1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * Scanning implementation 4 * 5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 6 * Copyright 2004, Instant802 Networks, Inc. 7 * Copyright 2005, Devicescape Software, Inc. 8 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 10 * Copyright 2013-2015 Intel Mobile Communications GmbH 11 * Copyright 2016-2017 Intel Deutschland GmbH 12 * Copyright (C) 2018-2020 Intel Corporation 13 */ 14 15#include <linux/if_arp.h> 16#include <linux/etherdevice.h> 17#include <linux/rtnetlink.h> 18#include <net/sch_generic.h> 19#include <linux/slab.h> 20#include <linux/export.h> 21#include <linux/random.h> 22#include <net/mac80211.h> 23 24#include "ieee80211_i.h" 25#include "driver-ops.h" 26#include "mesh.h" 27 28#define IEEE80211_PROBE_DELAY (HZ / 33) 29#define IEEE80211_CHANNEL_TIME (HZ / 33) 30#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9) 31 32void ieee80211_rx_bss_put(struct ieee80211_local *local, 33 struct ieee80211_bss *bss) 34{ 35 if (!bss) 36 return; 37 cfg80211_put_bss(local->hw.wiphy, 38 container_of((void *)bss, struct cfg80211_bss, priv)); 39} 40 41static bool is_uapsd_supported(struct ieee802_11_elems *elems) 42{ 43 u8 qos_info; 44 45 if (elems->wmm_info && elems->wmm_info_len == 7 46 && elems->wmm_info[5] == 1) 47 qos_info = elems->wmm_info[6]; 48 else if (elems->wmm_param && elems->wmm_param_len == 24 49 && elems->wmm_param[5] == 1) 50 qos_info = elems->wmm_param[6]; 51 else 52 /* no valid wmm information or parameter element found */ 53 return false; 54 55 return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD; 56} 57 58static void 59ieee80211_update_bss_from_elems(struct ieee80211_local *local, 60 struct ieee80211_bss *bss, 61 struct ieee802_11_elems *elems, 62 struct ieee80211_rx_status *rx_status, 63 bool beacon) 64{ 65 int clen, srlen; 66 67 if (beacon) 68 bss->device_ts_beacon = rx_status->device_timestamp; 69 else 70 bss->device_ts_presp = rx_status->device_timestamp; 71 72 if (elems->parse_error) { 73 if (beacon) 74 bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON; 75 else 76 bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP; 77 } else { 78 if (beacon) 79 bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON; 80 else 81 bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP; 82 } 83 84 /* save the ERP value so that it is available at association time */ 85 if (elems->erp_info && (!elems->parse_error || 86 !(bss->valid_data & IEEE80211_BSS_VALID_ERP))) { 87 bss->erp_value = elems->erp_info[0]; 88 bss->has_erp_value = true; 89 if (!elems->parse_error) 90 bss->valid_data |= IEEE80211_BSS_VALID_ERP; 91 } 92 93 /* replace old supported rates if we get new values */ 94 if (!elems->parse_error || 95 !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) { 96 srlen = 0; 97 if (elems->supp_rates) { 98 clen = IEEE80211_MAX_SUPP_RATES; 99 if (clen > elems->supp_rates_len) 100 clen = elems->supp_rates_len; 101 memcpy(bss->supp_rates, elems->supp_rates, clen); 102 srlen += clen; 103 } 104 if (elems->ext_supp_rates) { 105 clen = IEEE80211_MAX_SUPP_RATES - srlen; 106 if (clen > elems->ext_supp_rates_len) 107 clen = elems->ext_supp_rates_len; 108 memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, 109 clen); 110 srlen += clen; 111 } 112 if (srlen) { 113 bss->supp_rates_len = srlen; 114 if (!elems->parse_error) 115 bss->valid_data |= IEEE80211_BSS_VALID_RATES; 116 } 117 } 118 119 if (!elems->parse_error || 120 !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) { 121 bss->wmm_used = elems->wmm_param || elems->wmm_info; 122 bss->uapsd_supported = is_uapsd_supported(elems); 123 if (!elems->parse_error) 124 bss->valid_data |= IEEE80211_BSS_VALID_WMM; 125 } 126 127 if (beacon) { 128 struct ieee80211_supported_band *sband = 129 local->hw.wiphy->bands[rx_status->band]; 130 if (!(rx_status->encoding == RX_ENC_HT) && 131 !(rx_status->encoding == RX_ENC_VHT)) 132 bss->beacon_rate = 133 &sband->bitrates[rx_status->rate_idx]; 134 } 135 136 if (elems->vht_cap_elem) 137 bss->vht_cap_info = 138 le32_to_cpu(elems->vht_cap_elem->vht_cap_info); 139 else 140 bss->vht_cap_info = 0; 141} 142 143struct ieee80211_bss * 144ieee80211_bss_info_update(struct ieee80211_local *local, 145 struct ieee80211_rx_status *rx_status, 146 struct ieee80211_mgmt *mgmt, size_t len, 147 struct ieee80211_channel *channel) 148{ 149 bool beacon = ieee80211_is_beacon(mgmt->frame_control) || 150 ieee80211_is_s1g_beacon(mgmt->frame_control); 151 struct cfg80211_bss *cbss, *non_tx_cbss; 152 struct ieee80211_bss *bss, *non_tx_bss; 153 struct cfg80211_inform_bss bss_meta = { 154 .boottime_ns = rx_status->boottime_ns, 155 }; 156 bool signal_valid; 157 struct ieee80211_sub_if_data *scan_sdata; 158 struct ieee802_11_elems elems; 159 size_t baselen; 160 u8 *elements; 161 162 if (rx_status->flag & RX_FLAG_NO_SIGNAL_VAL) 163 bss_meta.signal = 0; /* invalid signal indication */ 164 else if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 165 bss_meta.signal = rx_status->signal * 100; 166 else if (ieee80211_hw_check(&local->hw, SIGNAL_UNSPEC)) 167 bss_meta.signal = (rx_status->signal * 100) / local->hw.max_signal; 168 169 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_20; 170 if (rx_status->bw == RATE_INFO_BW_5) 171 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_5; 172 else if (rx_status->bw == RATE_INFO_BW_10) 173 bss_meta.scan_width = NL80211_BSS_CHAN_WIDTH_10; 174 175 bss_meta.chan = channel; 176 177 rcu_read_lock(); 178 scan_sdata = rcu_dereference(local->scan_sdata); 179 if (scan_sdata && scan_sdata->vif.type == NL80211_IFTYPE_STATION && 180 scan_sdata->vif.bss_conf.assoc && 181 ieee80211_have_rx_timestamp(rx_status)) { 182 bss_meta.parent_tsf = 183 ieee80211_calculate_rx_timestamp(local, rx_status, 184 len + FCS_LEN, 24); 185 ether_addr_copy(bss_meta.parent_bssid, 186 scan_sdata->vif.bss_conf.bssid); 187 } 188 rcu_read_unlock(); 189 190 cbss = cfg80211_inform_bss_frame_data(local->hw.wiphy, &bss_meta, 191 mgmt, len, GFP_ATOMIC); 192 if (!cbss) 193 return NULL; 194 195 if (ieee80211_is_probe_resp(mgmt->frame_control)) { 196 elements = mgmt->u.probe_resp.variable; 197 baselen = offsetof(struct ieee80211_mgmt, 198 u.probe_resp.variable); 199 } else if (ieee80211_is_s1g_beacon(mgmt->frame_control)) { 200 struct ieee80211_ext *ext = (void *) mgmt; 201 202 baselen = offsetof(struct ieee80211_ext, u.s1g_beacon.variable); 203 elements = ext->u.s1g_beacon.variable; 204 } else { 205 baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable); 206 elements = mgmt->u.beacon.variable; 207 } 208 209 if (baselen > len) 210 return NULL; 211 212 ieee802_11_parse_elems(elements, len - baselen, false, &elems, 213 mgmt->bssid, cbss->bssid); 214 215 /* In case the signal is invalid update the status */ 216 signal_valid = channel == cbss->channel; 217 if (!signal_valid) 218 rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL; 219 220 bss = (void *)cbss->priv; 221 ieee80211_update_bss_from_elems(local, bss, &elems, rx_status, beacon); 222 223 list_for_each_entry(non_tx_cbss, &cbss->nontrans_list, nontrans_list) { 224 non_tx_bss = (void *)non_tx_cbss->priv; 225 226 ieee80211_update_bss_from_elems(local, non_tx_bss, &elems, 227 rx_status, beacon); 228 } 229 230 kfree(elems.nontx_profile); 231 232 return bss; 233} 234 235static bool ieee80211_scan_accept_presp(struct ieee80211_sub_if_data *sdata, 236 u32 scan_flags, const u8 *da) 237{ 238 if (!sdata) 239 return false; 240 /* accept broadcast for OCE */ 241 if (scan_flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP && 242 is_broadcast_ether_addr(da)) 243 return true; 244 if (scan_flags & NL80211_SCAN_FLAG_RANDOM_ADDR) 245 return true; 246 return ether_addr_equal(da, sdata->vif.addr); 247} 248 249void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb) 250{ 251 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb); 252 struct ieee80211_sub_if_data *sdata1, *sdata2; 253 struct ieee80211_mgmt *mgmt = (void *)skb->data; 254 struct ieee80211_bss *bss; 255 struct ieee80211_channel *channel; 256 size_t min_hdr_len = offsetof(struct ieee80211_mgmt, 257 u.probe_resp.variable); 258 259 if (!ieee80211_is_probe_resp(mgmt->frame_control) && 260 !ieee80211_is_beacon(mgmt->frame_control) && 261 !ieee80211_is_s1g_beacon(mgmt->frame_control)) 262 return; 263 264 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) { 265 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control)) 266 min_hdr_len = offsetof(struct ieee80211_ext, 267 u.s1g_short_beacon.variable); 268 else 269 min_hdr_len = offsetof(struct ieee80211_ext, 270 u.s1g_beacon); 271 } 272 273 if (skb->len < min_hdr_len) 274 return; 275 276 sdata1 = rcu_dereference(local->scan_sdata); 277 sdata2 = rcu_dereference(local->sched_scan_sdata); 278 279 if (likely(!sdata1 && !sdata2)) 280 return; 281 282 if (test_and_clear_bit(SCAN_BEACON_WAIT, &local->scanning)) { 283 /* 284 * we were passive scanning because of radar/no-IR, but 285 * the beacon/proberesp rx gives us an opportunity to upgrade 286 * to active scan 287 */ 288 set_bit(SCAN_BEACON_DONE, &local->scanning); 289 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0); 290 } 291 292 if (ieee80211_is_probe_resp(mgmt->frame_control)) { 293 struct cfg80211_scan_request *scan_req; 294 struct cfg80211_sched_scan_request *sched_scan_req; 295 u32 scan_req_flags = 0, sched_scan_req_flags = 0; 296 297 scan_req = rcu_dereference(local->scan_req); 298 sched_scan_req = rcu_dereference(local->sched_scan_req); 299 300 if (scan_req) 301 scan_req_flags = scan_req->flags; 302 303 if (sched_scan_req) 304 sched_scan_req_flags = sched_scan_req->flags; 305 306 /* ignore ProbeResp to foreign address or non-bcast (OCE) 307 * unless scanning with randomised address 308 */ 309 if (!ieee80211_scan_accept_presp(sdata1, scan_req_flags, 310 mgmt->da) && 311 !ieee80211_scan_accept_presp(sdata2, sched_scan_req_flags, 312 mgmt->da)) 313 return; 314 } 315 316 channel = ieee80211_get_channel_khz(local->hw.wiphy, 317 ieee80211_rx_status_to_khz(rx_status)); 318 319 if (!channel || channel->flags & IEEE80211_CHAN_DISABLED) 320 return; 321 322 bss = ieee80211_bss_info_update(local, rx_status, 323 mgmt, skb->len, 324 channel); 325 if (bss) 326 ieee80211_rx_bss_put(local, bss); 327} 328 329static void 330ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef, 331 enum nl80211_bss_scan_width scan_width) 332{ 333 memset(chandef, 0, sizeof(*chandef)); 334 switch (scan_width) { 335 case NL80211_BSS_CHAN_WIDTH_5: 336 chandef->width = NL80211_CHAN_WIDTH_5; 337 break; 338 case NL80211_BSS_CHAN_WIDTH_10: 339 chandef->width = NL80211_CHAN_WIDTH_10; 340 break; 341 default: 342 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 343 break; 344 } 345} 346 347/* return false if no more work */ 348static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) 349{ 350 struct ieee80211_local *local = sdata->local; 351 struct cfg80211_scan_request *req; 352 struct cfg80211_chan_def chandef; 353 u8 bands_used = 0; 354 int i, ielen, n_chans; 355 u32 flags = 0; 356 357 req = rcu_dereference_protected(local->scan_req, 358 lockdep_is_held(&local->mtx)); 359 360 if (test_bit(SCAN_HW_CANCELLED, &local->scanning)) 361 return false; 362 363 if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { 364 for (i = 0; i < req->n_channels; i++) { 365 local->hw_scan_req->req.channels[i] = req->channels[i]; 366 bands_used |= BIT(req->channels[i]->band); 367 } 368 369 n_chans = req->n_channels; 370 } else { 371 do { 372 if (local->hw_scan_band == NUM_NL80211_BANDS) 373 return false; 374 375 n_chans = 0; 376 377 for (i = 0; i < req->n_channels; i++) { 378 if (req->channels[i]->band != 379 local->hw_scan_band) 380 continue; 381 local->hw_scan_req->req.channels[n_chans] = 382 req->channels[i]; 383 n_chans++; 384 bands_used |= BIT(req->channels[i]->band); 385 } 386 387 local->hw_scan_band++; 388 } while (!n_chans); 389 } 390 391 local->hw_scan_req->req.n_channels = n_chans; 392 ieee80211_prepare_scan_chandef(&chandef, req->scan_width); 393 394 if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT) 395 flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT; 396 397 ielen = ieee80211_build_preq_ies(sdata, 398 (u8 *)local->hw_scan_req->req.ie, 399 local->hw_scan_ies_bufsize, 400 &local->hw_scan_req->ies, 401 req->ie, req->ie_len, 402 bands_used, req->rates, &chandef, 403 flags); 404 local->hw_scan_req->req.ie_len = ielen; 405 local->hw_scan_req->req.no_cck = req->no_cck; 406 ether_addr_copy(local->hw_scan_req->req.mac_addr, req->mac_addr); 407 ether_addr_copy(local->hw_scan_req->req.mac_addr_mask, 408 req->mac_addr_mask); 409 ether_addr_copy(local->hw_scan_req->req.bssid, req->bssid); 410 411 return true; 412} 413 414static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) 415{ 416 struct ieee80211_local *local = hw_to_local(hw); 417 bool hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning); 418 bool was_scanning = local->scanning; 419 struct cfg80211_scan_request *scan_req; 420 struct ieee80211_sub_if_data *scan_sdata; 421 struct ieee80211_sub_if_data *sdata; 422 423 lockdep_assert_held(&local->mtx); 424 425 /* 426 * It's ok to abort a not-yet-running scan (that 427 * we have one at all will be verified by checking 428 * local->scan_req next), but not to complete it 429 * successfully. 430 */ 431 if (WARN_ON(!local->scanning && !aborted)) 432 aborted = true; 433 434 if (WARN_ON(!local->scan_req)) 435 return; 436 437 scan_sdata = rcu_dereference_protected(local->scan_sdata, 438 lockdep_is_held(&local->mtx)); 439 440 if (hw_scan && !aborted && 441 !ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS) && 442 ieee80211_prep_hw_scan(scan_sdata)) { 443 int rc; 444 445 rc = drv_hw_scan(local, 446 rcu_dereference_protected(local->scan_sdata, 447 lockdep_is_held(&local->mtx)), 448 local->hw_scan_req); 449 450 if (rc == 0) 451 return; 452 453 /* HW scan failed and is going to be reported as aborted, 454 * so clear old scan info. 455 */ 456 memset(&local->scan_info, 0, sizeof(local->scan_info)); 457 aborted = true; 458 } 459 460 kfree(local->hw_scan_req); 461 local->hw_scan_req = NULL; 462 463 scan_req = rcu_dereference_protected(local->scan_req, 464 lockdep_is_held(&local->mtx)); 465 466 RCU_INIT_POINTER(local->scan_req, NULL); 467 RCU_INIT_POINTER(local->scan_sdata, NULL); 468 469 local->scanning = 0; 470 local->scan_chandef.chan = NULL; 471 472 synchronize_rcu(); 473 474 if (scan_req != local->int_scan_req) { 475 local->scan_info.aborted = aborted; 476 cfg80211_scan_done(scan_req, &local->scan_info); 477 } 478 479 /* Set power back to normal operating levels. */ 480 ieee80211_hw_config(local, 0); 481 482 if (!hw_scan) { 483 ieee80211_configure_filter(local); 484 drv_sw_scan_complete(local, scan_sdata); 485 ieee80211_offchannel_return(local); 486 } 487 488 ieee80211_recalc_idle(local); 489 490 ieee80211_mlme_notify_scan_completed(local); 491 ieee80211_ibss_notify_scan_completed(local); 492 493 /* Requeue all the work that might have been ignored while 494 * the scan was in progress; if there was none this will 495 * just be a no-op for the particular interface. 496 */ 497 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 498 if (ieee80211_sdata_running(sdata)) 499 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 500 } 501 502 if (was_scanning) 503 ieee80211_start_next_roc(local); 504} 505 506void ieee80211_scan_completed(struct ieee80211_hw *hw, 507 struct cfg80211_scan_info *info) 508{ 509 struct ieee80211_local *local = hw_to_local(hw); 510 511 trace_api_scan_completed(local, info->aborted); 512 513 set_bit(SCAN_COMPLETED, &local->scanning); 514 if (info->aborted) 515 set_bit(SCAN_ABORTED, &local->scanning); 516 517 memcpy(&local->scan_info, info, sizeof(*info)); 518 519 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0); 520} 521EXPORT_SYMBOL(ieee80211_scan_completed); 522 523static int ieee80211_start_sw_scan(struct ieee80211_local *local, 524 struct ieee80211_sub_if_data *sdata) 525{ 526 /* Software scan is not supported in multi-channel cases */ 527 if (local->use_chanctx) 528 return -EOPNOTSUPP; 529 530 /* 531 * Hardware/driver doesn't support hw_scan, so use software 532 * scanning instead. First send a nullfunc frame with power save 533 * bit on so that AP will buffer the frames for us while we are not 534 * listening, then send probe requests to each channel and wait for 535 * the responses. After all channels are scanned, tune back to the 536 * original channel and send a nullfunc frame with power save bit 537 * off to trigger the AP to send us all the buffered frames. 538 * 539 * Note that while local->sw_scanning is true everything else but 540 * nullfunc frames and probe requests will be dropped in 541 * ieee80211_tx_h_check_assoc(). 542 */ 543 drv_sw_scan_start(local, sdata, local->scan_addr); 544 545 local->leave_oper_channel_time = jiffies; 546 local->next_scan_state = SCAN_DECISION; 547 local->scan_channel_idx = 0; 548 549 ieee80211_offchannel_stop_vifs(local); 550 551 /* ensure nullfunc is transmitted before leaving operating channel */ 552 ieee80211_flush_queues(local, NULL, false); 553 554 ieee80211_configure_filter(local); 555 556 /* We need to set power level at maximum rate for scanning. */ 557 ieee80211_hw_config(local, 0); 558 559 ieee80211_queue_delayed_work(&local->hw, 560 &local->scan_work, 0); 561 562 return 0; 563} 564 565static bool __ieee80211_can_leave_ch(struct ieee80211_sub_if_data *sdata) 566{ 567 struct ieee80211_local *local = sdata->local; 568 struct ieee80211_sub_if_data *sdata_iter; 569 570 if (!ieee80211_is_radar_required(local)) 571 return true; 572 573 if (!regulatory_pre_cac_allowed(local->hw.wiphy)) 574 return false; 575 576 mutex_lock(&local->iflist_mtx); 577 list_for_each_entry(sdata_iter, &local->interfaces, list) { 578 if (sdata_iter->wdev.cac_started) { 579 mutex_unlock(&local->iflist_mtx); 580 return false; 581 } 582 } 583 mutex_unlock(&local->iflist_mtx); 584 585 return true; 586} 587 588static bool ieee80211_can_scan(struct ieee80211_local *local, 589 struct ieee80211_sub_if_data *sdata) 590{ 591 if (!__ieee80211_can_leave_ch(sdata)) 592 return false; 593 594 if (!list_empty(&local->roc_list)) 595 return false; 596 597 if (sdata->vif.type == NL80211_IFTYPE_STATION && 598 sdata->u.mgd.flags & IEEE80211_STA_CONNECTION_POLL) 599 return false; 600 601 return true; 602} 603 604void ieee80211_run_deferred_scan(struct ieee80211_local *local) 605{ 606 lockdep_assert_held(&local->mtx); 607 608 if (!local->scan_req || local->scanning) 609 return; 610 611 if (!ieee80211_can_scan(local, 612 rcu_dereference_protected( 613 local->scan_sdata, 614 lockdep_is_held(&local->mtx)))) 615 return; 616 617 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 618 round_jiffies_relative(0)); 619} 620 621static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata, 622 const u8 *src, const u8 *dst, 623 const u8 *ssid, size_t ssid_len, 624 const u8 *ie, size_t ie_len, 625 u32 ratemask, u32 flags, u32 tx_flags, 626 struct ieee80211_channel *channel) 627{ 628 struct sk_buff *skb; 629 630 skb = ieee80211_build_probe_req(sdata, src, dst, ratemask, channel, 631 ssid, ssid_len, 632 ie, ie_len, flags); 633 634 if (skb) { 635 if (flags & IEEE80211_PROBE_FLAG_RANDOM_SN) { 636 struct ieee80211_hdr *hdr = (void *)skb->data; 637 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 638 u16 sn = get_random_u32(); 639 640 info->control.flags |= IEEE80211_TX_CTRL_NO_SEQNO; 641 hdr->seq_ctrl = 642 cpu_to_le16(IEEE80211_SN_TO_SEQ(sn)); 643 } 644 IEEE80211_SKB_CB(skb)->flags |= tx_flags; 645 ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band); 646 } 647} 648 649static void ieee80211_scan_state_send_probe(struct ieee80211_local *local, 650 unsigned long *next_delay) 651{ 652 int i; 653 struct ieee80211_sub_if_data *sdata; 654 struct cfg80211_scan_request *scan_req; 655 enum nl80211_band band = local->hw.conf.chandef.chan->band; 656 u32 flags = 0, tx_flags; 657 658 scan_req = rcu_dereference_protected(local->scan_req, 659 lockdep_is_held(&local->mtx)); 660 661 tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK; 662 if (scan_req->no_cck) 663 tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE; 664 if (scan_req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT) 665 flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT; 666 if (scan_req->flags & NL80211_SCAN_FLAG_RANDOM_SN) 667 flags |= IEEE80211_PROBE_FLAG_RANDOM_SN; 668 669 sdata = rcu_dereference_protected(local->scan_sdata, 670 lockdep_is_held(&local->mtx)); 671 672 for (i = 0; i < scan_req->n_ssids; i++) 673 ieee80211_send_scan_probe_req( 674 sdata, local->scan_addr, scan_req->bssid, 675 scan_req->ssids[i].ssid, scan_req->ssids[i].ssid_len, 676 scan_req->ie, scan_req->ie_len, 677 scan_req->rates[band], flags, 678 tx_flags, local->hw.conf.chandef.chan); 679 680 /* 681 * After sending probe requests, wait for probe responses 682 * on the channel. 683 */ 684 *next_delay = IEEE80211_CHANNEL_TIME; 685 local->next_scan_state = SCAN_DECISION; 686} 687 688static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, 689 struct cfg80211_scan_request *req) 690{ 691 struct ieee80211_local *local = sdata->local; 692 bool hw_scan = local->ops->hw_scan; 693 int rc; 694 695 lockdep_assert_held(&local->mtx); 696 697 if (local->scan_req) 698 return -EBUSY; 699 700 if (!__ieee80211_can_leave_ch(sdata)) 701 return -EBUSY; 702 703 if (!ieee80211_can_scan(local, sdata)) { 704 /* wait for the work to finish/time out */ 705 rcu_assign_pointer(local->scan_req, req); 706 rcu_assign_pointer(local->scan_sdata, sdata); 707 return 0; 708 } 709 710 again: 711 if (hw_scan) { 712 u8 *ies; 713 714 local->hw_scan_ies_bufsize = local->scan_ies_len + req->ie_len; 715 716 if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { 717 int i, n_bands = 0; 718 u8 bands_counted = 0; 719 720 for (i = 0; i < req->n_channels; i++) { 721 if (bands_counted & BIT(req->channels[i]->band)) 722 continue; 723 bands_counted |= BIT(req->channels[i]->band); 724 n_bands++; 725 } 726 727 local->hw_scan_ies_bufsize *= n_bands; 728 } 729 730 local->hw_scan_req = kmalloc( 731 sizeof(*local->hw_scan_req) + 732 req->n_channels * sizeof(req->channels[0]) + 733 local->hw_scan_ies_bufsize, GFP_KERNEL); 734 if (!local->hw_scan_req) 735 return -ENOMEM; 736 737 local->hw_scan_req->req.ssids = req->ssids; 738 local->hw_scan_req->req.n_ssids = req->n_ssids; 739 ies = (u8 *)local->hw_scan_req + 740 sizeof(*local->hw_scan_req) + 741 req->n_channels * sizeof(req->channels[0]); 742 local->hw_scan_req->req.ie = ies; 743 local->hw_scan_req->req.flags = req->flags; 744 eth_broadcast_addr(local->hw_scan_req->req.bssid); 745 local->hw_scan_req->req.duration = req->duration; 746 local->hw_scan_req->req.duration_mandatory = 747 req->duration_mandatory; 748 749 local->hw_scan_band = 0; 750 local->hw_scan_req->req.n_6ghz_params = req->n_6ghz_params; 751 local->hw_scan_req->req.scan_6ghz_params = 752 req->scan_6ghz_params; 753 local->hw_scan_req->req.scan_6ghz = req->scan_6ghz; 754 755 /* 756 * After allocating local->hw_scan_req, we must 757 * go through until ieee80211_prep_hw_scan(), so 758 * anything that might be changed here and leave 759 * this function early must not go after this 760 * allocation. 761 */ 762 } 763 764 rcu_assign_pointer(local->scan_req, req); 765 rcu_assign_pointer(local->scan_sdata, sdata); 766 767 if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) 768 get_random_mask_addr(local->scan_addr, 769 req->mac_addr, 770 req->mac_addr_mask); 771 else 772 memcpy(local->scan_addr, sdata->vif.addr, ETH_ALEN); 773 774 if (hw_scan) { 775 __set_bit(SCAN_HW_SCANNING, &local->scanning); 776 } else if ((req->n_channels == 1) && 777 (req->channels[0] == local->_oper_chandef.chan)) { 778 /* 779 * If we are scanning only on the operating channel 780 * then we do not need to stop normal activities 781 */ 782 unsigned long next_delay; 783 784 __set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning); 785 786 ieee80211_recalc_idle(local); 787 788 /* Notify driver scan is starting, keep order of operations 789 * same as normal software scan, in case that matters. */ 790 drv_sw_scan_start(local, sdata, local->scan_addr); 791 792 ieee80211_configure_filter(local); /* accept probe-responses */ 793 794 /* We need to ensure power level is at max for scanning. */ 795 ieee80211_hw_config(local, 0); 796 797 if ((req->channels[0]->flags & (IEEE80211_CHAN_NO_IR | 798 IEEE80211_CHAN_RADAR)) || 799 !req->n_ssids) { 800 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; 801 if (req->n_ssids) 802 set_bit(SCAN_BEACON_WAIT, &local->scanning); 803 } else { 804 ieee80211_scan_state_send_probe(local, &next_delay); 805 next_delay = IEEE80211_CHANNEL_TIME; 806 } 807 808 /* Now, just wait a bit and we are all done! */ 809 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 810 next_delay); 811 return 0; 812 } else { 813 /* Do normal software scan */ 814 __set_bit(SCAN_SW_SCANNING, &local->scanning); 815 } 816 817 ieee80211_recalc_idle(local); 818 819 if (hw_scan) { 820 WARN_ON(!ieee80211_prep_hw_scan(sdata)); 821 rc = drv_hw_scan(local, sdata, local->hw_scan_req); 822 } else { 823 rc = ieee80211_start_sw_scan(local, sdata); 824 } 825 826 if (rc) { 827 kfree(local->hw_scan_req); 828 local->hw_scan_req = NULL; 829 local->scanning = 0; 830 831 ieee80211_recalc_idle(local); 832 833 local->scan_req = NULL; 834 RCU_INIT_POINTER(local->scan_sdata, NULL); 835 } 836 837 if (hw_scan && rc == 1) { 838 /* 839 * we can't fall back to software for P2P-GO 840 * as it must update NoA etc. 841 */ 842 if (ieee80211_vif_type_p2p(&sdata->vif) == 843 NL80211_IFTYPE_P2P_GO) 844 return -EOPNOTSUPP; 845 hw_scan = false; 846 goto again; 847 } 848 849 return rc; 850} 851 852static unsigned long 853ieee80211_scan_get_channel_time(struct ieee80211_channel *chan) 854{ 855 /* 856 * TODO: channel switching also consumes quite some time, 857 * add that delay as well to get a better estimation 858 */ 859 if (chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) 860 return IEEE80211_PASSIVE_CHANNEL_TIME; 861 return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME; 862} 863 864static void ieee80211_scan_state_decision(struct ieee80211_local *local, 865 unsigned long *next_delay) 866{ 867 bool associated = false; 868 bool tx_empty = true; 869 bool bad_latency; 870 struct ieee80211_sub_if_data *sdata; 871 struct ieee80211_channel *next_chan; 872 enum mac80211_scan_state next_scan_state; 873 struct cfg80211_scan_request *scan_req; 874 875 /* 876 * check if at least one STA interface is associated, 877 * check if at least one STA interface has pending tx frames 878 * and grab the lowest used beacon interval 879 */ 880 mutex_lock(&local->iflist_mtx); 881 list_for_each_entry(sdata, &local->interfaces, list) { 882 if (!ieee80211_sdata_running(sdata)) 883 continue; 884 885 if (sdata->vif.type == NL80211_IFTYPE_STATION) { 886 if (sdata->u.mgd.associated) { 887 associated = true; 888 889 if (!qdisc_all_tx_empty(sdata->dev)) { 890 tx_empty = false; 891 break; 892 } 893 } 894 } 895 } 896 mutex_unlock(&local->iflist_mtx); 897 898 scan_req = rcu_dereference_protected(local->scan_req, 899 lockdep_is_held(&local->mtx)); 900 901 next_chan = scan_req->channels[local->scan_channel_idx]; 902 903 /* 904 * we're currently scanning a different channel, let's 905 * see if we can scan another channel without interfering 906 * with the current traffic situation. 907 * 908 * Keep good latency, do not stay off-channel more than 125 ms. 909 */ 910 911 bad_latency = time_after(jiffies + 912 ieee80211_scan_get_channel_time(next_chan), 913 local->leave_oper_channel_time + HZ / 8); 914 915 if (associated && !tx_empty) { 916 if (scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) 917 next_scan_state = SCAN_ABORT; 918 else 919 next_scan_state = SCAN_SUSPEND; 920 } else if (associated && bad_latency) { 921 next_scan_state = SCAN_SUSPEND; 922 } else { 923 next_scan_state = SCAN_SET_CHANNEL; 924 } 925 926 local->next_scan_state = next_scan_state; 927 928 *next_delay = 0; 929} 930 931static void ieee80211_scan_state_set_channel(struct ieee80211_local *local, 932 unsigned long *next_delay) 933{ 934 int skip; 935 struct ieee80211_channel *chan; 936 enum nl80211_bss_scan_width oper_scan_width; 937 struct cfg80211_scan_request *scan_req; 938 939 scan_req = rcu_dereference_protected(local->scan_req, 940 lockdep_is_held(&local->mtx)); 941 942 skip = 0; 943 chan = scan_req->channels[local->scan_channel_idx]; 944 945 local->scan_chandef.chan = chan; 946 local->scan_chandef.center_freq1 = chan->center_freq; 947 local->scan_chandef.freq1_offset = chan->freq_offset; 948 local->scan_chandef.center_freq2 = 0; 949 950 /* For scanning on the S1G band, ignore scan_width (which is constant 951 * across all channels) for now since channel width is specific to each 952 * channel. Detect the required channel width here and likely revisit 953 * later. Maybe scan_width could be used to build the channel scan list? 954 */ 955 if (chan->band == NL80211_BAND_S1GHZ) { 956 local->scan_chandef.width = ieee80211_s1g_channel_width(chan); 957 goto set_channel; 958 } 959 960 switch (scan_req->scan_width) { 961 case NL80211_BSS_CHAN_WIDTH_5: 962 local->scan_chandef.width = NL80211_CHAN_WIDTH_5; 963 break; 964 case NL80211_BSS_CHAN_WIDTH_10: 965 local->scan_chandef.width = NL80211_CHAN_WIDTH_10; 966 break; 967 default: 968 case NL80211_BSS_CHAN_WIDTH_20: 969 /* If scanning on oper channel, use whatever channel-type 970 * is currently in use. 971 */ 972 oper_scan_width = cfg80211_chandef_to_scan_width( 973 &local->_oper_chandef); 974 if (chan == local->_oper_chandef.chan && 975 oper_scan_width == scan_req->scan_width) 976 local->scan_chandef = local->_oper_chandef; 977 else 978 local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT; 979 break; 980 case NL80211_BSS_CHAN_WIDTH_1: 981 case NL80211_BSS_CHAN_WIDTH_2: 982 /* shouldn't get here, S1G handled above */ 983 WARN_ON(1); 984 break; 985 } 986 987set_channel: 988 if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL)) 989 skip = 1; 990 991 /* advance state machine to next channel/band */ 992 local->scan_channel_idx++; 993 994 if (skip) { 995 /* if we skip this channel return to the decision state */ 996 local->next_scan_state = SCAN_DECISION; 997 return; 998 } 999 1000 /* 1001 * Probe delay is used to update the NAV, cf. 11.1.3.2.2 1002 * (which unfortunately doesn't say _why_ step a) is done, 1003 * but it waits for the probe delay or until a frame is 1004 * received - and the received frame would update the NAV). 1005 * For now, we do not support waiting until a frame is 1006 * received. 1007 * 1008 * In any case, it is not necessary for a passive scan. 1009 */ 1010 if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) || 1011 !scan_req->n_ssids) { 1012 *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; 1013 local->next_scan_state = SCAN_DECISION; 1014 if (scan_req->n_ssids) 1015 set_bit(SCAN_BEACON_WAIT, &local->scanning); 1016 return; 1017 } 1018 1019 /* active scan, send probes */ 1020 *next_delay = IEEE80211_PROBE_DELAY; 1021 local->next_scan_state = SCAN_SEND_PROBE; 1022} 1023 1024static void ieee80211_scan_state_suspend(struct ieee80211_local *local, 1025 unsigned long *next_delay) 1026{ 1027 /* switch back to the operating channel */ 1028 local->scan_chandef.chan = NULL; 1029 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL); 1030 1031 /* disable PS */ 1032 ieee80211_offchannel_return(local); 1033 1034 *next_delay = HZ / 5; 1035 /* afterwards, resume scan & go to next channel */ 1036 local->next_scan_state = SCAN_RESUME; 1037} 1038 1039static void ieee80211_scan_state_resume(struct ieee80211_local *local, 1040 unsigned long *next_delay) 1041{ 1042 ieee80211_offchannel_stop_vifs(local); 1043 1044 if (local->ops->flush) { 1045 ieee80211_flush_queues(local, NULL, false); 1046 *next_delay = 0; 1047 } else 1048 *next_delay = HZ / 10; 1049 1050 /* remember when we left the operating channel */ 1051 local->leave_oper_channel_time = jiffies; 1052 1053 /* advance to the next channel to be scanned */ 1054 local->next_scan_state = SCAN_SET_CHANNEL; 1055} 1056 1057void ieee80211_scan_work(struct work_struct *work) 1058{ 1059 struct ieee80211_local *local = 1060 container_of(work, struct ieee80211_local, scan_work.work); 1061 struct ieee80211_sub_if_data *sdata; 1062 struct cfg80211_scan_request *scan_req; 1063 unsigned long next_delay = 0; 1064 bool aborted; 1065 1066 mutex_lock(&local->mtx); 1067 1068 if (!ieee80211_can_run_worker(local)) { 1069 aborted = true; 1070 goto out_complete; 1071 } 1072 1073 sdata = rcu_dereference_protected(local->scan_sdata, 1074 lockdep_is_held(&local->mtx)); 1075 scan_req = rcu_dereference_protected(local->scan_req, 1076 lockdep_is_held(&local->mtx)); 1077 1078 /* When scanning on-channel, the first-callback means completed. */ 1079 if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) { 1080 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning); 1081 goto out_complete; 1082 } 1083 1084 if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) { 1085 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning); 1086 goto out_complete; 1087 } 1088 1089 if (!sdata || !scan_req) 1090 goto out; 1091 1092 if (!local->scanning) { 1093 int rc; 1094 1095 RCU_INIT_POINTER(local->scan_req, NULL); 1096 RCU_INIT_POINTER(local->scan_sdata, NULL); 1097 1098 rc = __ieee80211_start_scan(sdata, scan_req); 1099 if (rc) { 1100 /* need to complete scan in cfg80211 */ 1101 rcu_assign_pointer(local->scan_req, scan_req); 1102 aborted = true; 1103 goto out_complete; 1104 } else 1105 goto out; 1106 } 1107 1108 clear_bit(SCAN_BEACON_WAIT, &local->scanning); 1109 1110 /* 1111 * as long as no delay is required advance immediately 1112 * without scheduling a new work 1113 */ 1114 do { 1115 if (!ieee80211_sdata_running(sdata)) { 1116 aborted = true; 1117 goto out_complete; 1118 } 1119 1120 if (test_and_clear_bit(SCAN_BEACON_DONE, &local->scanning) && 1121 local->next_scan_state == SCAN_DECISION) 1122 local->next_scan_state = SCAN_SEND_PROBE; 1123 1124 switch (local->next_scan_state) { 1125 case SCAN_DECISION: 1126 /* if no more bands/channels left, complete scan */ 1127 if (local->scan_channel_idx >= scan_req->n_channels) { 1128 aborted = false; 1129 goto out_complete; 1130 } 1131 ieee80211_scan_state_decision(local, &next_delay); 1132 break; 1133 case SCAN_SET_CHANNEL: 1134 ieee80211_scan_state_set_channel(local, &next_delay); 1135 break; 1136 case SCAN_SEND_PROBE: 1137 ieee80211_scan_state_send_probe(local, &next_delay); 1138 break; 1139 case SCAN_SUSPEND: 1140 ieee80211_scan_state_suspend(local, &next_delay); 1141 break; 1142 case SCAN_RESUME: 1143 ieee80211_scan_state_resume(local, &next_delay); 1144 break; 1145 case SCAN_ABORT: 1146 aborted = true; 1147 goto out_complete; 1148 } 1149 } while (next_delay == 0); 1150 1151 ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay); 1152 goto out; 1153 1154out_complete: 1155 __ieee80211_scan_completed(&local->hw, aborted); 1156out: 1157 mutex_unlock(&local->mtx); 1158} 1159 1160int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata, 1161 struct cfg80211_scan_request *req) 1162{ 1163 int res; 1164 1165 mutex_lock(&sdata->local->mtx); 1166 res = __ieee80211_start_scan(sdata, req); 1167 mutex_unlock(&sdata->local->mtx); 1168 1169 return res; 1170} 1171 1172int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata, 1173 const u8 *ssid, u8 ssid_len, 1174 struct ieee80211_channel **channels, 1175 unsigned int n_channels, 1176 enum nl80211_bss_scan_width scan_width) 1177{ 1178 struct ieee80211_local *local = sdata->local; 1179 int ret = -EBUSY, i, n_ch = 0; 1180 enum nl80211_band band; 1181 1182 mutex_lock(&local->mtx); 1183 1184 /* busy scanning */ 1185 if (local->scan_req) 1186 goto unlock; 1187 1188 /* fill internal scan request */ 1189 if (!channels) { 1190 int max_n; 1191 1192 for (band = 0; band < NUM_NL80211_BANDS; band++) { 1193 if (!local->hw.wiphy->bands[band] || 1194 band == NL80211_BAND_6GHZ) 1195 continue; 1196 1197 max_n = local->hw.wiphy->bands[band]->n_channels; 1198 for (i = 0; i < max_n; i++) { 1199 struct ieee80211_channel *tmp_ch = 1200 &local->hw.wiphy->bands[band]->channels[i]; 1201 1202 if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR | 1203 IEEE80211_CHAN_DISABLED)) 1204 continue; 1205 1206 local->int_scan_req->channels[n_ch] = tmp_ch; 1207 n_ch++; 1208 } 1209 } 1210 1211 if (WARN_ON_ONCE(n_ch == 0)) 1212 goto unlock; 1213 1214 local->int_scan_req->n_channels = n_ch; 1215 } else { 1216 for (i = 0; i < n_channels; i++) { 1217 if (channels[i]->flags & (IEEE80211_CHAN_NO_IR | 1218 IEEE80211_CHAN_DISABLED)) 1219 continue; 1220 1221 local->int_scan_req->channels[n_ch] = channels[i]; 1222 n_ch++; 1223 } 1224 1225 if (WARN_ON_ONCE(n_ch == 0)) 1226 goto unlock; 1227 1228 local->int_scan_req->n_channels = n_ch; 1229 } 1230 1231 local->int_scan_req->ssids = &local->scan_ssid; 1232 local->int_scan_req->n_ssids = 1; 1233 local->int_scan_req->scan_width = scan_width; 1234 memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN); 1235 local->int_scan_req->ssids[0].ssid_len = ssid_len; 1236 1237 ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req); 1238 unlock: 1239 mutex_unlock(&local->mtx); 1240 return ret; 1241} 1242 1243/* 1244 * Only call this function when a scan can't be queued -- under RTNL. 1245 */ 1246void ieee80211_scan_cancel(struct ieee80211_local *local) 1247{ 1248 /* 1249 * We are canceling software scan, or deferred scan that was not 1250 * yet really started (see __ieee80211_start_scan ). 1251 * 1252 * Regarding hardware scan: 1253 * - we can not call __ieee80211_scan_completed() as when 1254 * SCAN_HW_SCANNING bit is set this function change 1255 * local->hw_scan_req to operate on 5G band, what race with 1256 * driver which can use local->hw_scan_req 1257 * 1258 * - we can not cancel scan_work since driver can schedule it 1259 * by ieee80211_scan_completed(..., true) to finish scan 1260 * 1261 * Hence we only call the cancel_hw_scan() callback, but the low-level 1262 * driver is still responsible for calling ieee80211_scan_completed() 1263 * after the scan was completed/aborted. 1264 */ 1265 1266 mutex_lock(&local->mtx); 1267 if (!local->scan_req) 1268 goto out; 1269 1270 /* 1271 * We have a scan running and the driver already reported completion, 1272 * but the worker hasn't run yet or is stuck on the mutex - mark it as 1273 * cancelled. 1274 */ 1275 if (test_bit(SCAN_HW_SCANNING, &local->scanning) && 1276 test_bit(SCAN_COMPLETED, &local->scanning)) { 1277 set_bit(SCAN_HW_CANCELLED, &local->scanning); 1278 goto out; 1279 } 1280 1281 if (test_bit(SCAN_HW_SCANNING, &local->scanning)) { 1282 /* 1283 * Make sure that __ieee80211_scan_completed doesn't trigger a 1284 * scan on another band. 1285 */ 1286 set_bit(SCAN_HW_CANCELLED, &local->scanning); 1287 if (local->ops->cancel_hw_scan) 1288 drv_cancel_hw_scan(local, 1289 rcu_dereference_protected(local->scan_sdata, 1290 lockdep_is_held(&local->mtx))); 1291 goto out; 1292 } 1293 1294 /* 1295 * If the work is currently running, it must be blocked on 1296 * the mutex, but we'll set scan_sdata = NULL and it'll 1297 * simply exit once it acquires the mutex. 1298 */ 1299 cancel_delayed_work(&local->scan_work); 1300 /* and clean up */ 1301 memset(&local->scan_info, 0, sizeof(local->scan_info)); 1302 __ieee80211_scan_completed(&local->hw, true); 1303out: 1304 mutex_unlock(&local->mtx); 1305} 1306 1307int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, 1308 struct cfg80211_sched_scan_request *req) 1309{ 1310 struct ieee80211_local *local = sdata->local; 1311 struct ieee80211_scan_ies sched_scan_ies = {}; 1312 struct cfg80211_chan_def chandef; 1313 int ret, i, iebufsz, num_bands = 0; 1314 u32 rate_masks[NUM_NL80211_BANDS] = {}; 1315 u8 bands_used = 0; 1316 u8 *ie; 1317 u32 flags = 0; 1318 1319 iebufsz = local->scan_ies_len + req->ie_len; 1320 1321 lockdep_assert_held(&local->mtx); 1322 1323 if (!local->ops->sched_scan_start) 1324 return -ENOTSUPP; 1325 1326 for (i = 0; i < NUM_NL80211_BANDS; i++) { 1327 if (local->hw.wiphy->bands[i]) { 1328 bands_used |= BIT(i); 1329 rate_masks[i] = (u32) -1; 1330 num_bands++; 1331 } 1332 } 1333 1334 if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT) 1335 flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT; 1336 1337 ie = kcalloc(iebufsz, num_bands, GFP_KERNEL); 1338 if (!ie) { 1339 ret = -ENOMEM; 1340 goto out; 1341 } 1342 1343 ieee80211_prepare_scan_chandef(&chandef, req->scan_width); 1344 1345 ieee80211_build_preq_ies(sdata, ie, num_bands * iebufsz, 1346 &sched_scan_ies, req->ie, 1347 req->ie_len, bands_used, rate_masks, &chandef, 1348 flags); 1349 1350 ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies); 1351 if (ret == 0) { 1352 rcu_assign_pointer(local->sched_scan_sdata, sdata); 1353 rcu_assign_pointer(local->sched_scan_req, req); 1354 } 1355 1356 kfree(ie); 1357 1358out: 1359 if (ret) { 1360 /* Clean in case of failure after HW restart or upon resume. */ 1361 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1362 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1363 } 1364 1365 return ret; 1366} 1367 1368int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, 1369 struct cfg80211_sched_scan_request *req) 1370{ 1371 struct ieee80211_local *local = sdata->local; 1372 int ret; 1373 1374 mutex_lock(&local->mtx); 1375 1376 if (rcu_access_pointer(local->sched_scan_sdata)) { 1377 mutex_unlock(&local->mtx); 1378 return -EBUSY; 1379 } 1380 1381 ret = __ieee80211_request_sched_scan_start(sdata, req); 1382 1383 mutex_unlock(&local->mtx); 1384 return ret; 1385} 1386 1387int ieee80211_request_sched_scan_stop(struct ieee80211_local *local) 1388{ 1389 struct ieee80211_sub_if_data *sched_scan_sdata; 1390 int ret = -ENOENT; 1391 1392 mutex_lock(&local->mtx); 1393 1394 if (!local->ops->sched_scan_stop) { 1395 ret = -ENOTSUPP; 1396 goto out; 1397 } 1398 1399 /* We don't want to restart sched scan anymore. */ 1400 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1401 1402 sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata, 1403 lockdep_is_held(&local->mtx)); 1404 if (sched_scan_sdata) { 1405 ret = drv_sched_scan_stop(local, sched_scan_sdata); 1406 if (!ret) 1407 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1408 } 1409out: 1410 mutex_unlock(&local->mtx); 1411 1412 return ret; 1413} 1414 1415void ieee80211_sched_scan_results(struct ieee80211_hw *hw) 1416{ 1417 struct ieee80211_local *local = hw_to_local(hw); 1418 1419 trace_api_sched_scan_results(local); 1420 1421 cfg80211_sched_scan_results(hw->wiphy, 0); 1422} 1423EXPORT_SYMBOL(ieee80211_sched_scan_results); 1424 1425void ieee80211_sched_scan_end(struct ieee80211_local *local) 1426{ 1427 mutex_lock(&local->mtx); 1428 1429 if (!rcu_access_pointer(local->sched_scan_sdata)) { 1430 mutex_unlock(&local->mtx); 1431 return; 1432 } 1433 1434 RCU_INIT_POINTER(local->sched_scan_sdata, NULL); 1435 1436 /* If sched scan was aborted by the driver. */ 1437 RCU_INIT_POINTER(local->sched_scan_req, NULL); 1438 1439 mutex_unlock(&local->mtx); 1440 1441 cfg80211_sched_scan_stopped(local->hw.wiphy, 0); 1442} 1443 1444void ieee80211_sched_scan_stopped_work(struct work_struct *work) 1445{ 1446 struct ieee80211_local *local = 1447 container_of(work, struct ieee80211_local, 1448 sched_scan_stopped_work); 1449 1450 ieee80211_sched_scan_end(local); 1451} 1452 1453void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw) 1454{ 1455 struct ieee80211_local *local = hw_to_local(hw); 1456 1457 trace_api_sched_scan_stopped(local); 1458 1459 /* 1460 * this shouldn't really happen, so for simplicity 1461 * simply ignore it, and let mac80211 reconfigure 1462 * the sched scan later on. 1463 */ 1464 if (local->in_reconfig) 1465 return; 1466 1467 schedule_work(&local->sched_scan_stopped_work); 1468} 1469EXPORT_SYMBOL(ieee80211_sched_scan_stopped); 1470