mac80211: proper bss private data handling
[linux-2.6.git] / net / mac80211 / scan.c
1 /*
2  * Scanning implementation
3  *
4  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
5  * Copyright 2004, Instant802 Networks, Inc.
6  * Copyright 2005, Devicescape Software, Inc.
7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2 as
12  * published by the Free Software Foundation.
13  */
14
15 #include <linux/wireless.h>
16 #include <linux/if_arp.h>
17 #include <linux/rtnetlink.h>
18 #include <net/mac80211.h>
19
20 #include "ieee80211_i.h"
21 #include "driver-ops.h"
22 #include "mesh.h"
23
24 #define IEEE80211_PROBE_DELAY (HZ / 33)
25 #define IEEE80211_CHANNEL_TIME (HZ / 33)
26 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
27
28 struct ieee80211_bss *
29 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
30                      u8 *ssid, u8 ssid_len)
31 {
32         struct cfg80211_bss *cbss;
33
34         cbss = cfg80211_get_bss(local->hw.wiphy,
35                                 ieee80211_get_channel(local->hw.wiphy, freq),
36                                 bssid, ssid, ssid_len, 0, 0);
37         if (!cbss)
38                 return NULL;
39         return (void *)cbss->priv;
40 }
41
42 static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
43 {
44         struct ieee80211_bss *bss = (void *)cbss->priv;
45
46         kfree(bss_mesh_id(bss));
47         kfree(bss_mesh_cfg(bss));
48 }
49
50 void ieee80211_rx_bss_put(struct ieee80211_local *local,
51                           struct ieee80211_bss *bss)
52 {
53         if (!bss)
54                 return;
55         cfg80211_put_bss(container_of((void *)bss, struct cfg80211_bss, priv));
56 }
57
58 struct ieee80211_bss *
59 ieee80211_bss_info_update(struct ieee80211_local *local,
60                           struct ieee80211_rx_status *rx_status,
61                           struct ieee80211_mgmt *mgmt,
62                           size_t len,
63                           struct ieee802_11_elems *elems,
64                           struct ieee80211_channel *channel,
65                           bool beacon)
66 {
67         struct cfg80211_bss *cbss;
68         struct ieee80211_bss *bss;
69         int clen;
70         s32 signal = 0;
71
72         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
73                 signal = rx_status->signal * 100;
74         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
75                 signal = (rx_status->signal * 100) / local->hw.max_signal;
76
77         cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
78                                          mgmt, len, signal, GFP_ATOMIC);
79
80         if (!cbss)
81                 return NULL;
82
83         cbss->free_priv = ieee80211_rx_bss_free;
84         bss = (void *)cbss->priv;
85
86         /* save the ERP value so that it is available at association time */
87         if (elems->erp_info && elems->erp_info_len >= 1) {
88                 bss->erp_value = elems->erp_info[0];
89                 bss->has_erp_value = 1;
90         }
91
92         if (elems->tim) {
93                 struct ieee80211_tim_ie *tim_ie =
94                         (struct ieee80211_tim_ie *)elems->tim;
95                 bss->dtim_period = tim_ie->dtim_period;
96         }
97
98         /* set default value for buggy AP/no TIM element */
99         if (bss->dtim_period == 0)
100                 bss->dtim_period = 1;
101
102         bss->supp_rates_len = 0;
103         if (elems->supp_rates) {
104                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
105                 if (clen > elems->supp_rates_len)
106                         clen = elems->supp_rates_len;
107                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
108                        clen);
109                 bss->supp_rates_len += clen;
110         }
111         if (elems->ext_supp_rates) {
112                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
113                 if (clen > elems->ext_supp_rates_len)
114                         clen = elems->ext_supp_rates_len;
115                 memcpy(&bss->supp_rates[bss->supp_rates_len],
116                        elems->ext_supp_rates, clen);
117                 bss->supp_rates_len += clen;
118         }
119
120         bss->wmm_used = elems->wmm_param || elems->wmm_info;
121
122         if (!beacon)
123                 bss->last_probe_resp = jiffies;
124
125         return bss;
126 }
127
128 ieee80211_rx_result
129 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
130 {
131         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
132         struct ieee80211_mgmt *mgmt;
133         struct ieee80211_bss *bss;
134         u8 *elements;
135         struct ieee80211_channel *channel;
136         size_t baselen;
137         int freq;
138         __le16 fc;
139         bool presp, beacon = false;
140         struct ieee802_11_elems elems;
141
142         if (skb->len < 2)
143                 return RX_DROP_UNUSABLE;
144
145         mgmt = (struct ieee80211_mgmt *) skb->data;
146         fc = mgmt->frame_control;
147
148         if (ieee80211_is_ctl(fc))
149                 return RX_CONTINUE;
150
151         if (skb->len < 24)
152                 return RX_DROP_MONITOR;
153
154         presp = ieee80211_is_probe_resp(fc);
155         if (presp) {
156                 /* ignore ProbeResp to foreign address */
157                 if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
158                         return RX_DROP_MONITOR;
159
160                 presp = true;
161                 elements = mgmt->u.probe_resp.variable;
162                 baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
163         } else {
164                 beacon = ieee80211_is_beacon(fc);
165                 baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable);
166                 elements = mgmt->u.beacon.variable;
167         }
168
169         if (!presp && !beacon)
170                 return RX_CONTINUE;
171
172         if (baselen > skb->len)
173                 return RX_DROP_MONITOR;
174
175         ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
176
177         if (elems.ds_params && elems.ds_params_len == 1)
178                 freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
179         else
180                 freq = rx_status->freq;
181
182         channel = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
183
184         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
185                 return RX_DROP_MONITOR;
186
187         bss = ieee80211_bss_info_update(sdata->local, rx_status,
188                                         mgmt, skb->len, &elems,
189                                         channel, beacon);
190         if (bss)
191                 ieee80211_rx_bss_put(sdata->local, bss);
192
193         dev_kfree_skb(skb);
194         return RX_QUEUED;
195 }
196
197 /* return false if no more work */
198 static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
199 {
200         struct cfg80211_scan_request *req = local->scan_req;
201         enum ieee80211_band band;
202         int i, ielen, n_chans;
203
204         do {
205                 if (local->hw_scan_band == IEEE80211_NUM_BANDS)
206                         return false;
207
208                 band = local->hw_scan_band;
209                 n_chans = 0;
210                 for (i = 0; i < req->n_channels; i++) {
211                         if (req->channels[i]->band == band) {
212                                 local->hw_scan_req->channels[n_chans] =
213                                                         req->channels[i];
214                                 n_chans++;
215                         }
216                 }
217
218                 local->hw_scan_band++;
219         } while (!n_chans);
220
221         local->hw_scan_req->n_channels = n_chans;
222
223         ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
224                                          req->ie, req->ie_len, band);
225         local->hw_scan_req->ie_len = ielen;
226
227         return true;
228 }
229
230 /*
231  * inform AP that we will go to sleep so that it will buffer the frames
232  * while we scan
233  */
234 static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata)
235 {
236         struct ieee80211_local *local = sdata->local;
237
238         local->scan_ps_enabled = false;
239
240         /* FIXME: what to do when local->pspolling is true? */
241
242         del_timer_sync(&local->dynamic_ps_timer);
243         cancel_work_sync(&local->dynamic_ps_enable_work);
244
245         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
246                 local->scan_ps_enabled = true;
247                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
248                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
249         }
250
251         if (!(local->scan_ps_enabled) ||
252             !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
253                 /*
254                  * If power save was enabled, no need to send a nullfunc
255                  * frame because AP knows that we are sleeping. But if the
256                  * hardware is creating the nullfunc frame for power save
257                  * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
258                  * enabled) and power save was enabled, the firmware just
259                  * sent a null frame with power save disabled. So we need
260                  * to send a new nullfunc frame to inform the AP that we
261                  * are again sleeping.
262                  */
263                 ieee80211_send_nullfunc(local, sdata, 1);
264 }
265
266 /* inform AP that we are awake again, unless power save is enabled */
267 static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
268 {
269         struct ieee80211_local *local = sdata->local;
270
271         if (!local->ps_sdata)
272                 ieee80211_send_nullfunc(local, sdata, 0);
273         else if (local->scan_ps_enabled) {
274                 /*
275                  * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
276                  * will send a nullfunc frame with the powersave bit set
277                  * even though the AP already knows that we are sleeping.
278                  * This could be avoided by sending a null frame with power
279                  * save bit disabled before enabling the power save, but
280                  * this doesn't gain anything.
281                  *
282                  * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
283                  * to send a nullfunc frame because AP already knows that
284                  * we are sleeping, let's just enable power save mode in
285                  * hardware.
286                  */
287                 local->hw.conf.flags |= IEEE80211_CONF_PS;
288                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
289         } else if (local->hw.conf.dynamic_ps_timeout > 0) {
290                 /*
291                  * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
292                  * had been running before leaving the operating channel,
293                  * restart the timer now and send a nullfunc frame to inform
294                  * the AP that we are awake.
295                  */
296                 ieee80211_send_nullfunc(local, sdata, 0);
297                 mod_timer(&local->dynamic_ps_timer, jiffies +
298                           msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
299         }
300 }
301
302 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
303 {
304         struct ieee80211_local *local = hw_to_local(hw);
305         struct ieee80211_sub_if_data *sdata;
306         bool was_hw_scan;
307
308         mutex_lock(&local->scan_mtx);
309
310         /*
311          * It's ok to abort a not-yet-running scan (that
312          * we have one at all will be verified by checking
313          * local->scan_req next), but not to complete it
314          * successfully.
315          */
316         if (WARN_ON(!local->scanning && !aborted))
317                 aborted = true;
318
319         if (WARN_ON(!local->scan_req)) {
320                 mutex_unlock(&local->scan_mtx);
321                 return;
322         }
323
324         was_hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
325         if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
326                 ieee80211_queue_delayed_work(&local->hw,
327                                              &local->scan_work, 0);
328                 mutex_unlock(&local->scan_mtx);
329                 return;
330         }
331
332         kfree(local->hw_scan_req);
333         local->hw_scan_req = NULL;
334
335         if (local->scan_req != local->int_scan_req)
336                 cfg80211_scan_done(local->scan_req, aborted);
337         local->scan_req = NULL;
338         local->scan_sdata = NULL;
339
340         local->scanning = 0;
341         local->scan_channel = NULL;
342
343         /* we only have to protect scan_req and hw/sw scan */
344         mutex_unlock(&local->scan_mtx);
345
346         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
347         if (was_hw_scan)
348                 goto done;
349
350         ieee80211_configure_filter(local);
351
352         drv_sw_scan_complete(local);
353
354         mutex_lock(&local->iflist_mtx);
355         list_for_each_entry(sdata, &local->interfaces, list) {
356                 if (!ieee80211_sdata_running(sdata))
357                         continue;
358
359                 /* Tell AP we're back */
360                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
361                         if (sdata->u.mgd.associated) {
362                                 ieee80211_scan_ps_disable(sdata);
363                                 netif_wake_queue(sdata->dev);
364                         }
365                 } else
366                         netif_wake_queue(sdata->dev);
367
368                 /* re-enable beaconing */
369                 if (sdata->vif.type == NL80211_IFTYPE_AP ||
370                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
371                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
372                         ieee80211_bss_info_change_notify(
373                                 sdata, BSS_CHANGED_BEACON_ENABLED);
374         }
375         mutex_unlock(&local->iflist_mtx);
376
377  done:
378         ieee80211_recalc_idle(local);
379         ieee80211_mlme_notify_scan_completed(local);
380         ieee80211_ibss_notify_scan_completed(local);
381         ieee80211_mesh_notify_scan_completed(local);
382 }
383 EXPORT_SYMBOL(ieee80211_scan_completed);
384
385 static int ieee80211_start_sw_scan(struct ieee80211_local *local)
386 {
387         struct ieee80211_sub_if_data *sdata;
388
389         /*
390          * Hardware/driver doesn't support hw_scan, so use software
391          * scanning instead. First send a nullfunc frame with power save
392          * bit on so that AP will buffer the frames for us while we are not
393          * listening, then send probe requests to each channel and wait for
394          * the responses. After all channels are scanned, tune back to the
395          * original channel and send a nullfunc frame with power save bit
396          * off to trigger the AP to send us all the buffered frames.
397          *
398          * Note that while local->sw_scanning is true everything else but
399          * nullfunc frames and probe requests will be dropped in
400          * ieee80211_tx_h_check_assoc().
401          */
402         drv_sw_scan_start(local);
403
404         mutex_lock(&local->iflist_mtx);
405         list_for_each_entry(sdata, &local->interfaces, list) {
406                 if (!ieee80211_sdata_running(sdata))
407                         continue;
408
409                 /* disable beaconing */
410                 if (sdata->vif.type == NL80211_IFTYPE_AP ||
411                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
412                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
413                         ieee80211_bss_info_change_notify(
414                                 sdata, BSS_CHANGED_BEACON_ENABLED);
415
416                 /*
417                  * only handle non-STA interfaces here, STA interfaces
418                  * are handled in the scan state machine
419                  */
420                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
421                         netif_stop_queue(sdata->dev);
422         }
423         mutex_unlock(&local->iflist_mtx);
424
425         local->next_scan_state = SCAN_DECISION;
426         local->scan_channel_idx = 0;
427
428         drv_flush(local, false);
429
430         ieee80211_configure_filter(local);
431
432         ieee80211_queue_delayed_work(&local->hw,
433                                      &local->scan_work,
434                                      IEEE80211_CHANNEL_TIME);
435
436         return 0;
437 }
438
439
440 static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
441                                   struct cfg80211_scan_request *req)
442 {
443         struct ieee80211_local *local = sdata->local;
444         int rc;
445
446         if (local->scan_req)
447                 return -EBUSY;
448
449         if (local->ops->hw_scan) {
450                 u8 *ies;
451
452                 local->hw_scan_req = kmalloc(
453                                 sizeof(*local->hw_scan_req) +
454                                 req->n_channels * sizeof(req->channels[0]) +
455                                 2 + IEEE80211_MAX_SSID_LEN + local->scan_ies_len +
456                                 req->ie_len, GFP_KERNEL);
457                 if (!local->hw_scan_req)
458                         return -ENOMEM;
459
460                 local->hw_scan_req->ssids = req->ssids;
461                 local->hw_scan_req->n_ssids = req->n_ssids;
462                 ies = (u8 *)local->hw_scan_req +
463                         sizeof(*local->hw_scan_req) +
464                         req->n_channels * sizeof(req->channels[0]);
465                 local->hw_scan_req->ie = ies;
466
467                 local->hw_scan_band = 0;
468         }
469
470         local->scan_req = req;
471         local->scan_sdata = sdata;
472
473         if (!list_empty(&local->work_list)) {
474                 /* wait for the work to finish/time out */
475                 return 0;
476         }
477
478         if (local->ops->hw_scan)
479                 __set_bit(SCAN_HW_SCANNING, &local->scanning);
480         else
481                 __set_bit(SCAN_SW_SCANNING, &local->scanning);
482         /*
483          * Kicking off the scan need not be protected,
484          * only the scan variable stuff, since now
485          * local->scan_req is assigned and other callers
486          * will abort their scan attempts.
487          *
488          * This avoids getting a scan_mtx -> iflist_mtx
489          * dependency, so that the scan completed calls
490          * have more locking freedom.
491          */
492
493         ieee80211_recalc_idle(local);
494         mutex_unlock(&local->scan_mtx);
495
496         if (local->ops->hw_scan) {
497                 WARN_ON(!ieee80211_prep_hw_scan(local));
498                 rc = drv_hw_scan(local, local->hw_scan_req);
499         } else
500                 rc = ieee80211_start_sw_scan(local);
501
502         mutex_lock(&local->scan_mtx);
503
504         if (rc) {
505                 kfree(local->hw_scan_req);
506                 local->hw_scan_req = NULL;
507                 local->scanning = 0;
508
509                 ieee80211_recalc_idle(local);
510
511                 local->scan_req = NULL;
512                 local->scan_sdata = NULL;
513         }
514
515         return rc;
516 }
517
518 static int ieee80211_scan_state_decision(struct ieee80211_local *local,
519                                          unsigned long *next_delay)
520 {
521         bool associated = false;
522         struct ieee80211_sub_if_data *sdata;
523
524         /* if no more bands/channels left, complete scan and advance to the idle state */
525         if (local->scan_channel_idx >= local->scan_req->n_channels) {
526                 ieee80211_scan_completed(&local->hw, false);
527                 return 1;
528         }
529
530         /* check if at least one STA interface is associated */
531         mutex_lock(&local->iflist_mtx);
532         list_for_each_entry(sdata, &local->interfaces, list) {
533                 if (!ieee80211_sdata_running(sdata))
534                         continue;
535
536                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
537                         if (sdata->u.mgd.associated) {
538                                 associated = true;
539                                 break;
540                         }
541                 }
542         }
543         mutex_unlock(&local->iflist_mtx);
544
545         if (local->scan_channel) {
546                 /*
547                  * we're currently scanning a different channel, let's
548                  * switch back to the operating channel now if at least
549                  * one interface is associated. Otherwise just scan the
550                  * next channel
551                  */
552                 if (associated)
553                         local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
554                 else
555                         local->next_scan_state = SCAN_SET_CHANNEL;
556         } else {
557                 /*
558                  * we're on the operating channel currently, let's
559                  * leave that channel now to scan another one
560                  */
561                 local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
562         }
563
564         *next_delay = 0;
565         return 0;
566 }
567
568 static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
569                                                     unsigned long *next_delay)
570 {
571         struct ieee80211_sub_if_data *sdata;
572
573         /*
574          * notify the AP about us leaving the channel and stop all STA interfaces
575          */
576         mutex_lock(&local->iflist_mtx);
577         list_for_each_entry(sdata, &local->interfaces, list) {
578                 if (!ieee80211_sdata_running(sdata))
579                         continue;
580
581                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
582                         netif_stop_queue(sdata->dev);
583                         if (sdata->u.mgd.associated)
584                                 ieee80211_scan_ps_enable(sdata);
585                 }
586         }
587         mutex_unlock(&local->iflist_mtx);
588
589         __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
590
591         /*
592          * What if the nullfunc frames didn't arrive?
593          */
594         drv_flush(local, false);
595         if (local->ops->flush)
596                 *next_delay = 0;
597         else
598                 *next_delay = HZ / 10;
599
600         /* advance to the next channel to be scanned */
601         local->next_scan_state = SCAN_SET_CHANNEL;
602 }
603
604 static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *local,
605                                                     unsigned long *next_delay)
606 {
607         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
608
609         /* switch back to the operating channel */
610         local->scan_channel = NULL;
611         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
612
613         /*
614          * notify the AP about us being back and restart all STA interfaces
615          */
616         mutex_lock(&local->iflist_mtx);
617         list_for_each_entry(sdata, &local->interfaces, list) {
618                 if (!ieee80211_sdata_running(sdata))
619                         continue;
620
621                 /* Tell AP we're back */
622                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
623                         if (sdata->u.mgd.associated)
624                                 ieee80211_scan_ps_disable(sdata);
625                         netif_wake_queue(sdata->dev);
626                 }
627         }
628         mutex_unlock(&local->iflist_mtx);
629
630         __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
631
632         *next_delay = HZ / 5;
633         local->next_scan_state = SCAN_DECISION;
634 }
635
636 static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
637                                              unsigned long *next_delay)
638 {
639         int skip;
640         struct ieee80211_channel *chan;
641
642         skip = 0;
643         chan = local->scan_req->channels[local->scan_channel_idx];
644
645         local->scan_channel = chan;
646         if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
647                 skip = 1;
648
649         /* advance state machine to next channel/band */
650         local->scan_channel_idx++;
651
652         if (skip) {
653                 /* if we skip this channel return to the decision state */
654                 local->next_scan_state = SCAN_DECISION;
655                 return;
656         }
657
658         /*
659          * Probe delay is used to update the NAV, cf. 11.1.3.2.2
660          * (which unfortunately doesn't say _why_ step a) is done,
661          * but it waits for the probe delay or until a frame is
662          * received - and the received frame would update the NAV).
663          * For now, we do not support waiting until a frame is
664          * received.
665          *
666          * In any case, it is not necessary for a passive scan.
667          */
668         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
669             !local->scan_req->n_ssids) {
670                 *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
671                 local->next_scan_state = SCAN_DECISION;
672                 return;
673         }
674
675         /* active scan, send probes */
676         *next_delay = IEEE80211_PROBE_DELAY;
677         local->next_scan_state = SCAN_SEND_PROBE;
678 }
679
680 static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
681                                             unsigned long *next_delay)
682 {
683         int i;
684         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
685
686         for (i = 0; i < local->scan_req->n_ssids; i++)
687                 ieee80211_send_probe_req(
688                         sdata, NULL,
689                         local->scan_req->ssids[i].ssid,
690                         local->scan_req->ssids[i].ssid_len,
691                         local->scan_req->ie, local->scan_req->ie_len);
692
693         /*
694          * After sending probe requests, wait for probe responses
695          * on the channel.
696          */
697         *next_delay = IEEE80211_CHANNEL_TIME;
698         local->next_scan_state = SCAN_DECISION;
699 }
700
701 void ieee80211_scan_work(struct work_struct *work)
702 {
703         struct ieee80211_local *local =
704                 container_of(work, struct ieee80211_local, scan_work.work);
705         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
706         unsigned long next_delay = 0;
707
708         mutex_lock(&local->scan_mtx);
709         if (!sdata || !local->scan_req) {
710                 mutex_unlock(&local->scan_mtx);
711                 return;
712         }
713
714         if (local->hw_scan_req) {
715                 int rc = drv_hw_scan(local, local->hw_scan_req);
716                 mutex_unlock(&local->scan_mtx);
717                 if (rc)
718                         ieee80211_scan_completed(&local->hw, true);
719                 return;
720         }
721
722         if (local->scan_req && !local->scanning) {
723                 struct cfg80211_scan_request *req = local->scan_req;
724                 int rc;
725
726                 local->scan_req = NULL;
727                 local->scan_sdata = NULL;
728
729                 rc = __ieee80211_start_scan(sdata, req);
730                 mutex_unlock(&local->scan_mtx);
731
732                 if (rc)
733                         ieee80211_scan_completed(&local->hw, true);
734                 return;
735         }
736
737         mutex_unlock(&local->scan_mtx);
738
739         /*
740          * Avoid re-scheduling when the sdata is going away.
741          */
742         if (!ieee80211_sdata_running(sdata)) {
743                 ieee80211_scan_completed(&local->hw, true);
744                 return;
745         }
746
747         /*
748          * as long as no delay is required advance immediately
749          * without scheduling a new work
750          */
751         do {
752                 switch (local->next_scan_state) {
753                 case SCAN_DECISION:
754                         if (ieee80211_scan_state_decision(local, &next_delay))
755                                 return;
756                         break;
757                 case SCAN_SET_CHANNEL:
758                         ieee80211_scan_state_set_channel(local, &next_delay);
759                         break;
760                 case SCAN_SEND_PROBE:
761                         ieee80211_scan_state_send_probe(local, &next_delay);
762                         break;
763                 case SCAN_LEAVE_OPER_CHANNEL:
764                         ieee80211_scan_state_leave_oper_channel(local, &next_delay);
765                         break;
766                 case SCAN_ENTER_OPER_CHANNEL:
767                         ieee80211_scan_state_enter_oper_channel(local, &next_delay);
768                         break;
769                 }
770         } while (next_delay == 0);
771
772         ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
773 }
774
775 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
776                            struct cfg80211_scan_request *req)
777 {
778         int res;
779
780         mutex_lock(&sdata->local->scan_mtx);
781         res = __ieee80211_start_scan(sdata, req);
782         mutex_unlock(&sdata->local->scan_mtx);
783
784         return res;
785 }
786
787 int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
788                                     const u8 *ssid, u8 ssid_len)
789 {
790         struct ieee80211_local *local = sdata->local;
791         int ret = -EBUSY;
792
793         mutex_lock(&local->scan_mtx);
794
795         /* busy scanning */
796         if (local->scan_req)
797                 goto unlock;
798
799         memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
800         local->int_scan_req->ssids[0].ssid_len = ssid_len;
801
802         ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
803  unlock:
804         mutex_unlock(&local->scan_mtx);
805         return ret;
806 }
807
808 void ieee80211_scan_cancel(struct ieee80211_local *local)
809 {
810         bool abortscan;
811
812         cancel_delayed_work_sync(&local->scan_work);
813
814         /*
815          * Only call this function when a scan can't be
816          * queued -- mostly at suspend under RTNL.
817          */
818         mutex_lock(&local->scan_mtx);
819         abortscan = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
820                     (!local->scanning && local->scan_req);
821         mutex_unlock(&local->scan_mtx);
822
823         if (abortscan)
824                 ieee80211_scan_completed(&local->hw, true);
825 }