1 /* 2 * Scanning implementation 3 * 4 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 5 * Copyright 2004, Instant802 Networks, Inc. 6 * Copyright 2005, Devicescape Software, Inc. 7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 9 * Copyright 2013-2015 Intel Mobile Communications GmbH 10 * Copyright 2016 Intel Deutschland GmbH 11 * 12 * This program is free software; you can redistribute it and/or modify 13 * it under the terms of the GNU General Public License version 2 as 14 * published by the Free Software Foundation. 15 */ 16 17 #include <linux/if_arp.h> 18 #include <linux/etherdevice.h> 19 #include <linux/rtnetlink.h> 20 #include <net/sch_generic.h> 21 #include <linux/slab.h> 22 #include <linux/export.h> 23 #include <net/mac80211.h> 24 25 #include "ieee80211_i.h" 26 #include "driver-ops.h" 27 #include "mesh.h" 28 29 #define IEEE80211_PROBE_DELAY (HZ / 33) 30 #define IEEE80211_CHANNEL_TIME (HZ / 33) 31 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9) 32 33 void ieee80211_rx_bss_put(struct ieee80211_local *local, 34 struct ieee80211_bss *bss) 35 { 36 if (!bss) 37 return; 38 cfg80211_put_bss(local->hw.wiphy, 39 container_of((void *)bss, struct cfg80211_bss, priv)); 40 } 41 42 static bool is_uapsd_supported(struct ieee802_11_elems *elems) 43 { 44 u8 qos_info; 45 46 if (elems->wmm_info && elems->wmm_info_len == 7 47 && elems->wmm_info[5] == 1) 48 qos_info = elems->wmm_info[6]; 49 else if (elems->wmm_param && elems->wmm_param_len == 24 50 && elems->wmm_param[5] == 1) 51 qos_info = elems->wmm_param[6]; 52 else 53 /* no valid wmm information or parameter element found */ 54 return false; 55 56 return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD; 57 } 58 59 struct ieee80211_bss * 60 ieee80211_bss_info_update(struct ieee80211_local *local, 61 struct ieee80211_rx_status *rx_status, 62 struct ieee80211_mgmt *mgmt, size_t len, 63 struct ieee802_11_elems *elems, 64 struct ieee80211_channel *channel) 65 { 66 bool beacon = ieee80211_is_beacon(mgmt->frame_control); 67 struct cfg80211_bss *cbss; 68 struct ieee80211_bss *bss; 69 int clen, srlen; 70 struct cfg80211_inform_bss bss_meta = { 71 .boottime_ns = rx_status->boottime_ns, 72 }; 73 bool signal_valid; 74 struct ieee80211_sub_if_data *scan_sdata; 75 76 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 77 bss_meta.signal = rx_status->signal * 100; 78 else if (ieee80211_hw_check(&local->hw, SIGNAL_UNSPEC)) 79 bss_meta.signal = (rx_status->signal * 100) / local->hw.max_signal; 80 81 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_20; 82 if (rx_status->flag & RX_FLAG_5MHZ) 83 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_5; 84 if (rx_status->flag & RX_FLAG_10MHZ) 85 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_10; 86 87 bss_meta.chan = channel; 88 89 rcu_read_lock(); 90 scan_sdata = rcu_dereference(local->scan_sdata); 91 if (scan_sdata && scan_sdata->vif.type == NL80211_IFTYPE_STATION && 92 scan_sdata->vif.bss_conf.assoc && 93 ieee80211_have_rx_timestamp(rx_status)) { 94 bss_meta.parent_tsf = 95 ieee80211_calculate_rx_timestamp(local, rx_status, 96 len + FCS_LEN, 24); 97 ether_addr_copy(bss_meta.parent_bssid, 98 scan_sdata->vif.bss_conf.bssid); 99 } 100 rcu_read_unlock(); 101 102 cbss = cfg80211_inform_bss_frame_data(local->hw.wiphy, &bss_meta, 103 mgmt, len, GFP_ATOMIC); 104 if (!cbss) 105 return NULL; 106 /* In case the signal is invalid update the status */ 107 signal_valid = abs(channel->center_freq - cbss->channel->center_freq) 108 <= local->hw.wiphy->max_adj_channel_rssi_comp; 109 if (!signal_valid) 110 rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL; 111 112 bss = (void *)cbss->priv; 113 114 if (beacon) 115 bss->device_ts_beacon = rx_status->device_timestamp; 116 else 117 bss->device_ts_presp = rx_status->device_timestamp; 118 119 if (elems->parse_error) { 120 if (beacon) 121 bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON; 122 else 123 bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP; 124 } else { 125 if (beacon) 126 bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON; 127 else 128 bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP; 129 } 130 131 /* save the ERP value so that it is available at association time */ 132 if (elems->erp_info && (!elems->parse_error || 133 !(bss->valid_data & IEEE80211_BSS_VALID_ERP))) { 134 bss->erp_value = elems->erp_info[0]; 135 bss->has_erp_value = true; 136 if (!elems->parse_error) 137 bss->valid_data |= IEEE80211_BSS_VALID_ERP; 138 } 139 140 /* replace old supported rates if we get new values */ 141 if (!elems->parse_error || 142 !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) { 143 srlen = 0; 144 if (elems->supp_rates) { 145 clen = IEEE80211_MAX_SUPP_RATES; 146 if (clen > elems->supp_rates_len) 147 clen = elems->supp_rates_len; 148 memcpy(bss->supp_rates, elems->supp_rates, clen); 149 srlen += clen; 150 } 151 if (elems->ext_supp_rates) { 152 clen = IEEE80211_MAX_SUPP_RATES - srlen; 153 if (clen > elems->ext_supp_rates_len) 154 clen = elems->ext_supp_rates_len; 155 memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, 156 clen); 157 srlen += clen; 158 } 159 if (srlen) { 160 bss->supp_rates_len = srlen; 161 if (!elems->parse_error) 162 bss->valid_data |= IEEE80211_BSS_VALID_RATES; 163 } 164 } 165 166 if (!elems->parse_error || 167 !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) { 168 bss->wmm_used = elems->wmm_param || elems->wmm_info; 169 bss->uapsd_supported = is_uapsd_supported(elems); 170 if (!elems->parse_error) 171 bss->valid_data |= IEEE80211_BSS_VALID_WMM; 172 } 173 174 if (beacon) { 175 struct ieee80211_supported_band *sband = 176 local->hw.wiphy->bands[rx_status->band]; 177 if (!(rx_status->flag & RX_FLAG_HT) && 178 !(rx_status->flag & RX_FLAG_VHT)) 179 bss->beacon_rate = 180 &sband->bitrates[rx_status->rate_idx]; 181 } 182 183 return bss; 184 } 185 186 void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb) 187 { 188 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb); 189 struct ieee80211_sub_if_data *sdata1, *sdata2; 190 struct ieee80211_mgmt *mgmt = (void *)skb->data; 191 struct ieee80211_bss *bss; 192 u8 *elements; 193 struct ieee80211_channel *channel; 194 size_t baselen; 195 struct ieee802_11_elems elems; 196 197 if (skb->len < 24 || 198 (!ieee80211_is_probe_resp(mgmt->frame_control) && 199 !ieee80211_is_beacon(mgmt->frame_control))) 200 return; 201 202 sdata1 = rcu_dereference(local->scan_sdata); 203 sdata2 = rcu_dereference(local->sched_scan_sdata); 204 205 if (likely(!sdata1 && !sdata2)) 206 return; 207 208 if (ieee80211_is_probe_resp(mgmt->frame_control)) { 209 struct cfg80211_scan_request *scan_req; 210 struct cfg80211_sched_scan_request *sched_scan_req; 211 212 scan_req = rcu_dereference(local->scan_req); 213 sched_scan_req = rcu_dereference(local->sched_scan_req); 214 215 /* ignore ProbeResp to foreign address unless scanning 216 * with randomised address 217 */ 218 if (!(sdata1 && 219 (ether_addr_equal(mgmt->da, sdata1->vif.addr) || 220 scan_req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)) && 221 !(sdata2 && 222 (ether_addr_equal(mgmt->da, sdata2->vif.addr) || 223 sched_scan_req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))) 224 return; 225 226 elements = mgmt->u.probe_resp.variable; 227 baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable); 228 } else { 229 baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable); 230 elements = mgmt->u.beacon.variable; 231 } 232 233 if (baselen > skb->len) 234 return; 235 236 ieee802_11_parse_elems(elements, skb->len - baselen, false, &elems); 237 238 channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq); 239 240 if (!channel || channel->flags & IEEE80211_CHAN_DISABLED) 241 return; 242 243 bss = ieee80211_bss_info_update(local, rx_status, 244 mgmt, skb->len, &elems, 245 channel); 246 if (bss) 247 ieee80211_rx_bss_put(local, bss); 248 } 249 250 static void 251 ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef, 252 enum nl80211_bss_scan_width scan_width) 253 { 254 memset(chandef, 0, sizeof(*chandef)); 255 switch (scan_width) { 256 case NL80211_BSS_CHAN_WIDTH_5: 257 chandef->width = NL80211_CHAN_WIDTH_5; 258 break; 259 case NL80211_BSS_CHAN_WIDTH_10: 260 chandef->width = NL80211_CHAN_WIDTH_10; 261 break; 262 default: 263 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 264 break; 265 } 266 } 267 268 /* return false if no more work */ 269 static bool ieee80211_prep_hw_scan(struct ieee80211_local *local) 270 { 271 struct cfg80211_scan_request *req; 272 struct cfg80211_chan_def chandef; 273 u8 bands_used = 0; 274 int i, ielen, n_chans; 275 276 req = rcu_dereference_protected(local->scan_req, 277 lockdep_is_held(&local->mtx)); 278 279 if (test_bit(SCAN_HW_CANCELLED, &local->scanning)) 280 return false; 281 282 if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { 283 for (i = 0; i < req->n_channels; i++) { 284 local->hw_scan_req->req.channels[i] = req->channels[i]; 285 bands_used |= BIT(req->channels[i]->band); 286 } 287 288 n_chans = req->n_channels; 289 } else { 290 do { 291 if (local->hw_scan_band == NUM_NL80211_BANDS) 292 return false; 293 294 n_chans = 0; 295 296 for (i = 0; i < req->n_channels; i++) { 297 if (req->channels[i]->band != 298 local->hw_scan_band) 299 continue; 300 local->hw_scan_req->req.channels[n_chans] = 301 req->channels[i]; 302 n_chans++; 303 bands_used |= BIT(req->channels[i]->band); 304 } 305 306 local->hw_scan_band++; 307 } while (!n_chans); 308 } 309 310 local->hw_scan_req->req.n_channels = n_chans; 311 ieee80211_prepare_scan_chandef(&chandef, req->scan_width); 312 313 ielen = ieee80211_build_preq_ies(local, 314 (u8 *)local->hw_scan_req->req.ie, 315 local->hw_scan_ies_bufsize, 316 &local->hw_scan_req->ies, 317 req->ie, req->ie_len, 318 bands_used, req->rates, &chandef); 319 local->hw_scan_req->req.ie_len = ielen; 320 local->hw_scan_req->req.no_cck = req->no_cck; 321 ether_addr_copy(local->hw_scan_req->req.mac_addr, req->mac_addr); 322 ether_addr_copy(local->hw_scan_req->req.mac_addr_mask, 323 req->mac_addr_mask); 324 ether_addr_copy(local->hw_scan_req->req.bssid, req->bssid); 325 326 return true; 327 } 328 329 static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) 330 { 331 struct ieee80211_local *local = hw_to_local(hw); 332 bool hw_scan = local->ops->hw_scan; 333 bool was_scanning = local->scanning; 334 struct cfg80211_scan_request *scan_req; 335 struct ieee80211_sub_if_data *scan_sdata; 336 struct ieee80211_sub_if_data *sdata; 337 338 lockdep_assert_held(&local->mtx); 339 340 /* 341 * It's ok to abort a not-yet-running scan (that 342 * we have one at all will be verified by checking 343 * local->scan_req next), but not to complete it 344 * successfully. 345 */ 346 if (WARN_ON(!local->scanning && !aborted)) 347 aborted = true; 348 349 if (WARN_ON(!local->scan_req)) 350 return; 351 352 if (hw_scan && !aborted && 353 !ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS) && 354 ieee80211_prep_hw_scan(local)) { 355 int rc; 356 357 rc = drv_hw_scan(local, 358 rcu_dereference_protected(local->scan_sdata, 359 lockdep_is_held(&local->mtx)), 360 local->hw_scan_req); 361 362 if (rc == 0) 363 return; 364 365 /* HW scan failed and is going to be reported as done, so clear 366 * old scan info. 367 */ 368 memset(&local->scan_info, 0, sizeof(local->scan_info)); 369 } 370 371 kfree(local->hw_scan_req); 372 local->hw_scan_req = NULL; 373 374 scan_req = rcu_dereference_protected(local->scan_req, 375 lockdep_is_held(&local->mtx)); 376 377 if (scan_req != local->int_scan_req) { 378 local->scan_info.aborted = aborted; 379 cfg80211_scan_done(scan_req, &local->scan_info); 380 } 381 RCU_INIT_POINTER(local->scan_req, NULL); 382 383 scan_sdata = rcu_dereference_protected(local->scan_sdata, 384 lockdep_is_held(&local->mtx)); 385 RCU_INIT_POINTER(local->scan_sdata, NULL); 386 387 local->scanning = 0; 388 local->scan_chandef.chan = NULL; 389 390 /* Set power back to normal operating levels. */ 391 ieee80211_hw_config(local, 0); 392 393 if (!hw_scan) { 394 ieee80211_configure_filter(local); 395 drv_sw_scan_complete(local, scan_sdata); 396 ieee80211_offchannel_return(local); 397 } 398 399 ieee80211_recalc_idle(local); 400 401 ieee80211_mlme_notify_scan_completed(local); 402 ieee80211_ibss_notify_scan_completed(local); 403 404 /* Requeue all the work that might have been ignored while 405 * the scan was in progress; if there was none this will 406 * just be a no-op for the particular interface. 407 */ 408 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 409 if (ieee80211_sdata_running(sdata)) 410 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 411 } 412 413 if (was_scanning) 414 ieee80211_start_next_roc(local); 415 } 416 417 void ieee80211_scan_completed(struct ieee80211_hw *hw, 418 struct cfg80211_scan_info *info) 419 { 420 struct ieee80211_local *local = hw_to_local(hw); 421 422 trace_api_scan_completed(local, info); 423 424 set_bit(SCAN_COMPLETED, &local->scanning); 425 if (info->aborted) 426 set_bit(SCAN_ABORTED, &local->scanning); 427 428 memcpy(&local->scan_info, info, sizeof(*info)); 429 430 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0); 431 } 432 EXPORT_SYMBOL(ieee80211_scan_completed); 433 434 static int ieee80211_start_sw_scan(struct ieee80211_local *local, 435 struct ieee80211_sub_if_data *sdata) 436 { 437 /* Software scan is not supported in multi-channel cases */ 438 if (local->use_chanctx) 439 return -EOPNOTSUPP; 440 441 /* 442 * Hardware/driver doesn't support hw_scan, so use software 443 * scanning instead. First send a nullfunc frame with power save 444 * bit on so that AP will buffer the frames for us while we are not 445 * listening, then send probe requests to each channel and wait for 446 * the responses. After all channels are scanned, tune back to the 447 * original channel and send a nullfunc frame with power save bit 448 * off to trigger the AP to send us all the buffered frames. 449 * 450 * Note that while local->sw_scanning is true everything else but 451 * nullfunc frames and probe requests will be dropped in 452 * ieee80211_tx_h_check_assoc(). 453 */ 454 drv_sw_scan_start(local, sdata, local->scan_addr); 455 456 local->leave_oper_channel_time = jiffies; 457 local->next_scan_state = SCAN_DECISION; 458 local->scan_channel_idx = 0; 459 460 ieee80211_offchannel_stop_vifs(local); 461 462 /* ensure nullfunc is transmitted before leaving operating channel */ 463 ieee80211_flush_queues(local, NULL, false); 464 465 ieee80211_configure_filter(local); 466 467 /* We need to set power level at maximum rate for scanning. */ 468 ieee80211_hw_config(local, 0); 469 470 ieee80211_queue_delayed_work(&local->hw, 471 &local->scan_work, 0); 472 473 return 0; 474 } 475 476 static bool ieee80211_can_scan(struct ieee80211_local *local, 477 struct ieee80211_sub_if_data *sdata) 478 { 479 if (ieee80211_is_radar_required(local)) 480 return false; 481 482 if (!list_empty(&local->roc_list)) 483 return false; 484 485 if (sdata->vif.type == NL80211_IFTYPE_STATION && 486 sdata->u.mgd.flags & IEEE80211_STA_CONNECTION_POLL) 487 return false; 488 489 return true; 490 } 491 492 void ieee80211_run_deferred_scan(struct ieee80211_local *local) 493 { 494 lockdep_assert_held(&local->mtx); 495 496 if (!local->scan_req || local->scanning) 497 return; 498 499 if (!ieee80211_can_scan(local, 500 rcu_dereference_protected( 501 local->scan_sdata, 502 lockdep_is_held(&local->mtx)))) 503 return; 504 505 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 506 round_jiffies_relative(0)); 507 } 508 509 static void ieee80211_scan_state_send_probe(struct ieee80211_local *local, 510 unsigned long *next_delay) 511 { 512 int i; 513 struct ieee80211_sub_if_data *sdata; 514 struct cfg80211_scan_request *scan_req; 515 enum nl80211_band band = local->hw.conf.chandef.chan->band; 516 u32 tx_flags; 517 518 scan_req = rcu_dereference_protected(local->scan_req, 519 lockdep_is_held(&local->mtx)); 520 521 tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK; 522 if (scan_req->no_cck) 523 tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE; 524 525 sdata = rcu_dereference_protected(local->scan_sdata, 526 lockdep_is_held(&local->mtx)); 527 528 for (i = 0; i < scan_req->n_ssids; i++) 529 ieee80211_send_probe_req( 530 sdata, local->scan_addr, scan_req->bssid, 531 scan_req->ssids[i].ssid, scan_req->ssids[i].ssid_len, 532 scan_req->ie, scan_req->ie_len, 533 scan_req->rates[band], false, 534 tx_flags, local->hw.conf.chandef.chan, true); 535 536 /* 537 * After sending probe requests, wait for probe responses 538 * on the channel. 539 */ 540 *next_delay = IEEE80211_CHANNEL_TIME; 541 local->next_scan_state = SCAN_DECISION; 542 } 543 544 static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, 545 struct cfg80211_scan_request *req) 546 { 547 struct ieee80211_local *local = sdata->local; 548 int rc; 549 550 lockdep_assert_held(&local->mtx); 551 552 if (local->scan_req || ieee80211_is_radar_required(local)) 553 return -EBUSY; 554 555 if (!ieee80211_can_scan(local, sdata)) { 556 /* wait for the work to finish/time out */ 557 rcu_assign_pointer(local->scan_req, req); 558 rcu_assign_pointer(local->scan_sdata, sdata); 559 return 0; 560 } 561 562 if (local->ops->hw_scan) { 563 u8 *ies; 564 565 local->hw_scan_ies_bufsize = local->scan_ies_len + req->ie_len; 566 567 if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { 568 int i, n_bands = 0; 569 u8 bands_counted = 0; 570 571 for (i = 0; i < req->n_channels; i++) { 572 if (bands_counted & BIT(req->channels[i]->band)) 573 continue; 574 bands_counted |= BIT(req->channels[i]->band); 575 n_bands++; 576 } 577 578 local->hw_scan_ies_bufsize *= n_bands; 579 } 580 581 local->hw_scan_req = kmalloc( 582 sizeof(*local->hw_scan_req) + 583 req->n_channels * sizeof(req->channels[0]) + 584 local->hw_scan_ies_bufsize, GFP_KERNEL); 585 if (!local->hw_scan_req) 586 return -ENOMEM; 587 588 local->hw_scan_req->req.ssids = req->ssids; 589 local->hw_scan_req->req.n_ssids = req->n_ssids; 590 ies = (u8 *)local->hw_scan_req + 591 sizeof(*local->hw_scan_req) + 592 req->n_channels * sizeof(req->channels[0]); 593 local->hw_scan_req->req.ie = ies; 594 local->hw_scan_req->req.flags = req->flags; 595 eth_broadcast_addr(local->hw_scan_req->req.bssid); 596 local->hw_scan_req->req.duration = req->duration; 597 local->hw_scan_req->req.duration_mandatory = 598 req->duration_mandatory; 599 600 local->hw_scan_band = 0; 601 602 /* 603 * After allocating local->hw_scan_req, we must 604 * go through until ieee80211_prep_hw_scan(), so 605 * anything that might be changed here and leave 606 * this function early must not go after this 607 * allocation. 608 */ 609 } 610 611 rcu_assign_pointer(local->scan_req, req); 612 rcu_assign_pointer(local->scan_sdata, sdata); 613 614 if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) 615 get_random_mask_addr(local->scan_addr, 616 req->mac_addr, 617 req->mac_addr_mask); 618 else 619 memcpy(local->scan_addr, sdata->vif.addr, ETH_ALEN); 620 621 if (local->ops->hw_scan) { 622 __set_bit(SCAN_HW_SCANNING, &local->scanning); 623 } else if ((req->n_channels == 1) && 624 (req->channels[0] == local->_oper_chandef.chan)) { 625 /* 626 * If we are scanning only on the operating channel 627 * then we do not need to stop normal activities 628 */ 629 unsigned long next_delay; 630 631 __set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning); 632 633 ieee80211_recalc_idle(local); 634 635 /* Notify driver scan is starting, keep order of operations 636 * same as normal software scan, in case that matters. */ 637 drv_sw_scan_start(local, sdata, local->scan_addr); 638 639 ieee80211_configure_filter(local); /* accept probe-responses */ 640 641 /* We need to ensure power level is at max for scanning. */ 642 ieee80211_hw_config(local, 0); 643 644 if ((req->channels[0]->flags & (IEEE80211_CHAN_NO_IR | 645 IEEE80211_CHAN_RADAR)) || 646 !req->n_ssids) { 647 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; 648 } else { 649 ieee80211_scan_state_send_probe(local, &next_delay); 650 next_delay = IEEE80211_CHANNEL_TIME; 651 } 652 653 /* Now, just wait a bit and we are all done! */ 654 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 655 next_delay); 656 return 0; 657 } else { 658 /* Do normal software scan */ 659 __set_bit(SCAN_SW_SCANNING, &local->scanning); 660 } 661 662 ieee80211_recalc_idle(local); 663 664 if (local->ops->hw_scan) { 665 WARN_ON(!ieee80211_prep_hw_scan(local)); 666 rc = drv_hw_scan(local, sdata, local->hw_scan_req); 667 } else { 668 rc = ieee80211_start_sw_scan(local, sdata); 669 } 670 671 if (rc) { 672 kfree(local->hw_scan_req); 673 local->hw_scan_req = NULL; 674 local->scanning = 0; 675 676 ieee80211_recalc_idle(local); 677 678 local->scan_req = NULL; 679 RCU_INIT_POINTER(local->scan_sdata, NULL); 680 } 681 682 return rc; 683 } 684 685 static unsigned long 686 ieee80211_scan_get_channel_time(struct ieee80211_channel *chan) 687 { 688 /* 689 * TODO: channel switching also consumes quite some time, 690 * add that delay as well to get a better estimation 691 */ 692 if (chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) 693 return IEEE80211_PASSIVE_CHANNEL_TIME; 694 return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME; 695 } 696 697 static void ieee80211_scan_state_decision(struct ieee80211_local *local, 698 unsigned long *next_delay) 699 { 700 bool associated = false; 701 bool tx_empty = true; 702 bool bad_latency; 703 struct ieee80211_sub_if_data *sdata; 704 struct ieee80211_channel *next_chan; 705 enum mac80211_scan_state next_scan_state; 706 struct cfg80211_scan_request *scan_req; 707 708 /* 709 * check if at least one STA interface is associated, 710 * check if at least one STA interface has pending tx frames 711 * and grab the lowest used beacon interval 712 */ 713 mutex_lock(&local->iflist_mtx); 714 list_for_each_entry(sdata, &local->interfaces, list) { 715 if (!ieee80211_sdata_running(sdata)) 716 continue; 717 718 if (sdata->vif.type == NL80211_IFTYPE_STATION) { 719 if (sdata->u.mgd.associated) { 720 associated = true; 721 722 if (!qdisc_all_tx_empty(sdata->dev)) { 723 tx_empty = false; 724 break; 725 } 726 } 727 } 728 } 729 mutex_unlock(&local->iflist_mtx); 730 731 scan_req = rcu_dereference_protected(local->scan_req, 732 lockdep_is_held(&local->mtx)); 733 734 next_chan = scan_req->channels[local->scan_channel_idx]; 735 736 /* 737 * we're currently scanning a different channel, let's 738 * see if we can scan another channel without interfering 739 * with the current traffic situation. 740 * 741 * Keep good latency, do not stay off-channel more than 125 ms. 742 */ 743 744 bad_latency = time_after(jiffies + 745 ieee80211_scan_get_channel_time(next_chan), 746 local->leave_oper_channel_time + HZ / 8); 747 748 if (associated && !tx_empty) { 749 if (scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) 750 next_scan_state = SCAN_ABORT; 751 else 752 next_scan_state = SCAN_SUSPEND; 753 } else if (associated && bad_latency) { 754 next_scan_state = SCAN_SUSPEND; 755 } else { 756 next_scan_state = SCAN_SET_CHANNEL; 757 } 758 759 local->next_scan_state = next_scan_state; 760 761 *next_delay = 0; 762 } 763 764 static void ieee80211_scan_state_set_channel(struct ieee80211_local *local, 765 unsigned long *next_delay) 766 { 767 int skip; 768 struct ieee80211_channel *chan; 769 enum nl80211_bss_scan_width oper_scan_width; 770 struct cfg80211_scan_request *scan_req; 771 772 scan_req = rcu_dereference_protected(local->scan_req, 773 lockdep_is_held(&local->mtx)); 774 775 skip = 0; 776 chan = scan_req->channels[local->scan_channel_idx]; 777 778 local->scan_chandef.chan = chan; 779 local->scan_chandef.center_freq1 = chan->center_freq; 780 local->scan_chandef.center_freq2 = 0; 781 switch (scan_req->scan_width) { 782 case NL80211_BSS_CHAN_WIDTH_5: 783 local->scan_chandef.width = NL80211_CHAN_WIDTH_5; 784 break; 785 case NL80211_BSS_CHAN_WIDTH_10: 786 local->scan_chandef.width = NL80211_CHAN_WIDTH_10; 787 break; 788 case NL80211_BSS_CHAN_WIDTH_20: 789 /* If scanning on oper channel, use whatever channel-type 790 * is currently in use. 791 */ 792 oper_scan_width = cfg80211_chandef_to_scan_width( 793 &local->_oper_chandef); 794 if (chan == local->_oper_chandef.chan && 795 oper_scan_width == scan_req->scan_width) 796 local->scan_chandef = local->_oper_chandef; 797 else 798 local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT; 799 break; 800 } 801 802 if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL)) 803 skip = 1; 804 805 /* advance state machine to next channel/band */ 806 local->scan_channel_idx++; 807 808 if (skip) { 809 /* if we skip this channel return to the decision state */ 810 local->next_scan_state = SCAN_DECISION; 811 return; 812 } 813 814 /* 815 * Probe delay is used to update the NAV, cf. 11.1.3.2.2 816 * (which unfortunately doesn't say _why_ step a) is done, 817 * but it waits for the probe delay or until a frame is 818 * received - and the received frame would update the NAV). 819 * For now, we do not support waiting until a frame is 820 * received. 821 * 822 * In any case, it is not necessary for a passive scan. 823 */ 824 if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) || 825 !scan_req->n_ssids) { 826 *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; 827 local->next_scan_state = SCAN_DECISION; 828 return; 829 } 830 831 /* active scan, send probes */ 832 *next_delay = IEEE80211_PROBE_DELAY; 833 local->next_scan_state = SCAN_SEND_PROBE; 834 } 835 836 static void ieee80211_scan_state_suspend(struct ieee80211_local *local, 837 unsigned long *next_delay) 838 { 839 /* switch back to the operating channel */ 840 local->scan_chandef.chan = NULL; 841 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL); 842 843 /* disable PS */ 844 ieee80211_offchannel_return(local); 845 846 *next_delay = HZ / 5; 847 /* afterwards, resume scan & go to next channel */ 848 local->next_scan_state = SCAN_RESUME; 849 } 850 851 static void ieee80211_scan_state_resume(struct ieee80211_local *local, 852 unsigned long *next_delay) 853 { 854 ieee80211_offchannel_stop_vifs(local); 855 856 if (local->ops->flush) { 857 ieee80211_flush_queues(local, NULL, false); 858 *next_delay = 0; 859 } else 860 *next_delay = HZ / 10; 861 862 /* remember when we left the operating channel */ 863 local->leave_oper_channel_time = jiffies; 864 865 /* advance to the next channel to be scanned */ 866 local->next_scan_state = SCAN_SET_CHANNEL; 867 } 868 869 void ieee80211_scan_work(struct work_struct *work) 870 { 871 struct ieee80211_local *local = 872 container_of(work, struct ieee80211_local, scan_work.work); 873 struct ieee80211_sub_if_data *sdata; 874 struct cfg80211_scan_request *scan_req; 875 unsigned long next_delay = 0; 876 bool aborted; 877 878 mutex_lock(&local->mtx); 879 880 if (!ieee80211_can_run_worker(local)) { 881 aborted = true; 882 goto out_complete; 883 } 884 885 sdata = rcu_dereference_protected(local->scan_sdata, 886 lockdep_is_held(&local->mtx)); 887 scan_req = rcu_dereference_protected(local->scan_req, 888 lockdep_is_held(&local->mtx)); 889 890 /* When scanning on-channel, the first-callback means completed. */ 891 if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) { 892 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning); 893 goto out_complete; 894 } 895 896 if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) { 897 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning); 898 goto out_complete; 899 } 900 901 if (!sdata || !scan_req) 902 goto out; 903 904 if (!local->scanning) { 905 int rc; 906 907 RCU_INIT_POINTER(local->scan_req, NULL); 908 RCU_INIT_POINTER(local->scan_sdata, NULL); 909 910 rc = __ieee80211_start_scan(sdata, scan_req); 911 if (rc) { 912 /* need to complete scan in cfg80211 */ 913 rcu_assign_pointer(local->scan_req, scan_req); 914 aborted = true; 915 goto out_complete; 916 } else 917 goto out; 918 } 919 920 /* 921 * as long as no delay is required advance immediately 922 * without scheduling a new work 923 */ 924 do { 925 if (!ieee80211_sdata_running(sdata)) { 926 aborted = true; 927 goto out_complete; 928 } 929 930 switch (local->next_scan_state) { 931 case SCAN_DECISION: 932 /* if no more bands/channels left, complete scan */ 933 if (local->scan_channel_idx >= scan_req->n_channels) { 934 aborted = false; 935 goto out_complete; 936 } 937 ieee80211_scan_state_decision(local, &next_delay); 938 break; 939 case SCAN_SET_CHANNEL: 940 ieee80211_scan_state_set_channel(local, &next_delay); 941 break; 942 case SCAN_SEND_PROBE: 943 ieee80211_scan_state_send_probe(local, &next_delay); 944 break; 945 case SCAN_SUSPEND: 946 ieee80211_scan_state_suspend(local, &next_delay); 947 break; 948 case SCAN_RESUME: 949 ieee80211_scan_state_resume(local, &next_delay); 950 break; 951 case SCAN_ABORT: 952 aborted = true; 953 goto out_complete; 954 } 955 } while (next_delay == 0); 956 957 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay); 958 goto out; 959 960 out_complete: 961 __ieee80211_scan_completed(&local->hw, aborted); 962 out: 963 mutex_unlock(&local->mtx); 964 } 965 966 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata, 967 struct cfg80211_scan_request *req) 968 { 969 int res; 970 971 mutex_lock(&sdata->local->mtx); 972 res = __ieee80211_start_scan(sdata, req); 973 mutex_unlock(&sdata->local->mtx); 974 975 return res; 976 } 977 978 int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata, 979 const u8 *ssid, u8 ssid_len, 980 struct ieee80211_channel **channels, 981 unsigned int n_channels, 982 enum nl80211_bss_scan_width scan_width) 983 { 984 struct ieee80211_local *local = sdata->local; 985 int ret = -EBUSY, i, n_ch = 0; 986 enum nl80211_band band; 987 988 mutex_lock(&local->mtx); 989 990 /* busy scanning */ 991 if (local->scan_req) 992 goto unlock; 993 994 /* fill internal scan request */ 995 if (!channels) { 996 int max_n; 997 998 for (band = 0; band < NUM_NL80211_BANDS; band++) { 999 if (!local->hw.wiphy->bands[band]) 1000 continue; 1001 1002 max_n = local->hw.wiphy->bands[band]->n_channels; 1003 for (i = 0; i < max_n; i++) { 1004 struct ieee80211_channel *tmp_ch = 1005 &local->hw.wiphy->bands[band]->channels[i]; 1006 1007 if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR | 1008 IEEE80211_CHAN_DISABLED)) 1009 continue; 1010 1011 local->int_scan_req->channels[n_ch] = tmp_ch; 1012 n_ch++; 1013 } 1014 } 1015 1016 if (WARN_ON_ONCE(n_ch == 0)) 1017 goto unlock; 1018 1019 local->int_scan_req->n_channels = n_ch; 1020 } else { 1021 for (i = 0; i < n_channels; i++) { 1022 if (channels[i]->flags & (IEEE80211_CHAN_NO_IR | 1023 IEEE80211_CHAN_DISABLED)) 1024 continue; 1025 1026 local->int_scan_req->channels[n_ch] = channels[i]; 1027 n_ch++; 1028 } 1029 1030 if (WARN_ON_ONCE(n_ch == 0)) 1031 goto unlock; 1032 1033 local->int_scan_req->n_channels = n_ch; 1034 } 1035 1036 local->int_scan_req->ssids = &local->scan_ssid; 1037 local->int_scan_req->n_ssids = 1; 1038 local->int_scan_req->scan_width = scan_width; 1039 memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN); 1040 local->int_scan_req->ssids[0].ssid_len = ssid_len; 1041 1042 ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req); 1043 unlock: 1044 mutex_unlock(&local->mtx); 1045 return ret; 1046 } 1047 1048 /* 1049 * Only call this function when a scan can't be queued -- under RTNL. 1050 */ 1051 void ieee80211_scan_cancel(struct ieee80211_local *local) 1052 { 1053 /* 1054 * We are canceling software scan, or deferred scan that was not 1055 * yet really started (see __ieee80211_start_scan ). 1056 * 1057 * Regarding hardware scan: 1058 * - we can not call __ieee80211_scan_completed() as when 1059 * SCAN_HW_SCANNING bit is set this function change 1060 * local->hw_scan_req to operate on 5G band, what race with 1061 * driver which can use local->hw_scan_req 1062 * 1063 * - we can not cancel scan_work since driver can schedule it 1064 * by ieee80211_scan_completed(..., true) to finish scan 1065 * 1066 * Hence we only call the cancel_hw_scan() callback, but the low-level 1067 * driver is still responsible for calling ieee80211_scan_completed() 1068 * after the scan was completed/aborted. 1069 */ 1070 1071 mutex_lock(&local->mtx); 1072 if (!local->scan_req) 1073 goto out; 1074 1075 /* 1076 * We have a scan running and the driver already reported completion, 1077 * but the worker hasn't run yet or is stuck on the mutex - mark it as 1078 * cancelled. 1079 */ 1080 if (test_bit(SCAN_HW_SCANNING, &local->scanning) && 1081 test_bit(SCAN_COMPLETED, &local->scanning)) { 1082 set_bit(SCAN_HW_CANCELLED, &local->scanning); 1083 goto out; 1084 } 1085 1086 if (test_bit(SCAN_HW_SCANNING, &local->scanning)) { 1087 /* 1088 * Make sure that __ieee80211_scan_completed doesn't trigger a 1089 * scan on another band. 1090 */ 1091 set_bit(SCAN_HW_CANCELLED, &local->scanning); 1092 if (local->ops->cancel_hw_scan) 1093 drv_cancel_hw_scan(local, 1094 rcu_dereference_protected(local->scan_sdata, 1095 lockdep_is_held(&local->mtx))); 1096 goto out; 1097 } 1098 1099 /* 1100 * If the work is currently running, it must be blocked on 1101 * the mutex, but we'll set scan_sdata = NULL and it'll 1102 * simply exit once it acquires the mutex. 1103 */ 1104 cancel_delayed_work(&local->scan_work); 1105 /* and clean up */ 1106 memset(&local->scan_info, 0, sizeof(local->scan_info)); 1107 __ieee80211_scan_completed(&local->hw, true); 1108 out: 1109 mutex_unlock(&local->mtx); 1110 } 1111 1112 int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, 1113 struct cfg80211_sched_scan_request *req) 1114 { 1115 struct ieee80211_local *local = sdata->local; 1116 struct ieee80211_scan_ies sched_scan_ies = {}; 1117 struct cfg80211_chan_def chandef; 1118 int ret, i, iebufsz, num_bands = 0; 1119 u32 rate_masks[NUM_NL80211_BANDS] = {}; 1120 u8 bands_used = 0; 1121 u8 *ie; 1122 size_t len; 1123 1124 iebufsz = local->scan_ies_len + req->ie_len; 1125 1126 lockdep_assert_held(&local->mtx); 1127 1128 if (!local->ops->sched_scan_start) 1129 return -ENOTSUPP; 1130 1131 for (i = 0; i < NUM_NL80211_BANDS; i++) { 1132 if (local->hw.wiphy->bands[i]) { 1133 bands_used |= BIT(i); 1134 rate_masks[i] = (u32) -1; 1135 num_bands++; 1136 } 1137 } 1138 1139 ie = kzalloc(num_bands * iebufsz, GFP_KERNEL); 1140 if (!ie) { 1141 ret = -ENOMEM; 1142 goto out; 1143 } 1144 1145 ieee80211_prepare_scan_chandef(&chandef, req->scan_width); 1146 1147 len = ieee80211_build_preq_ies(local, ie, num_bands * iebufsz, 1148 &sched_scan_ies, req->ie, 1149 req->ie_len, bands_used, 1150 rate_masks, &chandef); 1151 1152 ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies); 1153 if (ret == 0) { 1154 rcu_assign_pointer(local->sched_scan_sdata, sdata); 1155 rcu_assign_pointer(local->sched_scan_req, req); 1156 } 1157 1158 kfree(ie); 1159 1160 out: 1161 if (ret) { 1162 /* Clean in case of failure after HW restart or upon resume. */ 1163 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1164 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1165 } 1166 1167 return ret; 1168 } 1169 1170 int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, 1171 struct cfg80211_sched_scan_request *req) 1172 { 1173 struct ieee80211_local *local = sdata->local; 1174 int ret; 1175 1176 mutex_lock(&local->mtx); 1177 1178 if (rcu_access_pointer(local->sched_scan_sdata)) { 1179 mutex_unlock(&local->mtx); 1180 return -EBUSY; 1181 } 1182 1183 ret = __ieee80211_request_sched_scan_start(sdata, req); 1184 1185 mutex_unlock(&local->mtx); 1186 return ret; 1187 } 1188 1189 int ieee80211_request_sched_scan_stop(struct ieee80211_local *local) 1190 { 1191 struct ieee80211_sub_if_data *sched_scan_sdata; 1192 int ret = -ENOENT; 1193 1194 mutex_lock(&local->mtx); 1195 1196 if (!local->ops->sched_scan_stop) { 1197 ret = -ENOTSUPP; 1198 goto out; 1199 } 1200 1201 /* We don't want to restart sched scan anymore. */ 1202 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1203 1204 sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata, 1205 lockdep_is_held(&local->mtx)); 1206 if (sched_scan_sdata) { 1207 ret = drv_sched_scan_stop(local, sched_scan_sdata); 1208 if (!ret) 1209 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1210 } 1211 out: 1212 mutex_unlock(&local->mtx); 1213 1214 return ret; 1215 } 1216 1217 void ieee80211_sched_scan_results(struct ieee80211_hw *hw) 1218 { 1219 struct ieee80211_local *local = hw_to_local(hw); 1220 1221 trace_api_sched_scan_results(local); 1222 1223 cfg80211_sched_scan_results(hw->wiphy); 1224 } 1225 EXPORT_SYMBOL(ieee80211_sched_scan_results); 1226 1227 void ieee80211_sched_scan_end(struct ieee80211_local *local) 1228 { 1229 mutex_lock(&local->mtx); 1230 1231 if (!rcu_access_pointer(local->sched_scan_sdata)) { 1232 mutex_unlock(&local->mtx); 1233 return; 1234 } 1235 1236 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1237 1238 /* If sched scan was aborted by the driver. */ 1239 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1240 1241 mutex_unlock(&local->mtx); 1242 1243 cfg80211_sched_scan_stopped(local->hw.wiphy); 1244 } 1245 1246 void ieee80211_sched_scan_stopped_work(struct work_struct *work) 1247 { 1248 struct ieee80211_local *local = 1249 container_of(work, struct ieee80211_local, 1250 sched_scan_stopped_work); 1251 1252 ieee80211_sched_scan_end(local); 1253 } 1254 1255 void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw) 1256 { 1257 struct ieee80211_local *local = hw_to_local(hw); 1258 1259 trace_api_sched_scan_stopped(local); 1260 1261 /* 1262 * this shouldn't really happen, so for simplicity 1263 * simply ignore it, and let mac80211 reconfigure 1264 * the sched scan later on. 1265 */ 1266 if (local->in_reconfig) 1267 return; 1268 1269 schedule_work(&local->sched_scan_stopped_work); 1270 } 1271 EXPORT_SYMBOL(ieee80211_sched_scan_stopped); 1272