2 * Scanning implementation
4 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
5 * Copyright 2004, Instant802 Networks, Inc.
6 * Copyright 2005, Devicescape Software, Inc.
7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 * figure out how to avoid that the "current BSS" expires
17 * clean up IBSS code (in MLME), see why it adds a BSS to the list
18 * use cfg80211's BSS handling (depends on IBSS TODO above)
19 * order BSS list by RSSI(?) ("quality of AP")
20 * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
24 #include <linux/wireless.h>
25 #include <linux/if_arp.h>
26 #include <linux/rtnetlink.h>
27 #include <net/mac80211.h>
28 #include <net/iw_handler.h>
30 #include "ieee80211_i.h"
33 #define IEEE80211_PROBE_DELAY (HZ / 33)
34 #define IEEE80211_CHANNEL_TIME (HZ / 33)
35 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
37 void ieee80211_rx_bss_list_init(struct ieee80211_local *local)
39 spin_lock_init(&local->bss_lock);
40 INIT_LIST_HEAD(&local->bss_list);
43 void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local)
45 struct ieee80211_bss *bss, *tmp;
47 list_for_each_entry_safe(bss, tmp, &local->bss_list, list)
48 ieee80211_rx_bss_put(local, bss);
51 struct ieee80211_bss *
52 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
53 u8 *ssid, u8 ssid_len)
55 struct ieee80211_bss *bss;
57 spin_lock_bh(&local->bss_lock);
58 bss = local->bss_hash[STA_HASH(bssid)];
60 if (!bss_mesh_cfg(bss) &&
61 !memcmp(bss->bssid, bssid, ETH_ALEN) &&
63 bss->ssid_len == ssid_len &&
64 (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
65 atomic_inc(&bss->users);
70 spin_unlock_bh(&local->bss_lock);
74 /* Caller must hold local->bss_lock */
75 static void __ieee80211_rx_bss_hash_add(struct ieee80211_local *local,
76 struct ieee80211_bss *bss)
80 if (bss_mesh_cfg(bss))
81 hash_idx = mesh_id_hash(bss_mesh_id(bss),
82 bss_mesh_id_len(bss));
84 hash_idx = STA_HASH(bss->bssid);
86 bss->hnext = local->bss_hash[hash_idx];
87 local->bss_hash[hash_idx] = bss;
90 /* Caller must hold local->bss_lock */
91 static void __ieee80211_rx_bss_hash_del(struct ieee80211_local *local,
92 struct ieee80211_bss *bss)
94 struct ieee80211_bss *b, *prev = NULL;
95 b = local->bss_hash[STA_HASH(bss->bssid)];
99 local->bss_hash[STA_HASH(bss->bssid)] =
102 prev->hnext = bss->hnext;
110 struct ieee80211_bss *
111 ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
112 u8 *ssid, u8 ssid_len)
114 struct ieee80211_bss *bss;
116 bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
119 atomic_set(&bss->users, 2);
120 memcpy(bss->bssid, bssid, ETH_ALEN);
122 if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
123 memcpy(bss->ssid, ssid, ssid_len);
124 bss->ssid_len = ssid_len;
127 spin_lock_bh(&local->bss_lock);
128 /* TODO: order by RSSI? */
129 list_add_tail(&bss->list, &local->bss_list);
130 __ieee80211_rx_bss_hash_add(local, bss);
131 spin_unlock_bh(&local->bss_lock);
135 #ifdef CONFIG_MAC80211_MESH
136 static struct ieee80211_bss *
137 ieee80211_rx_mesh_bss_get(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
138 u8 *mesh_cfg, int freq)
140 struct ieee80211_bss *bss;
142 spin_lock_bh(&local->bss_lock);
143 bss = local->bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
145 if (bss_mesh_cfg(bss) &&
146 !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
148 mesh_id_len == bss->mesh_id_len &&
149 (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
151 atomic_inc(&bss->users);
156 spin_unlock_bh(&local->bss_lock);
160 static struct ieee80211_bss *
161 ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
162 u8 *mesh_cfg, int mesh_config_len, int freq)
164 struct ieee80211_bss *bss;
166 if (mesh_config_len != IEEE80211_MESH_CONFIG_LEN)
169 bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
173 bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
174 if (!bss->mesh_cfg) {
179 if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
180 bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
182 kfree(bss->mesh_cfg);
186 memcpy(bss->mesh_id, mesh_id, mesh_id_len);
189 atomic_set(&bss->users, 2);
190 memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
191 bss->mesh_id_len = mesh_id_len;
193 spin_lock_bh(&local->bss_lock);
194 /* TODO: order by RSSI? */
195 list_add_tail(&bss->list, &local->bss_list);
196 __ieee80211_rx_bss_hash_add(local, bss);
197 spin_unlock_bh(&local->bss_lock);
202 static void ieee80211_rx_bss_free(struct ieee80211_bss *bss)
205 kfree(bss_mesh_id(bss));
206 kfree(bss_mesh_cfg(bss));
210 void ieee80211_rx_bss_put(struct ieee80211_local *local,
211 struct ieee80211_bss *bss)
214 if (!atomic_dec_and_lock(&bss->users, &local->bss_lock)) {
219 __ieee80211_rx_bss_hash_del(local, bss);
220 list_del(&bss->list);
221 spin_unlock_bh(&local->bss_lock);
222 ieee80211_rx_bss_free(bss);
225 struct ieee80211_bss *
226 ieee80211_bss_info_update(struct ieee80211_local *local,
227 struct ieee80211_rx_status *rx_status,
228 struct ieee80211_mgmt *mgmt,
230 struct ieee802_11_elems *elems,
231 struct ieee80211_channel *channel,
234 struct ieee80211_bss *bss;
235 int clen, freq = channel->center_freq;
236 enum cfg80211_signal_type sigtype = CFG80211_SIGNAL_TYPE_NONE;
239 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
240 sigtype = CFG80211_SIGNAL_TYPE_MBM;
241 signal = rx_status->signal * 100;
242 } else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC) {
243 sigtype = CFG80211_SIGNAL_TYPE_UNSPEC;
244 signal = (rx_status->signal * 100) / local->hw.max_signal;
248 cfg80211_inform_bss_frame(local->hw.wiphy, channel,
249 mgmt, len, signal, sigtype,
252 #ifdef CONFIG_MAC80211_MESH
253 if (elems->mesh_config)
254 bss = ieee80211_rx_mesh_bss_get(local, elems->mesh_id,
255 elems->mesh_id_len, elems->mesh_config, freq);
258 bss = ieee80211_rx_bss_get(local, mgmt->bssid, freq,
259 elems->ssid, elems->ssid_len);
261 #ifdef CONFIG_MAC80211_MESH
262 if (elems->mesh_config)
263 bss = ieee80211_rx_mesh_bss_add(local, elems->mesh_id,
264 elems->mesh_id_len, elems->mesh_config,
265 elems->mesh_config_len, freq);
268 bss = ieee80211_rx_bss_add(local, mgmt->bssid, freq,
269 elems->ssid, elems->ssid_len);
274 /* TODO: order by RSSI? */
275 spin_lock_bh(&local->bss_lock);
276 list_move_tail(&bss->list, &local->bss_list);
277 spin_unlock_bh(&local->bss_lock);
281 /* save the ERP value so that it is available at association time */
282 if (elems->erp_info && elems->erp_info_len >= 1) {
283 bss->erp_value = elems->erp_info[0];
284 bss->has_erp_value = 1;
287 bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
288 bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
291 struct ieee80211_tim_ie *tim_ie =
292 (struct ieee80211_tim_ie *)elems->tim;
293 bss->dtim_period = tim_ie->dtim_period;
296 /* set default value for buggy APs */
297 if (!elems->tim || bss->dtim_period == 0)
298 bss->dtim_period = 1;
300 bss->supp_rates_len = 0;
301 if (elems->supp_rates) {
302 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
303 if (clen > elems->supp_rates_len)
304 clen = elems->supp_rates_len;
305 memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
307 bss->supp_rates_len += clen;
309 if (elems->ext_supp_rates) {
310 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
311 if (clen > elems->ext_supp_rates_len)
312 clen = elems->ext_supp_rates_len;
313 memcpy(&bss->supp_rates[bss->supp_rates_len],
314 elems->ext_supp_rates, clen);
315 bss->supp_rates_len += clen;
318 bss->band = rx_status->band;
320 bss->timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
321 bss->last_update = jiffies;
322 bss->signal = rx_status->signal;
323 bss->noise = rx_status->noise;
324 bss->qual = rx_status->qual;
325 bss->wmm_used = elems->wmm_param || elems->wmm_info;
328 bss->last_probe_resp = jiffies;
331 * For probe responses, or if we don't have any information yet,
332 * use the IEs from the beacon.
334 if (!bss->ies || !beacon) {
335 if (bss->ies == NULL || bss->ies_len < elems->total_len) {
337 bss->ies = kmalloc(elems->total_len, GFP_ATOMIC);
340 memcpy(bss->ies, elems->ie_start, elems->total_len);
341 bss->ies_len = elems->total_len;
349 void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
350 int freq, u8 *ssid, u8 ssid_len)
352 struct ieee80211_bss *bss;
353 struct ieee80211_local *local = sdata->local;
355 bss = ieee80211_rx_bss_get(local, bssid, freq, ssid, ssid_len);
357 atomic_dec(&bss->users);
358 ieee80211_rx_bss_put(local, bss);
363 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
364 struct ieee80211_rx_status *rx_status)
366 struct ieee80211_mgmt *mgmt;
367 struct ieee80211_bss *bss;
369 struct ieee80211_channel *channel;
373 bool presp, beacon = false;
374 struct ieee802_11_elems elems;
377 return RX_DROP_UNUSABLE;
379 mgmt = (struct ieee80211_mgmt *) skb->data;
380 fc = mgmt->frame_control;
382 if (ieee80211_is_ctl(fc))
386 return RX_DROP_MONITOR;
388 presp = ieee80211_is_probe_resp(fc);
390 /* ignore ProbeResp to foreign address */
391 if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
392 return RX_DROP_MONITOR;
395 elements = mgmt->u.probe_resp.variable;
396 baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
398 beacon = ieee80211_is_beacon(fc);
399 baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable);
400 elements = mgmt->u.beacon.variable;
403 if (!presp && !beacon)
406 if (baselen > skb->len)
407 return RX_DROP_MONITOR;
409 ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
411 if (elems.ds_params && elems.ds_params_len == 1)
412 freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
414 freq = rx_status->freq;
416 channel = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
418 if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
419 return RX_DROP_MONITOR;
421 bss = ieee80211_bss_info_update(sdata->local, rx_status,
422 mgmt, skb->len, &elems,
425 ieee80211_rx_bss_put(sdata->local, bss);
431 void ieee80211_send_nullfunc(struct ieee80211_local *local,
432 struct ieee80211_sub_if_data *sdata,
436 struct ieee80211_hdr *nullfunc;
439 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
441 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
442 "frame\n", sdata->dev->name);
445 skb_reserve(skb, local->hw.extra_tx_headroom);
447 nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
448 memset(nullfunc, 0, 24);
449 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
450 IEEE80211_FCTL_TODS);
452 fc |= cpu_to_le16(IEEE80211_FCTL_PM);
453 nullfunc->frame_control = fc;
454 memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
455 memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
456 memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
458 ieee80211_tx_skb(sdata, skb, 0);
461 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
463 struct ieee80211_local *local = hw_to_local(hw);
464 struct ieee80211_sub_if_data *sdata;
466 if (WARN_ON(!local->hw_scanning && !local->sw_scanning))
469 if (WARN_ON(!local->scan_req))
472 if (local->scan_req != &local->int_scan_req)
473 cfg80211_scan_done(local->scan_req, aborted);
474 local->scan_req = NULL;
476 local->last_scan_completed = jiffies;
478 if (local->hw_scanning) {
479 local->hw_scanning = false;
481 * Somebody might have requested channel change during scan
482 * that we won't have acted upon, try now. ieee80211_hw_config
483 * will set the flag based on actual changes.
485 ieee80211_hw_config(local, 0);
489 local->sw_scanning = false;
490 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
492 netif_tx_lock_bh(local->mdev);
493 netif_addr_lock(local->mdev);
494 local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
495 local->ops->configure_filter(local_to_hw(local),
496 FIF_BCN_PRBRESP_PROMISC,
497 &local->filter_flags,
498 local->mdev->mc_count,
499 local->mdev->mc_list);
501 netif_addr_unlock(local->mdev);
502 netif_tx_unlock_bh(local->mdev);
504 mutex_lock(&local->iflist_mtx);
505 list_for_each_entry(sdata, &local->interfaces, list) {
506 if (!netif_running(sdata->dev))
509 /* Tell AP we're back */
510 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
511 if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
512 ieee80211_send_nullfunc(local, sdata, 0);
513 netif_tx_wake_all_queues(sdata->dev);
516 netif_tx_wake_all_queues(sdata->dev);
518 /* re-enable beaconing */
519 if (sdata->vif.type == NL80211_IFTYPE_AP ||
520 sdata->vif.type == NL80211_IFTYPE_ADHOC ||
521 sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
522 ieee80211_if_config(sdata,
523 IEEE80211_IFCC_BEACON_ENABLED);
525 mutex_unlock(&local->iflist_mtx);
528 ieee80211_mlme_notify_scan_completed(local);
529 ieee80211_mesh_notify_scan_completed(local);
531 EXPORT_SYMBOL(ieee80211_scan_completed);
533 void ieee80211_scan_work(struct work_struct *work)
535 struct ieee80211_local *local =
536 container_of(work, struct ieee80211_local, scan_work.work);
537 struct ieee80211_sub_if_data *sdata = local->scan_sdata;
538 struct ieee80211_channel *chan;
540 unsigned long next_delay = 0;
543 * Avoid re-scheduling when the sdata is going away.
545 if (!netif_running(sdata->dev))
548 switch (local->scan_state) {
549 case SCAN_SET_CHANNEL:
550 /* if no more bands/channels left, complete scan */
551 if (local->scan_channel_idx >= local->scan_req->n_channels) {
552 ieee80211_scan_completed(local_to_hw(local), false);
556 chan = local->scan_req->channels[local->scan_channel_idx];
558 if (chan->flags & IEEE80211_CHAN_DISABLED ||
559 (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
560 chan->flags & IEEE80211_CHAN_NO_IBSS))
564 local->scan_channel = chan;
565 if (ieee80211_hw_config(local,
566 IEEE80211_CONF_CHANGE_CHANNEL))
570 /* advance state machine to next channel/band */
571 local->scan_channel_idx++;
576 next_delay = IEEE80211_PROBE_DELAY +
577 usecs_to_jiffies(local->hw.channel_change_time);
578 local->scan_state = SCAN_SEND_PROBE;
580 case SCAN_SEND_PROBE:
581 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
582 local->scan_state = SCAN_SET_CHANNEL;
584 if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
585 !local->scan_req->n_ssids)
587 for (i = 0; i < local->scan_req->n_ssids; i++)
588 ieee80211_send_probe_req(
590 local->scan_req->ssids[i].ssid,
591 local->scan_req->ssids[i].ssid_len);
592 next_delay = IEEE80211_CHANNEL_TIME;
596 queue_delayed_work(local->hw.workqueue, &local->scan_work,
601 int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
602 struct cfg80211_scan_request *req)
604 struct ieee80211_local *local = scan_sdata->local;
605 struct ieee80211_sub_if_data *sdata;
610 if (local->scan_req && local->scan_req != req)
613 local->scan_req = req;
615 /* MLME-SCAN.request (page 118) page 144 (11.1.3.1)
616 * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
619 * ScanType: ACTIVE, PASSIVE
620 * ProbeDelay: delay (in microseconds) to be used prior to transmitting
621 * a Probe frame during active scanning
623 * MinChannelTime (>= ProbeDelay), in TU
624 * MaxChannelTime: (>= MinChannelTime), in TU
629 * ResultCode: SUCCESS, INVALID_PARAMETERS
632 if (local->sw_scanning || local->hw_scanning) {
633 if (local->scan_sdata == scan_sdata)
638 if (local->ops->hw_scan) {
641 local->hw_scanning = true;
642 rc = local->ops->hw_scan(local_to_hw(local), req);
644 local->hw_scanning = false;
647 local->scan_sdata = scan_sdata;
651 local->sw_scanning = true;
653 mutex_lock(&local->iflist_mtx);
654 list_for_each_entry(sdata, &local->interfaces, list) {
655 if (!netif_running(sdata->dev))
658 /* disable beaconing */
659 if (sdata->vif.type == NL80211_IFTYPE_AP ||
660 sdata->vif.type == NL80211_IFTYPE_ADHOC ||
661 sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
662 ieee80211_if_config(sdata,
663 IEEE80211_IFCC_BEACON_ENABLED);
665 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
666 if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
667 netif_tx_stop_all_queues(sdata->dev);
668 ieee80211_send_nullfunc(local, sdata, 1);
671 netif_tx_stop_all_queues(sdata->dev);
673 mutex_unlock(&local->iflist_mtx);
675 local->scan_state = SCAN_SET_CHANNEL;
676 local->scan_channel_idx = 0;
677 local->scan_sdata = scan_sdata;
678 local->scan_req = req;
680 netif_addr_lock_bh(local->mdev);
681 local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
682 local->ops->configure_filter(local_to_hw(local),
683 FIF_BCN_PRBRESP_PROMISC,
684 &local->filter_flags,
685 local->mdev->mc_count,
686 local->mdev->mc_list);
687 netif_addr_unlock_bh(local->mdev);
689 /* TODO: start scan as soon as all nullfunc frames are ACKed */
690 queue_delayed_work(local->hw.workqueue, &local->scan_work,
691 IEEE80211_CHANNEL_TIME);
697 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
698 struct cfg80211_scan_request *req)
700 struct ieee80211_local *local = sdata->local;
701 struct ieee80211_if_sta *ifsta;
706 if (local->scan_req && local->scan_req != req)
709 local->scan_req = req;
711 if (sdata->vif.type != NL80211_IFTYPE_STATION)
712 return ieee80211_start_scan(sdata, req);
715 * STA has a state machine that might need to defer scanning
716 * while it's trying to associate/authenticate, therefore we
717 * queue it up to the state machine in that case.
720 if (local->sw_scanning || local->hw_scanning) {
721 if (local->scan_sdata == sdata)
726 ifsta = &sdata->u.sta;
727 set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
728 queue_work(local->hw.workqueue, &ifsta->work);