Changeset 1dcc0b9 in mainline

Timestamp:

2015-04-06T10:47:51Z (9 years ago)

Author:

Jan Kolarik <kolarik@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

d7dadcb4

Parents:

59fa7ab

Message:

Scanning whole 2.4GHz spectrum, created supplicant for managing connection between device STA and AP, finished association process between STA and AP, handling 4way handshake protocol used for key management, written needed cryptographic algorithms (AES, SHA1, HMAC, PBKDF2) for CCMP protocol, data communication on OPEN/CCMP networks.

Location:

uspace

Files:

• Makefile (modified) (2 diffs)
• Makefile.common (modified) (1 diff)
• app/wifi_supplicant/wifi_supplicant.c (modified) (8 diffs)
• drv/nic/ar9271/Makefile (modified) (2 diffs)
• drv/nic/ar9271/ar9271.c (modified) (12 diffs)
• drv/nic/ar9271/ar9271.h (modified) (6 diffs)
• drv/nic/ar9271/ath_usb.h (modified) (1 diff)
• drv/nic/ar9271/htc.c (modified) (2 diffs)
• drv/nic/ar9271/htc.h (modified) (14 diffs)
• drv/nic/ar9271/hw.c (modified) (12 diffs)
• drv/nic/ar9271/hw.h (modified) (1 diff)
• drv/nic/ar9271/wmi.c (modified) (2 diffs)
• drv/nic/ar9271/wmi.h (modified) (2 diffs)
• lib/c/include/ieee80211/ieee80211.h (modified) (2 diffs)
• lib/crypto/Makefile (added)
• lib/crypto/aes.c (added)
• lib/crypto/crypto.c (added)
• lib/crypto/crypto.h (added)
• lib/drv/generic/remote_ieee80211.c (modified) (13 diffs)
• lib/drv/include/ieee80211_iface.h (modified) (1 diff)
• lib/drv/include/ops/ieee80211.h (modified) (2 diffs)
• lib/ieee80211/Makefile (modified) (2 diffs)
• lib/ieee80211/include/ieee80211.h (modified) (5 diffs)
• lib/ieee80211/include/ieee80211_iface_impl.h (modified) (1 diff)
• lib/ieee80211/include/ieee80211_impl.h (modified) (1 diff)
• lib/ieee80211/include/ieee80211_private.h (modified) (11 diffs)
• lib/ieee80211/src/ieee80211.c (modified) (25 diffs)
• lib/ieee80211/src/ieee80211_iface_impl.c (modified) (2 diffs)
• lib/ieee80211/src/ieee80211_impl.c (modified) (5 diffs)

uspace/Makefile

@@ -214 +214 @@
         lib/fs \
         lib/block \
+        lib/crypto \
         lib/clui \
         lib/fmtutil \
@@ -245 +246 @@
         lib/mbr \
         lib/gpt \
-        lib/ieee80211
+        lib/ieee80211 \
 
 LIBC_BUILD = $(addsuffix .build,$(LIBC))

uspace/Makefile.common

@@ -120 +120 @@
 LIBPOSIX_PREFIX = $(LIB_PREFIX)/posix
 
+LIBCRYPTO_PREFIX = $(LIB_PREFIX)/crypto
 LIBBLOCK_PREFIX = $(LIB_PREFIX)/block
 LIBFS_PREFIX = $(LIB_PREFIX)/fs

uspace/app/wifi_supplicant/wifi_supplicant.c

@@ -36 +36 @@
 #include <ieee80211_iface.h>
 
-#include <malloc.h>
 #include <errno.h>
 #include <stdio.h>
@@ -42 +41 @@
 
 #define NAME "wifi_supplicant"
+
+#define enum_name(name_arr, i) ((i < 0) ? "NA" : name_arr[i])
+
+static const char* ieee80211_security_type_strs[] = {
+        "OPEN", "WEP", "WPA", "WPA2"
+};
+
+static const char* ieee80211_security_alg_strs[] = {
+        "WEP40", "WEP104", "CCMP", "TKIP"
+};
+
+static const char* ieee80211_security_auth_strs[] = {
+        "PSK", "8021X"
+};
 
 static void print_syntax(void)
@@ -49 +62 @@
         printf("\t<cmd> is:\n");
         printf("\tlist - list wifi devices in <index>: <name> format\n");
-        printf("\tscan <index> - output scan results for given device\n");
+        printf("\tscan <index> [-n] - output scan results (force scan "
+                "immediately)\n");
+        printf("\tconnect <index> <ssid_prefix> [<password>] - connect to "
+                "network\n");
+        printf("\tdisconnect <index> - disconnect from network\n");
 }
 
@@ -98 +115 @@
         }
         
-        if(i > count - 1) {
+        if(i >= count) {
                 printf("Invalid wifi index.\n");
                 free(wifis);
@@ -104 +121 @@
         }
 
-        async_sess_t *sess = loc_service_connect(EXCHANGE_SERIALIZE, wifis[i], 0);
+        async_sess_t *sess = 
+                loc_service_connect(EXCHANGE_SERIALIZE, wifis[i], 0);
         if (sess == NULL) {
                 printf("Error connecting to service.\n");
@@ -144 +162 @@
 }
 
-static int wifi_connect(uint32_t index, char *ssid, char *password)
-{
-        assert(ssid);
+static int wifi_connect(uint32_t index, char *ssid_start, char *password)
+{
+        assert(ssid_start);
         
         async_sess_t *sess = get_wifi_by_index(index);
         if (sess == NULL) {
-                printf("Specified WIFI doesn't exist or cannot connect to it.\n");
+                printf("Specified WIFI doesn't exist or cannot connect to "
+                        "it.\n");
                 return EINVAL;
         }
         
-        int rc = ieee80211_connect(sess, ssid, password);
+        int rc = ieee80211_connect(sess, ssid_start, password);
         if(rc != EOK) {
-                printf("Failed connecting to network. Error: %d\n", rc);
-                return EINVAL;
-        }
-        
-        printf("Successfully connected to %s!\n", ssid);
-        
-        return EOK;
-}
-
-static int wifi_scan(uint32_t index)
-{
-        ieee80211_scan_results_t scan_results;
-        
+                if(rc == EREFUSED) {
+                        printf("Device is not ready yet.\n");                   
+                } else if(rc == ETIMEOUT) {
+                        printf("Timeout when authenticating to network.\n");
+                } else if(rc == EPERM) {
+                        printf("Bad password provided.\n");
+                } else {
+                        printf("Error when connecting to network. "
+                                "Error: %d\n", rc);
+                }
+                
+                return rc;
+        }
+        
+        printf("Successfully connected to network!\n");
+        
+        return EOK;
+}
+
+static int wifi_disconnect(uint32_t index)
+{
         async_sess_t *sess = get_wifi_by_index(index);
         if (sess == NULL) {
-                printf("Specified WIFI doesn't exist or cannot connect to it.\n");
+                printf("Specified WIFI doesn't exist or cannot connect to "
+                        "it.\n");
                 return EINVAL;
         }
         
-        int rc = ieee80211_get_scan_results(sess, &scan_results);
+        int rc = ieee80211_disconnect(sess);
         if(rc != EOK) {
-                printf("Failed to fetch scan results. Error: %d\n", rc);
+                if(rc == EREFUSED) {
+                        printf("Device is not ready yet.\n");
+                } else if(rc == EINVAL) {
+                        printf("Not connected to any WiFi network.\n");
+                } else {
+                        printf("Error when disconnecting from network. "
+                                "Error: %d\n", rc);
+                }
+                return rc;
+        }
+        
+        printf("Successfully disconnected.\n");
+        
+        return EOK;
+}
+
+static int wifi_scan(uint32_t index, bool now)
+{
+        ieee80211_scan_results_t scan_results;
+        
+        async_sess_t *sess = get_wifi_by_index(index);
+        if (sess == NULL) {
+                printf("Specified WIFI doesn't exist or cannot connect to "
+                        "it.\n");
                 return EINVAL;
         }
+        
+        int rc = ieee80211_get_scan_results(sess, &scan_results, now);
+        if(rc != EOK) {
+                if(rc == EREFUSED) {
+                        printf("Device is not ready yet.\n");
+                } else {
+                        printf("Failed to fetch scan results. Error: %d\n", rc);
+                }
+                
+                return rc;
+        }
+        
+        if(scan_results.length == 0)
+                return EOK;
+        
+        printf("%16.16s %17s %4s %5s %5s %7s %7s\n", 
+                "SSID", "MAC", "CHAN", "TYPE", "AUTH", "UNI-ALG", "GRP-ALG");
         
         for(int i = 0; i < scan_results.length; i++) {
                 ieee80211_scan_result_t result = scan_results.results[i];
                 
-                printf("SSID: %s, MAC addr: %s\n", result.ssid, 
-                        nic_addr_format(&result.bssid));
+                printf("%16.16s %17s %4d %5s %5s %7s %7s\n", 
+                        result.ssid, 
+                        nic_addr_format(&result.bssid),
+                        result.channel,
+                        enum_name(ieee80211_security_type_strs,
+                                result.security.type),
+                        enum_name(ieee80211_security_auth_strs,
+                                result.security.auth),
+                        enum_name(ieee80211_security_alg_strs,
+                                result.security.pair_alg),
+                        enum_name(ieee80211_security_alg_strs,
+                                result.security.group_alg)
+                );
         }
         
@@ -197 +276 @@
         
         if(argc == 2) {
-                if (!str_cmp(argv[1], "list")) {
+                if(!str_cmp(argv[1], "list")) {
                         return wifi_list();
                 }
         } else if(argc > 2) {
                 rc = str_uint32_t(argv[2], NULL, 10, false, &index);
-                if (rc != EOK) {
+                if(rc != EOK) {
                         printf(NAME ": Invalid argument.\n");
                         print_syntax();
                         return EINVAL;
                 }
-                if (!str_cmp(argv[1], "scan")) {
-                        return wifi_scan(index);
-                } else if (!str_cmp(argv[1], "connect")) {
+                if(!str_cmp(argv[1], "scan")) {
+                        bool now = false;
+                        if(argc > 3)
+                                if(!str_cmp(argv[3], "-n"))
+                                        now = true;
+                        return wifi_scan(index, now);
+                } else if(!str_cmp(argv[1], "connect")) {
                         char *pass = NULL;
                         if(argc > 3) {
@@ -216 +299 @@
                                 return wifi_connect(index, argv[3], pass);
                         } 
+                } else if(!str_cmp(argv[1], "disconnect")) {
+                        return wifi_disconnect(index);
                 }
         }

uspace/drv/nic/ar9271/Makefile

@@ -34 +34 @@
         $(LIBDRV_PREFIX)/libdrv.a \
         $(LIBNIC_PREFIX)/libnic.a \
-        $(LIBIEEE80211_PREFIX)/libieee80211.a
+        $(LIBIEEE80211_PREFIX)/libieee80211.a \
+        $(LIBCRYPTO_PREFIX)/libcrypto.a
         
 EXTRA_CFLAGS += \
@@ -43 +44 @@
         -I$(LIBNIC_PREFIX)/include \
         -I$(LIBIEEE80211_PREFIX)/include \
+        -I$(LIBCRYPTO_PREFIX)
         
 BINARY = ar9271

uspace/drv/nic/ar9271/ar9271.c

@@ -105 +105 @@
 static int ar9271_ieee80211_set_freq(ieee80211_dev_t *ieee80211_dev,
         uint16_t freq);
+static int ar9271_ieee80211_bssid_change(ieee80211_dev_t *ieee80211_dev);
+static int ar9271_ieee80211_key_config(ieee80211_dev_t *ieee80211_dev,
+        ieee80211_key_config_t *key_conf, bool insert);
 
 static driver_ops_t ar9271_driver_ops = {
@@ -118 +121 @@
         .start = ar9271_ieee80211_start,
         .tx_handler = ar9271_ieee80211_tx_handler,
-        .set_freq = ar9271_ieee80211_set_freq
+        .set_freq = ar9271_ieee80211_set_freq,
+        .bssid_change = ar9271_ieee80211_bssid_change,
+        .key_config = ar9271_ieee80211_key_config
 };
 
@@ -186 +191 @@
  *
  */
-static int ar9271_on_multicast_mode_change(nic_t *nic, nic_multicast_mode_t mode,
-    const nic_address_t *addr, size_t addr_cnt)
+static int ar9271_on_multicast_mode_change(nic_t *nic, 
+        nic_multicast_mode_t mode, const nic_address_t *addr, size_t addr_cnt)
 {
         /*
@@ -249 +254 @@
  *
  */
-static int ar9271_on_broadcast_mode_change(nic_t *nic, nic_broadcast_mode_t mode)
+static int ar9271_on_broadcast_mode_change(nic_t *nic, 
+        nic_broadcast_mode_t mode)
 {
         /*
@@ -271 +277 @@
 }
 
+static bool ar9271_rx_status_error(uint8_t status)
+{
+        return (status & AR9271_RX_ERROR_PHY) || (status & AR9271_RX_ERROR_CRC);
+}
+
 static int ar9271_data_polling(void *arg)
 {
+        assert(arg);
+        
         ar9271_t *ar9271 = (ar9271_t *) arg;
         
@@ -282 +295 @@
                 if(htc_read_data_message(ar9271->htc_device, 
                         buffer, buffer_size, &transferred_size) == EOK) {
-                        ath_usb_data_header_t *data_header = 
-                                (ath_usb_data_header_t *) buffer;
-
-                        /* Invalid packet. */
-                        if(data_header->tag != uint16_t_le2host(RX_TAG)) {
-                                continue;
-                        }
-                        
                         size_t strip_length = 
                                 sizeof(ath_usb_data_header_t) +
                                 sizeof(htc_frame_header_t) + 
-                                HTC_RX_HEADER_LENGTH;
+                                sizeof(htc_rx_status_t);
                         
-                        /* TODO: RX header inspection. */
+                        if(transferred_size < strip_length)
+                                continue;
+
+                        ath_usb_data_header_t *data_header = 
+                                (ath_usb_data_header_t *) buffer;
+
+                        /* Invalid packet. */
+                        if(data_header->tag != uint16_t_le2host(RX_TAG))
+                                continue;
+                        
+                        htc_rx_status_t *rx_status =
+                                (htc_rx_status_t *) ((void *) buffer +
+                                sizeof(ath_usb_data_header_t) +
+                                sizeof(htc_frame_header_t));
+                        
+                        uint16_t data_length =
+                                uint16_t_be2host(rx_status->data_length);
+                        
+                        int16_t payload_length = 
+                                transferred_size - strip_length;
+                        
+                        if(payload_length - data_length < 0)
+                                continue;
+                        
+                        if(ar9271_rx_status_error(rx_status->status))
+                                continue;
+                        
                         void *strip_buffer = buffer + strip_length;
-                        
+
                         ieee80211_rx_handler(ar9271->ieee80211_dev,
                                 strip_buffer,
-                                transferred_size - strip_length);
+                                payload_length);
                 }
         }
@@ -316 +347 @@
         uint16_t freq)
 {
+        assert(ieee80211_dev);
+        
         ar9271_t *ar9271 = (ar9271_t *) ieee80211_get_specific(ieee80211_dev);
+        
+        //hw_wakeup(ar9271);
         
         wmi_send_command(ar9271->htc_device, WMI_DISABLE_INTR, NULL, 0, NULL);
@@ -344 +379 @@
 }
 
+static int ar9271_ieee80211_bssid_change(ieee80211_dev_t *ieee80211_dev)
+{
+        assert(ieee80211_dev);
+        
+        ar9271_t *ar9271 = (ar9271_t *) ieee80211_get_specific(ieee80211_dev);
+
+        /* Check if we are connected or disconnected. */
+        if(ieee80211_is_connected(ieee80211_dev)) {
+                nic_address_t bssid;
+                ieee80211_query_bssid(ieee80211_dev, &bssid);
+
+                htc_sta_msg_t sta_msg;
+                memset(&sta_msg, 0, sizeof(htc_sta_msg_t));
+                sta_msg.is_vif_sta = 0;
+                sta_msg.max_ampdu = 
+                        host2uint16_t_be(1 << IEEE80211_MAX_AMPDU_FACTOR);
+                sta_msg.sta_index = 1;
+                sta_msg.vif_index = 0;
+                memcpy(&sta_msg.addr, bssid.address, ETH_ADDR);
+
+                wmi_send_command(ar9271->htc_device, WMI_NODE_CREATE, 
+                        (uint8_t *) &sta_msg, sizeof(sta_msg), NULL);
+
+                htc_rate_msg_t rate_msg;
+                memset(&rate_msg, 0, sizeof(htc_rate_msg_t));
+                rate_msg.sta_index = 1;
+                rate_msg.is_new = 1;
+                rate_msg.legacy_rates_count = 
+                        ARRAY_SIZE(ieee80211bg_data_rates);
+                memcpy(&rate_msg.legacy_rates, 
+                        ieee80211bg_data_rates, 
+                        ARRAY_SIZE(ieee80211bg_data_rates));
+
+                wmi_send_command(ar9271->htc_device, WMI_RC_RATE_UPDATE, 
+                        (uint8_t *) &rate_msg, sizeof(rate_msg), NULL);
+
+                hw_set_rx_filter(ar9271, true);
+        } else {
+                uint8_t station_id = 1;
+                wmi_send_command(ar9271->htc_device, WMI_NODE_REMOVE,
+                        &station_id, sizeof(station_id), NULL);
+                
+                hw_set_rx_filter(ar9271, false);
+        }
+        
+        hw_set_bssid(ar9271);
+        
+        return EOK;
+}
+
+static int ar9271_ieee80211_key_config(ieee80211_dev_t *ieee80211_dev,
+        ieee80211_key_config_t *key_conf, bool insert)
+{
+        assert(ieee80211_dev);
+        assert(key_conf);
+        
+        ar9271_t *ar9271 = (ar9271_t *) ieee80211_get_specific(ieee80211_dev);
+        
+        uint32_t key[5];
+        uint32_t key_type;
+        uint32_t reg_ptr;
+        void *data_start;
+        
+        if(insert) {
+                nic_address_t bssid;
+                ieee80211_query_bssid(ieee80211_dev, &bssid);
+                
+                switch(key_conf->suite) {
+                        case IEEE80211_SECURITY_SUITE_WEP40:
+                                key_type = AR9271_KEY_TABLE_TYPE_WEP40;
+                                break;
+                        case IEEE80211_SECURITY_SUITE_WEP104:
+                                key_type = AR9271_KEY_TABLE_TYPE_WEP104;
+                                break;
+                        case IEEE80211_SECURITY_SUITE_TKIP:
+                                key_type = AR9271_KEY_TABLE_TYPE_TKIP;
+                                break;
+                        case IEEE80211_SECURITY_SUITE_CCMP:
+                                key_type = AR9271_KEY_TABLE_TYPE_CCMP;
+                                break;
+                        default:
+                                key_type = -1;
+                }
+                
+                if(key_conf->flags & IEEE80211_KEY_FLAG_TYPE_PAIRWISE) {
+                        reg_ptr = AR9271_KEY_TABLE_STA;
+                } else {
+                        reg_ptr = AR9271_KEY_TABLE_GRP;
+                }
+                
+                if(key_conf->suite == IEEE80211_SECURITY_SUITE_TKIP) {
+                        // TODO
+                } else {
+                        data_start = (void *) key_conf->data;
+                        
+                        key[0] = uint32_t_le2host(
+                                *((uint32_t *) data_start));
+                        key[1] = uint16_t_le2host(
+                                *((uint16_t *) (data_start + 4)));
+                        key[2] = uint32_t_le2host(
+                                *((uint32_t *) (data_start + 6)));
+                        key[3] = uint16_t_le2host(
+                                *((uint16_t *) (data_start + 10)));
+                        key[4] = uint32_t_le2host(
+                                *((uint32_t *) (data_start + 12)));
+                        
+                        if(key_conf->suite == IEEE80211_SECURITY_SUITE_WEP40 ||
+                           key_conf->suite == IEEE80211_SECURITY_SUITE_WEP104) {
+                                key[4] &= 0xFF;
+                        }
+                        
+                        wmi_reg_write(ar9271->htc_device, reg_ptr + 0, key[0]);
+                        wmi_reg_write(ar9271->htc_device, reg_ptr + 4, key[1]);
+                        wmi_reg_write(ar9271->htc_device, reg_ptr + 8, key[2]);
+                        wmi_reg_write(ar9271->htc_device, reg_ptr + 12, key[3]);
+                        wmi_reg_write(ar9271->htc_device, reg_ptr + 16, key[4]);
+                        wmi_reg_write(ar9271->htc_device, reg_ptr + 20, 
+                                key_type);
+                }
+                
+                uint32_t macL, macH;
+                if(key_conf->flags & IEEE80211_KEY_FLAG_TYPE_PAIRWISE) {
+                        data_start = (void *) bssid.address;
+                        macL = uint32_t_le2host(*((uint32_t *) data_start));
+                        macH = uint16_t_le2host(*((uint16_t *) 
+                                (data_start + 4)));
+                } else {
+                        macL = macH = 0;
+                }
+                
+                macL >>= 1;
+                macL |= (macH & 1) << 31;
+                macH >>= 1;
+                macH |= 0x8000;
+                
+                wmi_reg_write(ar9271->htc_device, reg_ptr + 24, macL);
+                wmi_reg_write(ar9271->htc_device, reg_ptr + 28, macH);
+                
+                if(key_conf->flags & IEEE80211_KEY_FLAG_TYPE_GROUP)
+                        ieee80211_setup_key_confirm(ieee80211_dev, true);
+        } else {
+                // TODO
+        }
+        
+        return EOK;
+}
+
 static int ar9271_ieee80211_tx_handler(ieee80211_dev_t *ieee80211_dev,
         void *buffer, size_t buffer_size)
 {
+        assert(ieee80211_dev);
+        
         size_t complete_size, offset;
         void *complete_buffer;
@@ -355 +539 @@
         uint16_t frame_ctrl = *((uint16_t *) buffer);
         if(ieee80211_is_data_frame(frame_ctrl)) {
-                offset = sizeof(htc_frame_header_t);
+                offset = sizeof(htc_tx_data_header_t) +
+                        sizeof(htc_frame_header_t);
                 complete_size = buffer_size + offset;
                 complete_buffer = malloc(complete_size);
+                memset(complete_buffer, 0, complete_size);
+                
+                /* 
+                 * Because we handle just station mode yet, node ID and VIF ID
+                 * are fixed.
+                 */
+                htc_tx_data_header_t *data_header =
+                        (htc_tx_data_header_t *) 
+                        (complete_buffer + sizeof(htc_frame_header_t));
+                /* TODO: Distinguish data type. */
+                data_header->data_type = HTC_DATA_NORMAL;
+                data_header->node_idx = 1;
+                data_header->vif_idx = 0;
+                /* TODO: There I should probably handle slot number. */
+                data_header->cookie = 0;
+                
+                if(ieee80211_query_using_key(ieee80211_dev)) {
+                        data_header->keyix = AR9271_STA_KEY_INDEX;
+                        int sec_suite = 
+                                ieee80211_get_security_suite(ieee80211_dev);
+                        switch(sec_suite) {
+                                case IEEE80211_SECURITY_SUITE_WEP40:
+                                case IEEE80211_SECURITY_SUITE_WEP104:
+                                        data_header->key_type =
+                                                AR9271_KEY_TYPE_WEP;
+                                        break;
+                                case IEEE80211_SECURITY_SUITE_TKIP:
+                                        data_header->key_type =
+                                                AR9271_KEY_TYPE_TKIP;
+                                        break;
+                                case IEEE80211_SECURITY_SUITE_CCMP:
+                                        data_header->key_type =
+                                                AR9271_KEY_TYPE_AES;
+                                        break;
+                        }
+                } else {
+                        data_header->key_type = 0;
+                        data_header->keyix = 0xFF;
+                }
+                
                 endpoint = ar9271->htc_device->endpoints.data_be_endpoint;
         } else {
@@ -366 +591 @@
                 memset(complete_buffer, 0, complete_size);
                 
+                /* 
+                 * Because we handle just station mode yet, node ID and VIF ID
+                 * are fixed.
+                 */
                 htc_tx_management_header_t *mgmt_header =
                         (htc_tx_management_header_t *) 
                         (complete_buffer + sizeof(htc_frame_header_t));
+                mgmt_header->node_idx = 0;
+                mgmt_header->vif_idx = 0;
+                /* TODO: There I should probably handle slot number. */
+                mgmt_header->cookie = 0;
                 mgmt_header->keyix = 0xFF;
                 
@@ -387 +620 @@
 static int ar9271_ieee80211_start(ieee80211_dev_t *ieee80211_dev)
 {
+        assert(ieee80211_dev);
+        
         ar9271_t *ar9271 = (ar9271_t *) ieee80211_get_specific(ieee80211_dev);
         
@@ -434 +669 @@
         
         ar9271->starting_up = false;
+        ieee80211_set_ready(ieee80211_dev, true);
+        
+        usb_log_info("Device fully initialized.\n");
         
         return EOK;

uspace/drv/nic/ar9271/ar9271.h

@@ -46 +46 @@
 #define AR9271_LED_PIN 15
 
+/** Nominal value for AR9271 noise floor calibration. */
+#define AR9271_CALIB_NOMINAL_VALUE_2GHZ -118
+
+/** RX errors values. */
+#define AR9271_RX_ERROR_CRC 0x01
+#define AR9271_RX_ERROR_PHY 0x02
+
+/** Key index used for device in station mode. */
+#define AR9271_STA_KEY_INDEX 4
+
+/* HW encryption key indicator. */
+enum ath9k_key_type {
+        AR9271_KEY_TYPE_CLEAR,
+        AR9271_KEY_TYPE_WEP,
+        AR9271_KEY_TYPE_AES,
+        AR9271_KEY_TYPE_TKIP,
+};
+
 /** AR9271 Registers */
 typedef enum {
@@ -75 +93 @@
         AR9271_GPIO_OUT_MUX_AS_OUT = 0x0,       /**< GPIO set mux as output */
     
-        /* Wakeup related registers */
+        /* RTC related registers */
         AR9271_RTC_RC = 0x7000,
         AR9271_RTC_RC_MAC_WARM = 0x00000001,
@@ -86 +104 @@
         AR9271_RTC_STATUS_SHUTDOWN = 0x00000001,
         AR9271_RTC_STATUS_ON = 0x00000002,
+        AR9271_RTC_SLEEP_CLOCK = 0x7048,
+        AR9271_RTC_SLEEP_CLOCK_FORCE_DERIVED = 0x2,
         AR9271_RTC_FORCE_WAKE = 0x704C,
         AR9271_RTC_FORCE_WAKE_ENABLE = 0x00000001,
@@ -93 +113 @@
         AR9271_STATION_ID0 = 0x8000,    /**< STA Address Lower 32 Bits */
         AR9271_STATION_ID1 = 0x8004,    /**< STA Address Upper 16 Bits */
-        AR9271_BSSID0 = 0x8008,                 /**< BSSID Lower 32 Bits */
-        AR9271_BSSID1 = 0x800C,                 /**< BSSID Upper 16 Bits */
-        AR9271_BSSID_MASK0 = 0x80E0,            /**< BSSID Mask Lower 32 Bits */
-        AR9271_BSSID_MASK1 = 0x80E4,            /**< BSSID Mask Upper 16 Bits */
+        AR9271_BSSID0 = 0x8008,         /**< BSSID Lower 32 Bits */
+        AR9271_BSSID1 = 0x800C,         /**< BSSID Upper 16 Bits */
+        AR9271_BSSID_MASK0 = 0x80E0,    /**< BSSID Mask Lower 32 Bits */
+        AR9271_BSSID_MASK1 = 0x80E4,    /**< BSSID Mask Upper 16 Bits */
         AR9271_STATION_ID1_MASK = 0x0000FFFF,
         AR9271_STATION_ID1_POWER_SAVING = 0x00040000,
+        AR9271_MULTICAST_FILTER1 = 0x8040,
+        AR9271_MULTICAST_FILTER2 = 0x8044,      
+        AR9271_DIAG = 0x8048,
                 
         /* RX filtering register */
@@ -110 +133 @@
         AR9271_RX_FILTER_PROBEREQ = 0x00000080,
         AR9271_RX_FILTER_MYBEACON = 0x00000200,
-        AR9271_MULTICAST_FILTER1 = 0x8040,
-        AR9271_MULTICAST_FILTER2 = 0x8044,      
-        AR9271_DIAG = 0x8048,
+        AR9271_RX_FILTER_MCAST_BCAST_ALL = 0x00008000,
+                
+        /* Key related registers */
+        AR9271_KEY_TABLE_GRP = 0x8820,
+        AR9271_KEY_TABLE_STA = 0x8880,
+        AR9271_KEY_TABLE_TYPE_WEP40 = 0x0,
+        AR9271_KEY_TABLE_TYPE_WEP104 = 0x1,
+        AR9271_KEY_TABLE_TYPE_TKIP = 0x4,
+        AR9271_KEY_TABLE_TYPE_CCMP = 0x6,
                 
         /* Physical layer registers */
@@ -118 +147 @@
         AR9271_ADC_CONTROL = 0x982C,
         AR9271_AGC_CONTROL = 0x9860,
+        AR9271_PHY_CAL = 0x9864,
         AR9271_PHY_SYNTH_CONTROL = 0x9874, 
         AR9271_PHY_SPECTRAL_SCAN = 0x9910,

uspace/drv/nic/ar9271/ath_usb.h

@@ -57 +57 @@
 typedef struct {
         uint16_t length;                /**< Little Endian value! */
-        uint16_t tag;           /**< Little Endian value! */
+        uint16_t tag;                   /**< Little Endian value! */
 } ath_usb_data_header_t;
 

uspace/drv/nic/ar9271/htc.c

@@ -75 +75 @@
         
         nic_address_t addr;
-        nic_t *nic = nic_get_from_ddf_dev(ieee80211_get_ddf_dev(htc_device->ieee80211_dev));
+        nic_t *nic = 
+                nic_get_from_ddf_dev(
+                        ieee80211_get_ddf_dev(htc_device->ieee80211_dev)
+                );
         nic_query_address(nic, &addr);
         
@@ -128 +131 @@
         wmi_reg_write(htc_device, AR9271_STATION_ID1, id1);
         
-        /* TODO: Set BSSID mask for AP mode. */
-        
         return EOK;
 }

uspace/drv/nic/ar9271/htc.h

@@ -45 +45 @@
 
 #define HTC_RTS_THRESHOLD 2304
-#define HTC_RX_HEADER_LENGTH 40
-
-/**
- * HTC message IDs
+#define HTC_RATES_MAX_LENGTH 30
+
+/**
+ * HTC message IDs.
  */
 typedef enum {
@@ -59 +59 @@
 
 /**
- * HTC response message status codes
+ * HTC response message status codes.
  */
 typedef enum {
@@ -70 +70 @@
 
 /**
- * HTC operating mode definition
+ * HTC operating mode definition.
  */
 typedef enum {
@@ -80 +80 @@
 
 /**
- * HTC endpoint numbers
+ * HTC data type indicator.
+ */
+typedef enum {
+        HTC_DATA_AMPDU = 1,
+        HTC_DATA_NORMAL = 2,
+        HTC_DATA_BEACON = 3,
+        HTC_DATA_MGMT = 4
+} htc_data_type_t;
+
+/**
+ * HTC endpoint numbers.
  */
 typedef struct {
@@ -96 +106 @@
 
 /**
- * HTC device data
+ * HTC device data.
  */
 typedef struct {
@@ -119 +129 @@
 
 /** 
- * HTC frame header structure 
+ * HTC frame header structure.
  */
 typedef struct {
@@ -126 +136 @@
         uint16_t  payload_length;       /**< Big Endian value! */
         uint8_t   control_bytes[4];
-    
-        /* Message payload starts after the header. */
 } __attribute__((packed)) htc_frame_header_t;
 
 /** 
- * HTC management TX frame header structure 
+ * HTC management TX frame header structure.
  */
 typedef struct {
@@ -145 +153 @@
 
 /** 
- * HTC ready message structure 
+ * HTC data TX frame header structure.
+ */
+typedef struct {
+        uint8_t data_type;
+        uint8_t node_idx;
+        uint8_t vif_idx;
+        uint8_t tidno;
+        uint32_t flags;                 /**< Big Endian value! */
+        uint8_t key_type;
+        uint8_t keyix;
+        uint8_t cookie;
+        uint8_t pad;
+} __attribute__((packed)) htc_tx_data_header_t;
+
+/** 
+ * HTC ready message structure.
  */
 typedef struct {
@@ -157 +180 @@
 
 /** 
- * HTC service message structure 
+ * HTC service message structure.
  */
 typedef struct {
@@ -171 +194 @@
 
 /** 
- * HTC service response message structure 
+ * HTC service response message structure.
  */
 typedef struct {
@@ -184 +207 @@
 
 /**
- * HTC credits config message structure
+ * HTC credits config message structure.
  */
 typedef struct {
@@ -193 +216 @@
 
 /**
- * HTC new virtual interface message
+ * HTC new virtual interface message.
  */
 typedef struct {
@@ -205 +228 @@
 
 /**
- * HTC new station message
+ * HTC new station message.
  */
 typedef struct {
@@ -231 +254 @@
         uint8_t pad;
 } __attribute__((packed)) htc_cap_msg_t;
+
+typedef struct {
+        uint8_t sta_index;
+        uint8_t is_new;
+        uint32_t cap_flags;     /**< Big Endian value! */
+        uint8_t legacy_rates_count;
+        uint8_t legacy_rates[HTC_RATES_MAX_LENGTH];
+        uint16_t pad;
+} htc_rate_msg_t;
+
+/**
+ * HTC RX status structure used in incoming HTC data messages.
+ */
+typedef struct {
+        uint64_t timestamp;     /**< Big Endian value! */
+        uint16_t data_length;   /**< Big Endian value! */
+        uint8_t status;
+        uint8_t phy_err;
+        int8_t rssi;
+        int8_t rssi_ctl[3];
+        int8_t rssi_ext[3];
+        uint8_t keyix;
+        uint8_t rate;
+        uint8_t antenna;
+        uint8_t more;
+        uint8_t is_aggr;
+        uint8_t more_aggr;
+        uint8_t num_delims;
+        uint8_t flags;
+        uint8_t dummy;
+        uint32_t evm0;          /**< Big Endian value! */
+        uint32_t evm1;          /**< Big Endian value! */
+        uint32_t evm2;          /**< Big Endian value! */
+} htc_rx_status_t;
 
 /**

uspace/drv/nic/ar9271/hw.c

@@ -43 +43 @@
 
 /**
- * Try to wait for register value repeatedly until timeout defined by device 
- * is reached.
+ * Try to wait for register value repeatedly until timeout is reached.
  * 
  * @param ar9271 Device structure.
@@ -264 +263 @@
 }
 
+static int hw_activate_phy(ar9271_t *ar9271)
+{
+        wmi_reg_write(ar9271->htc_device, AR9271_PHY_ACTIVE, 1);
+        udelay(1000);
+        
+        return EOK;
+}
+
 static int hw_set_operating_mode(ar9271_t *ar9271, 
         ieee80211_operating_mode_t op_mode)
@@ -305 +312 @@
 static int hw_noise_floor_calibration(ar9271_t *ar9271)
 {
+        uint32_t value;
+        wmi_reg_read(ar9271->htc_device, AR9271_PHY_CAL, &value);
+        value &= 0xFFFFFE00;
+        value |= (((uint32_t) AR9271_CALIB_NOMINAL_VALUE_2GHZ << 1) & 0x1FF);
+        wmi_reg_write(ar9271->htc_device, AR9271_PHY_CAL, value);
+        
+        wmi_reg_clear_bit(ar9271->htc_device, AR9271_AGC_CONTROL, 
+                AR9271_AGC_CONTROL_NF_CALIB_EN);
+        
+        wmi_reg_clear_bit(ar9271->htc_device, AR9271_AGC_CONTROL, 
+                AR9271_AGC_CONTROL_NF_NOT_UPDATE);
+        
+        wmi_reg_set_bit(ar9271->htc_device, AR9271_AGC_CONTROL, 
+                AR9271_AGC_CONTROL_NF_CALIB);
+        
+        int rc = hw_read_wait(ar9271, AR9271_AGC_CONTROL, 
+                AR9271_AGC_CONTROL_NF_CALIB, 0);
+        if(rc != EOK) {
+                usb_log_error("Failed to wait for NF calibration.\n");
+                return rc;
+        }
+        
         wmi_reg_set_bit(ar9271->htc_device, AR9271_AGC_CONTROL, 
                 AR9271_AGC_CONTROL_NF_CALIB_EN);
@@ -348 +377 @@
 }
 
+int hw_wakeup(ar9271_t *ar9271)
+{
+        int rc;
+        
+        uint32_t rtc_status;
+        wmi_reg_read(ar9271->htc_device, AR9271_RTC_STATUS, &rtc_status);
+        if((rtc_status & AR9271_RTC_STATUS_MASK) == AR9271_RTC_STATUS_SHUTDOWN) {
+                rc = hw_reset_power_on(ar9271);
+                if(rc != EOK) {
+                        usb_log_info("Failed to HW reset power on.\n");
+                        return rc;
+                }
+
+                rc = hw_set_reset(ar9271, false);
+                if(rc != EOK) {
+                        usb_log_info("Failed to HW warm reset.\n");
+                        return rc;
+                }
+        }
+        
+        wmi_reg_set_bit(ar9271->htc_device, AR9271_RTC_FORCE_WAKE,
+                AR9271_RTC_FORCE_WAKE_ENABLE);
+        
+        size_t i;
+        for(i = 0; i < HW_WAIT_LOOPS; i++) {
+                wmi_reg_read(ar9271->htc_device, AR9271_RTC_STATUS, 
+                        &rtc_status);
+                if((rtc_status & AR9271_RTC_STATUS_MASK) == 
+                        AR9271_RTC_STATUS_ON) {
+                        break;
+                }
+                wmi_reg_set_bit(ar9271->htc_device, AR9271_RTC_FORCE_WAKE,
+                        AR9271_RTC_FORCE_WAKE_ENABLE);
+                udelay(50);
+        }       
+        
+        if(i == HW_WAIT_LOOPS) {
+                return EINVAL;
+        } else {
+                return EOK;
+        }
+}
+
 int hw_freq_switch(ar9271_t *ar9271, uint16_t freq)
 {
@@ -361 +433 @@
         if(rc != EOK) {
                 usb_log_error("Failed to HW set frequency.\n");
+                return rc;
+        }
+        
+        rc = hw_activate_phy(ar9271);
+        if(rc != EOK) {
+                usb_log_error("Failed to activate physical layer.\n");
                 return rc;
         }
@@ -376 +454 @@
 }
 
-static int hw_set_rx_filter(ar9271_t *ar9271)
+int hw_set_rx_filter(ar9271_t *ar9271, bool assoc)
 {
         uint32_t filter_bits;
         
-        /* TODO: Do proper filtering here. */
+        uint32_t additional_bits = 0;
+        
+        if(assoc) {
+                additional_bits |= AR9271_RX_FILTER_MYBEACON;
+        } else {
+                additional_bits |= AR9271_RX_FILTER_BEACON;
+        }
         
         filter_bits = AR9271_RX_FILTER_UNI | AR9271_RX_FILTER_MULTI | 
-                AR9271_RX_FILTER_BROAD | AR9271_RX_FILTER_BEACON;
+                AR9271_RX_FILTER_BROAD | additional_bits;
         
         wmi_reg_write(ar9271->htc_device, AR9271_RX_FILTER, filter_bits);
+        
+        return EOK;
+}
+
+int hw_set_bssid(ar9271_t *ar9271)
+{
+        ieee80211_dev_t *ieee80211_dev = ar9271->ieee80211_dev;
+        
+        nic_address_t bssid;
+        ieee80211_query_bssid(ieee80211_dev, &bssid);
+        
+        uint32_t *first_4bytes = (uint32_t *) &bssid.address;
+        uint16_t *last_2bytes = (uint16_t *) &bssid.address[4];
+        
+        wmi_reg_write(ar9271->htc_device, AR9271_BSSID0, 
+                uint32_t_le2host(*first_4bytes));
+        
+        wmi_reg_write(ar9271->htc_device, AR9271_BSSID1, 
+                uint16_t_le2host(*last_2bytes) | 
+                ((ieee80211_get_aid(ieee80211_dev) & 0x3FFF) << 16));
         
         return EOK;
@@ -395 +499 @@
                 AR9271_COMMAND_RX_ENABLE);
         
-        int rc = hw_set_rx_filter(ar9271);
+        int rc = hw_set_rx_filter(ar9271, false);
         if(rc != EOK) {
                 usb_log_error("Failed to set RX filtering.\n");
@@ -410 +514 @@
 }
 
-static int hw_activate_phy(ar9271_t *ar9271)
-{
-        wmi_reg_write(ar9271->htc_device, AR9271_PHY_ACTIVE, 1);
-        udelay(1000);
-        
-        return EOK;
-}
-
 static int hw_init_pll(ar9271_t *ar9271)
 {
@@ -423 +519 @@
         
         /* Some magic here (set for 2GHz channels). But VERY important :-) */
-        pll = (0x5 << 10) & 0x00003C00;
-        pll |= 0x2C & 0x000003FF;
+        pll = (0x5 << 10) | 0x2C;
         
         wmi_reg_write(ar9271->htc_device, AR9271_RTC_PLL_CONTROL, pll);
         
-        return EOK;
-}
-
-static int hw_set_init_values(ar9271_t *ar9271)
+        wmi_reg_write(ar9271->htc_device, AR9271_RTC_SLEEP_CLOCK,
+                AR9271_RTC_SLEEP_CLOCK_FORCE_DERIVED);
+        wmi_reg_set_bit(ar9271->htc_device, AR9271_RTC_FORCE_WAKE,
+                AR9271_RTC_FORCE_WAKE_ENABLE);
+        
+        return EOK;
+}
+
+static void hw_set_init_values(ar9271_t *ar9271)
 {
         uint32_t reg_offset, reg_value;
@@ -458 +558 @@
                 wmi_reg_write(ar9271->htc_device, reg_offset, reg_value);
         }
-        
-        return EOK;
 }
 
@@ -533 +631 @@
         }
         
-        rc = hw_set_init_values(ar9271);
-        if(rc != EOK) {
-                usb_log_error("Failed to set device init values.\n");
-                return rc;
-        }
+        hw_set_init_values(ar9271);
         
         /* Set physical layer mode. */
@@ -586 +680 @@
         /* Byteswap TX and RX data buffer words. */
         wmi_reg_write(ar9271->htc_device, AR9271_CONFIG, 0xA);
-        
-        usb_log_info("HW reset done.\n");
         
         return EOK;

uspace/drv/nic/ar9271/hw.h

@@ -45 +45 @@
 extern int hw_rx_init(ar9271_t *ar9271);
 extern int hw_reset(ar9271_t *ar9271);
+extern int hw_wakeup(ar9271_t *ar9271);
+extern int hw_set_bssid(ar9271_t *ar9271);
+extern int hw_set_rx_filter(ar9271_t *ar9271, bool assoc);
 
 #endif  /* ATHEROS_HW_H */

uspace/drv/nic/ar9271/wmi.c

@@ -231 +231 @@
         size_t buffer_size = header_size + command_length;
         void *buffer = malloc(buffer_size);
-        memcpy(buffer+header_size, command_buffer, command_length);
+        
+        if(command_buffer != NULL) {
+                memcpy(buffer+header_size, command_buffer, command_length);
+        }
         
         /* Set up WMI header */
@@ -261 +264 @@
         
         /* Read response. */
-        rc = htc_read_control_message(htc_device, response_buffer, 
-                response_buffer_size, NULL);
-        if(rc != EOK) {
-                free(buffer);
-                usb_log_error("Failed to receive WMI message response. "
-                    "Error: %d\n", rc);
-                return rc;
-        }
+        /* TODO: Ignoring WMI management RX messages ~ TX statuses etc. */
+        uint16_t cmd_id;
+        do {
+                rc = htc_read_control_message(htc_device, response_buffer, 
+                        response_buffer_size, NULL);
+                if(rc != EOK) {
+                        free(buffer);
+                        usb_log_error("Failed to receive WMI message response. "
+                            "Error: %d\n", rc);
+                        return rc;
+                }
+                
+                if(response_buffer_size < sizeof(htc_frame_header_t) + 
+                        sizeof(wmi_command_header_t)) {
+                        free(buffer);
+                        usb_log_error("Corrupted response received.\n");
+                        return EINVAL;
+                }
+                
+                wmi_command_header_t *wmi_hdr = (wmi_command_header_t *) 
+                        ((void*) response_buffer + sizeof(htc_frame_header_t));
+                cmd_id = uint16_t_be2host(wmi_hdr->command_id);
+        } while(cmd_id & WMI_MGMT_CMD_MASK);
         
         if(clean_resp_buffer) {

uspace/drv/nic/ar9271/wmi.h

@@ -42 +42 @@
 #define WMI_SERVICE_GROUP 1
 #define CREATE_SERVICE_ID(group, i) (int) (((int) group << 8) | (int) (i))
+
+#define WMI_MGMT_CMD_MASK 0x1000
 
 /**
@@ -117 +119 @@
 extern int wmi_reg_write(htc_device_t *htc_device, uint32_t reg_offset, 
         uint32_t val);
-extern int wmi_reg_set_clear_bit(htc_device_t *htc_device, uint32_t reg_offset, 
-        uint32_t set_bit, uint32_t clear_bit);
+extern int wmi_reg_set_clear_bit(htc_device_t *htc_device, 
+        uint32_t reg_offset, uint32_t set_bit, uint32_t clear_bit);
 extern int wmi_reg_set_bit(htc_device_t *htc_device, uint32_t reg_offset, 
         uint32_t set_bit);

uspace/lib/c/include/ieee80211/ieee80211.h

@@ -41 +41 @@
 #include <adt/list.h>
 #include <nic/nic.h>
+#include <time.h>
 
-/* Max length of scan results array. */
+/** Max length of scan results array. */
 #define IEEE80211_MAX_RESULTS_LENGTH 32
 
-/* Max SSID length including null character. */
+/** Max SSID length including null character. */
 #define IEEE80211_MAX_SSID_LENGTH 35
+
+/** WiFi security authentication method indicator. */
+typedef enum {
+        IEEE80211_SECURITY_OPEN,
+        IEEE80211_SECURITY_WEP,
+        IEEE80211_SECURITY_WPA,
+        IEEE80211_SECURITY_WPA2
+} ieee80211_security_type_t;
+
+/** WiFi security suite indicator. */
+typedef enum {
+        IEEE80211_SECURITY_SUITE_WEP40,
+        IEEE80211_SECURITY_SUITE_WEP104,
+        IEEE80211_SECURITY_SUITE_CCMP,
+        IEEE80211_SECURITY_SUITE_TKIP
+} ieee80211_security_suite_t;
+
+/** WiFi security authentication method indicator. */
+typedef enum {
+        IEEE80211_SECURITY_AUTH_PSK,
+        IEEE80211_SECURITY_AUTH_8021X
+} ieee80211_security_auth_t;
+
+/** Structure for indicating security network security settings. */
+typedef struct {
+        int type;
+        int group_alg;
+        int pair_alg;
+        int auth;
+} ieee80211_security_t;
 
 /** Structure with scan result info. */
@@ -52 +83 @@
         nic_address_t bssid;
         char ssid[IEEE80211_MAX_SSID_LENGTH];
+        uint8_t channel;
+        ieee80211_security_t security;
 } ieee80211_scan_result_t;
 
-/** List of scan results info. */
+/** Array of scan results info. */
 typedef struct {
         uint8_t length;

uspace/lib/drv/generic/remote_ieee80211.c

@@ -47 +47 @@
 typedef enum {
         IEEE80211_GET_SCAN_RESULTS,
-        IEEE80211_CONNECT
+        IEEE80211_CONNECT,
+        IEEE80211_DISCONNECT
 } ieee80211_funcs_t;
 
@@ -59 +60 @@
  */
 int ieee80211_get_scan_results(async_sess_t *dev_sess, 
-        ieee80211_scan_results_t *results)
+        ieee80211_scan_results_t *results, bool now)
 {
         assert(results);
@@ -65 +66 @@
         async_exch_t *exch = async_exchange_begin(dev_sess);
         
-        aid_t aid = async_send_1(exch, DEV_IFACE_ID(IEEE80211_DEV_IFACE),
-            IEEE80211_GET_SCAN_RESULTS, NULL);
+        aid_t aid = async_send_2(exch, DEV_IFACE_ID(IEEE80211_DEV_IFACE),
+            IEEE80211_GET_SCAN_RESULTS, now, NULL);
         int rc = async_data_read_start(exch, results, sizeof(ieee80211_scan_results_t));
         async_exchange_end(exch);
@@ -73 +74 @@
         async_wait_for(aid, &res);
         
-        if (rc != EOK)
+        if(res != EOK)
+                return (int) res;
+        else
                 return rc;
-        
-        return (int) res;
 }
 
@@ -82 +83 @@
  *
  * @param[in] dev_sess Device session.
- * @param[in] ssid Network SSID.
+ * @param[in] ssid_start Network SSID prefix.
  * @param[in] password Network password (pass empty string if not needed).
  *
@@ -88 +89 @@
  * negative error code otherwise.
  */
-int ieee80211_connect(async_sess_t *dev_sess, char *ssid, char *password)
-{
-        assert(ssid);
+int ieee80211_connect(async_sess_t *dev_sess, char *ssid_start, char *password)
+{
+        assert(ssid_start);
         
         sysarg_t rc_orig;
@@ -99 +100 @@
             IEEE80211_CONNECT, NULL);
         
-        sysarg_t rc = async_data_write_start(exch, ssid, str_size(ssid) + 1);
+        sysarg_t rc = async_data_write_start(exch, ssid_start, 
+                str_size(ssid_start) + 1);
         if (rc != EOK) {
                 async_exchange_end(exch);
@@ -132 +134 @@
 }
 
+/** Disconnect device from network.
+ *
+ * @param[in] dev_sess Device session.
+ *
+ * @return EOK If the operation was successfully completed,
+ * negative error code otherwise.
+ */
+int ieee80211_disconnect(async_sess_t *dev_sess)
+{
+        async_exch_t *exch = async_exchange_begin(dev_sess);
+        int rc = async_req_1_0(exch, DEV_IFACE_ID(IEEE80211_DEV_IFACE),
+            IEEE80211_DISCONNECT);
+        async_exchange_end(exch);
+        
+        return rc;
+}
+
 static void remote_ieee80211_get_scan_results(ddf_fun_t *fun, void *iface,
     ipc_callid_t callid, ipc_call_t *call)
@@ -141 +160 @@
         memset(&scan_results, 0, sizeof(ieee80211_scan_results_t));
         
-        int rc = ieee80211_iface->get_scan_results(fun, &scan_results);
+        bool now = IPC_GET_ARG2(*call);
+        
+        int rc = ieee80211_iface->get_scan_results(fun, &scan_results, now);
         if (rc == EOK) {
                 ipc_callid_t data_callid;
@@ -170 +191 @@
         assert(ieee80211_iface->connect);
         
-        char ssid[MAX_STRING_SIZE];
+        char ssid_start[MAX_STRING_SIZE];
         char password[MAX_STRING_SIZE];
         
@@ -187 +208 @@
         }
         
-        int rc = async_data_write_finalize(data_callid, ssid, len);
+        int rc = async_data_write_finalize(data_callid, ssid_start, len);
         if (rc != EOK) {
                 async_answer_0(data_callid, EINVAL);
@@ -213 +234 @@
         }
         
-        rc = ieee80211_iface->connect(fun, ssid, password);
-        
+        rc = ieee80211_iface->connect(fun, ssid_start, password);
+        
+        async_answer_0(callid, rc);
+}
+
+static void remote_ieee80211_disconnect(ddf_fun_t *fun, void *iface,
+    ipc_callid_t callid, ipc_call_t *call)
+{
+        ieee80211_iface_t *ieee80211_iface = (ieee80211_iface_t *) iface;
+        assert(ieee80211_iface->disconnect);
+        int rc = ieee80211_iface->disconnect(fun);
         async_answer_0(callid, rc);
 }
@@ -223 +253 @@
 static const remote_iface_func_ptr_t remote_ieee80211_iface_ops[] = {
         [IEEE80211_GET_SCAN_RESULTS] = remote_ieee80211_get_scan_results,
-        [IEEE80211_CONNECT] = remote_ieee80211_connect
+        [IEEE80211_CONNECT] = remote_ieee80211_connect,
+        [IEEE80211_DISCONNECT] = remote_ieee80211_disconnect
 };
 

uspace/lib/drv/include/ieee80211_iface.h

@@ -39 +39 @@
 #include <async.h>
 
-extern int ieee80211_get_scan_results(async_sess_t *, ieee80211_scan_results_t *);
+extern int ieee80211_get_scan_results(async_sess_t *, 
+        ieee80211_scan_results_t *, bool);
 extern int ieee80211_connect(async_sess_t *, char *, char *);
+extern int ieee80211_disconnect(async_sess_t *);
 
 #endif

uspace/lib/drv/include/ops/ieee80211.h

@@ -47 +47 @@
          * @param fun IEEE 802.11 function.
          * @param results Structure where to put scan results.
+         * @param now Whether to initiate scan immediately.
          * 
          * @return EOK if succeed, negative error code otherwise.
          */
-        int (*get_scan_results)(ddf_fun_t *, ieee80211_scan_results_t *);
+        int (*get_scan_results)(ddf_fun_t *, ieee80211_scan_results_t *, bool);
         
         /** 
          * Connect IEEE 802.11 device to specified network.
+         *
          * @param fun IEEE 802.11 function.
          * @param ssid Network SSID.
@@ -61 +63 @@
          */
         int (*connect)(ddf_fun_t *, char *, char *);
+        
+        /** 
+         * Disconnect IEEE 802.11 device from network.
+         *
+         * @param fun IEEE 802.11 function.
+         * 
+         * @return EOK if succeed, negative error code otherwise.
+         */
+        int (*disconnect)(ddf_fun_t *);
 } ieee80211_iface_t;
 

uspace/lib/ieee80211/Makefile

@@ -1 +1 @@
 #
-# Copyright (c) 2005 Martin Decky
-# Copyright (c) 2007 Jakub Jermar
+# Copyright (c) 2015 Jan Kolarik
 # All rights reserved.
 #
@@ -33 +32 @@
 LIBS = \
         $(LIBDRV_PREFIX)/libdrv.a \
-        $(LIBNIC_PREFIX)/libnic.a 
+        $(LIBNIC_PREFIX)/libnic.a \
+        $(LIBCRYPTO_PREFIX)/libcrypto.a
 
 EXTRA_CFLAGS += \
         -Iinclude \
         -I$(LIBDRV_PREFIX)/include \
-        -I$(LIBNIC_PREFIX)/include
+        -I$(LIBNIC_PREFIX)/include \
+        -I$(LIBCRYPTO_PREFIX)
 
 SOURCES = \

uspace/lib/ieee80211/include/ieee80211.h

@@ -57 +57 @@
 #define IEEE80211_CHANNEL_GAP 5
 
+/* Max AMPDU factor. */
+#define IEEE80211_MAX_AMPDU_FACTOR 13
+
+/* Max passphrase length in WPA/WPA2 protocols. */
+#define IEEE80211_WPA_MAX_PASSWORD_LENGTH 64
+
+/** IEEE 802.11 b/g supported data rates in units of 500 kb/s. */
+static const uint8_t ieee80211bg_data_rates[] = {
+        2, 4, 11, 12, 18, 22, 24, 36, 48, 72, 96, 108
+};
+
 /** Device operating modes. */
 typedef enum {
@@ -65 +76 @@
 } ieee80211_operating_mode_t;
 
+/** Key flags. */
+typedef enum {
+        IEEE80211_KEY_FLAG_TYPE_PAIRWISE = 0x01,
+        IEEE80211_KEY_FLAG_TYPE_GROUP = 0x02
+} ieee80211_key_flags_t;
+
+/** Key config structure. */
+typedef struct {
+        uint8_t id;
+        uint8_t flags;
+        ieee80211_security_suite_t suite;
+        uint8_t data[32];
+} ieee80211_key_config_t;
+
 /** IEEE 802.11 callback functions. */
 typedef struct {
@@ -109 +134 @@
          */
         int (*set_freq)(struct ieee80211_dev *, uint16_t);
+        
+        /**
+         * Callback to inform device about BSSID change.
+         * 
+         * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+         * 
+         * @return EOK if succeed, negative error code otherwise.
+         */
+        int (*bssid_change)(struct ieee80211_dev *);
+        
+        /**
+         * Callback to setup encryption key in IEEE 802.11 device.
+         * 
+         * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+         * @param key_conf Key config structure.
+         * @param insert True to insert this key to device, false to remove it.
+         * 
+         * @return EOK if succeed, negative error code otherwise.
+         */
+        int (*key_config)(struct ieee80211_dev *, 
+                ieee80211_key_config_t *key_conf, bool);
 } ieee80211_ops_t;
 
@@ -124 +170 @@
         void *specific);
 extern ddf_dev_t *ieee80211_get_ddf_dev(ieee80211_dev_t* ieee80211_dev);
-extern ieee80211_operating_mode_t ieee80211_query_current_op_mode(ieee80211_dev_t *ieee80211_dev);
+extern ieee80211_operating_mode_t 
+        ieee80211_query_current_op_mode(ieee80211_dev_t *ieee80211_dev);
 extern uint16_t ieee80211_query_current_freq(ieee80211_dev_t *ieee80211_dev);
+extern void ieee80211_query_bssid(ieee80211_dev_t* ieee80211_dev, 
+        nic_address_t *bssid);
+extern bool ieee80211_is_connected(ieee80211_dev_t* ieee80211_dev);
 extern void ieee80211_report_current_op_mode(ieee80211_dev_t *ieee80211_dev,
         ieee80211_operating_mode_t op_mode);
 extern void ieee80211_report_current_freq(ieee80211_dev_t *ieee80211_dev,
         uint16_t freq);
+extern uint16_t ieee80211_get_aid(ieee80211_dev_t* ieee80211_dev);
+extern int ieee80211_get_security_suite(ieee80211_dev_t* ieee80211_dev);
+extern bool ieee80211_is_ready(ieee80211_dev_t* ieee80211_dev);
+extern void ieee80211_set_ready(ieee80211_dev_t* ieee80211_dev, bool ready);
+extern bool ieee80211_query_using_key(ieee80211_dev_t* ieee80211_dev);
+extern void ieee80211_setup_key_confirm(ieee80211_dev_t* ieee80211_dev, 
+        bool using_key);
 
 extern bool ieee80211_is_data_frame(uint16_t frame_ctrl);
@@ -135 +192 @@
 extern bool ieee80211_is_beacon_frame(uint16_t frame_ctrl);
 extern bool ieee80211_is_probe_response_frame(uint16_t frame_ctrl);
+extern bool ieee80211_is_auth_frame(uint16_t frame_ctrl);
+extern bool ieee80211_is_assoc_response_frame(uint16_t frame_ctrl);
 
 /* Worker functions. */

uspace/lib/ieee80211/include/ieee80211_iface_impl.h

@@ -45 +45 @@
 
 extern int ieee80211_get_scan_results_impl(ddf_fun_t *fun, 
-        ieee80211_scan_results_t *results);
-extern int ieee80211_connect_impl(ddf_fun_t *fun, char *ssid, char *password);
+        ieee80211_scan_results_t *results, bool now);
+extern int ieee80211_connect_impl(ddf_fun_t *fun, char *ssid_start, 
+        char *password);
+extern int ieee80211_disconnect_impl(ddf_fun_t *fun);
 
 #endif  /* LIB_IEEE80211_IFACE_IMPL_H */

uspace/lib/ieee80211/include/ieee80211_impl.h

@@ -43 +43 @@
 
 extern int ieee80211_start_impl(ieee80211_dev_t *ieee80211_dev);
-extern int ieee80211_tx_handler_impl(ieee80211_dev_t *ieee80211_dev, void *buffer, 
-        size_t buffer_size);
-extern int ieee80211_set_freq_impl(ieee80211_dev_t *ieee80211_dev, uint16_t freq);
+extern int ieee80211_tx_handler_impl(ieee80211_dev_t *ieee80211_dev, 
+        void *buffer, size_t buffer_size);
+extern int ieee80211_set_freq_impl(ieee80211_dev_t *ieee80211_dev, 
+        uint16_t freq);
+extern int ieee80211_bssid_change_impl(ieee80211_dev_t *ieee80211_dev);
+extern int ieee80211_key_config_impl(ieee80211_dev_t *ieee80211_dev,
+        ieee80211_key_config_t *key_conf, bool insert);
 extern int ieee80211_scan_impl(ieee80211_dev_t *ieee80211_dev);
+extern int ieee80211_prf(uint8_t *key, uint8_t *data, uint8_t *hash, 
+        hash_func_t hash_sel);
+extern int ieee80211_aes_key_unwrap(uint8_t *kek, uint8_t *data, 
+        size_t data_size, uint8_t *output);
+extern int rnd_sequence(uint8_t *sequence, size_t length);
+extern uint8_t *min_sequence(uint8_t *seq1, uint8_t *seq2, size_t size);
+extern uint8_t *max_sequence(uint8_t *seq1, uint8_t *seq2, size_t size);
 
 #endif  /* LIB_IEEE80211_IMPL_H */

uspace/lib/ieee80211/include/ieee80211_private.h

@@ -40 +40 @@
 #define LIBNET_IEEE80211_PRIVATE_H
 
+#include <fibril_synch.h>
 #include <byteorder.h>
 #include <ddf/driver.h>
@@ -46 +47 @@
 #include <ieee80211/ieee80211.h>
 #include "ieee80211.h"
+
+/* Timeout in us for waiting to authentication/association response. */
+#define AUTH_TIMEOUT 200000
+
+/* Timeout in us for waiting to finish 4-way handshake process. */
+#define HANDSHAKE_TIMEOUT 3000000
+
+/* Max period to rerun scan. */
+#define MAX_SCAN_SPAN_SEC 30
+
+/* Max time to keep scan result. */
+#define MAX_KEEP_SCAN_SPAN_SEC 120
+
+/* Security bit in capability info field. */
+#define CAP_SECURITY 0x10
+
+/* Protocol type used in EAPOL frames. */
+#define ETH_TYPE_PAE 0x888E
+
+/* WPA OUI used in vendor specific IE. */
+#define WPA_OUI 0x0050F201
+
+/* GTK OUI used in vendor specific IE. */
+#define GTK_OUI 0x000FAC01
+
+/* Max PTK key length. */
+#define MAX_PTK_LENGTH 64
+
+/* Max GTK key length. */
+#define MAX_GTK_LENGTH 64
+
+/* KEK offset inside PTK. */
+#define KEK_OFFSET 16
+
+/* TK offset inside PTK. */
+#define TK_OFFSET 32
+
+/* Length of CCMP header we need to reserve. */
+#define IEEE80211_CCMP_HEADER_LENGTH 8
+
+/* 
+ * Length of data to be encrypted by PRF function:
+ * NONCE + SNONCE (2 * 32) + DEST_MAC + SOURCE_MAC (2 * ETH_ADDR) 
+ */
+#define PRF_CRYPT_DATA_LENGTH 2*32 + 2*ETH_ADDR
+
+/** IEEE 802.11 PTK key length. */
+typedef enum {
+        IEEE80211_PTK_CCMP_LENGTH = 48,
+        IEEE80211_PTK_TKIP_LENGTH = 64
+} ieee80211_ptk_length_t;
+
+/** IEEE 802.11 GTK key length. */
+typedef enum {
+        IEEE80211_GTK_CCMP_LENGTH = 16,
+        IEEE80211_GTK_TKIP_LENGTH = 32
+} ieee80211_gtk_length_t;
 
 /** IEEE 802.11 frame types. */
@@ -55 +113 @@
 } ieee80211_frame_type_t;
 
-/** IEEE 802.11 frame subtypes. */
+/** IEEE 802.11 management frame subtypes. */
 typedef enum {
         IEEE80211_MGMT_ASSOC_REQ_FRAME = 0x00,
@@ -64 +122 @@
         IEEE80211_MGMT_PROBE_RESP_FRAME = 0x50,
         IEEE80211_MGMT_BEACON_FRAME = 0x80,
-        IEEE80211_MGMT_DIASSOC_FRAME = 0xA0,
+        IEEE80211_MGMT_DISASSOC_FRAME = 0xA0,
         IEEE80211_MGMT_AUTH_FRAME = 0xB0,
         IEEE80211_MGMT_DEAUTH_FRAME = 0xC0,
-} ieee80211_frame_subtype_t;
+} ieee80211_frame_mgmt_subtype_t;
+
+/** IEEE 802.11 data frame subtypes. */
+typedef enum {
+        IEEE80211_DATA_DATA_FRAME = 0x0000,
+        IEEE80211_DATA_QOS_FRAME = 0x0080
+} ieee80211_frame_data_subtype_t;
 
 /** IEEE 802.11 frame control value masks. */
@@ -73 +137 @@
         IEEE80211_FRAME_CTRL_FRAME_TYPE = 0x000C,
         IEEE80211_FRAME_CTRL_FRAME_SUBTYPE = 0x00F0,
-} ieee80211_frame_control_mask_t;
+        IEEE80211_FRAME_CTRL_PROTECTED = 0x4000
+} ieee80211_frame_ctrl_mask_t;
+
+/** IEEE 802.11 frame control DS field values. */
+typedef enum {
+        IEEE80211_FRAME_CTRL_TODS = 0x0100,
+        IEEE80211_FRAME_CTRL_FROMDS = 0x0200
+} ieee80211_frame_ctrl_ds_t;
+
+/** IEEE 802.11 authentication cipher suites values. */
+typedef enum {
+        IEEE80211_AUTH_CIPHER_TKIP = 0x02,
+        IEEE80211_AUTH_CIPHER_CCMP = 0x04
+} ieee80211_auth_cipher_type_t;
+
+/** IEEE 802.11 AKM suites values. */
+typedef enum {
+        IEEE80211_AUTH_AKM_8021X = 0x01,
+        IEEE80211_AUTH_AKM_PSK = 0x02
+} ieee80211_auth_akm_type_t;
+
+typedef enum {
+        IEEE80211_EAPOL_START = 0x1,
+        IEEE80211_EAPOL_KEY = 0x3
+} ieee80211_eapol_frame_type_t;
+
+typedef enum {
+        IEEE80211_EAPOL_KEY_KEYINFO_KEYTYPE = 0x0008,
+        IEEE80211_EAPOL_KEY_KEYINFO_INSTALL = 0x0040,
+        IEEE80211_EAPOL_KEY_KEYINFO_ACK = 0x0080,
+        IEEE80211_EAPOL_KEY_KEYINFO_MIC = 0x0100,
+        IEEE80211_EAPOL_KEY_KEYINFO_SECURE = 0x0200,
+        IEEE80211_EAPOL_KEY_KEYINFO_ENCDATA = 0x1000
+} ieee80211_eapol_key_keyinfo_t;
 
 /** IEEE 802.11 information element types. */
@@ -80 +177 @@
         IEEE80211_RATES_IE = 1,         /**< Supported data rates. */
         IEEE80211_CHANNEL_IE = 3,       /**< Current channel number. */
-        IEEE80211_EXT_RATES_IE = 50     /**< Extended data rates. */
+        IEEE80211_CHALLENGE_IE = 16,    /**< Challenge text. */
+        IEEE80211_RSN_IE = 48,          /**< RSN. */
+        IEEE80211_EXT_RATES_IE = 50,    /**< Extended data rates. */
+        IEEE80211_VENDOR_IE = 221       /**< Vendor specific IE. */
 } ieee80211_ie_type_t;
+
+/** IEEE 802.11 authentication phases. */
+typedef enum {
+        IEEE80211_AUTH_DISCONNECTED,
+        IEEE80211_AUTH_AUTHENTICATED,
+        IEEE80211_AUTH_ASSOCIATED
+} ieee80211_auth_phase_t;
+
+/** Link with scan result info. */
+typedef struct {
+        link_t link;
+        time_t last_beacon;
+        ieee80211_scan_result_t scan_result;
+        uint8_t rsn_copy[256];
+        size_t rsn_copy_len;
+} ieee80211_scan_result_link_t;
+
+/** List of scan results info. */
+typedef struct {
+        list_t list;
+        time_t last_scan;
+        fibril_mutex_t scan_mutex;
+        size_t size;
+} ieee80211_scan_result_list_t;
+
+/** BSSID info. */
+typedef struct {
+        uint16_t aid;
+        char password[IEEE80211_WPA_MAX_PASSWORD_LENGTH];
+        uint8_t ptk[MAX_PTK_LENGTH];
+        uint8_t gtk[MAX_GTK_LENGTH];
+        ieee80211_scan_result_link_t *res_link;
+} ieee80211_bssid_info_t;
 
 /** IEEE 802.11 WiFi device structure. */
@@ -103 +236 @@
         ieee80211_operating_mode_t current_op_mode;
         
+        /** Info about BSSID we are connected to. */
+        ieee80211_bssid_info_t bssid_info;
+        
+        /** 
+         * Flag indicating that data traffic is encrypted by HW key
+         * that is set up in device. 
+         */
+        bool using_hw_key;
+        
         /** BSSIDs we listen to. */
         nic_address_t bssid_mask;
         
         /** List of APs in neighborhood. */
-        ieee80211_scan_results_t ap_list;
-        
-        /* TODO: Probably to be removed later - nic.open function is now 
-         * executed multiple times, have to find out reason and fix it. 
-         */
+        ieee80211_scan_result_list_t ap_list;
+        
+        /** Current sequence number used in data frames. */
+        uint16_t sequence_number;
+        
+        /** Current authentication phase. */
+        ieee80211_auth_phase_t current_auth_phase;
+        
+        /** General purpose guard. */
+        fibril_mutex_t gen_mutex;
+        
+        /** General purpose condition variable. */
+        fibril_condvar_t gen_cond;
+        
+        /** Indicates whether device is fully initialized. */
+        bool ready;
+        
         /** Indicates whether driver has already started. */
         bool started;
 };
+
+/** IEEE 802.3 (ethernet) header. */
+typedef struct {
+        uint8_t dest_addr[ETH_ADDR];
+        uint8_t src_addr[ETH_ADDR];
+        uint16_t proto;                 /**< Big Endian value! */
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        eth_header_t;
 
 /** IEEE 802.11 management header structure. */
@@ -124 +286 @@
         uint8_t bssid[ETH_ADDR];
         uint16_t seq_ctrl;              /**< Little Endian value! */
-} __attribute__((packed)) __attribute__ ((aligned(2))) ieee80211_mgmt_header_t;
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_mgmt_header_t;
 
 /** IEEE 802.11 data header structure. */
@@ -134 +297 @@
         uint8_t address3[ETH_ADDR];
         uint16_t seq_ctrl;              /**< Little Endian value! */
-        uint8_t address4[ETH_ADDR];
-        uint16_t qos_ctrl;              /**< Little Endian value! */
-} __attribute__((packed)) __attribute__ ((aligned(2))) ieee80211_data_header_t;
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_data_header_t;
 
 /** IEEE 802.11 information element header. */
@@ -142 +304 @@
         uint8_t element_id;
         uint8_t length;
-} __attribute__((packed)) __attribute__ ((aligned(2))) ieee80211_ie_header_t;
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_ie_header_t;
 
 /** IEEE 802.11 authentication frame body. */
@@ -149 +312 @@
         uint16_t auth_trans_no;         /**< Little Endian value! */
         uint16_t status;                /**< Little Endian value! */
-} __attribute__((packed)) __attribute__ ((aligned(2))) ieee80211_auth_body_t;
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_auth_body_t;
+
+/** IEEE 802.11 deauthentication frame body. */
+typedef struct {
+        uint16_t reason;                /**< Little Endian value! */
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_deauth_body_t;
+
+/** IEEE 802.11 association request frame body. */
+typedef struct {
+        uint16_t capability;            /**< Little Endian value! */
+        uint16_t listen_interval;       /**< Little Endian value! */
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_assoc_req_body_t;
+
+/** IEEE 802.11 association response frame body. */
+typedef struct {
+        uint16_t capability;            /**< Little Endian value! */
+        uint16_t status;                /**< Little Endian value! */
+        uint16_t aid;                   /**< Little Endian value! */
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_assoc_resp_body_t;
 
 /** IEEE 802.11 beacon frame body start. */
 typedef struct {
         uint8_t timestamp[8];
-        uint16_t beacon_interval;
-        uint16_t capability;
-} __attribute__((packed)) __attribute__ ((aligned(2))) ieee80211_beacon_start_t;
-
-extern int ieee80211_probe_request(ieee80211_dev_t *ieee80211_dev);
-extern int ieee80211_probe_auth(ieee80211_dev_t *ieee80211_dev);
+        uint16_t beacon_interval;       /**< Little Endian value! */
+        uint16_t capability;            /**< Little Endian value! */
+} __attribute__((packed)) __attribute__ ((aligned(2))) 
+        ieee80211_beacon_start_t;
+
+/** IEEE 802.11i EAPOL-Key frame format. */
+typedef struct {
+        uint8_t proto_version;
+        uint8_t packet_type;
+        uint16_t body_length;           /**< Big Endian value! */
+        uint8_t descriptor_type;
+        uint16_t key_info;              /**< Big Endian value! */
+        uint16_t key_length;            /**< Big Endian value! */
+        uint8_t key_replay_counter[8];
+        uint8_t key_nonce[32];
+        uint8_t eapol_key_iv[16];
+        uint8_t key_rsc[8];
+        uint8_t reserved[8];
+        uint8_t key_mic[16];
+        uint16_t key_data_length;       /**< Big Endian value! */
+} __attribute__((packed)) ieee80211_eapol_key_frame_t;
+
+#define ieee80211_scan_result_list_foreach(results, iter) \
+    list_foreach((results).list, link, ieee80211_scan_result_link_t, (iter))
+
+static inline void ieee80211_scan_result_list_init(
+        ieee80211_scan_result_list_t *results) 
+{
+        list_initialize(&results->list);
+        fibril_mutex_initialize(&results->scan_mutex);
+}
+
+static inline void ieee80211_scan_result_list_remove(
+        ieee80211_scan_result_list_t *results,
+        ieee80211_scan_result_link_t *result)
+{
+        list_remove(&result->link);
+        results->size--;
+}
+
+static inline void ieee80211_scan_result_list_append(
+        ieee80211_scan_result_list_t *results,
+        ieee80211_scan_result_link_t *result)
+{
+        list_append(&result->link, &results->list);
+        results->size++;
+}
+
+extern int ieee80211_probe_request(ieee80211_dev_t *ieee80211_dev, 
+        char *ssid);
+extern int ieee80211_authenticate(ieee80211_dev_t *ieee80211_dev);
+extern int ieee80211_associate(ieee80211_dev_t *ieee80211_dev, 
+        char *password);
+extern int ieee80211_deauthenticate(ieee80211_dev_t *ieee80211_dev);
 
 #endif /* LIBN_IEEE80211_H */

uspace/lib/ieee80211/src/ieee80211.c

@@ -36 +36 @@
  */
 
+#include <stdio.h>
+#include <crypto.h>
+#include <str.h>
 #include <macros.h>
 #include <errno.h>
@@ -45 +48 @@
 #include <ops/ieee80211.h>
 
+#define IEEE80211_DATA_RATES_SIZE 8
+#define IEEE80211_EXT_DATA_RATES_SIZE 4
+
+/** Frame encapsulation used in IEEE 802.11. */
+static const uint8_t rfc1042_header[] = { 
+        0xAA, 0xAA, 0x03, 0x00, 0x00, 0x00 
+};
+
 /** Broadcast MAC address used to spread probe request through channel. */
 static const uint8_t ieee80211_broadcast_mac_addr[] = {
@@ -50 +61 @@
 };
 
-/** IEEE 802.11 b/g supported data rates in units of 500 kb/s. */
-static const uint8_t ieee80211bg_data_rates[] = {
-        2, 4, 11, 12, 18, 22, 24, 36
-};
-
-/** IEEE 802.11 b/g extended supported data rates in units of 500 kb/s.
- * 
- *  These are defined separately, because probe request message can
- *  only handle up to 8 data rates in supported rates IE. 
- */
-static const uint8_t ieee80211bg_ext_data_rates[] = {
-        48, 72, 96, 108
-};
-
+/**
+ * Check data frame.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is data frame, otherwise false.
+ */
 inline bool ieee80211_is_data_frame(uint16_t frame_ctrl)
 {
@@ -72 +76 @@
 }
 
+/**
+ * Check management frame.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is management frame, otherwise false.
+ */
 inline bool ieee80211_is_mgmt_frame(uint16_t frame_ctrl)
 {
@@ -80 +91 @@
 }
 
+/**
+ * Check management beacon frame.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is beacon frame, otherwise false.
+ */
 inline bool ieee80211_is_beacon_frame(uint16_t frame_ctrl)
 {
@@ -88 +106 @@
 }
 
+/**
+ * Check management probe response frame.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is probe resp frame, otherwise false.
+ */
 inline bool ieee80211_is_probe_response_frame(uint16_t frame_ctrl)
 {
@@ -97 +122 @@
 
 /**
+ * Check management authentication frame.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is auth frame, otherwise false.
+ */
+inline bool ieee80211_is_auth_frame(uint16_t frame_ctrl)
+{
+        frame_ctrl = uint16_t_le2host(frame_ctrl);
+        
+        return (frame_ctrl & IEEE80211_FRAME_CTRL_FRAME_SUBTYPE)
+                == IEEE80211_MGMT_AUTH_FRAME;
+}
+
+/**
+ * Check management association response frame.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is assoc resp frame, otherwise false.
+ */
+inline bool ieee80211_is_assoc_response_frame(uint16_t frame_ctrl)
+{
+        frame_ctrl = uint16_t_le2host(frame_ctrl);
+        
+        return (frame_ctrl & IEEE80211_FRAME_CTRL_FRAME_SUBTYPE)
+                == IEEE80211_MGMT_ASSOC_RESP_FRAME;
+}
+
+/**
+ * Check data frame "to distribution system" direction.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is TODS frame, otherwise false.
+ */
+static inline bool ieee80211_is_tods_frame(uint16_t frame_ctrl)
+{
+        frame_ctrl = uint16_t_le2host(frame_ctrl);
+        
+        return (frame_ctrl & IEEE80211_FRAME_CTRL_TODS);
+}
+
+/**
+ * Check data frame "from distribution system" direction.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it is FROMDS frame, otherwise false.
+ */
+static inline bool ieee80211_is_fromds_frame(uint16_t frame_ctrl)
+{
+        frame_ctrl = uint16_t_le2host(frame_ctrl);
+        
+        return (frame_ctrl & IEEE80211_FRAME_CTRL_FROMDS);
+}
+
+/**
+ * Check if it is data frame containing payload data.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if it has payload data, otherwise false.
+ */
+static inline bool ieee80211_has_data_frame(uint16_t frame_ctrl)
+{
+        frame_ctrl = uint16_t_le2host(frame_ctrl);
+        
+        return (frame_ctrl & (IEEE80211_FRAME_CTRL_FRAME_TYPE | 0x40))
+                == IEEE80211_DATA_FRAME;
+}
+
+/**
+ * Check if it is encrypted frame.
+ * 
+ * @param frame_ctrl Frame control field in little endian (!).
+ * 
+ * @return True if the frame is encrypted, otherwise false.
+ */
+static inline bool ieee80211_is_encrypted_frame(uint16_t frame_ctrl)
+{
+        frame_ctrl = uint16_t_le2host(frame_ctrl);
+        
+        return (frame_ctrl & IEEE80211_FRAME_CTRL_PROTECTED) != 0;
+}
+
+/**
+ * Check if PAE packet is EAPOL-Key frame.
+ * 
+ * @param key_frame Pointer to start of EAPOL frame.
+ * 
+ * @return True if it is EAPOL-Key frame, otherwise false.
+ */
+static inline bool ieee80211_is_eapol_key_frame(ieee80211_eapol_key_frame_t 
+        *key_frame)
+{
+        return (key_frame->packet_type == IEEE80211_EAPOL_KEY);
+}
+
+
+/**
+ * Generate packet sequence number.
+ * 
+ * @param ieee80211_dev IEEE 802.11 device.
+ * 
+ * @return True if it has payload data, otherwise false.
+ */
+static uint16_t ieee80211_get_sequence_number(ieee80211_dev_t *ieee80211_dev)
+{
+        uint16_t ret_val = ieee80211_dev->sequence_number;
+        ieee80211_dev->sequence_number += (1 << 4);
+        return ret_val;
+}
+
+/**
  * Get driver-specific structure for IEEE 802.11 device.
  * 
@@ -139 +279 @@
  * @return Current IEEE 802.11 operating mode.
  */
-ieee80211_operating_mode_t ieee80211_query_current_op_mode(ieee80211_dev_t* ieee80211_dev)
+ieee80211_operating_mode_t ieee80211_query_current_op_mode(ieee80211_dev_t* 
+        ieee80211_dev)
 {
         return ieee80211_dev->current_op_mode;
@@ -154 +295 @@
 {
         return ieee80211_dev->current_freq;
+}
+
+/**
+ * Query BSSID the device is connected to.
+ * 
+ * @param ieee80211_dev IEEE 802.11 device.
+ * @param bssid Pointer to structure where should be stored BSSID.
+ */
+void ieee80211_query_bssid(ieee80211_dev_t* ieee80211_dev, 
+        nic_address_t *bssid)
+{
+        if(bssid) {
+                ieee80211_scan_result_t *auth_data =
+                        &ieee80211_dev->bssid_info.res_link->scan_result;
+                
+                memcpy(bssid, (void *)&auth_data->bssid, sizeof(nic_address_t));
+        }
+}
+
+/**
+ * Get AID of network we are connected to.
+ * 
+ * @param ieee80211_dev IEEE 802.11 device.
+ * 
+ * @return AID.
+ */
+uint16_t ieee80211_get_aid(ieee80211_dev_t* ieee80211_dev)
+{
+        return ieee80211_dev->bssid_info.aid;
+}
+
+/**
+ * Get security suite used for HW encryption. 
+ * 
+ * @param ieee80211_dev IEEE 802.11 device.
+ * 
+ * @return Security suite indicator.
+ */
+int ieee80211_get_security_suite(ieee80211_dev_t* ieee80211_dev)
+{
+        ieee80211_scan_result_link_t *auth_link = 
+                ieee80211_dev->bssid_info.res_link;
+        
+        return auth_link->scan_result.security.pair_alg;
+}
+
+/**
+ * Check if IEEE 802.11 device is connected to network.
+ * 
+ * @param ieee80211_dev IEEE 802.11 device.
+ * 
+ * @return True if device is connected to network, otherwise false.
+ */
+bool ieee80211_is_connected(ieee80211_dev_t* ieee80211_dev)
+{
+        return ieee80211_dev->current_auth_phase == IEEE80211_AUTH_ASSOCIATED;
 }
 
@@ -178 +375 @@
 {
         ieee80211_dev->current_freq = freq;
+}
+
+/**
+ * Check if IEEE 802.11 device is ready (fully initialized).
+ * 
+ * @param ieee80211_dev IEEE 802.11 device.
+ * 
+ * @return True if device is ready to work, otherwise false.
+ */
+bool ieee80211_is_ready(ieee80211_dev_t* ieee80211_dev)
+{
+        fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+        bool ready_state = ieee80211_dev->ready;
+        fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+        
+        return ready_state;
+}
+
+/**
+ * Set IEEE 802.11 device to ready state.
+ * 
+ * @param ieee80211_dev IEEE 802.11 device.
+ * @param ready Ready state to be set.
+ */
+void ieee80211_set_ready(ieee80211_dev_t* ieee80211_dev, bool ready)
+{
+        fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+        ieee80211_dev->ready = ready;
+        fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+}
+
+extern bool ieee80211_query_using_key(ieee80211_dev_t* ieee80211_dev)
+{
+        return ieee80211_dev->using_hw_key;
+}
+
+void ieee80211_setup_key_confirm(ieee80211_dev_t* ieee80211_dev, 
+        bool using_key)
+{
+        ieee80211_dev->using_hw_key = using_key;
 }
 
@@ -209 +446 @@
 }
 
-/** 
+/**
  * Send frame handler.
+ * 
+ * @param nic Pointer to NIC device.
+ * @param data Data buffer.
+ * @param size Data buffer size.
  */
 static void ieee80211_send_frame(nic_t *nic, void *data, size_t size)
@@ -217 +458 @@
                 nic_get_specific(nic);
         
-        ieee80211_dev->ops->tx_handler(ieee80211_dev, data, size);
+        if(!ieee80211_is_connected(ieee80211_dev)) {
+                return;
+        }
+        
+        ieee80211_scan_result_t *auth_data =
+                        &ieee80211_dev->bssid_info.res_link->scan_result;
+        
+        /* We drop part of IEEE 802.3 ethernet header. */
+        size_t drop_bytes = sizeof(eth_header_t) - 2;
+        
+        size_t complete_size = (size - drop_bytes) + 
+                sizeof(ieee80211_data_header_t) +
+                ARRAY_SIZE(rfc1042_header);
+        
+        /* Init crypto data. */
+        size_t add_size = 0;
+        uint16_t crypto = 0;
+        uint8_t add_data[8];
+        memset(add_data, 0, 8);
+        
+        if(ieee80211_dev->using_hw_key) {
+                int sec_suite = auth_data->security.pair_alg;
+                switch(sec_suite) {
+                        case IEEE80211_SECURITY_SUITE_CCMP:
+                                add_size = IEEE80211_CCMP_HEADER_LENGTH;
+                                add_data[3] = 0x20;
+                                break;
+                        default:
+                                break;
+                }
+
+                crypto = uint16_t_le2host(IEEE80211_FRAME_CTRL_PROTECTED);
+        }
+        
+        complete_size += add_size;
+        
+        void *complete_buffer = malloc(complete_size);
+        memset(complete_buffer, 0, complete_size);
+        
+        if(add_size) {
+                memcpy(complete_buffer + sizeof(ieee80211_data_header_t),
+                        add_data, add_size);
+        }
+        
+        memcpy(complete_buffer + sizeof(ieee80211_data_header_t) + add_size,
+                rfc1042_header,
+                ARRAY_SIZE(rfc1042_header));
+        
+        memcpy(complete_buffer + 
+                sizeof(ieee80211_data_header_t) +
+                ARRAY_SIZE(rfc1042_header) + add_size, 
+                data + drop_bytes, size - drop_bytes);
+        
+        ieee80211_data_header_t *data_header =
+                (ieee80211_data_header_t *) complete_buffer;
+        data_header->frame_ctrl = 
+                uint16_t_le2host(IEEE80211_DATA_FRAME) |
+                uint16_t_le2host(IEEE80211_DATA_DATA_FRAME) |
+                uint16_t_le2host(IEEE80211_FRAME_CTRL_TODS) |
+                crypto;
+        data_header->seq_ctrl = ieee80211_get_sequence_number(ieee80211_dev);
+        
+        /* BSSID, SA, DA. */
+        memcpy(data_header->address1, auth_data->bssid.address, ETH_ADDR);
+        memcpy(data_header->address2, data + ETH_ADDR, ETH_ADDR);
+        memcpy(data_header->address3, data, ETH_ADDR);
+        
+        ieee80211_dev->ops->tx_handler(ieee80211_dev, 
+                complete_buffer, 
+                complete_size);
+        
+        free(complete_buffer);
 }
 
@@ -246 +558 @@
                         ieee80211_ops->set_freq = ieee80211_set_freq_impl;
                 
+                if(!ieee80211_ops->bssid_change)
+                        ieee80211_ops->bssid_change = 
+                                ieee80211_bssid_change_impl;
+                
+                if(!ieee80211_ops->key_config)
+                        ieee80211_ops->key_config = ieee80211_key_config_impl;
+                
                 if(!ieee80211_ops->scan)
                         ieee80211_ops->scan = ieee80211_scan_impl;
@@ -257 +576 @@
                 if(nic_dev_ops)
                         if (!nic_dev_ops->interfaces[IEEE80211_DEV_IFACE])
-                                nic_dev_ops->interfaces[IEEE80211_DEV_IFACE] = ieee80211_iface;
+                                nic_dev_ops->interfaces[IEEE80211_DEV_IFACE] = 
+                                        ieee80211_iface;
                 
                 if(!ieee80211_iface->get_scan_results)
-                        ieee80211_iface->get_scan_results = ieee80211_get_scan_results_impl;
+                        ieee80211_iface->get_scan_results = 
+                                ieee80211_get_scan_results_impl;
                 
                 if(!ieee80211_iface->connect)
                         ieee80211_iface->connect = ieee80211_connect_impl;
+                
+                if(!ieee80211_iface->disconnect)
+                        ieee80211_iface->disconnect = ieee80211_disconnect_impl;
         } else {
                 return EINVAL;
@@ -304 +628 @@
         ieee80211_dev->ddf_dev = ddf_dev;
         ieee80211_dev->started = false;
+        ieee80211_dev->ready = false;
+        ieee80211_dev->using_hw_key = false;
         ieee80211_dev->current_op_mode = IEEE80211_OPMODE_STATION;
+        ieee80211_dev->current_auth_phase = IEEE80211_AUTH_DISCONNECTED;
         memcpy(ieee80211_dev->bssid_mask.address, ieee80211_broadcast_mac_addr, 
                 ETH_ADDR);
+        
+        ieee80211_scan_result_list_init(&ieee80211_dev->ap_list);
+        
+        fibril_mutex_initialize(&ieee80211_dev->gen_mutex);
+        fibril_condvar_initialize(&ieee80211_dev->gen_cond);
         
         /* Bind NIC to device */
@@ -373 +705 @@
 }
 
+/**
+ * Convert frequency value to channel number.
+ * 
+ * @param freq IEEE 802.11 operating frequency.
+ * 
+ * @return Operating channel number.
+ */
 static uint8_t ieee80211_freq_to_channel(uint16_t freq)
 {
@@ -378 +717 @@
 }
 
+static void ieee80211_prepare_ie_header(void **ie_header,
+        uint8_t id, uint8_t length, void *data)
+{
+        ieee80211_ie_header_t *header =
+                (ieee80211_ie_header_t *) *ie_header;
+        
+        header->element_id = id;
+        header->length = length;
+        
+        memcpy(*ie_header + sizeof(ieee80211_ie_header_t), data, length);
+        
+        *ie_header = (void *) ((void *) header + 
+                sizeof(ieee80211_ie_header_t) + length);
+}
+
 /**
  * Probe request implementation.
  * 
  * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+ * @param ssid Probing SSID or NULL if broadcast.
  * 
  * @return EOK if succeed, negative error code otherwise.
  */
-int ieee80211_probe_request(ieee80211_dev_t *ieee80211_dev)
+int ieee80211_probe_request(ieee80211_dev_t *ieee80211_dev, char *ssid)
 {
         nic_t *nic = nic_get_from_ddf_dev(ieee80211_dev->ddf_dev);
@@ -391 +746 @@
         nic_query_address(nic, &nic_address);
         
-        size_t data_rates_size = ARRAY_SIZE(ieee80211bg_data_rates);
-        size_t ext_data_rates_size = ARRAY_SIZE(ieee80211bg_ext_data_rates);
-        
-        /* 3 headers - (rates, ext rates, current channel) and their data
-         * lengths + pad. 
+        size_t ssid_data_size = (ssid != NULL) ? str_size(ssid) : 0;
+        size_t channel_data_size = 1;
+        
+        uint8_t channel = 
+                ieee80211_freq_to_channel(ieee80211_dev->current_freq);
+        
+        /* 4 headers - (ssid, rates, ext rates, current channel) and their data
+         * lengths. 
          */
         size_t payload_size = 
-                sizeof(ieee80211_ie_header_t) * 3 +
-                data_rates_size + ext_data_rates_size + sizeof(uint8_t) + 2;
+                sizeof(ieee80211_ie_header_t) * 4 +
+                ssid_data_size + 
+                IEEE80211_DATA_RATES_SIZE + IEEE80211_EXT_DATA_RATES_SIZE + 
+                channel_data_size;
         
         size_t buffer_size = sizeof(ieee80211_mgmt_header_t) + payload_size;
@@ -415 +775 @@
         memcpy(mgmt_header->src_addr, nic_address.address, ETH_ADDR);
         memcpy(mgmt_header->bssid, ieee80211_broadcast_mac_addr, ETH_ADDR);
-        
-        /* Jump to payload -> header + padding. */
-        ieee80211_ie_header_t *rates_ie_header = (ieee80211_ie_header_t *) 
-                ((void *)buffer + sizeof(ieee80211_mgmt_header_t) + 2);
-        rates_ie_header->element_id = IEEE80211_RATES_IE;
-        rates_ie_header->length = data_rates_size;
-        memcpy(rates_ie_header + sizeof(ieee80211_ie_header_t), 
-                ieee80211bg_data_rates, 
-                data_rates_size);
-        
-        ieee80211_ie_header_t *ext_rates_ie_header = (ieee80211_ie_header_t *) 
-                ((void *)rates_ie_header + sizeof(ieee80211_ie_header_t) + 
-                data_rates_size);
-        ext_rates_ie_header->element_id = IEEE80211_EXT_RATES_IE;
-        ext_rates_ie_header->length = ext_data_rates_size;
-        memcpy(ext_rates_ie_header + sizeof(ieee80211_ie_header_t), 
-                ieee80211bg_ext_data_rates, 
-                ext_data_rates_size);
-        
-        ieee80211_ie_header_t *chan_ie_header = (ieee80211_ie_header_t *) 
-                ((void *)ext_rates_ie_header + sizeof(ieee80211_ie_header_t) + 
-                ext_data_rates_size);
-        chan_ie_header->element_id = IEEE80211_CHANNEL_IE;
-        chan_ie_header->length = 1;
-        uint8_t *it = (uint8_t *) ((void *)chan_ie_header + 
-                sizeof(ieee80211_ie_header_t));
-        *it = ieee80211_freq_to_channel(ieee80211_dev->current_freq);
+        mgmt_header->seq_ctrl = 
+                host2uint16_t_le(ieee80211_get_sequence_number(ieee80211_dev));
+        
+        /* Jump to payload. */
+        void *it = (void *) buffer + sizeof(ieee80211_mgmt_header_t);
+        ieee80211_prepare_ie_header(&it, IEEE80211_SSID_IE, ssid_data_size, 
+                (void *) ssid);
+        ieee80211_prepare_ie_header(&it, IEEE80211_RATES_IE, 
+                IEEE80211_DATA_RATES_SIZE, 
+                (void *) &ieee80211bg_data_rates);
+        ieee80211_prepare_ie_header(&it, IEEE80211_EXT_RATES_IE, 
+                IEEE80211_EXT_DATA_RATES_SIZE, 
+                (void *) &ieee80211bg_data_rates[IEEE80211_DATA_RATES_SIZE]);
+        ieee80211_prepare_ie_header(&it, IEEE80211_CHANNEL_IE, 
+                channel_data_size, (void *) &channel);
         
         ieee80211_dev->ops->tx_handler(ieee80211_dev, buffer, buffer_size);
@@ -451 +799 @@
 
 /**
- * Probe authentication implementation.
+ * IEEE 802.11 authentication implementation.
  * 
  * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
@@ -457 +805 @@
  * @return EOK if succeed, negative error code otherwise.
  */
-int ieee80211_probe_auth(ieee80211_dev_t *ieee80211_dev)
-{
-        uint8_t test_bssid[] = {0x14, 0xF6, 0x5A, 0xAF, 0x5E, 0xB7};
-        
+int ieee80211_authenticate(ieee80211_dev_t *ieee80211_dev)
+{
         nic_t *nic = nic_get_from_ddf_dev(ieee80211_dev->ddf_dev);
         nic_address_t nic_address;
         nic_query_address(nic, &nic_address);
         
+        ieee80211_scan_result_t *auth_data =
+                &ieee80211_dev->bssid_info.res_link->scan_result;
+        
         size_t buffer_size = sizeof(ieee80211_mgmt_header_t) + 
                 sizeof(ieee80211_auth_body_t);
+        
         void *buffer = malloc(buffer_size);
         memset(buffer, 0, buffer_size);
@@ -477 +827 @@
                 IEEE80211_MGMT_AUTH_FRAME
                 );
-        memcpy(mgmt_header->dest_addr, test_bssid, ETH_ADDR);
+        memcpy(mgmt_header->dest_addr, auth_data->bssid.address, ETH_ADDR);
         memcpy(mgmt_header->src_addr, nic_address.address, ETH_ADDR);
-        memcpy(mgmt_header->bssid, test_bssid, ETH_ADDR);
+        memcpy(mgmt_header->bssid, auth_data->bssid.address, ETH_ADDR);
         
         ieee80211_auth_body_t *auth_body =
@@ -485 +835 @@
                 (buffer + sizeof(ieee80211_mgmt_header_t));
         auth_body->auth_alg = host2uint16_t_le(0);
-        auth_body->auth_trans_no = host2uint16_t_le(0);
+        auth_body->auth_trans_no = host2uint16_t_le(1);
         
         ieee80211_dev->ops->tx_handler(ieee80211_dev, buffer, buffer_size);
@@ -494 +844 @@
 }
 
+/** 
+ * IEEE 802.11 association implementation.
+ * 
+ * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+ * @param password Passphrase to be used in encrypted communication or NULL
+ * for open networks.
+ * 
+ * @return EOK if succeed, negative error code otherwise.
+ */
+int ieee80211_associate(ieee80211_dev_t *ieee80211_dev, char *password) 
+{
+        nic_t *nic = nic_get_from_ddf_dev(ieee80211_dev->ddf_dev);
+        nic_address_t nic_address;
+        nic_query_address(nic, &nic_address);
+        
+        ieee80211_scan_result_link_t *auth_link =
+                ieee80211_dev->bssid_info.res_link;
+        
+        ieee80211_scan_result_t *auth_data = &auth_link->scan_result;
+        
+        size_t ssid_data_size = str_size(auth_data->ssid);
+        
+        size_t payload_size = 
+                sizeof(ieee80211_ie_header_t) * 3 +
+                ssid_data_size + 
+                IEEE80211_DATA_RATES_SIZE + 
+                IEEE80211_EXT_DATA_RATES_SIZE;
+        
+        size_t buffer_size = 
+                sizeof(ieee80211_mgmt_header_t) + 
+                sizeof(ieee80211_assoc_req_body_t) +
+                payload_size;
+        
+        if(auth_data->security.type == IEEE80211_SECURITY_WPA2) {
+                buffer_size += auth_link->rsn_copy_len;
+        }
+        
+        void *buffer = malloc(buffer_size);
+        memset(buffer, 0, buffer_size);
+        
+        ieee80211_mgmt_header_t *mgmt_header = 
+                (ieee80211_mgmt_header_t *) buffer;
+        
+        mgmt_header->frame_ctrl = host2uint16_t_le(
+                IEEE80211_MGMT_FRAME | 
+                IEEE80211_MGMT_ASSOC_REQ_FRAME
+                );
+        memcpy(mgmt_header->dest_addr, auth_data->bssid.address, ETH_ADDR);
+        memcpy(mgmt_header->src_addr, nic_address.address, ETH_ADDR);
+        memcpy(mgmt_header->bssid, auth_data->bssid.address, ETH_ADDR);
+        
+        ieee80211_assoc_req_body_t *assoc_body =
+                (ieee80211_assoc_req_body_t *) 
+                (buffer + sizeof(ieee80211_mgmt_header_t));
+        assoc_body->listen_interval = host2uint16_t_le(1);
+        
+        /* Jump to payload. */
+        void *it = buffer + sizeof(ieee80211_mgmt_header_t) +
+                sizeof(ieee80211_assoc_req_body_t);
+        ieee80211_prepare_ie_header(&it, IEEE80211_SSID_IE, 
+                ssid_data_size, (void *) auth_data->ssid);
+        ieee80211_prepare_ie_header(&it, IEEE80211_RATES_IE, 
+                IEEE80211_DATA_RATES_SIZE, 
+                (void *) &ieee80211bg_data_rates);
+        ieee80211_prepare_ie_header(&it, IEEE80211_EXT_RATES_IE, 
+                IEEE80211_EXT_DATA_RATES_SIZE, 
+                (void *) &ieee80211bg_data_rates[IEEE80211_DATA_RATES_SIZE]);
+        
+        if(auth_data->security.type != IEEE80211_SECURITY_OPEN) {
+                assoc_body->capability |= host2uint16_t_le(CAP_SECURITY);
+        }
+        
+        if(auth_data->security.type == IEEE80211_SECURITY_WPA2) {
+                memcpy(it, auth_link->rsn_copy, auth_link->rsn_copy_len);
+        }
+        
+        ieee80211_dev->ops->tx_handler(ieee80211_dev, buffer, buffer_size);
+        
+        /* 
+         * Save password and SSID to be used in eventual authentication 
+         * handshake. 
+         */
+        memcpy(ieee80211_dev->bssid_info.password, password, 
+                str_size(password));
+        
+        free(buffer);
+        
+        return EOK;
+}
+
+/** 
+ * IEEE 802.11 deauthentication implementation.
+ * 
+ * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+ * 
+ * @return EOK if succeed, negative error code otherwise.
+ */
+int ieee80211_deauthenticate(ieee80211_dev_t *ieee80211_dev)
+{
+        ieee80211_scan_result_t *auth_data =
+                &ieee80211_dev->bssid_info.res_link->scan_result;
+        
+        ieee80211_dev->current_auth_phase = IEEE80211_AUTH_DISCONNECTED;
+        ieee80211_dev->bssid_info.aid = (uint16_t) -1;
+        memcpy(auth_data->bssid.address, ieee80211_broadcast_mac_addr, 
+                ETH_ADDR);
+        
+        nic_t *nic = nic_get_from_ddf_dev(ieee80211_dev->ddf_dev);
+        nic_address_t nic_address;
+        nic_query_address(nic, &nic_address);
+        
+        size_t buffer_size = sizeof(ieee80211_mgmt_header_t) + 
+                sizeof(ieee80211_deauth_body_t);
+        void *buffer = malloc(buffer_size);
+        memset(buffer, 0, buffer_size);
+        
+        ieee80211_mgmt_header_t *mgmt_header = 
+                (ieee80211_mgmt_header_t *) buffer;
+        
+        mgmt_header->frame_ctrl = host2uint16_t_le(
+                IEEE80211_MGMT_FRAME | 
+                IEEE80211_MGMT_DEAUTH_FRAME
+                );
+        memcpy(mgmt_header->dest_addr, auth_data->bssid.address, ETH_ADDR);
+        memcpy(mgmt_header->src_addr, nic_address.address, ETH_ADDR);
+        memcpy(mgmt_header->bssid, auth_data->bssid.address, ETH_ADDR);
+        
+        ieee80211_dev->ops->tx_handler(ieee80211_dev, buffer, buffer_size);
+        
+        free(buffer);
+        
+        ieee80211_dev->ops->bssid_change(ieee80211_dev);
+        
+        return EOK;
+}
+
+static void ieee80211_process_auth_info(ieee80211_scan_result_link_t *ap_data,
+        void *buffer)
+{
+        uint8_t *it = (uint8_t *) buffer;
+        
+        uint16_t *version = (uint16_t *) it;
+        if(uint16_t_le2host(*version) != 0x1) {
+                ap_data->scan_result.security.type = -1;
+                return;
+        }
+        
+        it += sizeof(uint16_t);
+        
+        uint32_t group_cipher = *(it+3);
+        switch(group_cipher) {
+                case IEEE80211_AUTH_CIPHER_TKIP:
+                        ap_data->scan_result.security.group_alg =
+                                IEEE80211_SECURITY_SUITE_TKIP;
+                        break;
+                case IEEE80211_AUTH_CIPHER_CCMP:
+                        ap_data->scan_result.security.group_alg =
+                                IEEE80211_SECURITY_SUITE_CCMP;
+                        break;
+                default:
+                        ap_data->scan_result.security.group_alg = -1;
+        }
+        
+        it += 4*sizeof(uint8_t);
+        
+        uint16_t *pairwise_count = (uint16_t *) it;
+        uint32_t pairwise_cipher = *(it+sizeof(uint16_t)+3);
+        switch(pairwise_cipher) {
+                case IEEE80211_AUTH_CIPHER_TKIP:
+                        ap_data->scan_result.security.pair_alg =
+                                IEEE80211_SECURITY_SUITE_TKIP;
+                        break;
+                case IEEE80211_AUTH_CIPHER_CCMP:
+                        ap_data->scan_result.security.pair_alg =
+                                IEEE80211_SECURITY_SUITE_CCMP;
+                        break;
+                default:
+                        ap_data->scan_result.security.pair_alg = -1;
+        }
+        
+        it += 2*sizeof(uint16_t) + 
+                uint16_t_le2host(*pairwise_count)*sizeof(uint32_t);
+        
+        uint32_t auth_suite = *(it+3);
+        switch(auth_suite) {
+                case IEEE80211_AUTH_AKM_PSK:
+                        ap_data->scan_result.security.auth =
+                                IEEE80211_SECURITY_AUTH_PSK;
+                        break;
+                case IEEE80211_AUTH_AKM_8021X:
+                        ap_data->scan_result.security.auth =
+                                IEEE80211_SECURITY_AUTH_8021X;
+                        break;
+                default:
+                        ap_data->scan_result.security.auth = -1;
+        }
+}
+
+static uint32_t uint32_from_uint8_seq(uint8_t *seq)
+{
+        return (*seq << 24) + (*(seq+1) << 16) + (*(seq+2) << 8) + *(seq+3); 
+}
+
+static uint8_t *ieee80211_process_ies(ieee80211_dev_t *ieee80211_dev,
+        ieee80211_scan_result_link_t *ap_data, void *buffer, size_t buffer_size)
+{
+        void *it = buffer;
+        while((it + sizeof(ieee80211_ie_header_t)) < buffer + buffer_size) {
+                ieee80211_ie_header_t *ie_header = 
+                        (ieee80211_ie_header_t *) it;
+                uint8_t *channel;
+                switch(ie_header->element_id) {
+                        case IEEE80211_CHANNEL_IE:
+                                channel = (uint8_t *) 
+                                        (it + sizeof(ieee80211_ie_header_t));
+                                ap_data->scan_result.channel = *channel;
+                                break;
+                        case IEEE80211_RSN_IE:
+                                if(!ap_data)
+                                        break;
+                                ap_data->scan_result.security.type =
+                                        IEEE80211_SECURITY_WPA2;
+                                ieee80211_process_auth_info(ap_data, 
+                                        it + sizeof(ieee80211_ie_header_t));
+                                ap_data->rsn_copy_len = ie_header->length +
+                                        sizeof(ieee80211_ie_header_t);
+                                memcpy(ap_data->rsn_copy, 
+                                        it, 
+                                        ap_data->rsn_copy_len);
+                                break;
+                        case IEEE80211_VENDOR_IE:
+                                if(uint32_from_uint8_seq(it + 
+                                        sizeof(ieee80211_ie_header_t)) ==
+                                        WPA_OUI) {
+                                        if(ap_data->scan_result.security.type ==
+                                                IEEE80211_SECURITY_WPA2) {
+                                                break;
+                                        }
+                                        ap_data->scan_result.security.type =
+                                                IEEE80211_SECURITY_WPA;
+                                        ieee80211_process_auth_info(ap_data,
+                                                it + 
+                                                sizeof(ieee80211_ie_header_t) +
+                                                sizeof(uint32_t));
+                                } else if(uint32_from_uint8_seq(it + 
+                                        sizeof(ieee80211_ie_header_t)) ==
+                                        GTK_OUI) {
+                                        return it + 
+                                                sizeof(ieee80211_ie_header_t) +
+                                                sizeof(uint32_t) + 2;
+                                }
+                }
+                it += sizeof(ieee80211_ie_header_t) + ie_header->length;
+        }
+        
+        return NULL;
+}
+
 /**
  * Process probe response and store results.
  * 
  * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+ * @param mgmt_header Pointer to start of management frame header.
  * 
  * @return EOK if succeed, negative error code otherwise.
  */
 static int ieee80211_process_probe_response(ieee80211_dev_t *ieee80211_dev, 
+        ieee80211_mgmt_header_t *mgmt_header, size_t buffer_size)
+{
+        ieee80211_beacon_start_t *beacon_body = (ieee80211_beacon_start_t *) 
+                ((void *)mgmt_header + sizeof(ieee80211_mgmt_header_t));
+        
+        ieee80211_ie_header_t *ssid_ie_header = (ieee80211_ie_header_t *) 
+                ((void *)beacon_body + sizeof(ieee80211_beacon_start_t));
+        
+        /* Not empty SSID. */
+        if(ssid_ie_header->length > 0) {
+                fibril_mutex_t *scan_mutex = &ieee80211_dev->ap_list.scan_mutex;
+                
+                fibril_mutex_lock(scan_mutex);
+                
+                ieee80211_scan_result_list_t *result_list =
+                        &ieee80211_dev->ap_list;
+                
+                uint8_t *ssid_start = (uint8_t *) ((void *)ssid_ie_header + 
+                        sizeof(ieee80211_ie_header_t));
+                char ssid[IEEE80211_MAX_SSID_LENGTH];
+                memcpy(ssid, ssid_start, ssid_ie_header->length);
+                ssid[ssid_ie_header->length] = '\0';
+                
+                /* Check whether SSID is already in results. */
+                ieee80211_scan_result_list_foreach(*result_list, result) {
+                        if(!str_cmp(ssid, result->scan_result.ssid)) {
+                                result->last_beacon = time(NULL);
+                                fibril_mutex_unlock(scan_mutex);
+                                return EOK;
+                        }
+                }
+                
+                /* Results are full. */
+                if(result_list->size == IEEE80211_MAX_RESULTS_LENGTH - 1) {
+                        fibril_mutex_unlock(scan_mutex);
+                        return EOK;
+                }
+                
+                ieee80211_scan_result_link_t *ap_data = 
+                        malloc(sizeof(ieee80211_scan_result_link_t));
+                memset(ap_data, 0, sizeof(ieee80211_scan_result_link_t));
+                link_initialize(&ap_data->link);
+                
+                memcpy(ap_data->scan_result.bssid.address, 
+                        mgmt_header->bssid, ETH_ADDR);
+                memcpy(ap_data->scan_result.ssid, ssid, 
+                        ssid_ie_header->length + 1);
+                
+                if(uint16_t_le2host(beacon_body->capability) & CAP_SECURITY) {
+                        ap_data->scan_result.security.type = 
+                                IEEE80211_SECURITY_WEP;
+                } else {
+                        ap_data->scan_result.security.type = 
+                                IEEE80211_SECURITY_OPEN;
+                        ap_data->scan_result.security.auth = -1;
+                        ap_data->scan_result.security.pair_alg = -1;
+                        ap_data->scan_result.security.group_alg = -1;
+                }
+                
+                void *rest_ies_start = ssid_start + ssid_ie_header->length;
+                size_t rest_buffer_size = 
+                        buffer_size - 
+                        sizeof(ieee80211_mgmt_header_t) -
+                        sizeof(ieee80211_beacon_start_t) -
+                        sizeof(ieee80211_ie_header_t) -
+                        ssid_ie_header->length;
+                
+                ieee80211_process_ies(ieee80211_dev, ap_data, rest_ies_start, 
+                        rest_buffer_size);
+                
+                ap_data->last_beacon = time(NULL);
+                
+                ieee80211_scan_result_list_append(result_list, ap_data);
+                
+                fibril_mutex_unlock(scan_mutex);
+        }
+        
+        return EOK;
+}
+
+/**
+ * Process authentication response.
+ * 
+ * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+ * @param mgmt_header Pointer to start of management frame header.
+ * 
+ * @return EOK if succeed, negative error code otherwise.
+ */
+static int ieee80211_process_auth_response(ieee80211_dev_t *ieee80211_dev,
         ieee80211_mgmt_header_t *mgmt_header)
 {
-        ieee80211_ie_header_t *ssid_ie_header = (ieee80211_ie_header_t *) 
-                ((void *)mgmt_header + sizeof(ieee80211_mgmt_header_t) + 
-                sizeof(ieee80211_beacon_start_t));
-        
-        if(ssid_ie_header->length > 0) {
-                uint8_t *results_length = &ieee80211_dev->ap_list.length;
-                
-                ieee80211_scan_result_t *ap_data = 
-                        &ieee80211_dev->ap_list.results[(*results_length)++];
-                
-                memset(ap_data, 0, sizeof(ieee80211_scan_result_t));
-                
-                uint8_t *ssid_start = (uint8_t *) 
-                        ((void *)ssid_ie_header + 
-                        sizeof(ieee80211_ie_header_t));
-
-                memcpy(ap_data->bssid.address, mgmt_header->bssid, ETH_ADDR);
-                memcpy(ap_data->ssid, ssid_start, ssid_ie_header->length);
-                ap_data->ssid[ssid_ie_header->length] = '\0';
+        fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+        
+        ieee80211_dev->current_auth_phase = IEEE80211_AUTH_AUTHENTICATED;
+        
+        fibril_condvar_signal(&ieee80211_dev->gen_cond);
+        fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+        
+        return EOK;
+}
+
+/**
+ * Process association response.
+ * 
+ * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+ * @param mgmt_header Pointer to start of management frame header.
+ * 
+ * @return EOK if succeed, negative error code otherwise.
+ */
+static int ieee80211_process_assoc_response(ieee80211_dev_t *ieee80211_dev,
+        ieee80211_mgmt_header_t *mgmt_header)
+{
+        ieee80211_scan_result_t *auth_data =
+                &ieee80211_dev->bssid_info.res_link->scan_result;
+        
+        fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+        
+        ieee80211_assoc_resp_body_t *assoc_resp =
+                (ieee80211_assoc_resp_body_t *) ((void *)mgmt_header +
+                sizeof(ieee80211_mgmt_header_t));
+        
+        ieee80211_dev->bssid_info.aid = uint16_t_le2host(assoc_resp->aid);
+        memcpy(auth_data->bssid.address, mgmt_header->bssid, ETH_ADDR);
+        
+        ieee80211_dev->current_auth_phase = IEEE80211_AUTH_ASSOCIATED;
+        
+        ieee80211_dev->ops->bssid_change(ieee80211_dev);
+        
+        fibril_condvar_signal(&ieee80211_dev->gen_cond);
+        fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+        
+        return EOK;
+}
+
+static int ieee80211_process_4way_handshake(ieee80211_dev_t *ieee80211_dev,
+        void *buffer, size_t buffer_size)
+{
+        ieee80211_eapol_key_frame_t *key_frame = 
+                (ieee80211_eapol_key_frame_t *) buffer;
+        
+        bool handshake_done = false;
+                
+        ieee80211_scan_result_link_t *auth_link =
+                ieee80211_dev->bssid_info.res_link;
+
+        ieee80211_scan_result_t *auth_data = &auth_link->scan_result;
+        uint8_t *ptk = ieee80211_dev->bssid_info.ptk;
+        uint8_t *gtk = ieee80211_dev->bssid_info.gtk;
+
+        size_t ptk_key_length, gtk_key_length;
+        hash_func_t hash_sel;
+        switch(auth_data->security.pair_alg) {
+                case IEEE80211_SECURITY_SUITE_CCMP:
+                        ptk_key_length = IEEE80211_PTK_CCMP_LENGTH;
+                        hash_sel = HASH_SHA1;
+                        break;
+                default:
+                        return ENOTSUP;
+        }
+
+        switch(auth_data->security.group_alg) {
+                case IEEE80211_SECURITY_SUITE_CCMP:
+                        gtk_key_length = IEEE80211_GTK_CCMP_LENGTH;
+                        break;
+                default:
+                        return ENOTSUP;
+        }
+
+        size_t output_size = 
+                sizeof(eth_header_t) +
+                sizeof(ieee80211_eapol_key_frame_t);
+
+        if(!(uint16_t_be2host(key_frame->key_info) & 
+                IEEE80211_EAPOL_KEY_KEYINFO_SECURE)) {
+                output_size += auth_link->rsn_copy_len;
+        }
+
+        nic_t *nic = nic_get_from_ddf_dev(ieee80211_dev->ddf_dev);
+        nic_address_t nic_address;
+        nic_query_address(nic, &nic_address);
+
+        void *output_buffer = malloc(output_size);
+        memset(output_buffer, 0, output_size);
+
+        /* Setup ethernet header. */
+        eth_header_t *eth_header = (eth_header_t *) output_buffer;
+        memcpy(eth_header->dest_addr, auth_data->bssid.address, ETH_ADDR);
+        memcpy(eth_header->src_addr, nic_address.address, ETH_ADDR);
+        eth_header->proto = host2uint16_t_be(ETH_TYPE_PAE);
+
+        ieee80211_eapol_key_frame_t *output_key_frame =
+                (ieee80211_eapol_key_frame_t *) 
+                (output_buffer + sizeof(eth_header_t));
+
+        /* Copy content of incoming EAPOL-Key frame. */
+        memcpy((void *) output_key_frame, buffer, 
+                sizeof(ieee80211_eapol_key_frame_t));
+
+        output_key_frame->proto_version = 0x1;
+        output_key_frame->key_length = 0;
+        output_key_frame->body_length =
+                host2uint16_t_be(output_size - sizeof(eth_header_t)-4);
+        output_key_frame->key_info &= 
+                ~host2uint16_t_be(
+                        IEEE80211_EAPOL_KEY_KEYINFO_ACK
+                );
+
+        /* 
+         * Check if it is last or first incoming message in 4-way 
+         * handshake. 
+         */
+        if(uint16_t_be2host(key_frame->key_info) & 
+                IEEE80211_EAPOL_KEY_KEYINFO_SECURE) {
+                output_key_frame->key_info &= 
+                        ~host2uint16_t_be(
+                                IEEE80211_EAPOL_KEY_KEYINFO_ENCDATA
+                        );
+                output_key_frame->key_info &= 
+                        ~host2uint16_t_be(
+                                IEEE80211_EAPOL_KEY_KEYINFO_INSTALL
+                        );
+                output_key_frame->key_data_length = 0;
+                output_key_frame->key_length = 0;
+                memset(output_key_frame->key_nonce, 0, 32);
+                memset(output_key_frame->key_mic, 0, 16);
+                memset(output_key_frame->key_rsc, 0, 8);
+                memset(output_key_frame->eapol_key_iv, 0, 16);
+
+                /* Derive GTK and save it. */
+                uint16_t key_data_length = 
+                        uint16_t_be2host(key_frame->key_data_length);
+                uint16_t decrypt_len = key_data_length - 8;
+                uint8_t key_data[decrypt_len];
+                uint8_t *data_ptr = (uint8_t *) (buffer + 
+                        sizeof(ieee80211_eapol_key_frame_t));
+                if(ieee80211_aes_key_unwrap(ptk + KEK_OFFSET, data_ptr,
+                        key_data_length, key_data) == EOK) {
+                        
+                        uint8_t *key_ptr = ieee80211_process_ies(ieee80211_dev, 
+                                NULL, key_data, decrypt_len);
+
+                        if(key_ptr) {
+                                memcpy(gtk, key_ptr, gtk_key_length);
+                                handshake_done = true;
+                        }
+                }
+        } else {
+                output_key_frame->key_info |= 
+                        host2uint16_t_be(
+                                IEEE80211_EAPOL_KEY_KEYINFO_MIC
+                        );
+                output_key_frame->key_data_length =
+                        host2uint16_t_be(auth_link->rsn_copy_len);
+                memcpy((void *)output_key_frame + 
+                        sizeof(ieee80211_eapol_key_frame_t),
+                        auth_link->rsn_copy,
+                        auth_link->rsn_copy_len);
+
+                /* Compute PMK. */
+                uint8_t pmk[PBKDF2_KEY_LENGTH];
+                pbkdf2((uint8_t *) ieee80211_dev->bssid_info.password,
+                        str_size(ieee80211_dev->bssid_info.password),
+                        (uint8_t *) auth_data->ssid,
+                        str_size(auth_data->ssid), pmk, hash_sel);
+
+                uint8_t *anonce = key_frame->key_nonce;
+
+                /* Generate SNONCE. */
+                uint8_t snonce[32];
+                rnd_sequence(snonce, 32);
+
+                memcpy(output_key_frame->key_nonce, snonce, 32);
+
+                uint8_t *dest_addr = eth_header->dest_addr;
+                uint8_t *src_addr = eth_header->src_addr;
+
+                /* Derive PTK and save it. */
+                uint8_t prf_result[ptk_key_length];
+                uint8_t crypt_data[PRF_CRYPT_DATA_LENGTH];
+                memcpy(crypt_data, 
+                        min_sequence(dest_addr, src_addr, ETH_ADDR), 
+                        ETH_ADDR);
+                memcpy(crypt_data + ETH_ADDR, 
+                        max_sequence(dest_addr, src_addr, ETH_ADDR), 
+                        ETH_ADDR);
+                memcpy(crypt_data + 2*ETH_ADDR, 
+                        min_sequence(anonce, snonce, 32), 
+                        32);
+                memcpy(crypt_data + 2*ETH_ADDR + 32, 
+                        max_sequence(anonce, snonce, 32),
+                        32);
+                ieee80211_prf(pmk, crypt_data, prf_result, hash_sel);
+                memcpy(ptk, prf_result, ptk_key_length);
+        }
+
+        /* Compute MIC of key frame data from KCK part of PTK. */
+        uint8_t mic[SHA1_HASH_LENGTH];
+        hmac(ptk, 16, (uint8_t *) output_key_frame, 
+                output_size - sizeof(eth_header_t), mic, hash_sel);
+
+        memcpy(output_key_frame->key_mic, mic, 16);
+
+        ieee80211_send_frame(nic, output_buffer, output_size);
+
+        free(output_buffer);
+
+        if(handshake_done) {
+                /* Insert keys into device. */
+                
+                /* Pairwise key. */
+                ieee80211_key_config_t key_config;
+                key_config.suite = auth_data->security.pair_alg;
+                key_config.flags =
+                        IEEE80211_KEY_FLAG_TYPE_PAIRWISE;
+                memcpy(key_config.data, 
+                        ptk + TK_OFFSET,
+                        ptk_key_length - TK_OFFSET);
+
+                ieee80211_dev->ops->key_config(ieee80211_dev,
+                        &key_config, true);
+                
+                /* Group key. */
+                key_config.suite = auth_data->security.group_alg;
+                key_config.flags =
+                        IEEE80211_KEY_FLAG_TYPE_GROUP;
+                memcpy(key_config.data, gtk, gtk_key_length);
+
+                ieee80211_dev->ops->key_config(ieee80211_dev,
+                        &key_config, true);
+
+                /* Signal successful handshake completion. */
+                fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+                fibril_condvar_signal(&ieee80211_dev->gen_cond);
+                fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+        }
+        
+        return EOK;
+}
+
+static int ieee80211_process_eapol_frame(ieee80211_dev_t *ieee80211_dev,
+        void *buffer, size_t buffer_size)
+{
+        ieee80211_eapol_key_frame_t *key_frame = 
+                (ieee80211_eapol_key_frame_t *) buffer;
+        if(ieee80211_is_eapol_key_frame(key_frame)) {
+                return ieee80211_process_4way_handshake(ieee80211_dev, buffer,
+                        buffer_size);
+        }
+        
+        return EOK;
+}
+
+/**
+ * Process data frame.
+ * 
+ * @param ieee80211_dev Pointer to IEEE 802.11 device structure.
+ * @param buffer Data buffer starting with IEEE 802.11 data header.
+ * @param buffer_size Size of buffer.
+ * 
+ * @return EOK if succeed, negative error code otherwise.
+ */
+static int ieee80211_process_data(ieee80211_dev_t *ieee80211_dev, 
+        void *buffer, size_t buffer_size)
+{
+        ieee80211_data_header_t *data_header = 
+                (ieee80211_data_header_t *) buffer;
+        
+        if(ieee80211_has_data_frame(data_header->frame_ctrl)) {
+                nic_t *nic = nic_get_from_ddf_dev(ieee80211_dev->ddf_dev);
+                size_t strip_length = sizeof(ieee80211_data_header_t) + 
+                        ARRAY_SIZE(rfc1042_header);
+                
+                /* TODO: Probably different by used security alg. */
+                if(ieee80211_is_encrypted_frame(data_header->frame_ctrl)) {
+                        strip_length += 8;
+                }
+                
+                /* Process 4-way authentication handshake. */
+                uint16_t *proto = (uint16_t *) (buffer + strip_length);
+                if(uint16_t_be2host(*proto) == ETH_TYPE_PAE) {
+                        return ieee80211_process_eapol_frame(ieee80211_dev,
+                                buffer + strip_length + sizeof(uint16_t),
+                                buffer_size - strip_length - sizeof(uint16_t));
+                }
+                
+                /* Note: ETH protocol ID is already there, so we don't create 
+                 * whole ETH header. */
+                size_t frame_size = 
+                        buffer_size - strip_length + sizeof(eth_header_t)-2;
+                nic_frame_t *frame = nic_alloc_frame(nic, frame_size);
+
+                if(frame == NULL) {
+                        return ENOMEM;
+                }
+
+                uint8_t *src_addr = 
+                        ieee80211_is_fromds_frame(data_header->frame_ctrl) ?
+                                data_header->address3 : data_header->address2;
+                uint8_t *dest_addr = 
+                        ieee80211_is_tods_frame(data_header->frame_ctrl) ?
+                                data_header->address3 : data_header->address1;
+
+                eth_header_t *eth_header =
+                        (eth_header_t *) frame->data;
+                memcpy(eth_header->src_addr, src_addr, ETH_ADDR);
+                memcpy(eth_header->dest_addr, dest_addr, ETH_ADDR);
+
+                memcpy(frame->data + sizeof(eth_header_t)-2, 
+                        buffer + strip_length, 
+                        buffer_size - strip_length);
+
+                nic_received_frame(nic, frame);
         }
         
@@ -548 +1548 @@
                         ieee80211_is_beacon_frame(mgmt_header->frame_ctrl)) {
                         return ieee80211_process_probe_response(ieee80211_dev,
+                                mgmt_header, buffer_size);
+                }
+                
+                if(ieee80211_is_auth_frame(mgmt_header->frame_ctrl)) {
+                        return ieee80211_process_auth_response(ieee80211_dev,
                                 mgmt_header);
                 }
-                // TODO
+                
+                if(ieee80211_is_assoc_response_frame(mgmt_header->frame_ctrl)) {
+                        return ieee80211_process_assoc_response(ieee80211_dev,
+                                mgmt_header);
+                }
         } else if(ieee80211_is_data_frame(frame_ctrl)) {
-                nic_t *nic = nic_get_from_ddf_dev(ieee80211_dev->ddf_dev);
-                size_t frame_size = buffer_size - sizeof(ieee80211_data_header_t);
-                nic_frame_t *frame = nic_alloc_frame(nic, frame_size); 
-                if (frame != NULL) {
-                        memcpy(frame->data, 
-                                buffer + sizeof(ieee80211_data_header_t), 
-                                frame_size);
-                        nic_received_frame(nic, frame);
-                }
-        } else {
-                // TODO
+                return ieee80211_process_data(ieee80211_dev, buffer, 
+                        buffer_size);
         }
         

uspace/lib/ieee80211/src/ieee80211_iface_impl.c

@@ -27 +27 @@
  */
 
-#include <stdio.h>
+#include <str.h>
 #include <errno.h>
 
@@ -42 +42 @@
  */
 
+/**
+ * Implementation of fetching scan results.
+ * 
+ * @param fun Device function.
+ * @param results Structure where should be stored scan results.
+ * 
+ * @return EOK. 
+ */
 int ieee80211_get_scan_results_impl(ddf_fun_t *fun, 
-        ieee80211_scan_results_t *results)
+        ieee80211_scan_results_t *results, bool now)
 {
         nic_t *nic_data = nic_get_from_ddf_fun(fun);
         ieee80211_dev_t *ieee80211_dev = nic_get_specific(nic_data);
         
+        if(!ieee80211_is_ready(ieee80211_dev))
+                return EREFUSED;
+        
+        fibril_mutex_lock(&ieee80211_dev->ap_list.scan_mutex);
+        time_t scan_span = time(NULL) - ieee80211_dev->ap_list.last_scan;
+        fibril_mutex_unlock(&ieee80211_dev->ap_list.scan_mutex);
+        
+        if(now || scan_span > MAX_SCAN_SPAN_SEC) {
+                ieee80211_dev->ops->scan(ieee80211_dev);
+        }
+        
+        fibril_mutex_lock(&ieee80211_dev->ap_list.scan_mutex);
         if(results) {
-                memcpy(results, &ieee80211_dev->ap_list, 
-                        sizeof(ieee80211_scan_results_t));
-        }
+                ieee80211_scan_result_list_t *result_list =
+                        &ieee80211_dev->ap_list;
+                
+                int i = 0;
+                ieee80211_scan_result_list_foreach(*result_list, result) {
+                        memcpy(&results->results[i], 
+                                &result->scan_result, 
+                                sizeof(ieee80211_scan_result_t));
+                        i++;
+                }
+                
+                results->length = i;
+        }
+        fibril_mutex_unlock(&ieee80211_dev->ap_list.scan_mutex);
         
         return EOK;
 }
 
-int ieee80211_connect_impl(ddf_fun_t *fun, char *ssid, char *password)
-{
-        assert(ssid);
+static uint16_t ieee80211_channel_to_freq(uint8_t channel)
+{
+        return IEEE80211_CHANNEL_GAP * (channel - 1) + IEEE80211_FIRST_FREQ;
+}
+
+/**
+ * Working procedure of connect function.
+ * 
+ * @param ieee80211_dev Pointer to IEEE 802.11 device.
+ * @param auth_data Selected AP data we want to connect to.
+ * 
+ * @return EOK if everything OK, ETIMEOUT when timeout during authenticating.
+ */
+static int ieee80211_connect_proc(ieee80211_dev_t *ieee80211_dev,
+        ieee80211_scan_result_link_t *auth_data, char *password)
+{
+        int rc;
+        
+        ieee80211_dev->bssid_info.res_link = auth_data;
+        
+        /* Set channel. */
+        rc = ieee80211_dev->ops->set_freq(ieee80211_dev, 
+                ieee80211_channel_to_freq(auth_data->scan_result.channel));
+        if(rc != EOK)
+                return rc;
+        
+        /* Try to authenticate. */
+        ieee80211_authenticate(ieee80211_dev);
+        fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+        rc = fibril_condvar_wait_timeout(&ieee80211_dev->gen_cond,
+                        &ieee80211_dev->gen_mutex,
+                        AUTH_TIMEOUT);
+        fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+        if(rc != EOK)
+                return rc;
+        if(ieee80211_dev->current_auth_phase != IEEE80211_AUTH_AUTHENTICATED)
+                return EINVAL;
+        
+        /* Try to associate. */
+        ieee80211_associate(ieee80211_dev, password);
+        fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+        rc = fibril_condvar_wait_timeout(&ieee80211_dev->gen_cond,
+                        &ieee80211_dev->gen_mutex,
+                        AUTH_TIMEOUT);
+        fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+        if(rc != EOK)
+                return rc;
+        if(ieee80211_dev->current_auth_phase != IEEE80211_AUTH_ASSOCIATED)
+                return EINVAL;
+        
+        /* On open network, we are finished. */
+        if(auth_data->scan_result.security.type == IEEE80211_SECURITY_OPEN)
+                return EOK;
+        
+        /* Otherwise wait for 4-way handshake to complete. */
+        fibril_mutex_lock(&ieee80211_dev->gen_mutex);
+        rc = fibril_condvar_wait_timeout(&ieee80211_dev->gen_cond,
+                        &ieee80211_dev->gen_mutex,
+                        HANDSHAKE_TIMEOUT);
+        fibril_mutex_unlock(&ieee80211_dev->gen_mutex);
+        if(rc != EOK)
+                return rc;
+        if(ieee80211_dev->current_auth_phase != IEEE80211_AUTH_ASSOCIATED)
+                return EINVAL;
+        
+        return EOK;
+}
+
+/**
+ * Implementation of connecting to specified SSID.
+ * 
+ * @param fun Device function.
+ * @param ssid_start SSID prefix of access point we want to connect to.
+ * 
+ * @return EOK if everything OK, ETIMEOUT when timeout during authenticating,
+ * EINVAL when SSID not in scan results list, EPERM when incorrect password
+ * passed.
+ */
+int ieee80211_connect_impl(ddf_fun_t *fun, char *ssid_start, char *password)
+{
+        assert(ssid_start);
         assert(password);
         
-        /*
         nic_t *nic_data = nic_get_from_ddf_fun(fun);
         ieee80211_dev_t *ieee80211_dev = nic_get_specific(nic_data);
-         */
-        
-        // TODO
-        
-        return EOK;
+        
+        if(!ieee80211_is_ready(ieee80211_dev))
+                return EREFUSED;
+        
+        if(ieee80211_is_connected(ieee80211_dev)) {
+                int rc = ieee80211_dev->iface->disconnect(fun);
+                if(rc != EOK)
+                        return rc;
+        }
+        
+        fibril_mutex_lock(&ieee80211_dev->ap_list.scan_mutex);
+
+        ieee80211_scan_result_list_foreach(ieee80211_dev->ap_list, result) {
+                if(!str_lcmp(ssid_start, 
+                        result->scan_result.ssid, 
+                        str_size(ssid_start))) {
+                        fibril_mutex_unlock(&ieee80211_dev->ap_list.scan_mutex);
+                        return ieee80211_connect_proc(ieee80211_dev, result,
+                                password);
+                }
+        }
+        
+        fibril_mutex_unlock(&ieee80211_dev->ap_list.scan_mutex);
+        
+        return EINVAL;
+}
+
+/**
+ * Implementation of disconnecting device from network.
+ * 
+ * @param fun Device function.
+ * 
+ * @return EOK if everything OK, EINVAL when not connected to any network.
+ */
+int ieee80211_disconnect_impl(ddf_fun_t *fun)
+{
+        nic_t *nic_data = nic_get_from_ddf_fun(fun);
+        ieee80211_dev_t *ieee80211_dev = nic_get_specific(nic_data);
+        
+        if(!ieee80211_is_ready(ieee80211_dev))
+                return EREFUSED;
+        
+        if(!ieee80211_is_connected(ieee80211_dev)) {
+                return EINVAL;
+        } else {
+                return ieee80211_deauthenticate(ieee80211_dev);
+        }
 }
 

uspace/lib/ieee80211/src/ieee80211_impl.c

@@ -36 +36 @@
  */
 
+#include <stdio.h>
+#include <crypto.h>
+#include <stdlib.h>
 #include <errno.h>
 
@@ -81 +84 @@
 
 /**
+ * Default implementation of IEEE802.11 BSSID change function.
+ * 
+ * @param ieee80211_dev Structure of IEEE802.11 device.
+ * 
+ * @return EOK. 
+ */
+int ieee80211_bssid_change_impl(ieee80211_dev_t *ieee80211_dev)
+{
+        return EOK;
+}
+
+/**
+ * Default implementation of IEEE802.11 key config function.
+ * 
+ * @param ieee80211_dev Structure of IEEE802.11 device.
+ * 
+ * @return EOK. 
+ */
+int ieee80211_key_config_impl(ieee80211_dev_t *ieee80211_dev,
+        ieee80211_key_config_t *key_conf, bool insert)
+{
+        return EOK;
+}
+
+/**
  * Default implementation of IEEE802.11 scan function.
  * 
  * @param ieee80211_dev Structure of IEEE802.11 device.
- * @param results Pointer to structure where should be scan results stored.
+ * @param clear Whether to clear current scan results.
  * 
  * @return EOK if succeed, negative error code otherwise. 
@@ -90 +118 @@
 int ieee80211_scan_impl(ieee80211_dev_t *ieee80211_dev)
 {
+        if(ieee80211_is_connected(ieee80211_dev))
+                return EOK;
+        
+        fibril_mutex_lock(&ieee80211_dev->ap_list.scan_mutex);
+        
+        /* Remove old entries we don't receive beacons from. */
+        ieee80211_scan_result_list_t *result_list = 
+                &ieee80211_dev->ap_list;
+        list_foreach_safe(result_list->list, cur_link, next_link) {
+                ieee80211_scan_result_link_t *cur_result = 
+                        list_get_instance(cur_link,
+                        ieee80211_scan_result_link_t, 
+                        link);
+                if((time(NULL) - cur_result->last_beacon) > 
+                        MAX_KEEP_SCAN_SPAN_SEC) {
+                        ieee80211_scan_result_list_remove(result_list, 
+                                cur_result);
+                }
+        }
+        
+        fibril_mutex_unlock(&ieee80211_dev->ap_list.scan_mutex);
+        
         uint16_t orig_freq = ieee80211_dev->current_freq;
         
@@ -96 +146 @@
                 freq += IEEE80211_CHANNEL_GAP) {
                 ieee80211_dev->ops->set_freq(ieee80211_dev, freq);
-                ieee80211_probe_request(ieee80211_dev);
+                ieee80211_probe_request(ieee80211_dev, NULL);
                 
                 /* Wait for probe responses. */
@@ -104 +154 @@
         ieee80211_dev->ops->set_freq(ieee80211_dev, orig_freq);
         
-        return EOK;
+        fibril_mutex_lock(&ieee80211_dev->ap_list.scan_mutex);
+        time(&ieee80211_dev->ap_list.last_scan);
+        fibril_mutex_unlock(&ieee80211_dev->ap_list.scan_mutex);
+        
+        return EOK;
+}
+
+/**
+ * Pseudorandom function used for IEEE 802.11 pairwise key computation.
+ * 
+ * @param key Key with PBKDF2 encrypted passphrase.
+ * @param data Concatenated sequence of both mac addresses and nonces.
+ * @param hash Output parameter for result hash (48 byte value).
+ * @param hash_sel Hash function selector.
+ * 
+ * @return EINVAL when key or data not specified, ENOMEM when pointer for 
+ * output hash result is not allocated, otherwise EOK. 
+ */
+int ieee80211_prf(uint8_t *key, uint8_t *data, uint8_t *hash, 
+        hash_func_t hash_sel)
+{
+        if(!key || !data)
+                return EINVAL;
+        
+        if(!hash)
+                return ENOMEM;
+        
+        size_t hash_length, result_length;
+        switch(hash_sel) {
+                case HASH_MD5:
+                        hash_length = MD5_HASH_LENGTH;
+                        result_length = IEEE80211_PTK_TKIP_LENGTH;
+                        break;
+                case HASH_SHA1:
+                        hash_length = SHA1_HASH_LENGTH;
+                        result_length = IEEE80211_PTK_CCMP_LENGTH;
+                        break;
+                default:
+                        hash_length = 0;
+                        result_length = 0;
+        }
+        
+        size_t iters = ((result_length * 8) + 159) / 160;
+        
+        const char *a = "Pairwise key expansion";
+        uint8_t result[hash_length*iters];
+        uint8_t temp[hash_length];
+        size_t data_size = PRF_CRYPT_DATA_LENGTH + str_size(a) + 2;
+        uint8_t work_arr[data_size];
+        memset(work_arr, 0, data_size);
+        
+        memcpy(work_arr, a, str_size(a));
+        memcpy(work_arr + str_size(a) + 1, data, PRF_CRYPT_DATA_LENGTH);
+
+        for(uint8_t i = 0; i < iters; i++) {
+                memcpy(work_arr + data_size - 1, &i, 1);
+                hmac(key, PBKDF2_KEY_LENGTH, work_arr, data_size, temp, 
+                        hash_sel);
+                memcpy(result + i*hash_length, temp, hash_length);
+        }
+        
+        memcpy(hash, result, result_length);
+        
+        return EOK;
+}
+
+int ieee80211_aes_key_unwrap(uint8_t *kek, uint8_t *data, size_t data_size,
+        uint8_t *output)
+{
+        if(!kek || !data)
+                return EINVAL;
+        
+        if(!output)
+                return ENOMEM;
+
+        uint32_t n = data_size/8 - 1;
+        uint8_t work_data[n*8];
+        uint8_t work_input[AES_CIPHER_LENGTH];
+        uint8_t work_output[AES_CIPHER_LENGTH];
+        uint8_t *work_block;
+        uint8_t a[8];
+        memcpy(a, data, 8);
+        uint64_t mask = 0xFF;
+        uint8_t shift, shb;
+        
+        memcpy(work_data, data + 8, n*8);
+        for(int j = 5; j >=0; j--) {
+                for(int i = n; i > 0; i--) {
+                        for(size_t k = 0; k < 8; k++) {
+                                shift = 56 - 8*k;
+                                shb = ((n*j+i) & (mask << shift)) >> shift;
+                                a[k] ^= shb;
+                        }
+                        work_block = work_data + (i-1)*8;
+                        memcpy(work_input, a, 8);
+                        memcpy(work_input + 8, work_block, 8);
+                        aes_decrypt(kek, work_input, work_output);
+                        memcpy(a, work_output, 8);
+                        memcpy(work_data + (i-1)*8, work_output + 8, 8);
+                }
+        }
+        
+        size_t it;
+        for(it = 0; it < 8; it++) {
+                if(a[it] != 0xA6)
+                        break;
+        }
+        
+        if(it == 8) {
+                memcpy(output, work_data, n*8);
+                return EOK;
+        } else {
+                return EINVAL;
+        }
+}
+
+int rnd_sequence(uint8_t *sequence, size_t length)
+{
+        if(!sequence)
+                return ENOMEM;
+        
+        for(size_t i = 0; i < length; i++) {
+                sequence[i] = (uint8_t) rand();
+        }
+        
+        return EOK;
+}
+
+uint8_t *min_sequence(uint8_t *seq1, uint8_t *seq2, size_t size)
+{
+        if(!seq1 || !seq2)
+                return NULL;
+        
+        for(size_t i = 0; i < size; i++) {
+                if(seq1[i] < seq2[i]) {
+                        return seq1;
+                } else if(seq1[i] > seq2[i]) {
+                        return seq2;
+                }
+        }
+        
+        return seq1;
+}
+
+uint8_t *max_sequence(uint8_t *seq1, uint8_t *seq2, size_t size)
+{
+        uint8_t *min = min_sequence(seq1, seq2, size);
+        if(min == seq1) {
+                return seq2;
+        } else {
+                return seq1;
+        }
 }