2 * mac80211 work implementation
4 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5 * Copyright 2004, Instant802 Networks, Inc.
6 * Copyright 2005, Devicescape Software, Inc.
7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9 * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2 as
13 * published by the Free Software Foundation.
16 #include <linux/delay.h>
17 #include <linux/if_ether.h>
18 #include <linux/skbuff.h>
19 #include <linux/if_arp.h>
20 #include <linux/etherdevice.h>
21 #include <linux/crc32.h>
22 #include <linux/slab.h>
23 #include <net/mac80211.h>
24 #include <asm/unaligned.h>
26 #include "ieee80211_i.h"
29 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
30 #define IEEE80211_AUTH_MAX_TRIES 3
31 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
32 #define IEEE80211_ASSOC_MAX_TRIES 3
43 static inline void ASSERT_WORK_MTX(struct ieee80211_local *local)
45 lockdep_assert_held(&local->mtx);
49 * We can have multiple work items (and connection probing)
50 * scheduling this timer, but we need to take care to only
51 * reschedule it when it should fire _earlier_ than it was
52 * asked for before, or if it's not pending right now. This
53 * function ensures that. Note that it then is required to
54 * run this function for all timeouts after the first one
55 * has happened -- the work that runs from this timer will
58 static void run_again(struct ieee80211_local *local,
59 unsigned long timeout)
61 ASSERT_WORK_MTX(local);
63 if (!timer_pending(&local->work_timer) ||
64 time_before(timeout, local->work_timer.expires))
65 mod_timer(&local->work_timer, timeout);
68 void free_work(struct ieee80211_work *wk)
70 kfree_rcu(wk, rcu_head);
73 static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
74 struct ieee80211_supported_band *sband,
80 for (i = 0; i < supp_rates_len; i++) {
81 int rate = (supp_rates[i] & 0x7F) * 5;
83 for (j = 0; j < sband->n_bitrates; j++)
84 if (sband->bitrates[j].bitrate == rate) {
94 /* frame sending functions */
96 static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
97 struct ieee80211_supported_band *sband,
98 struct ieee80211_channel *channel,
99 enum ieee80211_smps_mode smps)
101 struct ieee80211_ht_info *ht_info;
103 u32 flags = channel->flags;
104 u16 cap = sband->ht_cap.cap;
107 if (!sband->ht_cap.ht_supported)
113 if (ht_info_ie[1] < sizeof(struct ieee80211_ht_info))
116 ht_info = (struct ieee80211_ht_info *)(ht_info_ie + 2);
118 /* determine capability flags */
120 switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
121 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
122 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
123 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
124 cap &= ~IEEE80211_HT_CAP_SGI_40;
127 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
128 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
129 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
130 cap &= ~IEEE80211_HT_CAP_SGI_40;
135 /* set SM PS mode properly */
136 cap &= ~IEEE80211_HT_CAP_SM_PS;
138 case IEEE80211_SMPS_AUTOMATIC:
139 case IEEE80211_SMPS_NUM_MODES:
141 case IEEE80211_SMPS_OFF:
142 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
143 IEEE80211_HT_CAP_SM_PS_SHIFT;
145 case IEEE80211_SMPS_STATIC:
146 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
147 IEEE80211_HT_CAP_SM_PS_SHIFT;
149 case IEEE80211_SMPS_DYNAMIC:
150 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
151 IEEE80211_HT_CAP_SM_PS_SHIFT;
155 /* reserve and fill IE */
157 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
158 *pos++ = WLAN_EID_HT_CAPABILITY;
159 *pos++ = sizeof(struct ieee80211_ht_cap);
160 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
162 /* capability flags */
163 tmp = cpu_to_le16(cap);
164 memcpy(pos, &tmp, sizeof(u16));
167 /* AMPDU parameters */
168 *pos++ = sband->ht_cap.ampdu_factor |
169 (sband->ht_cap.ampdu_density <<
170 IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
173 memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
174 pos += sizeof(sband->ht_cap.mcs);
176 /* extended capabilities */
177 pos += sizeof(__le16);
179 /* BF capabilities */
180 pos += sizeof(__le32);
182 /* antenna selection */
186 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
187 struct ieee80211_work *wk)
189 struct ieee80211_local *local = sdata->local;
191 struct ieee80211_mgmt *mgmt;
193 size_t offset = 0, noffset;
194 int i, count, rates_len, supp_rates_len;
196 struct ieee80211_supported_band *sband;
199 sband = local->hw.wiphy->bands[wk->chan->band];
201 if (wk->assoc.supp_rates_len) {
203 * Get all rates supported by the device and the AP as
204 * some APs don't like getting a superset of their rates
205 * in the association request (e.g. D-Link DAP 1353 in
208 rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
209 wk->assoc.supp_rates_len,
213 * In case AP not provide any supported rates information
214 * before association, we send information element(s) with
215 * all rates that we support.
218 rates_len = sband->n_bitrates;
221 skb = alloc_skb(local->hw.extra_tx_headroom +
222 sizeof(*mgmt) + /* bit too much but doesn't matter */
223 2 + wk->assoc.ssid_len + /* SSID */
224 4 + rates_len + /* (extended) rates */
225 4 + /* power capability */
226 2 + 2 * sband->n_channels + /* supported channels */
227 2 + sizeof(struct ieee80211_ht_cap) + /* HT */
228 wk->ie_len + /* extra IEs */
232 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
233 "frame\n", sdata->name);
236 skb_reserve(skb, local->hw.extra_tx_headroom);
238 capab = WLAN_CAPABILITY_ESS;
240 if (sband->band == IEEE80211_BAND_2GHZ) {
241 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
242 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
243 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
244 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
247 if (wk->assoc.capability & WLAN_CAPABILITY_PRIVACY)
248 capab |= WLAN_CAPABILITY_PRIVACY;
250 if ((wk->assoc.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
251 (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
252 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
254 mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
256 memcpy(mgmt->da, wk->filter_ta, ETH_ALEN);
257 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
258 memcpy(mgmt->bssid, wk->filter_ta, ETH_ALEN);
260 if (!is_zero_ether_addr(wk->assoc.prev_bssid)) {
262 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
263 IEEE80211_STYPE_REASSOC_REQ);
264 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
265 mgmt->u.reassoc_req.listen_interval =
266 cpu_to_le16(local->hw.conf.listen_interval);
267 memcpy(mgmt->u.reassoc_req.current_ap, wk->assoc.prev_bssid,
271 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
272 IEEE80211_STYPE_ASSOC_REQ);
273 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
274 mgmt->u.assoc_req.listen_interval =
275 cpu_to_le16(local->hw.conf.listen_interval);
279 pos = skb_put(skb, 2 + wk->assoc.ssid_len);
280 *pos++ = WLAN_EID_SSID;
281 *pos++ = wk->assoc.ssid_len;
282 memcpy(pos, wk->assoc.ssid, wk->assoc.ssid_len);
284 /* add all rates which were marked to be used above */
285 supp_rates_len = rates_len;
286 if (supp_rates_len > 8)
289 pos = skb_put(skb, supp_rates_len + 2);
290 *pos++ = WLAN_EID_SUPP_RATES;
291 *pos++ = supp_rates_len;
294 for (i = 0; i < sband->n_bitrates; i++) {
295 if (BIT(i) & rates) {
296 int rate = sband->bitrates[i].bitrate;
297 *pos++ = (u8) (rate / 5);
303 if (rates_len > count) {
304 pos = skb_put(skb, rates_len - count + 2);
305 *pos++ = WLAN_EID_EXT_SUPP_RATES;
306 *pos++ = rates_len - count;
308 for (i++; i < sband->n_bitrates; i++) {
309 if (BIT(i) & rates) {
310 int rate = sband->bitrates[i].bitrate;
311 *pos++ = (u8) (rate / 5);
316 if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
317 /* 1. power capabilities */
318 pos = skb_put(skb, 4);
319 *pos++ = WLAN_EID_PWR_CAPABILITY;
321 *pos++ = 0; /* min tx power */
322 *pos++ = wk->chan->max_power; /* max tx power */
324 /* 2. supported channels */
325 /* TODO: get this in reg domain format */
326 pos = skb_put(skb, 2 * sband->n_channels + 2);
327 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
328 *pos++ = 2 * sband->n_channels;
329 for (i = 0; i < sband->n_channels; i++) {
330 *pos++ = ieee80211_frequency_to_channel(
331 sband->channels[i].center_freq);
332 *pos++ = 1; /* one channel in the subband*/
336 /* if present, add any custom IEs that go before HT */
337 if (wk->ie_len && wk->ie) {
338 static const u8 before_ht[] = {
341 WLAN_EID_EXT_SUPP_RATES,
342 WLAN_EID_PWR_CAPABILITY,
343 WLAN_EID_SUPPORTED_CHANNELS,
346 WLAN_EID_RRM_ENABLED_CAPABILITIES,
347 WLAN_EID_MOBILITY_DOMAIN,
348 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
350 noffset = ieee80211_ie_split(wk->ie, wk->ie_len,
351 before_ht, ARRAY_SIZE(before_ht),
353 pos = skb_put(skb, noffset - offset);
354 memcpy(pos, wk->ie + offset, noffset - offset);
358 if (wk->assoc.use_11n && wk->assoc.wmm_used &&
359 local->hw.queues >= 4)
360 ieee80211_add_ht_ie(skb, wk->assoc.ht_information_ie,
361 sband, wk->chan, wk->assoc.smps);
363 /* if present, add any custom non-vendor IEs that go after HT */
364 if (wk->ie_len && wk->ie) {
365 noffset = ieee80211_ie_split_vendor(wk->ie, wk->ie_len,
367 pos = skb_put(skb, noffset - offset);
368 memcpy(pos, wk->ie + offset, noffset - offset);
372 if (wk->assoc.wmm_used && local->hw.queues >= 4) {
373 if (wk->assoc.uapsd_used) {
374 qos_info = local->uapsd_queues;
375 qos_info |= (local->uapsd_max_sp_len <<
376 IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
381 pos = skb_put(skb, 9);
382 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
383 *pos++ = 7; /* len */
384 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
387 *pos++ = 2; /* WME */
388 *pos++ = 0; /* WME info */
389 *pos++ = 1; /* WME ver */
393 /* add any remaining custom (i.e. vendor specific here) IEs */
394 if (wk->ie_len && wk->ie) {
395 noffset = wk->ie_len;
396 pos = skb_put(skb, noffset - offset);
397 memcpy(pos, wk->ie + offset, noffset - offset);
400 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
401 ieee80211_tx_skb(sdata, skb);
404 static void ieee80211_remove_auth_bss(struct ieee80211_local *local,
405 struct ieee80211_work *wk)
407 struct cfg80211_bss *cbss;
408 u16 capa_val = WLAN_CAPABILITY_ESS;
410 if (wk->probe_auth.privacy)
411 capa_val |= WLAN_CAPABILITY_PRIVACY;
413 cbss = cfg80211_get_bss(local->hw.wiphy, wk->chan, wk->filter_ta,
414 wk->probe_auth.ssid, wk->probe_auth.ssid_len,
415 WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
420 cfg80211_unlink_bss(local->hw.wiphy, cbss);
421 cfg80211_put_bss(cbss);
424 static enum work_action __must_check
425 ieee80211_direct_probe(struct ieee80211_work *wk)
427 struct ieee80211_sub_if_data *sdata = wk->sdata;
428 struct ieee80211_local *local = sdata->local;
430 wk->probe_auth.tries++;
431 if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
432 printk(KERN_DEBUG "%s: direct probe to %pM timed out\n",
433 sdata->name, wk->filter_ta);
436 * Most likely AP is not in the range so remove the
437 * bss struct for that AP.
439 ieee80211_remove_auth_bss(local, wk);
441 return WORK_ACT_TIMEOUT;
444 printk(KERN_DEBUG "%s: direct probe to %pM (try %d/%i)\n",
445 sdata->name, wk->filter_ta, wk->probe_auth.tries,
446 IEEE80211_AUTH_MAX_TRIES);
449 * Direct probe is sent to broadcast address as some APs
450 * will not answer to direct packet in unassociated state.
452 ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
453 wk->probe_auth.ssid_len, NULL, 0,
456 wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
457 run_again(local, wk->timeout);
459 return WORK_ACT_NONE;
463 static enum work_action __must_check
464 ieee80211_authenticate(struct ieee80211_work *wk)
466 struct ieee80211_sub_if_data *sdata = wk->sdata;
467 struct ieee80211_local *local = sdata->local;
469 wk->probe_auth.tries++;
470 if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
471 printk(KERN_DEBUG "%s: authentication with %pM"
472 " timed out\n", sdata->name, wk->filter_ta);
475 * Most likely AP is not in the range so remove the
476 * bss struct for that AP.
478 ieee80211_remove_auth_bss(local, wk);
480 return WORK_ACT_TIMEOUT;
483 printk(KERN_DEBUG "%s: authenticate with %pM (try %d)\n",
484 sdata->name, wk->filter_ta, wk->probe_auth.tries);
486 ieee80211_send_auth(sdata, 1, wk->probe_auth.algorithm, wk->ie,
487 wk->ie_len, wk->filter_ta, NULL, 0, 0);
488 wk->probe_auth.transaction = 2;
490 wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
491 run_again(local, wk->timeout);
493 return WORK_ACT_NONE;
496 static enum work_action __must_check
497 ieee80211_associate(struct ieee80211_work *wk)
499 struct ieee80211_sub_if_data *sdata = wk->sdata;
500 struct ieee80211_local *local = sdata->local;
503 if (wk->assoc.tries > IEEE80211_ASSOC_MAX_TRIES) {
504 printk(KERN_DEBUG "%s: association with %pM"
506 sdata->name, wk->filter_ta);
509 * Most likely AP is not in the range so remove the
510 * bss struct for that AP.
513 cfg80211_unlink_bss(local->hw.wiphy, wk->assoc.bss);
515 return WORK_ACT_TIMEOUT;
518 printk(KERN_DEBUG "%s: associate with %pM (try %d)\n",
519 sdata->name, wk->filter_ta, wk->assoc.tries);
520 ieee80211_send_assoc(sdata, wk);
522 wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
523 run_again(local, wk->timeout);
525 return WORK_ACT_NONE;
528 static enum work_action __must_check
529 ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
532 * First time we run, do nothing -- the generic code will
533 * have switched to the right channel etc.
536 wk->timeout = jiffies + msecs_to_jiffies(wk->remain.duration);
538 cfg80211_ready_on_channel(wk->sdata->dev, (unsigned long) wk,
539 wk->chan, wk->chan_type,
540 wk->remain.duration, GFP_KERNEL);
542 return WORK_ACT_NONE;
545 return WORK_ACT_TIMEOUT;
548 static enum work_action __must_check
549 ieee80211_offchannel_tx(struct ieee80211_work *wk)
552 wk->timeout = jiffies + msecs_to_jiffies(wk->offchan_tx.wait);
555 * After this, offchan_tx.frame remains but now is no
556 * longer a valid pointer -- we still need it as the
557 * cookie for canceling this work.
559 ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
561 return WORK_ACT_NONE;
564 return WORK_ACT_TIMEOUT;
567 static enum work_action __must_check
568 ieee80211_assoc_beacon_wait(struct ieee80211_work *wk)
571 return WORK_ACT_TIMEOUT;
574 * Wait up to one beacon interval ...
575 * should this be more if we miss one?
577 printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
578 wk->sdata->name, wk->filter_ta);
579 wk->timeout = TU_TO_EXP_TIME(wk->assoc.bss->beacon_interval);
580 return WORK_ACT_NONE;
583 static void ieee80211_auth_challenge(struct ieee80211_work *wk,
584 struct ieee80211_mgmt *mgmt,
587 struct ieee80211_sub_if_data *sdata = wk->sdata;
589 struct ieee802_11_elems elems;
591 pos = mgmt->u.auth.variable;
592 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
593 if (!elems.challenge)
595 ieee80211_send_auth(sdata, 3, wk->probe_auth.algorithm,
596 elems.challenge - 2, elems.challenge_len + 2,
597 wk->filter_ta, wk->probe_auth.key,
598 wk->probe_auth.key_len, wk->probe_auth.key_idx);
599 wk->probe_auth.transaction = 4;
602 static enum work_action __must_check
603 ieee80211_rx_mgmt_auth(struct ieee80211_work *wk,
604 struct ieee80211_mgmt *mgmt, size_t len)
606 u16 auth_alg, auth_transaction, status_code;
608 if (wk->type != IEEE80211_WORK_AUTH)
609 return WORK_ACT_MISMATCH;
612 return WORK_ACT_NONE;
614 auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
615 auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
616 status_code = le16_to_cpu(mgmt->u.auth.status_code);
618 if (auth_alg != wk->probe_auth.algorithm ||
619 auth_transaction != wk->probe_auth.transaction)
620 return WORK_ACT_NONE;
622 if (status_code != WLAN_STATUS_SUCCESS) {
623 printk(KERN_DEBUG "%s: %pM denied authentication (status %d)\n",
624 wk->sdata->name, mgmt->sa, status_code);
625 return WORK_ACT_DONE;
628 switch (wk->probe_auth.algorithm) {
633 case WLAN_AUTH_SHARED_KEY:
634 if (wk->probe_auth.transaction != 4) {
635 ieee80211_auth_challenge(wk, mgmt, len);
636 /* need another frame */
637 return WORK_ACT_NONE;
642 return WORK_ACT_NONE;
645 printk(KERN_DEBUG "%s: authenticated\n", wk->sdata->name);
646 return WORK_ACT_DONE;
649 static enum work_action __must_check
650 ieee80211_rx_mgmt_assoc_resp(struct ieee80211_work *wk,
651 struct ieee80211_mgmt *mgmt, size_t len,
654 struct ieee80211_sub_if_data *sdata = wk->sdata;
655 struct ieee80211_local *local = sdata->local;
656 u16 capab_info, status_code, aid;
657 struct ieee802_11_elems elems;
660 if (wk->type != IEEE80211_WORK_ASSOC)
661 return WORK_ACT_MISMATCH;
664 * AssocResp and ReassocResp have identical structure, so process both
665 * of them in this function.
669 return WORK_ACT_NONE;
671 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
672 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
673 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
675 printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
676 "status=%d aid=%d)\n",
677 sdata->name, reassoc ? "Rea" : "A", mgmt->sa,
678 capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
680 pos = mgmt->u.assoc_resp.variable;
681 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
683 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
684 elems.timeout_int && elems.timeout_int_len == 5 &&
685 elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
687 tu = get_unaligned_le32(elems.timeout_int + 1);
688 ms = tu * 1024 / 1000;
689 printk(KERN_DEBUG "%s: %pM rejected association temporarily; "
690 "comeback duration %u TU (%u ms)\n",
691 sdata->name, mgmt->sa, tu, ms);
692 wk->timeout = jiffies + msecs_to_jiffies(ms);
693 if (ms > IEEE80211_ASSOC_TIMEOUT)
694 run_again(local, wk->timeout);
695 return WORK_ACT_NONE;
698 if (status_code != WLAN_STATUS_SUCCESS)
699 printk(KERN_DEBUG "%s: %pM denied association (code=%d)\n",
700 sdata->name, mgmt->sa, status_code);
702 printk(KERN_DEBUG "%s: associated\n", sdata->name);
704 return WORK_ACT_DONE;
707 static enum work_action __must_check
708 ieee80211_rx_mgmt_probe_resp(struct ieee80211_work *wk,
709 struct ieee80211_mgmt *mgmt, size_t len,
710 struct ieee80211_rx_status *rx_status)
712 struct ieee80211_sub_if_data *sdata = wk->sdata;
713 struct ieee80211_local *local = sdata->local;
716 ASSERT_WORK_MTX(local);
718 if (wk->type != IEEE80211_WORK_DIRECT_PROBE)
719 return WORK_ACT_MISMATCH;
722 return WORK_ACT_NONE;
724 baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
726 return WORK_ACT_NONE;
728 printk(KERN_DEBUG "%s: direct probe responded\n", sdata->name);
729 return WORK_ACT_DONE;
732 static enum work_action __must_check
733 ieee80211_rx_mgmt_beacon(struct ieee80211_work *wk,
734 struct ieee80211_mgmt *mgmt, size_t len)
736 struct ieee80211_sub_if_data *sdata = wk->sdata;
737 struct ieee80211_local *local = sdata->local;
739 ASSERT_WORK_MTX(local);
741 if (wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
742 return WORK_ACT_MISMATCH;
745 return WORK_ACT_NONE;
747 printk(KERN_DEBUG "%s: beacon received\n", sdata->name);
748 return WORK_ACT_DONE;
751 static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
754 struct ieee80211_rx_status *rx_status;
755 struct ieee80211_mgmt *mgmt;
756 struct ieee80211_work *wk;
757 enum work_action rma = WORK_ACT_NONE;
760 rx_status = (struct ieee80211_rx_status *) skb->cb;
761 mgmt = (struct ieee80211_mgmt *) skb->data;
762 fc = le16_to_cpu(mgmt->frame_control);
764 mutex_lock(&local->mtx);
766 list_for_each_entry(wk, &local->work_list, list) {
767 const u8 *bssid = NULL;
770 case IEEE80211_WORK_DIRECT_PROBE:
771 case IEEE80211_WORK_AUTH:
772 case IEEE80211_WORK_ASSOC:
773 case IEEE80211_WORK_ASSOC_BEACON_WAIT:
774 bssid = wk->filter_ta;
781 * Before queuing, we already verified mgmt->sa,
782 * so this is needed just for matching.
784 if (compare_ether_addr(bssid, mgmt->bssid))
787 switch (fc & IEEE80211_FCTL_STYPE) {
788 case IEEE80211_STYPE_BEACON:
789 rma = ieee80211_rx_mgmt_beacon(wk, mgmt, skb->len);
791 case IEEE80211_STYPE_PROBE_RESP:
792 rma = ieee80211_rx_mgmt_probe_resp(wk, mgmt, skb->len,
795 case IEEE80211_STYPE_AUTH:
796 rma = ieee80211_rx_mgmt_auth(wk, mgmt, skb->len);
798 case IEEE80211_STYPE_ASSOC_RESP:
799 rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
802 case IEEE80211_STYPE_REASSOC_RESP:
803 rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
812 * We've either received an unexpected frame, or we have
813 * multiple work items and need to match the frame to the
816 if (rma == WORK_ACT_MISMATCH)
820 * We've processed this frame for that work, so it can't
821 * belong to another work struct.
822 * NB: this is also required for correctness for 'rma'!
828 case WORK_ACT_MISMATCH:
829 /* ignore this unmatched frame */
834 list_del_rcu(&wk->list);
837 WARN(1, "unexpected: %d", rma);
840 mutex_unlock(&local->mtx);
842 if (rma != WORK_ACT_DONE)
845 switch (wk->done(wk, skb)) {
846 case WORK_DONE_DESTROY:
849 case WORK_DONE_REQUEUE:
851 wk->started = false; /* restart */
852 mutex_lock(&local->mtx);
853 list_add_tail(&wk->list, &local->work_list);
854 mutex_unlock(&local->mtx);
861 static bool ieee80211_work_ct_coexists(enum nl80211_channel_type wk_ct,
862 enum nl80211_channel_type oper_ct)
865 case NL80211_CHAN_NO_HT:
867 case NL80211_CHAN_HT20:
868 if (oper_ct != NL80211_CHAN_NO_HT)
871 case NL80211_CHAN_HT40MINUS:
872 case NL80211_CHAN_HT40PLUS:
873 return (wk_ct == oper_ct);
875 WARN_ON(1); /* shouldn't get here */
879 static enum nl80211_channel_type
880 ieee80211_calc_ct(enum nl80211_channel_type wk_ct,
881 enum nl80211_channel_type oper_ct)
884 case NL80211_CHAN_NO_HT:
886 case NL80211_CHAN_HT20:
887 if (oper_ct != NL80211_CHAN_NO_HT)
890 case NL80211_CHAN_HT40MINUS:
891 case NL80211_CHAN_HT40PLUS:
894 WARN_ON(1); /* shouldn't get here */
899 static void ieee80211_work_timer(unsigned long data)
901 struct ieee80211_local *local = (void *) data;
903 if (local->quiescing)
906 ieee80211_queue_work(&local->hw, &local->work_work);
909 static void ieee80211_work_work(struct work_struct *work)
911 struct ieee80211_local *local =
912 container_of(work, struct ieee80211_local, work_work);
914 struct ieee80211_work *wk, *tmp;
915 LIST_HEAD(free_work);
916 enum work_action rma;
917 bool remain_off_channel = false;
923 * ieee80211_queue_work() should have picked up most cases,
924 * here we'll pick the rest.
926 if (WARN(local->suspended, "work scheduled while going to suspend\n"))
929 /* first process frames to avoid timing out while a frame is pending */
930 while ((skb = skb_dequeue(&local->work_skb_queue)))
931 ieee80211_work_rx_queued_mgmt(local, skb);
933 mutex_lock(&local->mtx);
935 ieee80211_recalc_idle(local);
937 list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
938 bool started = wk->started;
940 /* mark work as started if it's on the current off-channel */
941 if (!started && local->tmp_channel &&
942 wk->chan == local->tmp_channel &&
943 wk->chan_type == local->tmp_channel_type) {
945 wk->timeout = jiffies;
948 if (!started && !local->tmp_channel) {
950 bool tmp_chan_changed = false;
952 enum nl80211_channel_type wk_ct;
953 on_oper_chan = ieee80211_cfg_on_oper_channel(local);
955 /* Work with existing channel type if possible. */
956 wk_ct = wk->chan_type;
957 if (wk->chan == local->hw.conf.channel)
958 wk_ct = ieee80211_calc_ct(wk->chan_type,
959 local->hw.conf.channel_type);
961 if (local->tmp_channel)
962 if ((local->tmp_channel != wk->chan) ||
963 (local->tmp_channel_type != wk_ct))
964 tmp_chan_changed = true;
966 local->tmp_channel = wk->chan;
967 local->tmp_channel_type = wk_ct;
969 * Leave the station vifs in awake mode if they
970 * happen to be on the same channel as
971 * the requested channel.
973 on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
974 if (on_oper_chan != on_oper_chan2) {
976 /* going off oper channel, PS too */
977 ieee80211_offchannel_stop_vifs(local,
979 ieee80211_hw_config(local, 0);
981 /* going on channel, but leave PS
983 ieee80211_hw_config(local, 0);
984 ieee80211_offchannel_return(local,
988 } else if (tmp_chan_changed)
989 /* Still off-channel, but on some other
990 * channel, so update hardware.
991 * PS should already be off-channel.
993 ieee80211_hw_config(local, 0);
996 wk->timeout = jiffies;
999 /* don't try to work with items that aren't started */
1003 if (time_is_after_jiffies(wk->timeout)) {
1005 * This work item isn't supposed to be worked on
1006 * right now, but take care to adjust the timer
1009 run_again(local, wk->timeout);
1017 rma = WORK_ACT_NONE;
1019 case IEEE80211_WORK_ABORT:
1020 rma = WORK_ACT_TIMEOUT;
1022 case IEEE80211_WORK_DIRECT_PROBE:
1023 rma = ieee80211_direct_probe(wk);
1025 case IEEE80211_WORK_AUTH:
1026 rma = ieee80211_authenticate(wk);
1028 case IEEE80211_WORK_ASSOC:
1029 rma = ieee80211_associate(wk);
1031 case IEEE80211_WORK_REMAIN_ON_CHANNEL:
1032 rma = ieee80211_remain_on_channel_timeout(wk);
1034 case IEEE80211_WORK_OFFCHANNEL_TX:
1035 rma = ieee80211_offchannel_tx(wk);
1037 case IEEE80211_WORK_ASSOC_BEACON_WAIT:
1038 rma = ieee80211_assoc_beacon_wait(wk);
1042 wk->started = started;
1046 /* might have changed the timeout */
1047 run_again(local, wk->timeout);
1049 case WORK_ACT_TIMEOUT:
1050 list_del_rcu(&wk->list);
1052 list_add(&wk->list, &free_work);
1055 WARN(1, "unexpected: %d", rma);
1059 list_for_each_entry(wk, &local->work_list, list) {
1062 if (wk->chan != local->tmp_channel)
1064 if (ieee80211_work_ct_coexists(wk->chan_type,
1065 local->tmp_channel_type))
1067 remain_off_channel = true;
1070 if (!remain_off_channel && local->tmp_channel) {
1071 bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
1072 local->tmp_channel = NULL;
1073 /* If tmp_channel wasn't operating channel, then
1074 * we need to go back on-channel.
1075 * NOTE: If we can ever be here while scannning,
1076 * or if the hw_config() channel config logic changes,
1077 * then we may need to do a more thorough check to see if
1078 * we still need to do a hardware config. Currently,
1079 * we cannot be here while scanning, however.
1081 if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
1082 ieee80211_hw_config(local, 0);
1084 /* At the least, we need to disable offchannel_ps,
1085 * so just go ahead and run the entire offchannel
1086 * return logic here. We *could* skip enabling
1087 * beaconing if we were already on-oper-channel
1088 * as a future optimization.
1090 ieee80211_offchannel_return(local, true, true);
1092 /* give connection some time to breathe */
1093 run_again(local, jiffies + HZ/2);
1096 if (list_empty(&local->work_list) && local->scan_req &&
1098 ieee80211_queue_delayed_work(&local->hw,
1100 round_jiffies_relative(0));
1102 ieee80211_recalc_idle(local);
1104 mutex_unlock(&local->mtx);
1106 list_for_each_entry_safe(wk, tmp, &free_work, list) {
1108 list_del(&wk->list);
1113 void ieee80211_add_work(struct ieee80211_work *wk)
1115 struct ieee80211_local *local;
1117 if (WARN_ON(!wk->chan))
1120 if (WARN_ON(!wk->sdata))
1123 if (WARN_ON(!wk->done))
1126 if (WARN_ON(!ieee80211_sdata_running(wk->sdata)))
1129 wk->started = false;
1131 local = wk->sdata->local;
1132 mutex_lock(&local->mtx);
1133 list_add_tail(&wk->list, &local->work_list);
1134 mutex_unlock(&local->mtx);
1136 ieee80211_queue_work(&local->hw, &local->work_work);
1139 void ieee80211_work_init(struct ieee80211_local *local)
1141 INIT_LIST_HEAD(&local->work_list);
1142 setup_timer(&local->work_timer, ieee80211_work_timer,
1143 (unsigned long)local);
1144 INIT_WORK(&local->work_work, ieee80211_work_work);
1145 skb_queue_head_init(&local->work_skb_queue);
1148 void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
1150 struct ieee80211_local *local = sdata->local;
1151 struct ieee80211_work *wk;
1152 bool cleanup = false;
1154 mutex_lock(&local->mtx);
1155 list_for_each_entry(wk, &local->work_list, list) {
1156 if (wk->sdata != sdata)
1159 wk->type = IEEE80211_WORK_ABORT;
1161 wk->timeout = jiffies;
1163 mutex_unlock(&local->mtx);
1165 /* run cleanups etc. */
1167 ieee80211_work_work(&local->work_work);
1169 mutex_lock(&local->mtx);
1170 list_for_each_entry(wk, &local->work_list, list) {
1171 if (wk->sdata != sdata)
1176 mutex_unlock(&local->mtx);
1179 ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
1180 struct sk_buff *skb)
1182 struct ieee80211_local *local = sdata->local;
1183 struct ieee80211_mgmt *mgmt;
1184 struct ieee80211_work *wk;
1188 return RX_DROP_MONITOR;
1190 mgmt = (struct ieee80211_mgmt *) skb->data;
1191 fc = le16_to_cpu(mgmt->frame_control);
1193 list_for_each_entry_rcu(wk, &local->work_list, list) {
1194 if (sdata != wk->sdata)
1196 if (compare_ether_addr(wk->filter_ta, mgmt->sa))
1198 if (compare_ether_addr(wk->filter_ta, mgmt->bssid))
1201 switch (fc & IEEE80211_FCTL_STYPE) {
1202 case IEEE80211_STYPE_AUTH:
1203 case IEEE80211_STYPE_PROBE_RESP:
1204 case IEEE80211_STYPE_ASSOC_RESP:
1205 case IEEE80211_STYPE_REASSOC_RESP:
1206 case IEEE80211_STYPE_BEACON:
1207 skb_queue_tail(&local->work_skb_queue, skb);
1208 ieee80211_queue_work(&local->hw, &local->work_work);
1216 static enum work_done_result ieee80211_remain_done(struct ieee80211_work *wk,
1217 struct sk_buff *skb)
1220 * We are done serving the remain-on-channel command.
1222 cfg80211_remain_on_channel_expired(wk->sdata->dev, (unsigned long) wk,
1223 wk->chan, wk->chan_type,
1226 return WORK_DONE_DESTROY;
1229 int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
1230 struct ieee80211_channel *chan,
1231 enum nl80211_channel_type channel_type,
1232 unsigned int duration, u64 *cookie)
1234 struct ieee80211_work *wk;
1236 wk = kzalloc(sizeof(*wk), GFP_KERNEL);
1240 wk->type = IEEE80211_WORK_REMAIN_ON_CHANNEL;
1242 wk->chan_type = channel_type;
1244 wk->done = ieee80211_remain_done;
1246 wk->remain.duration = duration;
1248 *cookie = (unsigned long) wk;
1250 ieee80211_add_work(wk);
1255 int ieee80211_wk_cancel_remain_on_channel(struct ieee80211_sub_if_data *sdata,
1258 struct ieee80211_local *local = sdata->local;
1259 struct ieee80211_work *wk, *tmp;
1262 mutex_lock(&local->mtx);
1263 list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
1264 if ((unsigned long) wk == cookie) {
1265 wk->timeout = jiffies;
1270 mutex_unlock(&local->mtx);
1275 ieee80211_queue_work(&local->hw, &local->work_work);