scan.c 26.7 KB
Newer Older
1
/*
2 3
 * Scanning implementation
 *
4 5 6 7 8 9 10 11 12 13 14 15
 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/if_arp.h>
16
#include <linux/etherdevice.h>
17
#include <linux/rtnetlink.h>
18
#include <linux/pm_qos.h>
19
#include <net/sch_generic.h>
20
#include <linux/slab.h>
21
#include <linux/export.h>
22 23 24
#include <net/mac80211.h>

#include "ieee80211_i.h"
25
#include "driver-ops.h"
26
#include "mesh.h"
27 28 29

#define IEEE80211_PROBE_DELAY (HZ / 33)
#define IEEE80211_CHANNEL_TIME (HZ / 33)
30
#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
31

32
static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
33
{
34
	struct ieee80211_bss *bss = (void *)cbss->priv;
35 36 37 38 39 40

	kfree(bss_mesh_id(bss));
	kfree(bss_mesh_cfg(bss));
}

void ieee80211_rx_bss_put(struct ieee80211_local *local,
41
			  struct ieee80211_bss *bss)
42
{
43 44 45
	if (!bss)
		return;
	cfg80211_put_bss(container_of((void *)bss, struct cfg80211_bss, priv));
46 47
}

K
Kalle Valo 已提交
48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64
static bool is_uapsd_supported(struct ieee802_11_elems *elems)
{
	u8 qos_info;

	if (elems->wmm_info && elems->wmm_info_len == 7
	    && elems->wmm_info[5] == 1)
		qos_info = elems->wmm_info[6];
	else if (elems->wmm_param && elems->wmm_param_len == 24
		 && elems->wmm_param[5] == 1)
		qos_info = elems->wmm_param[6];
	else
		/* no valid wmm information or parameter element found */
		return false;

	return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD;
}

65
struct ieee80211_bss *
66 67 68 69 70
ieee80211_bss_info_update(struct ieee80211_local *local,
			  struct ieee80211_rx_status *rx_status,
			  struct ieee80211_mgmt *mgmt,
			  size_t len,
			  struct ieee802_11_elems *elems,
71 72
			  struct ieee80211_channel *channel,
			  bool beacon)
73
{
74
	struct cfg80211_bss *cbss;
75
	struct ieee80211_bss *bss;
76
	int clen, srlen;
77 78
	s32 signal = 0;

J
Johannes Berg 已提交
79
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
80
		signal = rx_status->signal * 100;
J
Johannes Berg 已提交
81
	else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
82 83
		signal = (rx_status->signal * 100) / local->hw.max_signal;

84 85
	cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
					 mgmt, len, signal, GFP_ATOMIC);
86

87
	if (!cbss)
88 89
		return NULL;

90 91
	cbss->free_priv = ieee80211_rx_bss_free;
	bss = (void *)cbss->priv;
92

P
Paul Stewart 已提交
93 94 95 96 97 98 99 100 101 102 103 104
	if (elems->parse_error) {
		if (beacon)
			bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON;
		else
			bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP;
	} else {
		if (beacon)
			bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON;
		else
			bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP;
	}

105
	/* save the ERP value so that it is available at association time */
P
Paul Stewart 已提交
106 107 108
	if (elems->erp_info && elems->erp_info_len >= 1 &&
			(!elems->parse_error ||
			 !(bss->valid_data & IEEE80211_BSS_VALID_ERP))) {
109
		bss->erp_value = elems->erp_info[0];
110
		bss->has_erp_value = true;
P
Paul Stewart 已提交
111 112
		if (!elems->parse_error)
			bss->valid_data |= IEEE80211_BSS_VALID_ERP;
113 114
	}

P
Paul Stewart 已提交
115 116
	if (elems->tim && (!elems->parse_error ||
			   !(bss->valid_data & IEEE80211_BSS_VALID_DTIM))) {
117 118 119
		struct ieee80211_tim_ie *tim_ie =
			(struct ieee80211_tim_ie *)elems->tim;
		bss->dtim_period = tim_ie->dtim_period;
P
Paul Stewart 已提交
120 121
		if (!elems->parse_error)
				bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
122 123
	}

124 125 126 127
	/* If the beacon had no TIM IE, or it was invalid, use 1 */
	if (beacon && !bss->dtim_period)
		bss->dtim_period = 1;

128
	/* replace old supported rates if we get new values */
P
Paul Stewart 已提交
129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151
	if (!elems->parse_error ||
	    !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
		srlen = 0;
		if (elems->supp_rates) {
			clen = IEEE80211_MAX_SUPP_RATES;
			if (clen > elems->supp_rates_len)
				clen = elems->supp_rates_len;
			memcpy(bss->supp_rates, elems->supp_rates, clen);
			srlen += clen;
		}
		if (elems->ext_supp_rates) {
			clen = IEEE80211_MAX_SUPP_RATES - srlen;
			if (clen > elems->ext_supp_rates_len)
				clen = elems->ext_supp_rates_len;
			memcpy(bss->supp_rates + srlen, elems->ext_supp_rates,
			       clen);
			srlen += clen;
		}
		if (srlen) {
			bss->supp_rates_len = srlen;
			if (!elems->parse_error)
				bss->valid_data |= IEEE80211_BSS_VALID_RATES;
		}
152 153
	}

P
Paul Stewart 已提交
154 155 156 157 158 159 160
	if (!elems->parse_error ||
	    !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) {
		bss->wmm_used = elems->wmm_param || elems->wmm_info;
		bss->uapsd_supported = is_uapsd_supported(elems);
		if (!elems->parse_error)
			bss->valid_data |= IEEE80211_BSS_VALID_WMM;
	}
161 162 163 164 165 166

	if (!beacon)
		bss->last_probe_resp = jiffies;

	return bss;
}
167

168
ieee80211_rx_result
169
ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
170
{
171
	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
172
	struct ieee80211_mgmt *mgmt;
173
	struct ieee80211_bss *bss;
174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191
	u8 *elements;
	struct ieee80211_channel *channel;
	size_t baselen;
	int freq;
	__le16 fc;
	bool presp, beacon = false;
	struct ieee802_11_elems elems;

	if (skb->len < 2)
		return RX_DROP_UNUSABLE;

	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = mgmt->frame_control;

	if (ieee80211_is_ctl(fc))
		return RX_CONTINUE;

	if (skb->len < 24)
192
		return RX_CONTINUE;
193 194 195 196

	presp = ieee80211_is_probe_resp(fc);
	if (presp) {
		/* ignore ProbeResp to foreign address */
197
		if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217
			return RX_DROP_MONITOR;

		presp = true;
		elements = mgmt->u.probe_resp.variable;
		baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
	} else {
		beacon = ieee80211_is_beacon(fc);
		baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable);
		elements = mgmt->u.beacon.variable;
	}

	if (!presp && !beacon)
		return RX_CONTINUE;

	if (baselen > skb->len)
		return RX_DROP_MONITOR;

	ieee802_11_parse_elems(elements, skb->len - baselen, &elems);

	if (elems.ds_params && elems.ds_params_len == 1)
218 219
		freq = ieee80211_channel_to_frequency(elems.ds_params[0],
						      rx_status->band);
220 221 222 223 224 225 226 227 228 229
	else
		freq = rx_status->freq;

	channel = ieee80211_get_channel(sdata->local->hw.wiphy, freq);

	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
		return RX_DROP_MONITOR;

	bss = ieee80211_bss_info_update(sdata->local, rx_status,
					mgmt, skb->len, &elems,
230
					channel, beacon);
231 232
	if (bss)
		ieee80211_rx_bss_put(sdata->local, bss);
233

234
	if (channel == sdata->local->oper_channel)
235 236
		return RX_CONTINUE;

237 238 239 240
	dev_kfree_skb(skb);
	return RX_QUEUED;
}

241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267
/* return false if no more work */
static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
{
	struct cfg80211_scan_request *req = local->scan_req;
	enum ieee80211_band band;
	int i, ielen, n_chans;

	do {
		if (local->hw_scan_band == IEEE80211_NUM_BANDS)
			return false;

		band = local->hw_scan_band;
		n_chans = 0;
		for (i = 0; i < req->n_channels; i++) {
			if (req->channels[i]->band == band) {
				local->hw_scan_req->channels[n_chans] =
							req->channels[i];
				n_chans++;
			}
		}

		local->hw_scan_band++;
	} while (!n_chans);

	local->hw_scan_req->n_channels = n_chans;

	ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
268
					 req->ie, req->ie_len, band,
269
					 req->rates[band], 0);
270
	local->hw_scan_req->ie_len = ielen;
271
	local->hw_scan_req->no_cck = req->no_cck;
272 273 274 275

	return true;
}

276
static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
277
				       bool was_hw_scan)
278 279 280
{
	struct ieee80211_local *local = hw_to_local(hw);

281
	lockdep_assert_held(&local->mtx);
282

283 284 285 286 287 288 289 290
	/*
	 * It's ok to abort a not-yet-running scan (that
	 * we have one at all will be verified by checking
	 * local->scan_req next), but not to complete it
	 * successfully.
	 */
	if (WARN_ON(!local->scanning && !aborted))
		aborted = true;
291

292
	if (WARN_ON(!local->scan_req))
293
		return;
294

295
	if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
296 297 298 299 300 301 302
		int rc;

		rc = drv_hw_scan(local,
			rcu_dereference_protected(local->scan_sdata,
						  lockdep_is_held(&local->mtx)),
			local->hw_scan_req);

303
		if (rc == 0)
304
			return;
305 306 307 308
	}

	kfree(local->hw_scan_req);
	local->hw_scan_req = NULL;
309

310
	if (local->scan_req != local->int_scan_req)
311 312
		cfg80211_scan_done(local->scan_req, aborted);
	local->scan_req = NULL;
313
	local->scan_sdata = NULL;
314

315
	local->scanning = 0;
J
Johannes Berg 已提交
316
	local->scan_channel = NULL;
317

318 319
	/* Set power back to normal operating levels. */
	ieee80211_hw_config(local, 0);
320

321 322 323
	if (!was_hw_scan) {
		ieee80211_configure_filter(local);
		drv_sw_scan_complete(local);
324
		ieee80211_offchannel_return(local, true);
325
	}
326

J
Johannes Berg 已提交
327
	ieee80211_recalc_idle(local);
328

329
	ieee80211_mlme_notify_scan_completed(local);
330
	ieee80211_ibss_notify_scan_completed(local);
331
	ieee80211_mesh_notify_scan_completed(local);
332
	ieee80211_start_next_roc(local);
333
}
334 335 336 337 338 339 340 341 342 343 344 345

void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
{
	struct ieee80211_local *local = hw_to_local(hw);

	trace_api_scan_completed(local, aborted);

	set_bit(SCAN_COMPLETED, &local->scanning);
	if (aborted)
		set_bit(SCAN_ABORTED, &local->scanning);
	ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
}
346 347
EXPORT_SYMBOL(ieee80211_scan_completed);

348 349 350 351 352 353 354 355 356 357 358 359 360 361 362
static int ieee80211_start_sw_scan(struct ieee80211_local *local)
{
	/*
	 * Hardware/driver doesn't support hw_scan, so use software
	 * scanning instead. First send a nullfunc frame with power save
	 * bit on so that AP will buffer the frames for us while we are not
	 * listening, then send probe requests to each channel and wait for
	 * the responses. After all channels are scanned, tune back to the
	 * original channel and send a nullfunc frame with power save bit
	 * off to trigger the AP to send us all the buffered frames.
	 *
	 * Note that while local->sw_scanning is true everything else but
	 * nullfunc frames and probe requests will be dropped in
	 * ieee80211_tx_h_check_assoc().
	 */
363
	drv_sw_scan_start(local);
364

365
	local->leave_oper_channel_time = jiffies;
366
	local->next_scan_state = SCAN_DECISION;
367 368
	local->scan_channel_idx = 0;

369
	ieee80211_offchannel_stop_vifs(local, true);
370

371
	ieee80211_configure_filter(local);
372

373 374 375
	/* We need to set power level at maximum rate for scanning. */
	ieee80211_hw_config(local, 0);

376
	ieee80211_queue_delayed_work(&local->hw,
377
				     &local->scan_work, 0);
378 379 380 381

	return 0;
}

382 383 384
static bool ieee80211_can_scan(struct ieee80211_local *local,
			       struct ieee80211_sub_if_data *sdata)
{
385
	if (!list_empty(&local->roc_list))
386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402
		return false;

	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    sdata->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
				  IEEE80211_STA_CONNECTION_POLL))
		return false;

	return true;
}

void ieee80211_run_deferred_scan(struct ieee80211_local *local)
{
	lockdep_assert_held(&local->mtx);

	if (!local->scan_req || local->scanning)
		return;

403 404 405 406
	if (!ieee80211_can_scan(local,
				rcu_dereference_protected(
					local->scan_sdata,
					lockdep_is_held(&local->mtx))))
407 408 409 410 411
		return;

	ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
				     round_jiffies_relative(0));
}
412

413 414 415 416
static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
					    unsigned long *next_delay)
{
	int i;
417
	struct ieee80211_sub_if_data *sdata;
418 419
	enum ieee80211_band band = local->hw.conf.channel->band;

420 421 422
	sdata = rcu_dereference_protected(local->scan_sdata,
					  lockdep_is_held(&local->mtx));;

423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439
	for (i = 0; i < local->scan_req->n_ssids; i++)
		ieee80211_send_probe_req(
			sdata, NULL,
			local->scan_req->ssids[i].ssid,
			local->scan_req->ssids[i].ssid_len,
			local->scan_req->ie, local->scan_req->ie_len,
			local->scan_req->rates[band], false,
			local->scan_req->no_cck);

	/*
	 * After sending probe requests, wait for probe responses
	 * on the channel.
	 */
	*next_delay = IEEE80211_CHANNEL_TIME;
	local->next_scan_state = SCAN_DECISION;
}

440 441 442 443 444 445
static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_scan_request *req)
{
	struct ieee80211_local *local = sdata->local;
	int rc;

446 447
	lockdep_assert_held(&local->mtx);

448 449 450
	if (local->scan_req)
		return -EBUSY;

451
	if (!ieee80211_can_scan(local, sdata)) {
452
		/* wait for the work to finish/time out */
453
		local->scan_req = req;
454
		rcu_assign_pointer(local->scan_sdata, sdata);
455 456 457
		return 0;
	}

458 459 460
	if (local->ops->hw_scan) {
		u8 *ies;

461 462 463 464 465 466
		local->hw_scan_req = kmalloc(
				sizeof(*local->hw_scan_req) +
				req->n_channels * sizeof(req->channels[0]) +
				2 + IEEE80211_MAX_SSID_LEN + local->scan_ies_len +
				req->ie_len, GFP_KERNEL);
		if (!local->hw_scan_req)
467 468
			return -ENOMEM;

469 470 471 472 473 474 475 476
		local->hw_scan_req->ssids = req->ssids;
		local->hw_scan_req->n_ssids = req->n_ssids;
		ies = (u8 *)local->hw_scan_req +
			sizeof(*local->hw_scan_req) +
			req->n_channels * sizeof(req->channels[0]);
		local->hw_scan_req->ie = ies;

		local->hw_scan_band = 0;
477 478 479 480 481 482 483 484

		/*
		 * After allocating local->hw_scan_req, we must
		 * go through until ieee80211_prep_hw_scan(), so
		 * anything that might be changed here and leave
		 * this function early must not go after this
		 * allocation.
		 */
485 486 487
	}

	local->scan_req = req;
488
	rcu_assign_pointer(local->scan_sdata, sdata);
489

490
	if (local->ops->hw_scan) {
491
		__set_bit(SCAN_HW_SCANNING, &local->scanning);
492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528
	} else if ((req->n_channels == 1) &&
		   (req->channels[0]->center_freq ==
		    local->hw.conf.channel->center_freq)) {

		/* If we are scanning only on the current channel, then
		 * we do not need to stop normal activities
		 */
		unsigned long next_delay;

		__set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);

		ieee80211_recalc_idle(local);

		/* Notify driver scan is starting, keep order of operations
		 * same as normal software scan, in case that matters. */
		drv_sw_scan_start(local);

		ieee80211_configure_filter(local); /* accept probe-responses */

		/* We need to ensure power level is at max for scanning. */
		ieee80211_hw_config(local, 0);

		if ((req->channels[0]->flags &
		     IEEE80211_CHAN_PASSIVE_SCAN) ||
		    !local->scan_req->n_ssids) {
			next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
		} else {
			ieee80211_scan_state_send_probe(local, &next_delay);
			next_delay = IEEE80211_CHANNEL_TIME;
		}

		/* Now, just wait a bit and we are all done! */
		ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
					     next_delay);
		return 0;
	} else {
		/* Do normal software scan */
529
		__set_bit(SCAN_SW_SCANNING, &local->scanning);
530
	}
531

J
Johannes Berg 已提交
532
	ieee80211_recalc_idle(local);
533

534 535
	if (local->ops->hw_scan) {
		WARN_ON(!ieee80211_prep_hw_scan(local));
536
		rc = drv_hw_scan(local, sdata, local->hw_scan_req);
537
	} else
538 539 540
		rc = ieee80211_start_sw_scan(local);

	if (rc) {
541 542
		kfree(local->hw_scan_req);
		local->hw_scan_req = NULL;
543
		local->scanning = 0;
544

J
Johannes Berg 已提交
545 546
		ieee80211_recalc_idle(local);

547
		local->scan_req = NULL;
548
		rcu_assign_pointer(local->scan_sdata, NULL);
549 550 551 552 553
	}

	return rc;
}

554 555 556 557 558 559 560 561 562 563 564 565
static unsigned long
ieee80211_scan_get_channel_time(struct ieee80211_channel *chan)
{
	/*
	 * TODO: channel switching also consumes quite some time,
	 * add that delay as well to get a better estimation
	 */
	if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
		return IEEE80211_PASSIVE_CHANNEL_TIME;
	return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME;
}

566 567
static void ieee80211_scan_state_decision(struct ieee80211_local *local,
					  unsigned long *next_delay)
H
Helmut Schaa 已提交
568
{
569
	bool associated = false;
570 571 572 573
	bool tx_empty = true;
	bool bad_latency;
	bool listen_int_exceeded;
	unsigned long min_beacon_int = 0;
574
	struct ieee80211_sub_if_data *sdata;
575
	struct ieee80211_channel *next_chan;
576

577 578 579 580 581
	/*
	 * check if at least one STA interface is associated,
	 * check if at least one STA interface has pending tx frames
	 * and grab the lowest used beacon interval
	 */
582 583
	mutex_lock(&local->iflist_mtx);
	list_for_each_entry(sdata, &local->interfaces, list) {
584
		if (!ieee80211_sdata_running(sdata))
585 586 587 588 589
			continue;

		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
			if (sdata->u.mgd.associated) {
				associated = true;
590 591 592 593 594 595 596 597 598 599

				if (sdata->vif.bss_conf.beacon_int <
				    min_beacon_int || min_beacon_int == 0)
					min_beacon_int =
						sdata->vif.bss_conf.beacon_int;

				if (!qdisc_all_tx_empty(sdata->dev)) {
					tx_empty = false;
					break;
				}
600 601 602 603 604
			}
		}
	}
	mutex_unlock(&local->iflist_mtx);

605 606
	next_chan = local->scan_req->channels[local->scan_channel_idx];

607
	/*
608 609 610 611 612 613 614 615 616 617 618 619 620
	 * we're currently scanning a different channel, let's
	 * see if we can scan another channel without interfering
	 * with the current traffic situation.
	 *
	 * Since we don't know if the AP has pending frames for us
	 * we can only check for our tx queues and use the current
	 * pm_qos requirements for rx. Hence, if no tx traffic occurs
	 * at all we will scan as many channels in a row as the pm_qos
	 * latency allows us to. Additionally we also check for the
	 * currently negotiated listen interval to prevent losing
	 * frames unnecessarily.
	 *
	 * Otherwise switch back to the operating channel.
621 622
	 */

623 624 625 626
	bad_latency = time_after(jiffies +
			ieee80211_scan_get_channel_time(next_chan),
			local->leave_oper_channel_time +
			usecs_to_jiffies(pm_qos_request(PM_QOS_NETWORK_LATENCY)));
627

628 629 630 631 632
	listen_int_exceeded = time_after(jiffies +
			ieee80211_scan_get_channel_time(next_chan),
			local->leave_oper_channel_time +
			usecs_to_jiffies(min_beacon_int * 1024) *
			local->hw.conf.listen_interval);
633

634 635 636 637
	if (associated && (!tx_empty || bad_latency || listen_int_exceeded))
		local->next_scan_state = SCAN_SUSPEND;
	else
		local->next_scan_state = SCAN_SET_CHANNEL;
638

639
	*next_delay = 0;
640 641
}

642 643 644 645 646 647
static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
					     unsigned long *next_delay)
{
	int skip;
	struct ieee80211_channel *chan;

H
Helmut Schaa 已提交
648 649 650
	skip = 0;
	chan = local->scan_req->channels[local->scan_channel_idx];

J
Johannes Berg 已提交
651
	local->scan_channel = chan;
652

653 654
	if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
		skip = 1;
H
Helmut Schaa 已提交
655 656 657 658

	/* advance state machine to next channel/band */
	local->scan_channel_idx++;

659 660 661
	if (skip) {
		/* if we skip this channel return to the decision state */
		local->next_scan_state = SCAN_DECISION;
662
		return;
663
	}
H
Helmut Schaa 已提交
664 665 666 667 668 669 670 671 672 673 674 675 676 677

	/*
	 * Probe delay is used to update the NAV, cf. 11.1.3.2.2
	 * (which unfortunately doesn't say _why_ step a) is done,
	 * but it waits for the probe delay or until a frame is
	 * received - and the received frame would update the NAV).
	 * For now, we do not support waiting until a frame is
	 * received.
	 *
	 * In any case, it is not necessary for a passive scan.
	 */
	if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
	    !local->scan_req->n_ssids) {
		*next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
678
		local->next_scan_state = SCAN_DECISION;
679
		return;
H
Helmut Schaa 已提交
680 681
	}

682
	/* active scan, send probes */
H
Helmut Schaa 已提交
683
	*next_delay = IEEE80211_PROBE_DELAY;
684
	local->next_scan_state = SCAN_SEND_PROBE;
H
Helmut Schaa 已提交
685 686
}

687 688 689 690 691 692 693 694 695 696 697 698
static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
					 unsigned long *next_delay)
{
	/* switch back to the operating channel */
	local->scan_channel = NULL;
	ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);

	/*
	 * Re-enable vifs and beaconing.  Leave PS
	 * in off-channel state..will put that back
	 * on-channel at the end of scanning.
	 */
699
	ieee80211_offchannel_return(local, false);
700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721

	*next_delay = HZ / 5;
	/* afterwards, resume scan & go to next channel */
	local->next_scan_state = SCAN_RESUME;
}

static void ieee80211_scan_state_resume(struct ieee80211_local *local,
					unsigned long *next_delay)
{
	/* PS already is in off-channel mode */
	ieee80211_offchannel_stop_vifs(local, false);

	if (local->ops->flush) {
		drv_flush(local, false);
		*next_delay = 0;
	} else
		*next_delay = HZ / 10;

	/* remember when we left the operating channel */
	local->leave_oper_channel_time = jiffies;

	/* advance to the next channel to be scanned */
722
	local->next_scan_state = SCAN_SET_CHANNEL;
723 724
}

725
void ieee80211_scan_work(struct work_struct *work)
726 727 728
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local, scan_work.work);
729
	struct ieee80211_sub_if_data *sdata;
730
	unsigned long next_delay = 0;
731
	bool aborted, hw_scan;
732

733
	mutex_lock(&local->mtx);
734

735 736
	sdata = rcu_dereference_protected(local->scan_sdata,
					  lockdep_is_held(&local->mtx));
737

738 739 740 741 742 743
	/* When scanning on-channel, the first-callback means completed. */
	if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) {
		aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
		goto out_complete;
	}

744
	if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) {
745
		aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
746
		goto out_complete;
747 748
	}

749 750
	if (!sdata || !local->scan_req)
		goto out;
751

752
	if (local->scan_req && !local->scanning) {
753 754 755 756
		struct cfg80211_scan_request *req = local->scan_req;
		int rc;

		local->scan_req = NULL;
757
		rcu_assign_pointer(local->scan_sdata, NULL);
758 759

		rc = __ieee80211_start_scan(sdata, req);
760
		if (rc) {
761 762
			/* need to complete scan in cfg80211 */
			local->scan_req = req;
763 764 765 766
			aborted = true;
			goto out_complete;
		} else
			goto out;
767 768
	}

769 770 771
	/*
	 * Avoid re-scheduling when the sdata is going away.
	 */
772
	if (!ieee80211_sdata_running(sdata)) {
773 774
		aborted = true;
		goto out_complete;
775
	}
776

777 778 779 780 781
	/*
	 * as long as no delay is required advance immediately
	 * without scheduling a new work
	 */
	do {
782 783 784 785 786
		if (!ieee80211_sdata_running(sdata)) {
			aborted = true;
			goto out_complete;
		}

787
		switch (local->next_scan_state) {
788
		case SCAN_DECISION:
789 790 791 792 793 794
			/* if no more bands/channels left, complete scan */
			if (local->scan_channel_idx >= local->scan_req->n_channels) {
				aborted = false;
				goto out_complete;
			}
			ieee80211_scan_state_decision(local, &next_delay);
795
			break;
796 797 798
		case SCAN_SET_CHANNEL:
			ieee80211_scan_state_set_channel(local, &next_delay);
			break;
799 800 801
		case SCAN_SEND_PROBE:
			ieee80211_scan_state_send_probe(local, &next_delay);
			break;
802 803
		case SCAN_SUSPEND:
			ieee80211_scan_state_suspend(local, &next_delay);
804
			break;
805 806
		case SCAN_RESUME:
			ieee80211_scan_state_resume(local, &next_delay);
807
			break;
808 809
		}
	} while (next_delay == 0);
810

811
	ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
812
	goto out;
813 814

out_complete:
815
	hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
816
	__ieee80211_scan_completed(&local->hw, aborted, hw_scan);
817 818
out:
	mutex_unlock(&local->mtx);
819 820
}

821 822
int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
			   struct cfg80211_scan_request *req)
823
{
824
	int res;
825

826
	mutex_lock(&sdata->local->mtx);
827
	res = __ieee80211_start_scan(sdata, req);
828
	mutex_unlock(&sdata->local->mtx);
829

830
	return res;
831 832
}

833
int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
834 835
				    const u8 *ssid, u8 ssid_len,
				    struct ieee80211_channel *chan)
836 837
{
	struct ieee80211_local *local = sdata->local;
838
	int ret = -EBUSY;
839
	enum ieee80211_band band;
840

841
	mutex_lock(&local->mtx);
842

843 844 845
	/* busy scanning */
	if (local->scan_req)
		goto unlock;
J
Johannes Berg 已提交
846

J
Johannes Berg 已提交
847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870
	/* fill internal scan request */
	if (!chan) {
		int i, nchan = 0;

		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
			if (!local->hw.wiphy->bands[band])
				continue;
			for (i = 0;
			     i < local->hw.wiphy->bands[band]->n_channels;
			     i++) {
				local->int_scan_req->channels[nchan] =
				    &local->hw.wiphy->bands[band]->channels[i];
				nchan++;
			}
		}

		local->int_scan_req->n_channels = nchan;
	} else {
		local->int_scan_req->channels[0] = chan;
		local->int_scan_req->n_channels = 1;
	}

	local->int_scan_req->ssids = &local->scan_ssid;
	local->int_scan_req->n_ssids = 1;
871 872
	memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
	local->int_scan_req->ssids[0].ssid_len = ssid_len;
J
Johannes Berg 已提交
873

874
	ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
875
 unlock:
876
	mutex_unlock(&local->mtx);
877
	return ret;
878
}
879

880 881 882
/*
 * Only call this function when a scan can't be queued -- under RTNL.
 */
883 884 885
void ieee80211_scan_cancel(struct ieee80211_local *local)
{
	/*
886
	 * We are canceling software scan, or deferred scan that was not
887 888 889 890 891 892 893 894 895 896 897
	 * yet really started (see __ieee80211_start_scan ).
	 *
	 * Regarding hardware scan:
	 * - we can not call  __ieee80211_scan_completed() as when
	 *   SCAN_HW_SCANNING bit is set this function change
	 *   local->hw_scan_req to operate on 5G band, what race with
	 *   driver which can use local->hw_scan_req
	 *
	 * - we can not cancel scan_work since driver can schedule it
	 *   by ieee80211_scan_completed(..., true) to finish scan
	 *
898 899 900
	 * Hence we only call the cancel_hw_scan() callback, but the low-level
	 * driver is still responsible for calling ieee80211_scan_completed()
	 * after the scan was completed/aborted.
901
	 */
902

903
	mutex_lock(&local->mtx);
904 905 906 907 908
	if (!local->scan_req)
		goto out;

	if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
		if (local->ops->cancel_hw_scan)
909 910 911
			drv_cancel_hw_scan(local,
				rcu_dereference_protected(local->scan_sdata,
						lockdep_is_held(&local->mtx)));
912
		goto out;
913
	}
914 915 916 917 918 919 920 921 922 923

	/*
	 * If the work is currently running, it must be blocked on
	 * the mutex, but we'll set scan_sdata = NULL and it'll
	 * simply exit once it acquires the mutex.
	 */
	cancel_delayed_work(&local->scan_work);
	/* and clean up */
	__ieee80211_scan_completed(&local->hw, true, false);
out:
924
	mutex_unlock(&local->mtx);
925
}
926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945

int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
				       struct cfg80211_sched_scan_request *req)
{
	struct ieee80211_local *local = sdata->local;
	int ret, i;

	mutex_lock(&sdata->local->mtx);

	if (local->sched_scanning) {
		ret = -EBUSY;
		goto out;
	}

	if (!local->ops->sched_scan_start) {
		ret = -ENOTSUPP;
		goto out;
	}

	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
946 947 948
		if (!local->hw.wiphy->bands[i])
			continue;

949 950
		local->sched_scan_ies.ie[i] = kzalloc(2 +
						      IEEE80211_MAX_SSID_LEN +
951 952
						      local->scan_ies_len +
						      req->ie_len,
953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980
						      GFP_KERNEL);
		if (!local->sched_scan_ies.ie[i]) {
			ret = -ENOMEM;
			goto out_free;
		}

		local->sched_scan_ies.len[i] =
			ieee80211_build_preq_ies(local,
						 local->sched_scan_ies.ie[i],
						 req->ie, req->ie_len, i,
						 (u32) -1, 0);
	}

	ret = drv_sched_scan_start(local, sdata, req,
				   &local->sched_scan_ies);
	if (ret == 0) {
		local->sched_scanning = true;
		goto out;
	}

out_free:
	while (i > 0)
		kfree(local->sched_scan_ies.ie[--i]);
out:
	mutex_unlock(&sdata->local->mtx);
	return ret;
}

981
int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
982 983 984 985 986 987 988 989 990 991 992 993 994 995 996
{
	struct ieee80211_local *local = sdata->local;
	int ret = 0, i;

	mutex_lock(&sdata->local->mtx);

	if (!local->ops->sched_scan_stop) {
		ret = -ENOTSUPP;
		goto out;
	}

	if (local->sched_scanning) {
		for (i = 0; i < IEEE80211_NUM_BANDS; i++)
			kfree(local->sched_scan_ies.ie[i]);

997
		drv_sched_scan_stop(local, sdata);
998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015
		local->sched_scanning = false;
	}
out:
	mutex_unlock(&sdata->local->mtx);

	return ret;
}

void ieee80211_sched_scan_results(struct ieee80211_hw *hw)
{
	struct ieee80211_local *local = hw_to_local(hw);

	trace_api_sched_scan_results(local);

	cfg80211_sched_scan_results(hw->wiphy);
}
EXPORT_SYMBOL(ieee80211_sched_scan_results);

1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039
void ieee80211_sched_scan_stopped_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     sched_scan_stopped_work);
	int i;

	mutex_lock(&local->mtx);

	if (!local->sched_scanning) {
		mutex_unlock(&local->mtx);
		return;
	}

	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
		kfree(local->sched_scan_ies.ie[i]);

	local->sched_scanning = false;

	mutex_unlock(&local->mtx);

	cfg80211_sched_scan_stopped(local->hw.wiphy);
}

1040 1041 1042 1043 1044 1045
void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
{
	struct ieee80211_local *local = hw_to_local(hw);

	trace_api_sched_scan_stopped(local);

1046
	ieee80211_queue_work(&local->hw, &local->sched_scan_stopped_work);
1047 1048
}
EXPORT_SYMBOL(ieee80211_sched_scan_stopped);