->vif.bss_conf.enable_beacon = false;
 728	sdata->vif.bss_conf.ssid_len = 0;
 729
 730	/* remove beacon */
 731	presp = rcu_dereference_protected(ifibss->presp,
 732					  lockdep_is_held(&sdata->wdev.mtx));
 733	RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
 734	if (presp)
 735		kfree_rcu(presp, rcu_head);
 736
 737	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
 738	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
 739						BSS_CHANGED_IBSS);
 740	drv_leave_ibss(local, sdata);
 741	mutex_lock(&local->mtx);
 742	ieee80211_vif_release_channel(sdata);
 743	mutex_unlock(&local->mtx);
 744}
 745
 746static void ieee80211_csa_connection_drop_work(struct work_struct *work)
 747{
 748	struct ieee80211_sub_if_data *sdata =
 749		container_of(work, struct ieee80211_sub_if_data,
 750			     u.ibss.csa_connection_drop_work);
 751
 752	sdata_lock(sdata);
 753
 754	ieee80211_ibss_disconnect(sdata);
 755	synchronize_rcu();
 756	skb_queue_purge(&sdata->skb_queue);
 757
 758	/* trigger a scan to find another IBSS network to join */
 759	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 760
 761	sdata_unlock(sdata);
 762}
 763
 764static void ieee80211_ibss_csa_mark_radar(struct ieee80211_sub_if_data *sdata)
 765{
 766	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 767	int err;
 768
 769	/* if the current channel is a DFS channel, mark the channel as
 770	 * unavailable.
 771	 */
 772	err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
 773					    &ifibss->chandef,
 774					    NL80211_IFTYPE_ADHOC);
 775	if (err > 0)
 776		cfg80211_radar_event(sdata->local->hw.wiphy, &ifibss->chandef,
 777				     GFP_ATOMIC);
 778}
 779
 780static bool
 781ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 782				  struct ieee802_11_elems *elems,
 783				  bool beacon)
 784{
 785	struct cfg80211_csa_settings params;
 786	struct ieee80211_csa_ie csa_ie;
 787	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 788	enum nl80211_channel_type ch_type;
 789	int err;
 790	u32 sta_flags;
 791
 792	sdata_assert_lock(sdata);
 793
 794	sta_flags = IEEE80211_STA_DISABLE_VHT;
 795	switch (ifibss->chandef.width) {
 796	case NL80211_CHAN_WIDTH_5:
 797	case NL80211_CHAN_WIDTH_10:
 798	case NL80211_CHAN_WIDTH_20_NOHT:
 799		sta_flags |= IEEE80211_STA_DISABLE_HT;
 800		/* fall through */
 801	case NL80211_CHAN_WIDTH_20:
 802		sta_flags |= IEEE80211_STA_DISABLE_40MHZ;
 803		break;
 804	default:
 805		break;
 806	}
 807
 808	memset(&params, 0, sizeof(params));
 809	memset(&csa_ie, 0, sizeof(csa_ie));
 810	err = ieee80211_parse_ch_switch_ie(sdata, elems,
 811					   ifibss->chandef.chan->band,
 812					   sta_flags, ifibss->bssid, &csa_ie);
 813	/* can't switch to destination channel, fail */
 814	if (err < 0)
 815		goto disconnect;
 816
 817	/* did not contain a CSA */
 818	if (err)
 819		return false;
 820
 821	/* channel switch is not supported, disconnect */
 822	if (!(sdata->local->hw.wiphy->flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
 823		goto disconnect;
 824
 825	params.count = csa_ie.count;
 826	params.chandef = csa_ie.chandef;
 827
 828	switch (ifibss->chandef.width) {
 829	case NL80211_CHAN_WIDTH_20_NOHT:
 830	case NL80211_CHAN_WIDTH_20:
 831	case NL80211_CHAN_WIDTH_40:
 832		/* keep our current HT mode (HT20/HT40+/HT40-), even if
 833		 * another mode  has been announced. The mode is not adopted
 834		 * within the beacon while doing CSA and we should therefore
 835		 * keep the mode which we announce.
 836		 */
 837		ch_type = cfg80211_get_chandef_type(&ifibss->chandef);
 838		cfg80211_chandef_create(&params.chandef, params.chandef.chan,
 839					ch_type);
 840		break;
 841	case NL80211_CHAN_WIDTH_5:
 842	case NL80211_CHAN_WIDTH_10:
 843		if (params.chandef.width != ifibss->chandef.width) {
 844			sdata_info(sdata,
 845				   "IBSS %pM received channel switch from incompatible channel width (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
 846				   ifibss->bssid,
 847				   params.chandef.chan->center_freq,
 848				   params.chandef.width,
 849				   params.chandef.center_freq1,
 850				   params.chandef.center_freq2);
 851			goto disconnect;
 852		}
 853		break;
 854	default:
 855		/* should not happen, sta_flags should prevent VHT modes. */
 856		WARN_ON(1);
 857		goto disconnect;
 858	}
 859
 860	if (!cfg80211_reg_can_beacon(sdata->local->hw.wiphy, &params.chandef,
 861				     NL80211_IFTYPE_ADHOC)) {
 862		sdata_info(sdata,
 863			   "IBSS %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
 864			   ifibss->bssid,
 865			   params.chandef.chan->center_freq,
 866			   params.chandef.width,
 867			   params.chandef.center_freq1,
 868			   params.chandef.center_freq2);
 869		goto disconnect;
 870	}
 871
 872	err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
 873					    &params.chandef,
 874					    NL80211_IFTYPE_ADHOC);
 875	if (err < 0)
 876		goto disconnect;
 877	if (err > 0 && !ifibss->userspace_handles_dfs) {
 878		/* IBSS-DFS only allowed with a control program */
 879		goto disconnect;
 880	}
 881
 882	params.radar_required = err;
 883
 884	if (cfg80211_chandef_identical(&params.chandef,
 885				       &sdata->vif.bss_conf.chandef)) {
 886		ibss_dbg(sdata,
 887			 "received csa with an identical chandef, ignoring\n");
 888		return true;
 889	}
 890
 891	/* all checks done, now perform the channel switch. */
 892	ibss_dbg(sdata,
 893		 "received channel switch announcement to go to channel %d MHz\n",
 894		 params.chandef.chan->center_freq);
 895
 896	params.block_tx = !!csa_ie.mode;
 897
 898	if (ieee80211_channel_switch(sdata->local->hw.wiphy, sdata->dev,
 899				     &params))
 900		goto disconnect;
 901
 902	ieee80211_ibss_csa_mark_radar(sdata);
 903
 904	return true;
 905disconnect:
 906	ibss_dbg(sdata, "Can't handle channel switch, disconnect\n");
 907	ieee80211_queue_work(&sdata->local->hw,
 908			     &ifibss->csa_connection_drop_work);
 909
 910	ieee80211_ibss_csa_mark_radar(sdata);
 911
 912	return true;
 913}
 914
 915static void
 916ieee80211_rx_mgmt_spectrum_mgmt(struct ieee80211_sub_if_data *sdata,
 917				struct ieee80211_mgmt *mgmt, size_t len,
 918				struct ieee80211_rx_status *rx_status,
 919				struct ieee802_11_elems *elems)
 920{
 921	int required_len;
 922
 923	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
 924		return;
 925
 926	/* CSA is the only action we handle for now */
 927	if (mgmt->u.action.u.measurement.action_code !=
 928	    WLAN_ACTION_SPCT_CHL_SWITCH)
 929		return;
 930
 931	required_len = IEEE80211_MIN_ACTION_SIZE +
 932		       sizeof(mgmt->u.action.u.chan_switch);
 933	if (len < required_len)
 934		return;
 935
 936	if (!sdata->vif.csa_active)
 937		ieee80211_ibss_process_chanswitch(sdata, elems, false);
 938}
 939
 940static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
 941					  struct ieee80211_mgmt *mgmt,
 942					  size_t len)
 943{
 944	u16 reason = le16_to_cpu(mgmt->u.deauth.reason_code);
 945
 946	if (len < IEEE80211_DEAUTH_FRAME_LEN)
 947		return;
 948
 949	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
 950		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
 951	sta_info_destroy_addr(sdata, mgmt->sa);
 952}
 953
 954static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 955					struct ieee80211_mgmt *mgmt,
 956					size_t len)
 957{
 958	u16 auth_alg, auth_transaction;
 959
 960	sdata_assert_lock(sdata);
 961
 962	if (len < 24 + 6)
 963		return;
 964
 965	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
 966	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 967
 968	ibss_dbg(sdata,
 969		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
 970		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
 971
 972	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
 973		return;
 974
 975	/*
 976	 * IEEE 802.11 standard does not require authentication in IBSS
 977	 * networks and most implementations do not seem to use it.
 978	 * However, try to reply to authentication attempts if someone
 979	 * has actually implemented this.
 980	 */
 981	ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, 0, NULL, 0,
 982			    mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0, 0);
 983}
 984
 985static void ieee80211_update_sta_info(struct ieee80211_sub_if_data *sdata,
 986				      struct ieee80211_mgmt *mgmt, size_t len,
 987				      struct ieee80211_rx_status *rx_status,
 988				      struct ieee802_11_elems *elems,
 989				      struct ieee80211_channel *channel)
 990{
 991	struct sta_info *sta;
 992	enum nl80211_band band = rx_status->band;
 993	enum nl80211_bss_scan_width scan_width;
 994	struct ieee80211_local *local = sdata->local;
 995	struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
 996	bool rates_updated = false;
 997	u32 supp_rates = 0;
 998
 999	if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
1000		return;
1001
1002	if (!ether_addr_equal(mgmt->bssid, sdata->u.ibss.bssid))
1003		return;
1004
 
 
 
 
1005	rcu_read_lock();
1006	sta = sta_info_get(sdata, mgmt->sa);
1007
1008	if (elems->supp_rates) {
1009		supp_rates = ieee80211_sta_get_rates(sdata, elems,
1010						     band, NULL);
1011		if (sta) {
1012			u32 prev_rates;
1013
1014			prev_rates = sta->sta.supp_rates[band];
1015			/* make sure mandatory rates are always added */
1016			scan_width = NL80211_BSS_CHAN_WIDTH_20;
1017			if (rx_status->flag & RX_FLAG_5MHZ)
1018				scan_width = NL80211_BSS_CHAN_WIDTH_5;
1019			if (rx_status->flag & RX_FLAG_10MHZ)
1020				scan_width = NL80211_BSS_CHAN_WIDTH_10;
1021
1022			sta->sta.supp_rates[band] = supp_rates |
1023				ieee80211_mandatory_rates(sband, scan_width);
1024			if (sta->sta.supp_rates[band] != prev_rates) {
1025				ibss_dbg(sdata,
1026					 "updated supp_rates set for %pM based on beacon/probe_resp (0x%x -> 0x%x)\n",
1027					 sta->sta.addr, prev_rates,
1028					 sta->sta.supp_rates[band]);
1029				rates_updated = true;
1030			}
1031		} else {
1032			rcu_read_unlock();
1033			sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid,
1034						     mgmt->sa, supp_rates);
1035		}
1036	}
1037
1038	if (sta && !sta->sta.wme &&
1039	    elems->wmm_info && local->hw.queues >= IEEE80211_NUM_ACS) {
1040		sta->sta.wme = true;
1041		ieee80211_check_fast_xmit(sta);
1042	}
1043
1044	if (sta && elems->ht_operation && elems->ht_cap_elem &&
1045	    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
1046	    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_5 &&
1047	    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_10) {
1048		/* we both use HT */
1049		struct ieee80211_ht_cap htcap_ie;
1050		struct cfg80211_chan_def chandef;
1051		enum ieee80211_sta_rx_bandwidth bw = sta->sta.bandwidth;
1052
1053		cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
1054		ieee80211_chandef_ht_oper(elems->ht_operation, &chandef);
1055
1056		memcpy(&htcap_ie, elems->ht_cap_elem, sizeof(htcap_ie));
1057		rates_updated |= ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
1058								   &htcap_ie,
1059								   sta);
1060
1061		if (elems->vht_operation && elems->vht_cap_elem &&
1062		    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20 &&
1063		    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_40) {
1064			/* we both use VHT */
1065			struct ieee80211_vht_cap cap_ie;
1066			struct ieee80211_sta_vht_cap cap = sta->sta.vht_cap;
1067
1068			ieee80211_chandef_vht_oper(elems->vht_operation,
1069						   &chandef);
1070			memcpy(&cap_ie, elems->vht_cap_elem, sizeof(cap_ie));
1071			ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
1072							    &cap_ie, sta);
1073			if (memcmp(&cap, &sta->sta.vht_cap, sizeof(cap)))
1074				rates_updated |= true;
1075		}
1076
1077		if (bw != sta->sta.bandwidth)
1078			rates_updated |= true;
1079
1080		if (!cfg80211_chandef_compatible(&sdata->u.ibss.chandef,
1081						 &chandef))
1082			WARN_ON_ONCE(1);
1083	}
1084
1085	if (sta && rates_updated) {
1086		u32 changed = IEEE80211_RC_SUPP_RATES_CHANGED;
1087		u8 rx_nss = sta->sta.rx_nss;
1088
1089		/* Force rx_nss recalculation */
1090		sta->sta.rx_nss = 0;
1091		rate_control_rate_init(sta);
1092		if (sta->sta.rx_nss != rx_nss)
1093			changed |= IEEE80211_RC_NSS_CHANGED;
1094
1095		drv_sta_rc_update(local, sdata, &sta->sta, changed);
1096	}
1097
1098	rcu_read_unlock();
1099}
1100
1101static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
1102				  struct ieee80211_mgmt *mgmt, size_t len,
1103				  struct ieee80211_rx_status *rx_status,
1104				  struct ieee802_11_elems *elems)
1105{
1106	struct ieee80211_local *local = sdata->local;
1107	struct cfg80211_bss *cbss;
1108	struct ieee80211_bss *bss;
1109	struct ieee80211_channel *channel;
1110	u64 beacon_timestamp, rx_timestamp;
1111	u32 supp_rates = 0;
1112	enum nl80211_band band = rx_status->band;
1113
1114	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
1115	if (!channel)
1116		return;
1117
1118	ieee80211_update_sta_info(sdata, mgmt, len, rx_status, elems, channel);
1119
1120	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
1121					channel);
1122	if (!bss)
1123		return;
1124
1125	cbss = container_of((void *)bss, struct cfg80211_bss, priv);
1126
1127	/* same for beacon and probe response */
1128	beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
1129
1130	/* check if we need to merge IBSS */
1131
1132	/* not an IBSS */
1133	if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
1134		goto put_bss;
1135
1136	/* different channel */
1137	if (sdata->u.ibss.fixed_channel &&
1138	    sdata->u.ibss.chandef.chan != cbss->channel)
1139		goto put_bss;
1140
1141	/* different SSID */
1142	if (elems->ssid_len != sdata->u.ibss.ssid_len ||
1143	    memcmp(elems->ssid, sdata->u.ibss.ssid,
1144				sdata->u.ibss.ssid_len))
1145		goto put_bss;
1146
1147	/* process channel switch */
1148	if (sdata->vif.csa_active ||
1149	    ieee80211_ibss_process_chanswitch(sdata, elems, true))
1150		goto put_bss;
1151
1152	/* same BSSID */
1153	if (ether_addr_equal(cbss->bssid, sdata->u.ibss.bssid))
1154		goto put_bss;
1155
1156	/* we use a fixed BSSID */
1157	if (sdata->u.ibss.fixed_bssid)
1158		goto put_bss;
1159
1160	if (ieee80211_have_rx_timestamp(rx_status)) {
1161		/* time when timestamp field was received */
1162		rx_timestamp =
1163			ieee80211_calculate_rx_timestamp(local, rx_status,
1164							 len + FCS_LEN, 24);
1165	} else {
1166		/*
1167		 * second best option: get current TSF
1168		 * (will return -1 if not supported)
1169		 */
1170		rx_timestamp = drv_get_tsf(local, sdata);
1171	}
1172
1173	ibss_dbg(sdata,
1174		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
1175		 mgmt->sa, mgmt->bssid,
1176		 (unsigned long long)rx_timestamp,
1177		 (unsigned long long)beacon_timestamp,
1178		 (unsigned long long)(rx_timestamp - beacon_timestamp),
1179		 jiffies);
1180
1181	if (beacon_timestamp > rx_timestamp) {
1182		ibss_dbg(sdata,
1183			 "beacon TSF higher than local TSF - IBSS merge with BSSID %pM\n",
1184			 mgmt->bssid);
1185		ieee80211_sta_join_ibss(sdata, bss);
1186		supp_rates = ieee80211_sta_get_rates(sdata, elems, band, NULL);
1187		ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
1188				       supp_rates);
1189		rcu_read_unlock();
1190	}
1191
1192 put_bss:
1193	ieee80211_rx_bss_put(local, bss);
1194}
1195
1196void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
1197			      const u8 *bssid, const u8 *addr,
1198			      u32 supp_rates)
1199{
1200	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1201	struct ieee80211_local *local = sdata->local;
1202	struct sta_info *sta;
1203	struct ieee80211_chanctx_conf *chanctx_conf;
1204	struct ieee80211_supported_band *sband;
1205	enum nl80211_bss_scan_width scan_width;
1206	int band;
1207
1208	/*
1209	 * XXX: Consider removing the least recently used entry and
1210	 * 	allow new one to be added.
1211	 */
1212	if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
1213		net_info_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
1214				    sdata->name, addr);
1215		return;
1216	}
1217
1218	if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
1219		return;
1220
1221	if (!ether_addr_equal(bssid, sdata->u.ibss.bssid))
1222		return;
1223
1224	rcu_read_lock();
1225	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1226	if (WARN_ON_ONCE(!chanctx_conf)) {
1227		rcu_read_unlock();
1228		return;
1229	}
1230	band = chanctx_conf->def.chan->band;
1231	scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
1232	rcu_read_unlock();
1233
1234	sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
1235	if (!sta)
1236		return;
1237
1238	/* make sure mandatory rates are always added */
1239	sband = local->hw.wiphy->bands[band];
1240	sta->sta.supp_rates[band] = supp_rates |
1241			ieee80211_mandatory_rates(sband, scan_width);
1242
1243	spin_lock(&ifibss->incomplete_lock);
1244	list_add(&sta->list, &ifibss->incomplete_stations);
1245	spin_unlock(&ifibss->incomplete_lock);
1246	ieee80211_queue_work(&local->hw, &sdata->work);
1247}
1248
1249static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
1250{
1251	struct ieee80211_local *local = sdata->local;
1252	struct sta_info *sta, *tmp;
1253	unsigned long exp_time = IEEE80211_IBSS_INACTIVITY_LIMIT;
1254	unsigned long exp_rsn = IEEE80211_IBSS_RSN_INACTIVITY_LIMIT;
1255
1256	mutex_lock(&local->sta_mtx);
1257
1258	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1259		unsigned long last_active = ieee80211_sta_last_active(sta);
1260
1261		if (sdata != sta->sdata)
1262			continue;
1263
1264		if (time_is_before_jiffies(last_active + exp_time) ||
1265		    (time_is_before_jiffies(last_active + exp_rsn) &&
1266		     sta->sta_state != IEEE80211_STA_AUTHORIZED)) {
1267			sta_dbg(sta->sdata, "expiring inactive %sSTA %pM\n",
1268				sta->sta_state != IEEE80211_STA_AUTHORIZED ?
1269				"not authorized " : "", sta->sta.addr);
1270
1271			WARN_ON(__sta_info_destroy(sta));
1272		}
1273	}
1274
1275	mutex_unlock(&local->sta_mtx);
1276}
1277
1278/*
1279 * This function is called with state == IEEE80211_IBSS_MLME_JOINED
1280 */
1281
1282static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
1283{
1284	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1285	enum nl80211_bss_scan_width scan_width;
1286
1287	sdata_assert_lock(sdata);
1288
1289	mod_timer(&ifibss->timer,
1290		  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
1291
1292	ieee80211_ibss_sta_expire(sdata);
1293
1294	if (time_before(jiffies, ifibss->last_scan_completed +
1295		       IEEE80211_IBSS_MERGE_INTERVAL))
1296		return;
1297
1298	if (ieee80211_sta_active_ibss(sdata))
1299		return;
1300
1301	if (ifibss->fixed_channel)
1302		return;
1303
1304	sdata_info(sdata,
1305		   "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
1306
1307	scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
1308	ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
1309				    NULL, 0, scan_width);
1310}
1311
1312static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
1313{
1314	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1315	u8 bssid[ETH_ALEN];
1316	u16 capability;
1317	int i;
1318
1319	sdata_assert_lock(sdata);
1320
1321	if (ifibss->fixed_bssid) {
1322		memcpy(bssid, ifibss->bssid, ETH_ALEN);
1323	} else {
1324		/* Generate random, not broadcast, locally administered BSSID. Mix in
1325		 * own MAC address to make sure that devices that do not have proper
1326		 * random number generator get different BSSID. */
1327		get_random_bytes(bssid, ETH_ALEN);
1328		for (i = 0; i < ETH_ALEN; i++)
1329			bssid[i] ^= sdata->vif.addr[i];
1330		bssid[0] &= ~0x01;
1331		bssid[0] |= 0x02;
1332	}
1333
1334	sdata_info(sdata, "Creating new IBSS network, BSSID %pM\n", bssid);
1335
1336	capability = WLAN_CAPABILITY_IBSS;
1337
1338	if (ifibss->privacy)
1339		capability |= WLAN_CAPABILITY_PRIVACY;
1340
1341	__ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
1342				  &ifibss->chandef, ifibss->basic_rates,
1343				  capability, 0, true);
1344}
1345
1346static unsigned ibss_setup_channels(struct wiphy *wiphy,
1347				    struct ieee80211_channel **channels,
1348				    unsigned int channels_max,
1349				    u32 center_freq, u32 width)
1350{
1351	struct ieee80211_channel *chan = NULL;
1352	unsigned int n_chan = 0;
1353	u32 start_freq, end_freq, freq;
1354
1355	if (width <= 20) {
1356		start_freq = center_freq;
1357		end_freq = center_freq;
1358	} else {
1359		start_freq = center_freq - width / 2 + 10;
1360		end_freq = center_freq + width / 2 - 10;
1361	}
1362
1363	for (freq = start_freq; freq <= end_freq; freq += 20) {
1364		chan = ieee80211_get_channel(wiphy, freq);
1365		if (!chan)
1366			continue;
1367		if (n_chan >= channels_max)
1368			return n_chan;
1369
1370		channels[n_chan] = chan;
1371		n_chan++;
1372	}
1373
1374	return n_chan;
1375}
1376
1377static unsigned int
1378ieee80211_ibss_setup_scan_channels(struct wiphy *wiphy,
1379				   const struct cfg80211_chan_def *chandef,
1380				   struct ieee80211_channel **channels,
1381				   unsigned int channels_max)
1382{
1383	unsigned int n_chan = 0;
1384	u32 width, cf1, cf2 = 0;
1385
1386	switch (chandef->width) {
1387	case NL80211_CHAN_WIDTH_40:
1388		width = 40;
1389		break;
1390	case NL80211_CHAN_WIDTH_80P80:
1391		cf2 = chandef->center_freq2;
1392		/* fall through */
1393	case NL80211_CHAN_WIDTH_80:
1394		width = 80;
1395		break;
1396	case NL80211_CHAN_WIDTH_160:
1397		width = 160;
1398		break;
1399	default:
1400		width = 20;
1401		break;
1402	}
1403
1404	cf1 = chandef->center_freq1;
1405
1406	n_chan = ibss_setup_channels(wiphy, channels, channels_max, cf1, width);
1407
1408	if (cf2)
1409		n_chan += ibss_setup_channels(wiphy, &channels[n_chan],
1410					      channels_max - n_chan, cf2,
1411					      width);
1412
1413	return n_chan;
1414}
1415
1416/*
1417 * This function is called with state == IEEE80211_IBSS_MLME_SEARCH
1418 */
1419
1420static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
1421{
1422	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1423	struct ieee80211_local *local = sdata->local;
1424	struct cfg80211_bss *cbss;
1425	struct ieee80211_channel *chan = NULL;
1426	const u8 *bssid = NULL;
1427	enum nl80211_bss_scan_width scan_width;
1428	int active_ibss;
1429
1430	sdata_assert_lock(sdata);
1431
1432	active_ibss = ieee80211_sta_active_ibss(sdata);
1433	ibss_dbg(sdata, "sta_find_ibss (active_ibss=%d)\n", active_ibss);
1434
1435	if (active_ibss)
1436		return;
1437
1438	if (ifibss->fixed_bssid)
1439		bssid = ifibss->bssid;
1440	if (ifibss->fixed_channel)
1441		chan = ifibss->chandef.chan;
1442	if (!is_zero_ether_addr(ifibss->bssid))
1443		bssid = ifibss->bssid;
1444	cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
1445				ifibss->ssid, ifibss->ssid_len,
1446				IEEE80211_BSS_TYPE_IBSS,
1447				IEEE80211_PRIVACY(ifibss->privacy));
1448
1449	if (cbss) {
1450		struct ieee80211_bss *bss;
1451
1452		bss = (void *)cbss->priv;
1453		ibss_dbg(sdata,
1454			 "sta_find_ibss: selected %pM current %pM\n",
1455			 cbss->bssid, ifibss->bssid);
1456		sdata_info(sdata,
1457			   "Selected IBSS BSSID %pM based on configured SSID\n",
1458			   cbss->bssid);
1459
1460		ieee80211_sta_join_ibss(sdata, bss);
1461		ieee80211_rx_bss_put(local, bss);
1462		return;
1463	}
1464
1465	/* if a fixed bssid and a fixed freq have been provided create the IBSS
1466	 * directly and do not waste time scanning
1467	 */
1468	if (ifibss->fixed_bssid && ifibss->fixed_channel) {
1469		sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
1470			   bssid);
1471		ieee80211_sta_create_ibss(sdata);
1472		return;
1473	}
1474
1475
1476	ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
1477
1478	/* Selected IBSS not found in current scan results - try to scan */
1479	if (time_after(jiffies, ifibss->last_scan_completed +
1480					IEEE80211_SCAN_INTERVAL)) {
1481		struct ieee80211_channel *channels[8];
1482		unsigned int num;
1483
1484		sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
1485
1486		scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
1487
1488		if (ifibss->fixed_channel) {
1489			num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
1490								 &ifibss->chandef,
1491								 channels,
1492								 ARRAY_SIZE(channels));
1493			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
1494						    ifibss->ssid_len, channels,
1495						    num, scan_width);
1496		} else {
1497			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
1498						    ifibss->ssid_len, NULL,
1499						    0, scan_width);
1500		}
1501	} else {
1502		int interval = IEEE80211_SCAN_INTERVAL;
1503
1504		if (time_after(jiffies, ifibss->ibss_join_req +
1505			       IEEE80211_IBSS_JOIN_TIMEOUT))
1506			ieee80211_sta_create_ibss(sdata);
1507
1508		mod_timer(&ifibss->timer,
1509			  round_jiffies(jiffies + interval));
1510	}
1511}
1512
1513static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
1514					struct sk_buff *req)
1515{
1516	struct ieee80211_mgmt *mgmt = (void *)req->data;
1517	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1518	struct ieee80211_local *local = sdata->local;
1519	int tx_last_beacon, len = req->len;
1520	struct sk_buff *skb;
1521	struct beacon_data *presp;
1522	u8 *pos, *end;
1523
1524	sdata_assert_lock(sdata);
1525
1526	presp = rcu_dereference_protected(ifibss->presp,
1527					  lockdep_is_held(&sdata->wdev.mtx));
1528
1529	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
1530	    len < 24 + 2 || !presp)
1531		return;
1532
1533	tx_last_beacon = drv_tx_last_beacon(local);
1534
1535	ibss_dbg(sdata,
1536		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
1537		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
1538
1539	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
1540		return;
1541
1542	if (!ether_addr_equal(mgmt->bssid, ifibss->bssid) &&
1543	    !is_broadcast_ether_addr(mgmt->bssid))
1544		return;
1545
1546	end = ((u8 *) mgmt) + len;
1547	pos = mgmt->u.probe_req.variable;
1548	if (pos[0] != WLAN_EID_SSID ||
1549	    pos + 2 + pos[1] > end) {
1550		ibss_dbg(sdata, "Invalid SSID IE in ProbeReq from %pM\n",
1551			 mgmt->sa);
1552		return;
1553	}
1554	if (pos[1] != 0 &&
1555	    (pos[1] != ifibss->ssid_len ||
1556	     memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
1557		/* Ignore ProbeReq for foreign SSID */
1558		return;
1559	}
1560
1561	/* Reply with ProbeResp */
1562	skb = dev_alloc_skb(local->tx_headroom + presp->head_len);
1563	if (!skb)
1564		return;
1565
1566	skb_reserve(skb, local->tx_headroom);
1567	memcpy(skb_put(skb, presp->head_len), presp->head, presp->head_len);
1568
1569	memcpy(((struct ieee80211_mgmt *) skb->data)->da, mgmt->sa, ETH_ALEN);
1570	ibss_dbg(sdata, "Sending ProbeResp to %pM\n", mgmt->sa);
1571	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1572
1573	/* avoid excessive retries for probe request to wildcard SSIDs */
1574	if (pos[1] == 0)
1575		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_NO_ACK;
1576
1577	ieee80211_tx_skb(sdata, skb);
1578}
1579
1580static
1581void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
1582				    struct ieee80211_mgmt *mgmt, size_t len,
1583				    struct ieee80211_rx_status *rx_status)
1584{
1585	size_t baselen;
1586	struct ieee802_11_elems elems;
1587
1588	BUILD_BUG_ON(offsetof(typeof(mgmt->u.probe_resp), variable) !=
1589		     offsetof(typeof(mgmt->u.beacon), variable));
1590
1591	/*
1592	 * either beacon or probe_resp but the variable field is at the
1593	 * same offset
1594	 */
1595	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
1596	if (baselen > len)
1597		return;
1598
1599	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
1600			       false, &elems);
1601
1602	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
1603}
1604
1605void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1606				   struct sk_buff *skb)
1607{
1608	struct ieee80211_rx_status *rx_status;
1609	struct ieee80211_mgmt *mgmt;
1610	u16 fc;
1611	struct ieee802_11_elems elems;
1612	int ies_len;
1613
1614	rx_status = IEEE80211_SKB_RXCB(skb);
1615	mgmt = (struct ieee80211_mgmt *) skb->data;
1616	fc = le16_to_cpu(mgmt->frame_control);
1617
1618	sdata_lock(sdata);
1619
1620	if (!sdata->u.ibss.ssid_len)
1621		goto mgmt_out; /* not ready to merge yet */
1622
1623	switch (fc & IEEE80211_FCTL_STYPE) {
1624	case IEEE80211_STYPE_PROBE_REQ:
1625		ieee80211_rx_mgmt_probe_req(sdata, skb);
1626		break;
1627	case IEEE80211_STYPE_PROBE_RESP:
1628	case IEEE80211_STYPE_BEACON:
1629		ieee80211_rx_mgmt_probe_beacon(sdata, mgmt, skb->len,
1630					       rx_status);
1631		break;
1632	case IEEE80211_STYPE_AUTH:
1633		ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
1634		break;
1635	case IEEE80211_STYPE_DEAUTH:
1636		ieee80211_rx_mgmt_deauth_ibss(sdata, mgmt, skb->len);
1637		break;
1638	case IEEE80211_STYPE_ACTION:
1639		switch (mgmt->u.action.category) {
1640		case WLAN_CATEGORY_SPECTRUM_MGMT:
1641			ies_len = skb->len -
1642				  offsetof(struct ieee80211_mgmt,
1643					   u.action.u.chan_switch.variable);
1644
1645			if (ies_len < 0)
1646				break;
1647
1648			ieee802_11_parse_elems(
1649				mgmt->u.action.u.chan_switch.variable,
1650				ies_len, true, &elems);
1651
1652			if (elems.parse_error)
1653				break;
1654
1655			ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len,
1656							rx_status, &elems);
1657			break;
1658		}
1659	}
1660
1661 mgmt_out:
1662	sdata_unlock(sdata);
1663}
1664
1665void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
1666{
1667	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1668	struct sta_info *sta;
1669
1670	sdata_lock(sdata);
1671
1672	/*
1673	 * Work could be scheduled after scan or similar
1674	 * when we aren't even joined (or trying) with a
1675	 * network.
1676	 */
1677	if (!ifibss->ssid_len)
1678		goto out;
1679
1680	spin_lock_bh(&ifibss->incomplete_lock);
1681	while (!list_empty(&ifibss->incomplete_stations)) {
1682		sta = list_first_entry(&ifibss->incomplete_stations,
1683				       struct sta_info, list);
1684		list_del(&sta->list);
1685		spin_unlock_bh(&ifibss->incomplete_lock);
1686
1687		ieee80211_ibss_finish_sta(sta);
1688		rcu_read_unlock();
1689		spin_lock_bh(&ifibss->incomplete_lock);
1690	}
1691	spin_unlock_bh(&ifibss->incomplete_lock);
1692
1693	switch (ifibss->state) {
1694	case IEEE80211_IBSS_MLME_SEARCH:
1695		ieee80211_sta_find_ibss(sdata);
1696		break;
1697	case IEEE80211_IBSS_MLME_JOINED:
1698		ieee80211_sta_merge_ibss(sdata);
1699		break;
1700	default:
1701		WARN_ON(1);
1702		break;
1703	}
1704
1705 out:
1706	sdata_unlock(sdata);
1707}
1708
1709static void ieee80211_ibss_timer(unsigned long data)
1710{
1711	struct ieee80211_sub_if_data *sdata =
1712		(struct ieee80211_sub_if_data *) data;
1713
1714	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1715}
1716
1717void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
1718{
1719	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1720
1721	setup_timer(&ifibss->timer, ieee80211_ibss_timer,
1722		    (unsigned long) sdata);
1723	INIT_LIST_HEAD(&ifibss->incomplete_stations);
1724	spin_lock_init(&ifibss->incomplete_lock);
1725	INIT_WORK(&ifibss->csa_connection_drop_work,
1726		  ieee80211_csa_connection_drop_work);
1727}
1728
1729/* scan finished notification */
1730void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
1731{
1732	struct ieee80211_sub_if_data *sdata;
1733
1734	mutex_lock(&local->iflist_mtx);
1735	list_for_each_entry(sdata, &local->interfaces, list) {
1736		if (!ieee80211_sdata_running(sdata))
1737			continue;
1738		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
1739			continue;
1740		sdata->u.ibss.last_scan_completed = jiffies;
1741	}
1742	mutex_unlock(&local->iflist_mtx);
1743}
1744
1745int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
1746			struct cfg80211_ibss_params *params)
1747{
1748	u32 changed = 0;
1749	u32 rate_flags;
1750	struct ieee80211_supported_band *sband;
1751	enum ieee80211_chanctx_mode chanmode;
1752	struct ieee80211_local *local = sdata->local;
1753	int radar_detect_width = 0;
1754	int i;
1755	int ret;
1756
1757	ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
1758					    &params->chandef,
1759					    sdata->wdev.iftype);
1760	if (ret < 0)
1761		return ret;
1762
1763	if (ret > 0) {
1764		if (!params->userspace_handles_dfs)
1765			return -EINVAL;
1766		radar_detect_width = BIT(params->chandef.width);
1767	}
1768
1769	chanmode = (params->channel_fixed && !ret) ?
1770		IEEE80211_CHANCTX_SHARED : IEEE80211_CHANCTX_EXCLUSIVE;
1771
1772	mutex_lock(&local->chanctx_mtx);
1773	ret = ieee80211_check_combinations(sdata, &params->chandef, chanmode,
1774					   radar_detect_width);
1775	mutex_unlock(&local->chanctx_mtx);
1776	if (ret < 0)
1777		return ret;
1778
1779	if (params->bssid) {
1780		memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
1781		sdata->u.ibss.fixed_bssid = true;
1782	} else
1783		sdata->u.ibss.fixed_bssid = false;
1784
1785	sdata->u.ibss.privacy = params->privacy;
1786	sdata->u.ibss.control_port = params->control_port;
1787	sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
1788	sdata->u.ibss.basic_rates = params->basic_rates;
1789	sdata->u.ibss.last_scan_completed = jiffies;
1790
1791	/* fix basic_rates if channel does not support these rates */
1792	rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
1793	sband = local->hw.wiphy->bands[params->chandef.chan->band];
1794	for (i = 0; i < sband->n_bitrates; i++) {
1795		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
1796			sdata->u.ibss.basic_rates &= ~BIT(i);
1797	}
1798	memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
1799	       sizeof(params->mcast_rate));
1800
1801	sdata->vif.bss_conf.beacon_int = params->beacon_interval;
1802
1803	sdata->u.ibss.chandef = params->chandef;
1804	sdata->u.ibss.fixed_channel = params->channel_fixed;
1805
1806	if (params->ie) {
1807		sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
1808					   GFP_KERNEL);
1809		if (sdata->u.ibss.ie)
1810			sdata->u.ibss.ie_len = params->ie_len;
1811	}
1812
1813	sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
1814	sdata->u.ibss.ibss_join_req = jiffies;
1815
1816	memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
1817	sdata->u.ibss.ssid_len = params->ssid_len;
1818
1819	memcpy(&sdata->u.ibss.ht_capa, &params->ht_capa,
1820	       sizeof(sdata->u.ibss.ht_capa));
1821	memcpy(&sdata->u.ibss.ht_capa_mask, &params->ht_capa_mask,
1822	       sizeof(sdata->u.ibss.ht_capa_mask));
1823
1824	/*
1825	 * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
1826	 * reserved, but an HT STA shall protect HT transmissions as though
1827	 * the HT Protection field were set to non-HT mixed mode.
1828	 *
1829	 * In an IBSS, the RIFS Mode field of the HT Operation element is
1830	 * also reserved, but an HT STA shall operate as though this field
1831	 * were set to 1.
1832	 */
1833
1834	sdata->vif.bss_conf.ht_operation_mode |=
1835		  IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED
1836		| IEEE80211_HT_PARAM_RIFS_MODE;
1837
1838	changed |= BSS_CHANGED_HT;
1839	ieee80211_bss_info_change_notify(sdata, changed);
1840
1841	sdata->smps_mode = IEEE80211_SMPS_OFF;
1842	sdata->needed_rx_chains = local->rx_chains;
 
1843
1844	ieee80211_queue_work(&local->hw, &sdata->work);
1845
1846	return 0;
1847}
1848
1849int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
1850{
1851	struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1852
1853	ieee80211_ibss_disconnect(sdata);
1854	ifibss->ssid_len = 0;
1855	eth_zero_addr(ifibss->bssid);
1856
1857	/* remove beacon */
1858	kfree(sdata->u.ibss.ie);
1859
1860	/* on the next join, re-program HT parameters */
1861	memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
1862	memset(&ifibss->ht_capa_mask, 0, sizeof(ifibss->ht_capa_mask));
1863
1864	synchronize_rcu();
1865
1866	skb_queue_purge(&sdata->skb_queue);
1867
1868	del_timer_sync(&sdata->u.ibss.timer);
1869
1870	return 0;
1871}