1 /* 2 * Scanning implementation 3 * 4 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 5 * Copyright 2004, Instant802 Networks, Inc. 6 * Copyright 2005, Devicescape Software, Inc. 7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 9 * Copyright 2013-2015 Intel Mobile Communications GmbH 10 * Copyright 2016 Intel Deutschland GmbH 11 * 12 * This program is free software; you can redistribute it and/or modify 13 * it under the terms of the GNU General Public License version 2 as 14 * published by the Free Software Foundation. 15 */ 16 17 #include <linux/if_arp.h> 18 #include <linux/etherdevice.h> 19 #include <linux/rtnetlink.h> 20 #include <net/sch_generic.h> 21 #include <linux/slab.h> 22 #include <linux/export.h> 23 #include <net/mac80211.h> 24 25 #include "ieee80211_i.h" 26 #include "driver-ops.h" 27 #include "mesh.h" 28 29 #define IEEE80211_PROBE_DELAY (HZ / 33) 30 #define IEEE80211_CHANNEL_TIME (HZ / 33) 31 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9) 32 33 void ieee80211_rx_bss_put(struct ieee80211_local *local, 34 struct ieee80211_bss *bss) 35 { 36 if (!bss) 37 return; 38 cfg80211_put_bss(local->hw.wiphy, 39 container_of((void *)bss, struct cfg80211_bss, priv)); 40 } 41 42 static bool is_uapsd_supported(struct ieee802_11_elems *elems) 43 { 44 u8 qos_info; 45 46 if (elems->wmm_info && elems->wmm_info_len == 7 47 && elems->wmm_info[5] == 1) 48 qos_info = elems->wmm_info[6]; 49 else if (elems->wmm_param && elems->wmm_param_len == 24 50 && elems->wmm_param[5] == 1) 51 qos_info = elems->wmm_param[6]; 52 else 53 /* no valid wmm information or parameter element found */ 54 return false; 55 56 return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD; 57 } 58 59 struct ieee80211_bss * 60 ieee80211_bss_info_update(struct ieee80211_local *local, 61 struct ieee80211_rx_status *rx_status, 62 struct ieee80211_mgmt *mgmt, size_t len, 63 struct ieee802_11_elems *elems, 64 struct ieee80211_channel *channel) 65 { 66 bool beacon = ieee80211_is_beacon(mgmt->frame_control); 67 struct cfg80211_bss *cbss; 68 struct ieee80211_bss *bss; 69 int clen, srlen; 70 struct cfg80211_inform_bss bss_meta = { 71 .boottime_ns = rx_status->boottime_ns, 72 }; 73 bool signal_valid; 74 struct ieee80211_sub_if_data *scan_sdata; 75 76 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 77 bss_meta.signal = rx_status->signal * 100; 78 else if (ieee80211_hw_check(&local->hw, SIGNAL_UNSPEC)) 79 bss_meta.signal = (rx_status->signal * 100) / local->hw.max_signal; 80 81 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_20; 82 if (rx_status->flag & RX_FLAG_5MHZ) 83 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_5; 84 if (rx_status->flag & RX_FLAG_10MHZ) 85 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_10; 86 87 bss_meta.chan = channel; 88 89 rcu_read_lock(); 90 scan_sdata = rcu_dereference(local->scan_sdata); 91 if (scan_sdata && scan_sdata->vif.type == NL80211_IFTYPE_STATION && 92 scan_sdata->vif.bss_conf.assoc && 93 ieee80211_have_rx_timestamp(rx_status)) { 94 bss_meta.parent_tsf = 95 ieee80211_calculate_rx_timestamp(local, rx_status, 96 len + FCS_LEN, 24); 97 ether_addr_copy(bss_meta.parent_bssid, 98 scan_sdata->vif.bss_conf.bssid); 99 } 100 rcu_read_unlock(); 101 102 cbss = cfg80211_inform_bss_frame_data(local->hw.wiphy, &bss_meta, 103 mgmt, len, GFP_ATOMIC); 104 if (!cbss) 105 return NULL; 106 /* In case the signal is invalid update the status */ 107 signal_valid = abs(channel->center_freq - cbss->channel->center_freq) 108 <= local->hw.wiphy->max_adj_channel_rssi_comp; 109 if (!signal_valid) 110 rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL; 111 112 bss = (void *)cbss->priv; 113 114 if (beacon) 115 bss->device_ts_beacon = rx_status->device_timestamp; 116 else 117 bss->device_ts_presp = rx_status->device_timestamp; 118 119 if (elems->parse_error) { 120 if (beacon) 121 bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON; 122 else 123 bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP; 124 } else { 125 if (beacon) 126 bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON; 127 else 128 bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP; 129 } 130 131 /* save the ERP value so that it is available at association time */ 132 if (elems->erp_info && (!elems->parse_error || 133 !(bss->valid_data & IEEE80211_BSS_VALID_ERP))) { 134 bss->erp_value = elems->erp_info[0]; 135 bss->has_erp_value = true; 136 if (!elems->parse_error) 137 bss->valid_data |= IEEE80211_BSS_VALID_ERP; 138 } 139 140 /* replace old supported rates if we get new values */ 141 if (!elems->parse_error || 142 !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) { 143 srlen = 0; 144 if (elems->supp_rates) { 145 clen = IEEE80211_MAX_SUPP_RATES; 146 if (clen > elems->supp_rates_len) 147 clen = elems->supp_rates_len; 148 memcpy(bss->supp_rates, elems->supp_rates, clen); 149 srlen += clen; 150 } 151 if (elems->ext_supp_rates) { 152 clen = IEEE80211_MAX_SUPP_RATES - srlen; 153 if (clen > elems->ext_supp_rates_len) 154 clen = elems->ext_supp_rates_len; 155 memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, 156 clen); 157 srlen += clen; 158 } 159 if (srlen) { 160 bss->supp_rates_len = srlen; 161 if (!elems->parse_error) 162 bss->valid_data |= IEEE80211_BSS_VALID_RATES; 163 } 164 } 165 166 if (!elems->parse_error || 167 !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) { 168 bss->wmm_used = elems->wmm_param || elems->wmm_info; 169 bss->uapsd_supported = is_uapsd_supported(elems); 170 if (!elems->parse_error) 171 bss->valid_data |= IEEE80211_BSS_VALID_WMM; 172 } 173 174 if (beacon) { 175 struct ieee80211_supported_band *sband = 176 local->hw.wiphy->bands[rx_status->band]; 177 if (!(rx_status->flag & RX_FLAG_HT) && 178 !(rx_status->flag & RX_FLAG_VHT)) 179 bss->beacon_rate = 180 &sband->bitrates[rx_status->rate_idx]; 181 } 182 183 return bss; 184 } 185 186 void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb) 187 { 188 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb); 189 struct ieee80211_sub_if_data *sdata1, *sdata2; 190 struct ieee80211_mgmt *mgmt = (void *)skb->data; 191 struct ieee80211_bss *bss; 192 u8 *elements; 193 struct ieee80211_channel *channel; 194 size_t baselen; 195 struct ieee802_11_elems elems; 196 197 if (skb->len < 24 || 198 (!ieee80211_is_probe_resp(mgmt->frame_control) && 199 !ieee80211_is_beacon(mgmt->frame_control))) 200 return; 201 202 sdata1 = rcu_dereference(local->scan_sdata); 203 sdata2 = rcu_dereference(local->sched_scan_sdata); 204 205 if (likely(!sdata1 && !sdata2)) 206 return; 207 208 if (ieee80211_is_probe_resp(mgmt->frame_control)) { 209 struct cfg80211_scan_request *scan_req; 210 struct cfg80211_sched_scan_request *sched_scan_req; 211 212 scan_req = rcu_dereference(local->scan_req); 213 sched_scan_req = rcu_dereference(local->sched_scan_req); 214 215 /* ignore ProbeResp to foreign address unless scanning 216 * with randomised address 217 */ 218 if (!(sdata1 && 219 (ether_addr_equal(mgmt->da, sdata1->vif.addr) || 220 scan_req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)) && 221 !(sdata2 && 222 (ether_addr_equal(mgmt->da, sdata2->vif.addr) || 223 sched_scan_req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))) 224 return; 225 226 elements = mgmt->u.probe_resp.variable; 227 baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable); 228 } else { 229 baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable); 230 elements = mgmt->u.beacon.variable; 231 } 232 233 if (baselen > skb->len) 234 return; 235 236 ieee802_11_parse_elems(elements, skb->len - baselen, false, &elems); 237 238 channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq); 239 240 if (!channel || channel->flags & IEEE80211_CHAN_DISABLED) 241 return; 242 243 bss = ieee80211_bss_info_update(local, rx_status, 244 mgmt, skb->len, &elems, 245 channel); 246 if (bss) 247 ieee80211_rx_bss_put(local, bss); 248 } 249 250 static void 251 ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef, 252 enum nl80211_bss_scan_width scan_width) 253 { 254 memset(chandef, 0, sizeof(*chandef)); 255 switch (scan_width) { 256 case NL80211_BSS_CHAN_WIDTH_5: 257 chandef->width = NL80211_CHAN_WIDTH_5; 258 break; 259 case NL80211_BSS_CHAN_WIDTH_10: 260 chandef->width = NL80211_CHAN_WIDTH_10; 261 break; 262 default: 263 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 264 break; 265 } 266 } 267 268 /* return false if no more work */ 269 static bool ieee80211_prep_hw_scan(struct ieee80211_local *local) 270 { 271 struct cfg80211_scan_request *req; 272 struct cfg80211_chan_def chandef; 273 u8 bands_used = 0; 274 int i, ielen, n_chans; 275 276 req = rcu_dereference_protected(local->scan_req, 277 lockdep_is_held(&local->mtx)); 278 279 if (test_bit(SCAN_HW_CANCELLED, &local->scanning)) 280 return false; 281 282 if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { 283 for (i = 0; i < req->n_channels; i++) { 284 local->hw_scan_req->req.channels[i] = req->channels[i]; 285 bands_used |= BIT(req->channels[i]->band); 286 } 287 288 n_chans = req->n_channels; 289 } else { 290 do { 291 if (local->hw_scan_band == NUM_NL80211_BANDS) 292 return false; 293 294 n_chans = 0; 295 296 for (i = 0; i < req->n_channels; i++) { 297 if (req->channels[i]->band != 298 local->hw_scan_band) 299 continue; 300 local->hw_scan_req->req.channels[n_chans] = 301 req->channels[i]; 302 n_chans++; 303 bands_used |= BIT(req->channels[i]->band); 304 } 305 306 local->hw_scan_band++; 307 } while (!n_chans); 308 } 309 310 local->hw_scan_req->req.n_channels = n_chans; 311 ieee80211_prepare_scan_chandef(&chandef, req->scan_width); 312 313 ielen = ieee80211_build_preq_ies(local, 314 (u8 *)local->hw_scan_req->req.ie, 315 local->hw_scan_ies_bufsize, 316 &local->hw_scan_req->ies, 317 req->ie, req->ie_len, 318 bands_used, req->rates, &chandef); 319 local->hw_scan_req->req.ie_len = ielen; 320 local->hw_scan_req->req.no_cck = req->no_cck; 321 ether_addr_copy(local->hw_scan_req->req.mac_addr, req->mac_addr); 322 ether_addr_copy(local->hw_scan_req->req.mac_addr_mask, 323 req->mac_addr_mask); 324 ether_addr_copy(local->hw_scan_req->req.bssid, req->bssid); 325 326 return true; 327 } 328 329 static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) 330 { 331 struct ieee80211_local *local = hw_to_local(hw); 332 bool hw_scan = local->ops->hw_scan; 333 bool was_scanning = local->scanning; 334 struct cfg80211_scan_request *scan_req; 335 struct ieee80211_sub_if_data *scan_sdata; 336 struct ieee80211_sub_if_data *sdata; 337 338 lockdep_assert_held(&local->mtx); 339 340 /* 341 * It's ok to abort a not-yet-running scan (that 342 * we have one at all will be verified by checking 343 * local->scan_req next), but not to complete it 344 * successfully. 345 */ 346 if (WARN_ON(!local->scanning && !aborted)) 347 aborted = true; 348 349 if (WARN_ON(!local->scan_req)) 350 return; 351 352 if (hw_scan && !aborted && 353 !ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS) && 354 ieee80211_prep_hw_scan(local)) { 355 int rc; 356 357 rc = drv_hw_scan(local, 358 rcu_dereference_protected(local->scan_sdata, 359 lockdep_is_held(&local->mtx)), 360 local->hw_scan_req); 361 362 if (rc == 0) 363 return; 364 365 /* HW scan failed and is going to be reported as aborted, 366 * so clear old scan info. 367 */ 368 memset(&local->scan_info, 0, sizeof(local->scan_info)); 369 aborted = true; 370 } 371 372 kfree(local->hw_scan_req); 373 local->hw_scan_req = NULL; 374 375 scan_req = rcu_dereference_protected(local->scan_req, 376 lockdep_is_held(&local->mtx)); 377 378 if (scan_req != local->int_scan_req) { 379 local->scan_info.aborted = aborted; 380 cfg80211_scan_done(scan_req, &local->scan_info); 381 } 382 RCU_INIT_POINTER(local->scan_req, NULL); 383 384 scan_sdata = rcu_dereference_protected(local->scan_sdata, 385 lockdep_is_held(&local->mtx)); 386 RCU_INIT_POINTER(local->scan_sdata, NULL); 387 388 local->scanning = 0; 389 local->scan_chandef.chan = NULL; 390 391 /* Set power back to normal operating levels. */ 392 ieee80211_hw_config(local, 0); 393 394 if (!hw_scan) { 395 ieee80211_configure_filter(local); 396 drv_sw_scan_complete(local, scan_sdata); 397 ieee80211_offchannel_return(local); 398 } 399 400 ieee80211_recalc_idle(local); 401 402 ieee80211_mlme_notify_scan_completed(local); 403 ieee80211_ibss_notify_scan_completed(local); 404 405 /* Requeue all the work that might have been ignored while 406 * the scan was in progress; if there was none this will 407 * just be a no-op for the particular interface. 408 */ 409 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 410 if (ieee80211_sdata_running(sdata)) 411 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 412 } 413 414 if (was_scanning) 415 ieee80211_start_next_roc(local); 416 } 417 418 void ieee80211_scan_completed(struct ieee80211_hw *hw, 419 struct cfg80211_scan_info *info) 420 { 421 struct ieee80211_local *local = hw_to_local(hw); 422 423 trace_api_scan_completed(local, info); 424 425 set_bit(SCAN_COMPLETED, &local->scanning); 426 if (info->aborted) 427 set_bit(SCAN_ABORTED, &local->scanning); 428 429 memcpy(&local->scan_info, info, sizeof(*info)); 430 431 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0); 432 } 433 EXPORT_SYMBOL(ieee80211_scan_completed); 434 435 static int ieee80211_start_sw_scan(struct ieee80211_local *local, 436 struct ieee80211_sub_if_data *sdata) 437 { 438 /* Software scan is not supported in multi-channel cases */ 439 if (local->use_chanctx) 440 return -EOPNOTSUPP; 441 442 /* 443 * Hardware/driver doesn't support hw_scan, so use software 444 * scanning instead. First send a nullfunc frame with power save 445 * bit on so that AP will buffer the frames for us while we are not 446 * listening, then send probe requests to each channel and wait for 447 * the responses. After all channels are scanned, tune back to the 448 * original channel and send a nullfunc frame with power save bit 449 * off to trigger the AP to send us all the buffered frames. 450 * 451 * Note that while local->sw_scanning is true everything else but 452 * nullfunc frames and probe requests will be dropped in 453 * ieee80211_tx_h_check_assoc(). 454 */ 455 drv_sw_scan_start(local, sdata, local->scan_addr); 456 457 local->leave_oper_channel_time = jiffies; 458 local->next_scan_state = SCAN_DECISION; 459 local->scan_channel_idx = 0; 460 461 ieee80211_offchannel_stop_vifs(local); 462 463 /* ensure nullfunc is transmitted before leaving operating channel */ 464 ieee80211_flush_queues(local, NULL, false); 465 466 ieee80211_configure_filter(local); 467 468 /* We need to set power level at maximum rate for scanning. */ 469 ieee80211_hw_config(local, 0); 470 471 ieee80211_queue_delayed_work(&local->hw, 472 &local->scan_work, 0); 473 474 return 0; 475 } 476 477 static bool ieee80211_can_scan(struct ieee80211_local *local, 478 struct ieee80211_sub_if_data *sdata) 479 { 480 if (ieee80211_is_radar_required(local)) 481 return false; 482 483 if (!list_empty(&local->roc_list)) 484 return false; 485 486 if (sdata->vif.type == NL80211_IFTYPE_STATION && 487 sdata->u.mgd.flags & IEEE80211_STA_CONNECTION_POLL) 488 return false; 489 490 return true; 491 } 492 493 void ieee80211_run_deferred_scan(struct ieee80211_local *local) 494 { 495 lockdep_assert_held(&local->mtx); 496 497 if (!local->scan_req || local->scanning) 498 return; 499 500 if (!ieee80211_can_scan(local, 501 rcu_dereference_protected( 502 local->scan_sdata, 503 lockdep_is_held(&local->mtx)))) 504 return; 505 506 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 507 round_jiffies_relative(0)); 508 } 509 510 static void ieee80211_scan_state_send_probe(struct ieee80211_local *local, 511 unsigned long *next_delay) 512 { 513 int i; 514 struct ieee80211_sub_if_data *sdata; 515 struct cfg80211_scan_request *scan_req; 516 enum nl80211_band band = local->hw.conf.chandef.chan->band; 517 u32 tx_flags; 518 519 scan_req = rcu_dereference_protected(local->scan_req, 520 lockdep_is_held(&local->mtx)); 521 522 tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK; 523 if (scan_req->no_cck) 524 tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE; 525 526 sdata = rcu_dereference_protected(local->scan_sdata, 527 lockdep_is_held(&local->mtx)); 528 529 for (i = 0; i < scan_req->n_ssids; i++) 530 ieee80211_send_probe_req( 531 sdata, local->scan_addr, scan_req->bssid, 532 scan_req->ssids[i].ssid, scan_req->ssids[i].ssid_len, 533 scan_req->ie, scan_req->ie_len, 534 scan_req->rates[band], false, 535 tx_flags, local->hw.conf.chandef.chan, true); 536 537 /* 538 * After sending probe requests, wait for probe responses 539 * on the channel. 540 */ 541 *next_delay = IEEE80211_CHANNEL_TIME; 542 local->next_scan_state = SCAN_DECISION; 543 } 544 545 static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, 546 struct cfg80211_scan_request *req) 547 { 548 struct ieee80211_local *local = sdata->local; 549 int rc; 550 551 lockdep_assert_held(&local->mtx); 552 553 if (local->scan_req || ieee80211_is_radar_required(local)) 554 return -EBUSY; 555 556 if (!ieee80211_can_scan(local, sdata)) { 557 /* wait for the work to finish/time out */ 558 rcu_assign_pointer(local->scan_req, req); 559 rcu_assign_pointer(local->scan_sdata, sdata); 560 return 0; 561 } 562 563 if (local->ops->hw_scan) { 564 u8 *ies; 565 566 local->hw_scan_ies_bufsize = local->scan_ies_len + req->ie_len; 567 568 if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { 569 int i, n_bands = 0; 570 u8 bands_counted = 0; 571 572 for (i = 0; i < req->n_channels; i++) { 573 if (bands_counted & BIT(req->channels[i]->band)) 574 continue; 575 bands_counted |= BIT(req->channels[i]->band); 576 n_bands++; 577 } 578 579 local->hw_scan_ies_bufsize *= n_bands; 580 } 581 582 local->hw_scan_req = kmalloc( 583 sizeof(*local->hw_scan_req) + 584 req->n_channels * sizeof(req->channels[0]) + 585 local->hw_scan_ies_bufsize, GFP_KERNEL); 586 if (!local->hw_scan_req) 587 return -ENOMEM; 588 589 local->hw_scan_req->req.ssids = req->ssids; 590 local->hw_scan_req->req.n_ssids = req->n_ssids; 591 ies = (u8 *)local->hw_scan_req + 592 sizeof(*local->hw_scan_req) + 593 req->n_channels * sizeof(req->channels[0]); 594 local->hw_scan_req->req.ie = ies; 595 local->hw_scan_req->req.flags = req->flags; 596 eth_broadcast_addr(local->hw_scan_req->req.bssid); 597 local->hw_scan_req->req.duration = req->duration; 598 local->hw_scan_req->req.duration_mandatory = 599 req->duration_mandatory; 600 601 local->hw_scan_band = 0; 602 603 /* 604 * After allocating local->hw_scan_req, we must 605 * go through until ieee80211_prep_hw_scan(), so 606 * anything that might be changed here and leave 607 * this function early must not go after this 608 * allocation. 609 */ 610 } 611 612 rcu_assign_pointer(local->scan_req, req); 613 rcu_assign_pointer(local->scan_sdata, sdata); 614 615 if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) 616 get_random_mask_addr(local->scan_addr, 617 req->mac_addr, 618 req->mac_addr_mask); 619 else 620 memcpy(local->scan_addr, sdata->vif.addr, ETH_ALEN); 621 622 if (local->ops->hw_scan) { 623 __set_bit(SCAN_HW_SCANNING, &local->scanning); 624 } else if ((req->n_channels == 1) && 625 (req->channels[0] == local->_oper_chandef.chan)) { 626 /* 627 * If we are scanning only on the operating channel 628 * then we do not need to stop normal activities 629 */ 630 unsigned long next_delay; 631 632 __set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning); 633 634 ieee80211_recalc_idle(local); 635 636 /* Notify driver scan is starting, keep order of operations 637 * same as normal software scan, in case that matters. */ 638 drv_sw_scan_start(local, sdata, local->scan_addr); 639 640 ieee80211_configure_filter(local); /* accept probe-responses */ 641 642 /* We need to ensure power level is at max for scanning. */ 643 ieee80211_hw_config(local, 0); 644 645 if ((req->channels[0]->flags & (IEEE80211_CHAN_NO_IR | 646 IEEE80211_CHAN_RADAR)) || 647 !req->n_ssids) { 648 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; 649 } else { 650 ieee80211_scan_state_send_probe(local, &next_delay); 651 next_delay = IEEE80211_CHANNEL_TIME; 652 } 653 654 /* Now, just wait a bit and we are all done! */ 655 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 656 next_delay); 657 return 0; 658 } else { 659 /* Do normal software scan */ 660 __set_bit(SCAN_SW_SCANNING, &local->scanning); 661 } 662 663 ieee80211_recalc_idle(local); 664 665 if (local->ops->hw_scan) { 666 WARN_ON(!ieee80211_prep_hw_scan(local)); 667 rc = drv_hw_scan(local, sdata, local->hw_scan_req); 668 } else { 669 rc = ieee80211_start_sw_scan(local, sdata); 670 } 671 672 if (rc) { 673 kfree(local->hw_scan_req); 674 local->hw_scan_req = NULL; 675 local->scanning = 0; 676 677 ieee80211_recalc_idle(local); 678 679 local->scan_req = NULL; 680 RCU_INIT_POINTER(local->scan_sdata, NULL); 681 } 682 683 return rc; 684 } 685 686 static unsigned long 687 ieee80211_scan_get_channel_time(struct ieee80211_channel *chan) 688 { 689 /* 690 * TODO: channel switching also consumes quite some time, 691 * add that delay as well to get a better estimation 692 */ 693 if (chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) 694 return IEEE80211_PASSIVE_CHANNEL_TIME; 695 return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME; 696 } 697 698 static void ieee80211_scan_state_decision(struct ieee80211_local *local, 699 unsigned long *next_delay) 700 { 701 bool associated = false; 702 bool tx_empty = true; 703 bool bad_latency; 704 struct ieee80211_sub_if_data *sdata; 705 struct ieee80211_channel *next_chan; 706 enum mac80211_scan_state next_scan_state; 707 struct cfg80211_scan_request *scan_req; 708 709 /* 710 * check if at least one STA interface is associated, 711 * check if at least one STA interface has pending tx frames 712 * and grab the lowest used beacon interval 713 */ 714 mutex_lock(&local->iflist_mtx); 715 list_for_each_entry(sdata, &local->interfaces, list) { 716 if (!ieee80211_sdata_running(sdata)) 717 continue; 718 719 if (sdata->vif.type == NL80211_IFTYPE_STATION) { 720 if (sdata->u.mgd.associated) { 721 associated = true; 722 723 if (!qdisc_all_tx_empty(sdata->dev)) { 724 tx_empty = false; 725 break; 726 } 727 } 728 } 729 } 730 mutex_unlock(&local->iflist_mtx); 731 732 scan_req = rcu_dereference_protected(local->scan_req, 733 lockdep_is_held(&local->mtx)); 734 735 next_chan = scan_req->channels[local->scan_channel_idx]; 736 737 /* 738 * we're currently scanning a different channel, let's 739 * see if we can scan another channel without interfering 740 * with the current traffic situation. 741 * 742 * Keep good latency, do not stay off-channel more than 125 ms. 743 */ 744 745 bad_latency = time_after(jiffies + 746 ieee80211_scan_get_channel_time(next_chan), 747 local->leave_oper_channel_time + HZ / 8); 748 749 if (associated && !tx_empty) { 750 if (scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) 751 next_scan_state = SCAN_ABORT; 752 else 753 next_scan_state = SCAN_SUSPEND; 754 } else if (associated && bad_latency) { 755 next_scan_state = SCAN_SUSPEND; 756 } else { 757 next_scan_state = SCAN_SET_CHANNEL; 758 } 759 760 local->next_scan_state = next_scan_state; 761 762 *next_delay = 0; 763 } 764 765 static void ieee80211_scan_state_set_channel(struct ieee80211_local *local, 766 unsigned long *next_delay) 767 { 768 int skip; 769 struct ieee80211_channel *chan; 770 enum nl80211_bss_scan_width oper_scan_width; 771 struct cfg80211_scan_request *scan_req; 772 773 scan_req = rcu_dereference_protected(local->scan_req, 774 lockdep_is_held(&local->mtx)); 775 776 skip = 0; 777 chan = scan_req->channels[local->scan_channel_idx]; 778 779 local->scan_chandef.chan = chan; 780 local->scan_chandef.center_freq1 = chan->center_freq; 781 local->scan_chandef.center_freq2 = 0; 782 switch (scan_req->scan_width) { 783 case NL80211_BSS_CHAN_WIDTH_5: 784 local->scan_chandef.width = NL80211_CHAN_WIDTH_5; 785 break; 786 case NL80211_BSS_CHAN_WIDTH_10: 787 local->scan_chandef.width = NL80211_CHAN_WIDTH_10; 788 break; 789 case NL80211_BSS_CHAN_WIDTH_20: 790 /* If scanning on oper channel, use whatever channel-type 791 * is currently in use. 792 */ 793 oper_scan_width = cfg80211_chandef_to_scan_width( 794 &local->_oper_chandef); 795 if (chan == local->_oper_chandef.chan && 796 oper_scan_width == scan_req->scan_width) 797 local->scan_chandef = local->_oper_chandef; 798 else 799 local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT; 800 break; 801 } 802 803 if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL)) 804 skip = 1; 805 806 /* advance state machine to next channel/band */ 807 local->scan_channel_idx++; 808 809 if (skip) { 810 /* if we skip this channel return to the decision state */ 811 local->next_scan_state = SCAN_DECISION; 812 return; 813 } 814 815 /* 816 * Probe delay is used to update the NAV, cf. 11.1.3.2.2 817 * (which unfortunately doesn't say _why_ step a) is done, 818 * but it waits for the probe delay or until a frame is 819 * received - and the received frame would update the NAV). 820 * For now, we do not support waiting until a frame is 821 * received. 822 * 823 * In any case, it is not necessary for a passive scan. 824 */ 825 if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) || 826 !scan_req->n_ssids) { 827 *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; 828 local->next_scan_state = SCAN_DECISION; 829 return; 830 } 831 832 /* active scan, send probes */ 833 *next_delay = IEEE80211_PROBE_DELAY; 834 local->next_scan_state = SCAN_SEND_PROBE; 835 } 836 837 static void ieee80211_scan_state_suspend(struct ieee80211_local *local, 838 unsigned long *next_delay) 839 { 840 /* switch back to the operating channel */ 841 local->scan_chandef.chan = NULL; 842 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL); 843 844 /* disable PS */ 845 ieee80211_offchannel_return(local); 846 847 *next_delay = HZ / 5; 848 /* afterwards, resume scan & go to next channel */ 849 local->next_scan_state = SCAN_RESUME; 850 } 851 852 static void ieee80211_scan_state_resume(struct ieee80211_local *local, 853 unsigned long *next_delay) 854 { 855 ieee80211_offchannel_stop_vifs(local); 856 857 if (local->ops->flush) { 858 ieee80211_flush_queues(local, NULL, false); 859 *next_delay = 0; 860 } else 861 *next_delay = HZ / 10; 862 863 /* remember when we left the operating channel */ 864 local->leave_oper_channel_time = jiffies; 865 866 /* advance to the next channel to be scanned */ 867 local->next_scan_state = SCAN_SET_CHANNEL; 868 } 869 870 void ieee80211_scan_work(struct work_struct *work) 871 { 872 struct ieee80211_local *local = 873 container_of(work, struct ieee80211_local, scan_work.work); 874 struct ieee80211_sub_if_data *sdata; 875 struct cfg80211_scan_request *scan_req; 876 unsigned long next_delay = 0; 877 bool aborted; 878 879 mutex_lock(&local->mtx); 880 881 if (!ieee80211_can_run_worker(local)) { 882 aborted = true; 883 goto out_complete; 884 } 885 886 sdata = rcu_dereference_protected(local->scan_sdata, 887 lockdep_is_held(&local->mtx)); 888 scan_req = rcu_dereference_protected(local->scan_req, 889 lockdep_is_held(&local->mtx)); 890 891 /* When scanning on-channel, the first-callback means completed. */ 892 if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) { 893 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning); 894 goto out_complete; 895 } 896 897 if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) { 898 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning); 899 goto out_complete; 900 } 901 902 if (!sdata || !scan_req) 903 goto out; 904 905 if (!local->scanning) { 906 int rc; 907 908 RCU_INIT_POINTER(local->scan_req, NULL); 909 RCU_INIT_POINTER(local->scan_sdata, NULL); 910 911 rc = __ieee80211_start_scan(sdata, scan_req); 912 if (rc) { 913 /* need to complete scan in cfg80211 */ 914 rcu_assign_pointer(local->scan_req, scan_req); 915 aborted = true; 916 goto out_complete; 917 } else 918 goto out; 919 } 920 921 /* 922 * as long as no delay is required advance immediately 923 * without scheduling a new work 924 */ 925 do { 926 if (!ieee80211_sdata_running(sdata)) { 927 aborted = true; 928 goto out_complete; 929 } 930 931 switch (local->next_scan_state) { 932 case SCAN_DECISION: 933 /* if no more bands/channels left, complete scan */ 934 if (local->scan_channel_idx >= scan_req->n_channels) { 935 aborted = false; 936 goto out_complete; 937 } 938 ieee80211_scan_state_decision(local, &next_delay); 939 break; 940 case SCAN_SET_CHANNEL: 941 ieee80211_scan_state_set_channel(local, &next_delay); 942 break; 943 case SCAN_SEND_PROBE: 944 ieee80211_scan_state_send_probe(local, &next_delay); 945 break; 946 case SCAN_SUSPEND: 947 ieee80211_scan_state_suspend(local, &next_delay); 948 break; 949 case SCAN_RESUME: 950 ieee80211_scan_state_resume(local, &next_delay); 951 break; 952 case SCAN_ABORT: 953 aborted = true; 954 goto out_complete; 955 } 956 } while (next_delay == 0); 957 958 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay); 959 goto out; 960 961 out_complete: 962 __ieee80211_scan_completed(&local->hw, aborted); 963 out: 964 mutex_unlock(&local->mtx); 965 } 966 967 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata, 968 struct cfg80211_scan_request *req) 969 { 970 int res; 971 972 mutex_lock(&sdata->local->mtx); 973 res = __ieee80211_start_scan(sdata, req); 974 mutex_unlock(&sdata->local->mtx); 975 976 return res; 977 } 978 979 int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata, 980 const u8 *ssid, u8 ssid_len, 981 struct ieee80211_channel **channels, 982 unsigned int n_channels, 983 enum nl80211_bss_scan_width scan_width) 984 { 985 struct ieee80211_local *local = sdata->local; 986 int ret = -EBUSY, i, n_ch = 0; 987 enum nl80211_band band; 988 989 mutex_lock(&local->mtx); 990 991 /* busy scanning */ 992 if (local->scan_req) 993 goto unlock; 994 995 /* fill internal scan request */ 996 if (!channels) { 997 int max_n; 998 999 for (band = 0; band < NUM_NL80211_BANDS; band++) { 1000 if (!local->hw.wiphy->bands[band]) 1001 continue; 1002 1003 max_n = local->hw.wiphy->bands[band]->n_channels; 1004 for (i = 0; i < max_n; i++) { 1005 struct ieee80211_channel *tmp_ch = 1006 &local->hw.wiphy->bands[band]->channels[i]; 1007 1008 if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR | 1009 IEEE80211_CHAN_DISABLED)) 1010 continue; 1011 1012 local->int_scan_req->channels[n_ch] = tmp_ch; 1013 n_ch++; 1014 } 1015 } 1016 1017 if (WARN_ON_ONCE(n_ch == 0)) 1018 goto unlock; 1019 1020 local->int_scan_req->n_channels = n_ch; 1021 } else { 1022 for (i = 0; i < n_channels; i++) { 1023 if (channels[i]->flags & (IEEE80211_CHAN_NO_IR | 1024 IEEE80211_CHAN_DISABLED)) 1025 continue; 1026 1027 local->int_scan_req->channels[n_ch] = channels[i]; 1028 n_ch++; 1029 } 1030 1031 if (WARN_ON_ONCE(n_ch == 0)) 1032 goto unlock; 1033 1034 local->int_scan_req->n_channels = n_ch; 1035 } 1036 1037 local->int_scan_req->ssids = &local->scan_ssid; 1038 local->int_scan_req->n_ssids = 1; 1039 local->int_scan_req->scan_width = scan_width; 1040 memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN); 1041 local->int_scan_req->ssids[0].ssid_len = ssid_len; 1042 1043 ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req); 1044 unlock: 1045 mutex_unlock(&local->mtx); 1046 return ret; 1047 } 1048 1049 /* 1050 * Only call this function when a scan can't be queued -- under RTNL. 1051 */ 1052 void ieee80211_scan_cancel(struct ieee80211_local *local) 1053 { 1054 /* 1055 * We are canceling software scan, or deferred scan that was not 1056 * yet really started (see __ieee80211_start_scan ). 1057 * 1058 * Regarding hardware scan: 1059 * - we can not call __ieee80211_scan_completed() as when 1060 * SCAN_HW_SCANNING bit is set this function change 1061 * local->hw_scan_req to operate on 5G band, what race with 1062 * driver which can use local->hw_scan_req 1063 * 1064 * - we can not cancel scan_work since driver can schedule it 1065 * by ieee80211_scan_completed(..., true) to finish scan 1066 * 1067 * Hence we only call the cancel_hw_scan() callback, but the low-level 1068 * driver is still responsible for calling ieee80211_scan_completed() 1069 * after the scan was completed/aborted. 1070 */ 1071 1072 mutex_lock(&local->mtx); 1073 if (!local->scan_req) 1074 goto out; 1075 1076 /* 1077 * We have a scan running and the driver already reported completion, 1078 * but the worker hasn't run yet or is stuck on the mutex - mark it as 1079 * cancelled. 1080 */ 1081 if (test_bit(SCAN_HW_SCANNING, &local->scanning) && 1082 test_bit(SCAN_COMPLETED, &local->scanning)) { 1083 set_bit(SCAN_HW_CANCELLED, &local->scanning); 1084 goto out; 1085 } 1086 1087 if (test_bit(SCAN_HW_SCANNING, &local->scanning)) { 1088 /* 1089 * Make sure that __ieee80211_scan_completed doesn't trigger a 1090 * scan on another band. 1091 */ 1092 set_bit(SCAN_HW_CANCELLED, &local->scanning); 1093 if (local->ops->cancel_hw_scan) 1094 drv_cancel_hw_scan(local, 1095 rcu_dereference_protected(local->scan_sdata, 1096 lockdep_is_held(&local->mtx))); 1097 goto out; 1098 } 1099 1100 /* 1101 * If the work is currently running, it must be blocked on 1102 * the mutex, but we'll set scan_sdata = NULL and it'll 1103 * simply exit once it acquires the mutex. 1104 */ 1105 cancel_delayed_work(&local->scan_work); 1106 /* and clean up */ 1107 memset(&local->scan_info, 0, sizeof(local->scan_info)); 1108 __ieee80211_scan_completed(&local->hw, true); 1109 out: 1110 mutex_unlock(&local->mtx); 1111 } 1112 1113 int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, 1114 struct cfg80211_sched_scan_request *req) 1115 { 1116 struct ieee80211_local *local = sdata->local; 1117 struct ieee80211_scan_ies sched_scan_ies = {}; 1118 struct cfg80211_chan_def chandef; 1119 int ret, i, iebufsz, num_bands = 0; 1120 u32 rate_masks[NUM_NL80211_BANDS] = {}; 1121 u8 bands_used = 0; 1122 u8 *ie; 1123 size_t len; 1124 1125 iebufsz = local->scan_ies_len + req->ie_len; 1126 1127 lockdep_assert_held(&local->mtx); 1128 1129 if (!local->ops->sched_scan_start) 1130 return -ENOTSUPP; 1131 1132 for (i = 0; i < NUM_NL80211_BANDS; i++) { 1133 if (local->hw.wiphy->bands[i]) { 1134 bands_used |= BIT(i); 1135 rate_masks[i] = (u32) -1; 1136 num_bands++; 1137 } 1138 } 1139 1140 ie = kzalloc(num_bands * iebufsz, GFP_KERNEL); 1141 if (!ie) { 1142 ret = -ENOMEM; 1143 goto out; 1144 } 1145 1146 ieee80211_prepare_scan_chandef(&chandef, req->scan_width); 1147 1148 len = ieee80211_build_preq_ies(local, ie, num_bands * iebufsz, 1149 &sched_scan_ies, req->ie, 1150 req->ie_len, bands_used, 1151 rate_masks, &chandef); 1152 1153 ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies); 1154 if (ret == 0) { 1155 rcu_assign_pointer(local->sched_scan_sdata, sdata); 1156 rcu_assign_pointer(local->sched_scan_req, req); 1157 } 1158 1159 kfree(ie); 1160 1161 out: 1162 if (ret) { 1163 /* Clean in case of failure after HW restart or upon resume. */ 1164 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1165 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1166 } 1167 1168 return ret; 1169 } 1170 1171 int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, 1172 struct cfg80211_sched_scan_request *req) 1173 { 1174 struct ieee80211_local *local = sdata->local; 1175 int ret; 1176 1177 mutex_lock(&local->mtx); 1178 1179 if (rcu_access_pointer(local->sched_scan_sdata)) { 1180 mutex_unlock(&local->mtx); 1181 return -EBUSY; 1182 } 1183 1184 ret = __ieee80211_request_sched_scan_start(sdata, req); 1185 1186 mutex_unlock(&local->mtx); 1187 return ret; 1188 } 1189 1190 int ieee80211_request_sched_scan_stop(struct ieee80211_local *local) 1191 { 1192 struct ieee80211_sub_if_data *sched_scan_sdata; 1193 int ret = -ENOENT; 1194 1195 mutex_lock(&local->mtx); 1196 1197 if (!local->ops->sched_scan_stop) { 1198 ret = -ENOTSUPP; 1199 goto out; 1200 } 1201 1202 /* We don't want to restart sched scan anymore. */ 1203 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1204 1205 sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata, 1206 lockdep_is_held(&local->mtx)); 1207 if (sched_scan_sdata) { 1208 ret = drv_sched_scan_stop(local, sched_scan_sdata); 1209 if (!ret) 1210 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1211 } 1212 out: 1213 mutex_unlock(&local->mtx); 1214 1215 return ret; 1216 } 1217 1218 void ieee80211_sched_scan_results(struct ieee80211_hw *hw) 1219 { 1220 struct ieee80211_local *local = hw_to_local(hw); 1221 1222 trace_api_sched_scan_results(local); 1223 1224 cfg80211_sched_scan_results(hw->wiphy); 1225 } 1226 EXPORT_SYMBOL(ieee80211_sched_scan_results); 1227 1228 void ieee80211_sched_scan_end(struct ieee80211_local *local) 1229 { 1230 mutex_lock(&local->mtx); 1231 1232 if (!rcu_access_pointer(local->sched_scan_sdata)) { 1233 mutex_unlock(&local->mtx); 1234 return; 1235 } 1236 1237 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1238 1239 /* If sched scan was aborted by the driver. */ 1240 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1241 1242 mutex_unlock(&local->mtx); 1243 1244 cfg80211_sched_scan_stopped(local->hw.wiphy); 1245 } 1246 1247 void ieee80211_sched_scan_stopped_work(struct work_struct *work) 1248 { 1249 struct ieee80211_local *local = 1250 container_of(work, struct ieee80211_local, 1251 sched_scan_stopped_work); 1252 1253 ieee80211_sched_scan_end(local); 1254 } 1255 1256 void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw) 1257 { 1258 struct ieee80211_local *local = hw_to_local(hw); 1259 1260 trace_api_sched_scan_stopped(local); 1261 1262 /* 1263 * this shouldn't really happen, so for simplicity 1264 * simply ignore it, and let mac80211 reconfigure 1265 * the sched scan later on. 1266 */ 1267 if (local->in_reconfig) 1268 return; 1269 1270 schedule_work(&local->sched_scan_stopped_work); 1271 } 1272 EXPORT_SYMBOL(ieee80211_sched_scan_stopped); 1273