1 /* Host AP driver Info Frame processing (part of hostap.o module) */
2 
3 #include <linux/if_arp.h>
4 #include <linux/sched.h>
5 #include <linux/slab.h>
6 #include <linux/export.h>
7 #include "hostap_wlan.h"
8 #include "hostap.h"
9 #include "hostap_ap.h"
10 
11 /* Called only as a tasklet (software IRQ) */
prism2_info_commtallies16(local_info_t * local,unsigned char * buf,int left)12 static void prism2_info_commtallies16(local_info_t *local, unsigned char *buf,
13 				      int left)
14 {
15 	struct hfa384x_comm_tallies *tallies;
16 
17 	if (left < sizeof(struct hfa384x_comm_tallies)) {
18 		printk(KERN_DEBUG "%s: too short (len=%d) commtallies "
19 		       "info frame\n", local->dev->name, left);
20 		return;
21 	}
22 
23 	tallies = (struct hfa384x_comm_tallies *) buf;
24 #define ADD_COMM_TALLIES(name) \
25 local->comm_tallies.name += le16_to_cpu(tallies->name)
26 	ADD_COMM_TALLIES(tx_unicast_frames);
27 	ADD_COMM_TALLIES(tx_multicast_frames);
28 	ADD_COMM_TALLIES(tx_fragments);
29 	ADD_COMM_TALLIES(tx_unicast_octets);
30 	ADD_COMM_TALLIES(tx_multicast_octets);
31 	ADD_COMM_TALLIES(tx_deferred_transmissions);
32 	ADD_COMM_TALLIES(tx_single_retry_frames);
33 	ADD_COMM_TALLIES(tx_multiple_retry_frames);
34 	ADD_COMM_TALLIES(tx_retry_limit_exceeded);
35 	ADD_COMM_TALLIES(tx_discards);
36 	ADD_COMM_TALLIES(rx_unicast_frames);
37 	ADD_COMM_TALLIES(rx_multicast_frames);
38 	ADD_COMM_TALLIES(rx_fragments);
39 	ADD_COMM_TALLIES(rx_unicast_octets);
40 	ADD_COMM_TALLIES(rx_multicast_octets);
41 	ADD_COMM_TALLIES(rx_fcs_errors);
42 	ADD_COMM_TALLIES(rx_discards_no_buffer);
43 	ADD_COMM_TALLIES(tx_discards_wrong_sa);
44 	ADD_COMM_TALLIES(rx_discards_wep_undecryptable);
45 	ADD_COMM_TALLIES(rx_message_in_msg_fragments);
46 	ADD_COMM_TALLIES(rx_message_in_bad_msg_fragments);
47 #undef ADD_COMM_TALLIES
48 }
49 
50 
51 /* Called only as a tasklet (software IRQ) */
prism2_info_commtallies32(local_info_t * local,unsigned char * buf,int left)52 static void prism2_info_commtallies32(local_info_t *local, unsigned char *buf,
53 				      int left)
54 {
55 	struct hfa384x_comm_tallies32 *tallies;
56 
57 	if (left < sizeof(struct hfa384x_comm_tallies32)) {
58 		printk(KERN_DEBUG "%s: too short (len=%d) commtallies32 "
59 		       "info frame\n", local->dev->name, left);
60 		return;
61 	}
62 
63 	tallies = (struct hfa384x_comm_tallies32 *) buf;
64 #define ADD_COMM_TALLIES(name) \
65 local->comm_tallies.name += le32_to_cpu(tallies->name)
66 	ADD_COMM_TALLIES(tx_unicast_frames);
67 	ADD_COMM_TALLIES(tx_multicast_frames);
68 	ADD_COMM_TALLIES(tx_fragments);
69 	ADD_COMM_TALLIES(tx_unicast_octets);
70 	ADD_COMM_TALLIES(tx_multicast_octets);
71 	ADD_COMM_TALLIES(tx_deferred_transmissions);
72 	ADD_COMM_TALLIES(tx_single_retry_frames);
73 	ADD_COMM_TALLIES(tx_multiple_retry_frames);
74 	ADD_COMM_TALLIES(tx_retry_limit_exceeded);
75 	ADD_COMM_TALLIES(tx_discards);
76 	ADD_COMM_TALLIES(rx_unicast_frames);
77 	ADD_COMM_TALLIES(rx_multicast_frames);
78 	ADD_COMM_TALLIES(rx_fragments);
79 	ADD_COMM_TALLIES(rx_unicast_octets);
80 	ADD_COMM_TALLIES(rx_multicast_octets);
81 	ADD_COMM_TALLIES(rx_fcs_errors);
82 	ADD_COMM_TALLIES(rx_discards_no_buffer);
83 	ADD_COMM_TALLIES(tx_discards_wrong_sa);
84 	ADD_COMM_TALLIES(rx_discards_wep_undecryptable);
85 	ADD_COMM_TALLIES(rx_message_in_msg_fragments);
86 	ADD_COMM_TALLIES(rx_message_in_bad_msg_fragments);
87 #undef ADD_COMM_TALLIES
88 }
89 
90 
91 /* Called only as a tasklet (software IRQ) */
prism2_info_commtallies(local_info_t * local,unsigned char * buf,int left)92 static void prism2_info_commtallies(local_info_t *local, unsigned char *buf,
93 				    int left)
94 {
95 	if (local->tallies32)
96 		prism2_info_commtallies32(local, buf, left);
97 	else
98 		prism2_info_commtallies16(local, buf, left);
99 }
100 
101 
102 #ifndef PRISM2_NO_STATION_MODES
103 #ifndef PRISM2_NO_DEBUG
hfa384x_linkstatus_str(u16 linkstatus)104 static const char* hfa384x_linkstatus_str(u16 linkstatus)
105 {
106 	switch (linkstatus) {
107 	case HFA384X_LINKSTATUS_CONNECTED:
108 		return "Connected";
109 	case HFA384X_LINKSTATUS_DISCONNECTED:
110 		return "Disconnected";
111 	case HFA384X_LINKSTATUS_AP_CHANGE:
112 		return "Access point change";
113 	case HFA384X_LINKSTATUS_AP_OUT_OF_RANGE:
114 		return "Access point out of range";
115 	case HFA384X_LINKSTATUS_AP_IN_RANGE:
116 		return "Access point in range";
117 	case HFA384X_LINKSTATUS_ASSOC_FAILED:
118 		return "Association failed";
119 	default:
120 		return "Unknown";
121 	}
122 }
123 #endif /* PRISM2_NO_DEBUG */
124 
125 
126 /* Called only as a tasklet (software IRQ) */
prism2_info_linkstatus(local_info_t * local,unsigned char * buf,int left)127 static void prism2_info_linkstatus(local_info_t *local, unsigned char *buf,
128 				    int left)
129 {
130 	u16 val;
131 	int non_sta_mode;
132 
133 	/* Alloc new JoinRequests to occur since LinkStatus for the previous
134 	 * has been received */
135 	local->last_join_time = 0;
136 
137 	if (left != 2) {
138 		printk(KERN_DEBUG "%s: invalid linkstatus info frame "
139 		       "length %d\n", local->dev->name, left);
140 		return;
141 	}
142 
143 	non_sta_mode = local->iw_mode == IW_MODE_MASTER ||
144 		local->iw_mode == IW_MODE_REPEAT ||
145 		local->iw_mode == IW_MODE_MONITOR;
146 
147 	val = buf[0] | (buf[1] << 8);
148 	if (!non_sta_mode || val != HFA384X_LINKSTATUS_DISCONNECTED) {
149 		PDEBUG(DEBUG_EXTRA, "%s: LinkStatus=%d (%s)\n",
150 		       local->dev->name, val, hfa384x_linkstatus_str(val));
151 	}
152 
153 	if (non_sta_mode) {
154 		netif_carrier_on(local->dev);
155 		netif_carrier_on(local->ddev);
156 		return;
157 	}
158 
159 	/* Get current BSSID later in scheduled task */
160 	set_bit(PRISM2_INFO_PENDING_LINKSTATUS, &local->pending_info);
161 	local->prev_link_status = val;
162 	schedule_work(&local->info_queue);
163 }
164 
165 
prism2_host_roaming(local_info_t * local)166 static void prism2_host_roaming(local_info_t *local)
167 {
168 	struct hfa384x_join_request req;
169 	struct net_device *dev = local->dev;
170 	struct hfa384x_hostscan_result *selected, *entry;
171 	int i;
172 	unsigned long flags;
173 
174 	if (local->last_join_time &&
175 	    time_before(jiffies, local->last_join_time + 10 * HZ)) {
176 		PDEBUG(DEBUG_EXTRA, "%s: last join request has not yet been "
177 		       "completed - waiting for it before issuing new one\n",
178 		       dev->name);
179 		return;
180 	}
181 
182 	/* ScanResults are sorted: first ESS results in decreasing signal
183 	 * quality then IBSS results in similar order.
184 	 * Trivial roaming policy: just select the first entry.
185 	 * This could probably be improved by adding hysteresis to limit
186 	 * number of handoffs, etc.
187 	 *
188 	 * Could do periodic RID_SCANREQUEST or Inquire F101 to get new
189 	 * ScanResults */
190 	spin_lock_irqsave(&local->lock, flags);
191 	if (local->last_scan_results == NULL ||
192 	    local->last_scan_results_count == 0) {
193 		spin_unlock_irqrestore(&local->lock, flags);
194 		PDEBUG(DEBUG_EXTRA, "%s: no scan results for host roaming\n",
195 		       dev->name);
196 		return;
197 	}
198 
199 	selected = &local->last_scan_results[0];
200 
201 	if (local->preferred_ap[0] || local->preferred_ap[1] ||
202 	    local->preferred_ap[2] || local->preferred_ap[3] ||
203 	    local->preferred_ap[4] || local->preferred_ap[5]) {
204 		/* Try to find preferred AP */
205 		PDEBUG(DEBUG_EXTRA, "%s: Preferred AP BSSID %pM\n",
206 		       dev->name, local->preferred_ap);
207 		for (i = 0; i < local->last_scan_results_count; i++) {
208 			entry = &local->last_scan_results[i];
209 			if (memcmp(local->preferred_ap, entry->bssid, 6) == 0)
210 			{
211 				PDEBUG(DEBUG_EXTRA, "%s: using preferred AP "
212 				       "selection\n", dev->name);
213 				selected = entry;
214 				break;
215 			}
216 		}
217 	}
218 
219 	memcpy(req.bssid, selected->bssid, 6);
220 	req.channel = selected->chid;
221 	spin_unlock_irqrestore(&local->lock, flags);
222 
223 	PDEBUG(DEBUG_EXTRA, "%s: JoinRequest: BSSID=%pM"
224 	       " channel=%d\n",
225 	       dev->name, req.bssid, le16_to_cpu(req.channel));
226 	if (local->func->set_rid(dev, HFA384X_RID_JOINREQUEST, &req,
227 				 sizeof(req))) {
228 		printk(KERN_DEBUG "%s: JoinRequest failed\n", dev->name);
229 	}
230 	local->last_join_time = jiffies;
231 }
232 
233 
hostap_report_scan_complete(local_info_t * local)234 static void hostap_report_scan_complete(local_info_t *local)
235 {
236 	union iwreq_data wrqu;
237 
238 	/* Inform user space about new scan results (just empty event,
239 	 * SIOCGIWSCAN can be used to fetch data */
240 	wrqu.data.length = 0;
241 	wrqu.data.flags = 0;
242 	wireless_send_event(local->dev, SIOCGIWSCAN, &wrqu, NULL);
243 
244 	/* Allow SIOCGIWSCAN handling to occur since we have received
245 	 * scanning result */
246 	local->scan_timestamp = 0;
247 }
248 
249 
250 /* Called only as a tasklet (software IRQ) */
prism2_info_scanresults(local_info_t * local,unsigned char * buf,int left)251 static void prism2_info_scanresults(local_info_t *local, unsigned char *buf,
252 				    int left)
253 {
254 	u16 *pos;
255 	int new_count, i;
256 	unsigned long flags;
257 	struct hfa384x_scan_result *res;
258 	struct hfa384x_hostscan_result *results, *prev;
259 
260 	if (left < 4) {
261 		printk(KERN_DEBUG "%s: invalid scanresult info frame "
262 		       "length %d\n", local->dev->name, left);
263 		return;
264 	}
265 
266 	pos = (u16 *) buf;
267 	pos++;
268 	pos++;
269 	left -= 4;
270 
271 	new_count = left / sizeof(struct hfa384x_scan_result);
272 	results = kmalloc(new_count * sizeof(struct hfa384x_hostscan_result),
273 			  GFP_ATOMIC);
274 	if (results == NULL)
275 		return;
276 
277 	/* Convert to hostscan result format. */
278 	res = (struct hfa384x_scan_result *) pos;
279 	for (i = 0; i < new_count; i++) {
280 		memcpy(&results[i], &res[i],
281 		       sizeof(struct hfa384x_scan_result));
282 		results[i].atim = 0;
283 	}
284 
285 	spin_lock_irqsave(&local->lock, flags);
286 	local->last_scan_type = PRISM2_SCAN;
287 	prev = local->last_scan_results;
288 	local->last_scan_results = results;
289 	local->last_scan_results_count = new_count;
290 	spin_unlock_irqrestore(&local->lock, flags);
291 	kfree(prev);
292 
293 	hostap_report_scan_complete(local);
294 
295 	/* Perform rest of ScanResults handling later in scheduled task */
296 	set_bit(PRISM2_INFO_PENDING_SCANRESULTS, &local->pending_info);
297 	schedule_work(&local->info_queue);
298 }
299 
300 
301 /* Called only as a tasklet (software IRQ) */
prism2_info_hostscanresults(local_info_t * local,unsigned char * buf,int left)302 static void prism2_info_hostscanresults(local_info_t *local,
303 					unsigned char *buf, int left)
304 {
305 	int i, result_size, copy_len, new_count;
306 	struct hfa384x_hostscan_result *results, *prev;
307 	unsigned long flags;
308 	__le16 *pos;
309 	u8 *ptr;
310 
311 	wake_up_interruptible(&local->hostscan_wq);
312 
313 	if (left < 4) {
314 		printk(KERN_DEBUG "%s: invalid hostscanresult info frame "
315 		       "length %d\n", local->dev->name, left);
316 		return;
317 	}
318 
319 	pos = (__le16 *) buf;
320 	copy_len = result_size = le16_to_cpu(*pos);
321 	if (result_size == 0) {
322 		printk(KERN_DEBUG "%s: invalid result_size (0) in "
323 		       "hostscanresults\n", local->dev->name);
324 		return;
325 	}
326 	if (copy_len > sizeof(struct hfa384x_hostscan_result))
327 		copy_len = sizeof(struct hfa384x_hostscan_result);
328 
329 	pos++;
330 	pos++;
331 	left -= 4;
332 	ptr = (u8 *) pos;
333 
334 	new_count = left / result_size;
335 	results = kcalloc(new_count, sizeof(struct hfa384x_hostscan_result),
336 			  GFP_ATOMIC);
337 	if (results == NULL)
338 		return;
339 
340 	for (i = 0; i < new_count; i++) {
341 		memcpy(&results[i], ptr, copy_len);
342 		ptr += result_size;
343 		left -= result_size;
344 	}
345 
346 	if (left) {
347 		printk(KERN_DEBUG "%s: short HostScan result entry (%d/%d)\n",
348 		       local->dev->name, left, result_size);
349 	}
350 
351 	spin_lock_irqsave(&local->lock, flags);
352 	local->last_scan_type = PRISM2_HOSTSCAN;
353 	prev = local->last_scan_results;
354 	local->last_scan_results = results;
355 	local->last_scan_results_count = new_count;
356 	spin_unlock_irqrestore(&local->lock, flags);
357 	kfree(prev);
358 
359 	hostap_report_scan_complete(local);
360 }
361 #endif /* PRISM2_NO_STATION_MODES */
362 
363 
364 /* Called only as a tasklet (software IRQ) */
hostap_info_process(local_info_t * local,struct sk_buff * skb)365 void hostap_info_process(local_info_t *local, struct sk_buff *skb)
366 {
367 	struct hfa384x_info_frame *info;
368 	unsigned char *buf;
369 	int left;
370 #ifndef PRISM2_NO_DEBUG
371 	int i;
372 #endif /* PRISM2_NO_DEBUG */
373 
374 	info = (struct hfa384x_info_frame *) skb->data;
375 	buf = skb->data + sizeof(*info);
376 	left = skb->len - sizeof(*info);
377 
378 	switch (le16_to_cpu(info->type)) {
379 	case HFA384X_INFO_COMMTALLIES:
380 		prism2_info_commtallies(local, buf, left);
381 		break;
382 
383 #ifndef PRISM2_NO_STATION_MODES
384 	case HFA384X_INFO_LINKSTATUS:
385 		prism2_info_linkstatus(local, buf, left);
386 		break;
387 
388 	case HFA384X_INFO_SCANRESULTS:
389 		prism2_info_scanresults(local, buf, left);
390 		break;
391 
392 	case HFA384X_INFO_HOSTSCANRESULTS:
393 		prism2_info_hostscanresults(local, buf, left);
394 		break;
395 #endif /* PRISM2_NO_STATION_MODES */
396 
397 #ifndef PRISM2_NO_DEBUG
398 	default:
399 		PDEBUG(DEBUG_EXTRA, "%s: INFO - len=%d type=0x%04x\n",
400 		       local->dev->name, le16_to_cpu(info->len),
401 		       le16_to_cpu(info->type));
402 		PDEBUG(DEBUG_EXTRA, "Unknown info frame:");
403 		for (i = 0; i < (left < 100 ? left : 100); i++)
404 			PDEBUG2(DEBUG_EXTRA, " %02x", buf[i]);
405 		PDEBUG2(DEBUG_EXTRA, "\n");
406 		break;
407 #endif /* PRISM2_NO_DEBUG */
408 	}
409 }
410 
411 
412 #ifndef PRISM2_NO_STATION_MODES
handle_info_queue_linkstatus(local_info_t * local)413 static void handle_info_queue_linkstatus(local_info_t *local)
414 {
415 	int val = local->prev_link_status;
416 	int connected;
417 	union iwreq_data wrqu;
418 
419 	connected =
420 		val == HFA384X_LINKSTATUS_CONNECTED ||
421 		val == HFA384X_LINKSTATUS_AP_CHANGE ||
422 		val == HFA384X_LINKSTATUS_AP_IN_RANGE;
423 
424 	if (local->func->get_rid(local->dev, HFA384X_RID_CURRENTBSSID,
425 				 local->bssid, ETH_ALEN, 1) < 0) {
426 		printk(KERN_DEBUG "%s: could not read CURRENTBSSID after "
427 		       "LinkStatus event\n", local->dev->name);
428 	} else {
429 		PDEBUG(DEBUG_EXTRA, "%s: LinkStatus: BSSID=%pM\n",
430 		       local->dev->name,
431 		       (unsigned char *) local->bssid);
432 		if (local->wds_type & HOSTAP_WDS_AP_CLIENT)
433 			hostap_add_sta(local->ap, local->bssid);
434 	}
435 
436 	/* Get BSSID if we have a valid AP address */
437 	if (connected) {
438 		netif_carrier_on(local->dev);
439 		netif_carrier_on(local->ddev);
440 		memcpy(wrqu.ap_addr.sa_data, local->bssid, ETH_ALEN);
441 	} else {
442 		netif_carrier_off(local->dev);
443 		netif_carrier_off(local->ddev);
444 		memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
445 	}
446 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
447 
448 	/*
449 	 * Filter out sequential disconnect events in order not to cause a
450 	 * flood of SIOCGIWAP events that have a race condition with EAPOL
451 	 * frames and can confuse wpa_supplicant about the current association
452 	 * status.
453 	 */
454 	if (connected || local->prev_linkstatus_connected)
455 		wireless_send_event(local->dev, SIOCGIWAP, &wrqu, NULL);
456 	local->prev_linkstatus_connected = connected;
457 }
458 
459 
handle_info_queue_scanresults(local_info_t * local)460 static void handle_info_queue_scanresults(local_info_t *local)
461 {
462 	if (local->host_roaming == 1 && local->iw_mode == IW_MODE_INFRA)
463 		prism2_host_roaming(local);
464 
465 	if (local->host_roaming == 2 && local->iw_mode == IW_MODE_INFRA &&
466 	    memcmp(local->preferred_ap, "\x00\x00\x00\x00\x00\x00",
467 		   ETH_ALEN) != 0) {
468 		/*
469 		 * Firmware seems to be getting into odd state in host_roaming
470 		 * mode 2 when hostscan is used without join command, so try
471 		 * to fix this by re-joining the current AP. This does not
472 		 * actually trigger a new association if the current AP is
473 		 * still in the scan results.
474 		 */
475 		prism2_host_roaming(local);
476 	}
477 }
478 
479 
480 /* Called only as scheduled task after receiving info frames (used to avoid
481  * pending too much time in HW IRQ handler). */
handle_info_queue(struct work_struct * work)482 static void handle_info_queue(struct work_struct *work)
483 {
484 	local_info_t *local = container_of(work, local_info_t, info_queue);
485 
486 	if (test_and_clear_bit(PRISM2_INFO_PENDING_LINKSTATUS,
487 			       &local->pending_info))
488 		handle_info_queue_linkstatus(local);
489 
490 	if (test_and_clear_bit(PRISM2_INFO_PENDING_SCANRESULTS,
491 			       &local->pending_info))
492 		handle_info_queue_scanresults(local);
493 }
494 #endif /* PRISM2_NO_STATION_MODES */
495 
496 
hostap_info_init(local_info_t * local)497 void hostap_info_init(local_info_t *local)
498 {
499 	skb_queue_head_init(&local->info_list);
500 #ifndef PRISM2_NO_STATION_MODES
501 	INIT_WORK(&local->info_queue, handle_info_queue);
502 #endif /* PRISM2_NO_STATION_MODES */
503 }
504 
505 
506 EXPORT_SYMBOL(hostap_info_init);
507 EXPORT_SYMBOL(hostap_info_process);
508