mac80211: add U-APSD client support
[linux-2.6.git] / net / mac80211 / scan.c
1 /*
2  * Scanning implementation
3  *
4  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
5  * Copyright 2004, Instant802 Networks, Inc.
6  * Copyright 2005, Devicescape Software, Inc.
7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2 as
12  * published by the Free Software Foundation.
13  */
14
15 #include <linux/if_arp.h>
16 #include <linux/rtnetlink.h>
17 #include <net/mac80211.h>
18
19 #include "ieee80211_i.h"
20 #include "driver-ops.h"
21 #include "mesh.h"
22
23 #define IEEE80211_PROBE_DELAY (HZ / 33)
24 #define IEEE80211_CHANNEL_TIME (HZ / 33)
25 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
26
27 struct ieee80211_bss *
28 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
29                      u8 *ssid, u8 ssid_len)
30 {
31         struct cfg80211_bss *cbss;
32
33         cbss = cfg80211_get_bss(local->hw.wiphy,
34                                 ieee80211_get_channel(local->hw.wiphy, freq),
35                                 bssid, ssid, ssid_len, 0, 0);
36         if (!cbss)
37                 return NULL;
38         return (void *)cbss->priv;
39 }
40
41 static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
42 {
43         struct ieee80211_bss *bss = (void *)cbss->priv;
44
45         kfree(bss_mesh_id(bss));
46         kfree(bss_mesh_cfg(bss));
47 }
48
49 void ieee80211_rx_bss_put(struct ieee80211_local *local,
50                           struct ieee80211_bss *bss)
51 {
52         if (!bss)
53                 return;
54         cfg80211_put_bss(container_of((void *)bss, struct cfg80211_bss, priv));
55 }
56
57 static bool is_uapsd_supported(struct ieee802_11_elems *elems)
58 {
59         u8 qos_info;
60
61         if (elems->wmm_info && elems->wmm_info_len == 7
62             && elems->wmm_info[5] == 1)
63                 qos_info = elems->wmm_info[6];
64         else if (elems->wmm_param && elems->wmm_param_len == 24
65                  && elems->wmm_param[5] == 1)
66                 qos_info = elems->wmm_param[6];
67         else
68                 /* no valid wmm information or parameter element found */
69                 return false;
70
71         return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD;
72 }
73
74 struct ieee80211_bss *
75 ieee80211_bss_info_update(struct ieee80211_local *local,
76                           struct ieee80211_rx_status *rx_status,
77                           struct ieee80211_mgmt *mgmt,
78                           size_t len,
79                           struct ieee802_11_elems *elems,
80                           struct ieee80211_channel *channel,
81                           bool beacon)
82 {
83         struct cfg80211_bss *cbss;
84         struct ieee80211_bss *bss;
85         int clen;
86         s32 signal = 0;
87
88         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
89                 signal = rx_status->signal * 100;
90         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
91                 signal = (rx_status->signal * 100) / local->hw.max_signal;
92
93         cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
94                                          mgmt, len, signal, GFP_ATOMIC);
95
96         if (!cbss)
97                 return NULL;
98
99         cbss->free_priv = ieee80211_rx_bss_free;
100         bss = (void *)cbss->priv;
101
102         /* save the ERP value so that it is available at association time */
103         if (elems->erp_info && elems->erp_info_len >= 1) {
104                 bss->erp_value = elems->erp_info[0];
105                 bss->has_erp_value = 1;
106         }
107
108         if (elems->tim) {
109                 struct ieee80211_tim_ie *tim_ie =
110                         (struct ieee80211_tim_ie *)elems->tim;
111                 bss->dtim_period = tim_ie->dtim_period;
112         }
113
114         /* set default value for buggy AP/no TIM element */
115         if (bss->dtim_period == 0)
116                 bss->dtim_period = 1;
117
118         bss->supp_rates_len = 0;
119         if (elems->supp_rates) {
120                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
121                 if (clen > elems->supp_rates_len)
122                         clen = elems->supp_rates_len;
123                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
124                        clen);
125                 bss->supp_rates_len += clen;
126         }
127         if (elems->ext_supp_rates) {
128                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
129                 if (clen > elems->ext_supp_rates_len)
130                         clen = elems->ext_supp_rates_len;
131                 memcpy(&bss->supp_rates[bss->supp_rates_len],
132                        elems->ext_supp_rates, clen);
133                 bss->supp_rates_len += clen;
134         }
135
136         bss->wmm_used = elems->wmm_param || elems->wmm_info;
137         bss->uapsd_supported = is_uapsd_supported(elems);
138
139         if (!beacon)
140                 bss->last_probe_resp = jiffies;
141
142         return bss;
143 }
144
145 ieee80211_rx_result
146 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
147 {
148         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
149         struct ieee80211_mgmt *mgmt;
150         struct ieee80211_bss *bss;
151         u8 *elements;
152         struct ieee80211_channel *channel;
153         size_t baselen;
154         int freq;
155         __le16 fc;
156         bool presp, beacon = false;
157         struct ieee802_11_elems elems;
158
159         if (skb->len < 2)
160                 return RX_DROP_UNUSABLE;
161
162         mgmt = (struct ieee80211_mgmt *) skb->data;
163         fc = mgmt->frame_control;
164
165         if (ieee80211_is_ctl(fc))
166                 return RX_CONTINUE;
167
168         if (skb->len < 24)
169                 return RX_DROP_MONITOR;
170
171         presp = ieee80211_is_probe_resp(fc);
172         if (presp) {
173                 /* ignore ProbeResp to foreign address */
174                 if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
175                         return RX_DROP_MONITOR;
176
177                 presp = true;
178                 elements = mgmt->u.probe_resp.variable;
179                 baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
180         } else {
181                 beacon = ieee80211_is_beacon(fc);
182                 baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable);
183                 elements = mgmt->u.beacon.variable;
184         }
185
186         if (!presp && !beacon)
187                 return RX_CONTINUE;
188
189         if (baselen > skb->len)
190                 return RX_DROP_MONITOR;
191
192         ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
193
194         if (elems.ds_params && elems.ds_params_len == 1)
195                 freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
196         else
197                 freq = rx_status->freq;
198
199         channel = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
200
201         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
202                 return RX_DROP_MONITOR;
203
204         bss = ieee80211_bss_info_update(sdata->local, rx_status,
205                                         mgmt, skb->len, &elems,
206                                         channel, beacon);
207         if (bss)
208                 ieee80211_rx_bss_put(sdata->local, bss);
209
210         dev_kfree_skb(skb);
211         return RX_QUEUED;
212 }
213
214 /* return false if no more work */
215 static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
216 {
217         struct cfg80211_scan_request *req = local->scan_req;
218         enum ieee80211_band band;
219         int i, ielen, n_chans;
220
221         do {
222                 if (local->hw_scan_band == IEEE80211_NUM_BANDS)
223                         return false;
224
225                 band = local->hw_scan_band;
226                 n_chans = 0;
227                 for (i = 0; i < req->n_channels; i++) {
228                         if (req->channels[i]->band == band) {
229                                 local->hw_scan_req->channels[n_chans] =
230                                                         req->channels[i];
231                                 n_chans++;
232                         }
233                 }
234
235                 local->hw_scan_band++;
236         } while (!n_chans);
237
238         local->hw_scan_req->n_channels = n_chans;
239
240         ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
241                                          req->ie, req->ie_len, band);
242         local->hw_scan_req->ie_len = ielen;
243
244         return true;
245 }
246
247 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
248 {
249         struct ieee80211_local *local = hw_to_local(hw);
250         bool was_hw_scan;
251
252         mutex_lock(&local->scan_mtx);
253
254         /*
255          * It's ok to abort a not-yet-running scan (that
256          * we have one at all will be verified by checking
257          * local->scan_req next), but not to complete it
258          * successfully.
259          */
260         if (WARN_ON(!local->scanning && !aborted))
261                 aborted = true;
262
263         if (WARN_ON(!local->scan_req)) {
264                 mutex_unlock(&local->scan_mtx);
265                 return;
266         }
267
268         was_hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
269         if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
270                 ieee80211_queue_delayed_work(&local->hw,
271                                              &local->scan_work, 0);
272                 mutex_unlock(&local->scan_mtx);
273                 return;
274         }
275
276         kfree(local->hw_scan_req);
277         local->hw_scan_req = NULL;
278
279         if (local->scan_req != local->int_scan_req)
280                 cfg80211_scan_done(local->scan_req, aborted);
281         local->scan_req = NULL;
282         local->scan_sdata = NULL;
283
284         local->scanning = 0;
285         local->scan_channel = NULL;
286
287         /* we only have to protect scan_req and hw/sw scan */
288         mutex_unlock(&local->scan_mtx);
289
290         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
291         if (was_hw_scan)
292                 goto done;
293
294         ieee80211_configure_filter(local);
295
296         drv_sw_scan_complete(local);
297
298         ieee80211_offchannel_return(local, true);
299
300  done:
301         ieee80211_recalc_idle(local);
302         ieee80211_mlme_notify_scan_completed(local);
303         ieee80211_ibss_notify_scan_completed(local);
304         ieee80211_mesh_notify_scan_completed(local);
305         ieee80211_queue_work(&local->hw, &local->work_work);
306 }
307 EXPORT_SYMBOL(ieee80211_scan_completed);
308
309 static int ieee80211_start_sw_scan(struct ieee80211_local *local)
310 {
311         /*
312          * Hardware/driver doesn't support hw_scan, so use software
313          * scanning instead. First send a nullfunc frame with power save
314          * bit on so that AP will buffer the frames for us while we are not
315          * listening, then send probe requests to each channel and wait for
316          * the responses. After all channels are scanned, tune back to the
317          * original channel and send a nullfunc frame with power save bit
318          * off to trigger the AP to send us all the buffered frames.
319          *
320          * Note that while local->sw_scanning is true everything else but
321          * nullfunc frames and probe requests will be dropped in
322          * ieee80211_tx_h_check_assoc().
323          */
324         drv_sw_scan_start(local);
325
326         ieee80211_offchannel_stop_beaconing(local);
327
328         local->next_scan_state = SCAN_DECISION;
329         local->scan_channel_idx = 0;
330
331         drv_flush(local, false);
332
333         ieee80211_configure_filter(local);
334
335         ieee80211_queue_delayed_work(&local->hw,
336                                      &local->scan_work,
337                                      IEEE80211_CHANNEL_TIME);
338
339         return 0;
340 }
341
342
343 static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
344                                   struct cfg80211_scan_request *req)
345 {
346         struct ieee80211_local *local = sdata->local;
347         int rc;
348
349         if (local->scan_req)
350                 return -EBUSY;
351
352         if (local->ops->hw_scan) {
353                 u8 *ies;
354
355                 local->hw_scan_req = kmalloc(
356                                 sizeof(*local->hw_scan_req) +
357                                 req->n_channels * sizeof(req->channels[0]) +
358                                 2 + IEEE80211_MAX_SSID_LEN + local->scan_ies_len +
359                                 req->ie_len, GFP_KERNEL);
360                 if (!local->hw_scan_req)
361                         return -ENOMEM;
362
363                 local->hw_scan_req->ssids = req->ssids;
364                 local->hw_scan_req->n_ssids = req->n_ssids;
365                 ies = (u8 *)local->hw_scan_req +
366                         sizeof(*local->hw_scan_req) +
367                         req->n_channels * sizeof(req->channels[0]);
368                 local->hw_scan_req->ie = ies;
369
370                 local->hw_scan_band = 0;
371         }
372
373         local->scan_req = req;
374         local->scan_sdata = sdata;
375
376         if (!list_empty(&local->work_list)) {
377                 /* wait for the work to finish/time out */
378                 return 0;
379         }
380
381         if (local->ops->hw_scan)
382                 __set_bit(SCAN_HW_SCANNING, &local->scanning);
383         else
384                 __set_bit(SCAN_SW_SCANNING, &local->scanning);
385         /*
386          * Kicking off the scan need not be protected,
387          * only the scan variable stuff, since now
388          * local->scan_req is assigned and other callers
389          * will abort their scan attempts.
390          *
391          * This avoids getting a scan_mtx -> iflist_mtx
392          * dependency, so that the scan completed calls
393          * have more locking freedom.
394          */
395
396         ieee80211_recalc_idle(local);
397         mutex_unlock(&local->scan_mtx);
398
399         if (local->ops->hw_scan) {
400                 WARN_ON(!ieee80211_prep_hw_scan(local));
401                 rc = drv_hw_scan(local, local->hw_scan_req);
402         } else
403                 rc = ieee80211_start_sw_scan(local);
404
405         mutex_lock(&local->scan_mtx);
406
407         if (rc) {
408                 kfree(local->hw_scan_req);
409                 local->hw_scan_req = NULL;
410                 local->scanning = 0;
411
412                 ieee80211_recalc_idle(local);
413
414                 local->scan_req = NULL;
415                 local->scan_sdata = NULL;
416         }
417
418         return rc;
419 }
420
421 static int ieee80211_scan_state_decision(struct ieee80211_local *local,
422                                          unsigned long *next_delay)
423 {
424         bool associated = false;
425         struct ieee80211_sub_if_data *sdata;
426
427         /* if no more bands/channels left, complete scan and advance to the idle state */
428         if (local->scan_channel_idx >= local->scan_req->n_channels) {
429                 ieee80211_scan_completed(&local->hw, false);
430                 return 1;
431         }
432
433         /* check if at least one STA interface is associated */
434         mutex_lock(&local->iflist_mtx);
435         list_for_each_entry(sdata, &local->interfaces, list) {
436                 if (!ieee80211_sdata_running(sdata))
437                         continue;
438
439                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
440                         if (sdata->u.mgd.associated) {
441                                 associated = true;
442                                 break;
443                         }
444                 }
445         }
446         mutex_unlock(&local->iflist_mtx);
447
448         if (local->scan_channel) {
449                 /*
450                  * we're currently scanning a different channel, let's
451                  * switch back to the operating channel now if at least
452                  * one interface is associated. Otherwise just scan the
453                  * next channel
454                  */
455                 if (associated)
456                         local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
457                 else
458                         local->next_scan_state = SCAN_SET_CHANNEL;
459         } else {
460                 /*
461                  * we're on the operating channel currently, let's
462                  * leave that channel now to scan another one
463                  */
464                 local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
465         }
466
467         *next_delay = 0;
468         return 0;
469 }
470
471 static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
472                                                     unsigned long *next_delay)
473 {
474         ieee80211_offchannel_stop_station(local);
475
476         __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
477
478         /*
479          * What if the nullfunc frames didn't arrive?
480          */
481         drv_flush(local, false);
482         if (local->ops->flush)
483                 *next_delay = 0;
484         else
485                 *next_delay = HZ / 10;
486
487         /* advance to the next channel to be scanned */
488         local->next_scan_state = SCAN_SET_CHANNEL;
489 }
490
491 static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *local,
492                                                     unsigned long *next_delay)
493 {
494         /* switch back to the operating channel */
495         local->scan_channel = NULL;
496         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
497
498         /*
499          * Only re-enable station mode interface now; beaconing will be
500          * re-enabled once the full scan has been completed.
501          */
502         ieee80211_offchannel_return(local, false);
503
504         __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
505
506         *next_delay = HZ / 5;
507         local->next_scan_state = SCAN_DECISION;
508 }
509
510 static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
511                                              unsigned long *next_delay)
512 {
513         int skip;
514         struct ieee80211_channel *chan;
515
516         skip = 0;
517         chan = local->scan_req->channels[local->scan_channel_idx];
518
519         local->scan_channel = chan;
520         if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
521                 skip = 1;
522
523         /* advance state machine to next channel/band */
524         local->scan_channel_idx++;
525
526         if (skip) {
527                 /* if we skip this channel return to the decision state */
528                 local->next_scan_state = SCAN_DECISION;
529                 return;
530         }
531
532         /*
533          * Probe delay is used to update the NAV, cf. 11.1.3.2.2
534          * (which unfortunately doesn't say _why_ step a) is done,
535          * but it waits for the probe delay or until a frame is
536          * received - and the received frame would update the NAV).
537          * For now, we do not support waiting until a frame is
538          * received.
539          *
540          * In any case, it is not necessary for a passive scan.
541          */
542         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
543             !local->scan_req->n_ssids) {
544                 *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
545                 local->next_scan_state = SCAN_DECISION;
546                 return;
547         }
548
549         /* active scan, send probes */
550         *next_delay = IEEE80211_PROBE_DELAY;
551         local->next_scan_state = SCAN_SEND_PROBE;
552 }
553
554 static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
555                                             unsigned long *next_delay)
556 {
557         int i;
558         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
559
560         for (i = 0; i < local->scan_req->n_ssids; i++)
561                 ieee80211_send_probe_req(
562                         sdata, NULL,
563                         local->scan_req->ssids[i].ssid,
564                         local->scan_req->ssids[i].ssid_len,
565                         local->scan_req->ie, local->scan_req->ie_len);
566
567         /*
568          * After sending probe requests, wait for probe responses
569          * on the channel.
570          */
571         *next_delay = IEEE80211_CHANNEL_TIME;
572         local->next_scan_state = SCAN_DECISION;
573 }
574
575 void ieee80211_scan_work(struct work_struct *work)
576 {
577         struct ieee80211_local *local =
578                 container_of(work, struct ieee80211_local, scan_work.work);
579         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
580         unsigned long next_delay = 0;
581
582         mutex_lock(&local->scan_mtx);
583         if (!sdata || !local->scan_req) {
584                 mutex_unlock(&local->scan_mtx);
585                 return;
586         }
587
588         if (local->hw_scan_req) {
589                 int rc = drv_hw_scan(local, local->hw_scan_req);
590                 mutex_unlock(&local->scan_mtx);
591                 if (rc)
592                         ieee80211_scan_completed(&local->hw, true);
593                 return;
594         }
595
596         if (local->scan_req && !local->scanning) {
597                 struct cfg80211_scan_request *req = local->scan_req;
598                 int rc;
599
600                 local->scan_req = NULL;
601                 local->scan_sdata = NULL;
602
603                 rc = __ieee80211_start_scan(sdata, req);
604                 mutex_unlock(&local->scan_mtx);
605
606                 if (rc)
607                         ieee80211_scan_completed(&local->hw, true);
608                 return;
609         }
610
611         mutex_unlock(&local->scan_mtx);
612
613         /*
614          * Avoid re-scheduling when the sdata is going away.
615          */
616         if (!ieee80211_sdata_running(sdata)) {
617                 ieee80211_scan_completed(&local->hw, true);
618                 return;
619         }
620
621         /*
622          * as long as no delay is required advance immediately
623          * without scheduling a new work
624          */
625         do {
626                 switch (local->next_scan_state) {
627                 case SCAN_DECISION:
628                         if (ieee80211_scan_state_decision(local, &next_delay))
629                                 return;
630                         break;
631                 case SCAN_SET_CHANNEL:
632                         ieee80211_scan_state_set_channel(local, &next_delay);
633                         break;
634                 case SCAN_SEND_PROBE:
635                         ieee80211_scan_state_send_probe(local, &next_delay);
636                         break;
637                 case SCAN_LEAVE_OPER_CHANNEL:
638                         ieee80211_scan_state_leave_oper_channel(local, &next_delay);
639                         break;
640                 case SCAN_ENTER_OPER_CHANNEL:
641                         ieee80211_scan_state_enter_oper_channel(local, &next_delay);
642                         break;
643                 }
644         } while (next_delay == 0);
645
646         ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
647 }
648
649 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
650                            struct cfg80211_scan_request *req)
651 {
652         int res;
653
654         mutex_lock(&sdata->local->scan_mtx);
655         res = __ieee80211_start_scan(sdata, req);
656         mutex_unlock(&sdata->local->scan_mtx);
657
658         return res;
659 }
660
661 int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
662                                     const u8 *ssid, u8 ssid_len)
663 {
664         struct ieee80211_local *local = sdata->local;
665         int ret = -EBUSY;
666
667         mutex_lock(&local->scan_mtx);
668
669         /* busy scanning */
670         if (local->scan_req)
671                 goto unlock;
672
673         memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
674         local->int_scan_req->ssids[0].ssid_len = ssid_len;
675
676         ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
677  unlock:
678         mutex_unlock(&local->scan_mtx);
679         return ret;
680 }
681
682 void ieee80211_scan_cancel(struct ieee80211_local *local)
683 {
684         bool abortscan;
685
686         cancel_delayed_work_sync(&local->scan_work);
687
688         /*
689          * Only call this function when a scan can't be
690          * queued -- mostly at suspend under RTNL.
691          */
692         mutex_lock(&local->scan_mtx);
693         abortscan = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
694                     (!local->scanning && local->scan_req);
695         mutex_unlock(&local->scan_mtx);
696
697         if (abortscan)
698                 ieee80211_scan_completed(&local->hw, true);
699 }