/* * Copyright (c) 2012-2015, 2017 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the * above copyright notice and this permission notice appear in all * copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR * PERFORMANCE OF THIS SOFTWARE. */ /* * This file was originally distributed by Qualcomm Atheros, Inc. * under proprietary terms before Copyright ownership was assigned * to the Linux Foundation. */ /* * * This file limProcessProbeRspFrame.cc contains the code * for processing Probe Response Frame. * Author: Chandra Modumudi * Date: 03/01/02 * History:- * Date Modified by Modification Information * -------------------------------------------------------------------- * */ #include "wniApi.h" #include "wniCfg.h" #include "aniGlobal.h" #include "schApi.h" #include "utilsApi.h" #include "limApi.h" #include "limTypes.h" #include "limUtils.h" #include "limAssocUtils.h" #include "limPropExtsUtils.h" #include "limSerDesUtils.h" #include "limSendMessages.h" #include "parserApi.h" tSirRetStatus limValidateIEInformationInProbeRspFrame (tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo) { tSirRetStatus status = eSIR_SUCCESS; tANI_U8 *pFrame; tANI_U32 nFrame; tANI_U32 nMissingRsnBytes; /* Validate a Probe response frame for malformed frame. * If the frame is malformed then do not consider as it * may cause problem fetching wrong IE values */ if (WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo) < (SIR_MAC_B_PR_SSID_OFFSET + SIR_MAC_MIN_IE_LEN)) { return eSIR_FAILURE; } pFrame = WDA_GET_RX_MPDU_DATA(pRxPacketInfo); nFrame = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); nMissingRsnBytes = 0; status = ValidateAndRectifyIEs(pMac, pFrame, nFrame, &nMissingRsnBytes); if ( status == eSIR_SUCCESS ) { WDA_GET_RX_MPDU_LEN(pRxPacketInfo) += nMissingRsnBytes; } return status; } /** * limProcessProbeRspFrame * *FUNCTION: * This function is called by limProcessMessageQueue() upon * Probe Response frame reception. * *LOGIC: * This function processes received Probe Response frame. * *ASSUMPTIONS: * *NOTE: * 1. Frames with out-of-order IEs are dropped. * 2. In case of IBSS, join 'success' makes MLM state machine * transition into 'BSS started' state. This may have to change * depending on supporting what kinda Authentication in IBSS. * * @param pMac Pointer to Global MAC structure * @param *pRxPacketInfo A pointer to Buffer descriptor + associated PDUs * @return None */ void limProcessProbeRspFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession psessionEntry) { tANI_U8 *pBody; tANI_U32 frameLen = 0; tSirMacAddr currentBssId; tpSirMacMgmtHdr pHdr; tSirProbeRespBeacon *pProbeRsp; tANI_U8 qosEnabled = false; tANI_U8 wmeEnabled = false; if (!psessionEntry) { limLog(pMac, LOGE, FL("psessionEntry is NULL") ); return; } limLog(pMac,LOG1,"SessionId:%d ProbeRsp Frame is received", psessionEntry->peSessionId); pProbeRsp = vos_mem_vmalloc(sizeof(tSirProbeRespBeacon)); if ( NULL == pProbeRsp ) { limLog(pMac, LOGE, FL("Unable to allocate memory in limProcessProbeRspFrame") ); return; } pProbeRsp->ssId.length = 0; pProbeRsp->wpa.length = 0; pProbeRsp->propIEinfo.apName.length = 0; pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo); limLog(pMac, LOG2, FL("Received Probe Response frame with length=%d from "), WDA_GET_RX_MPDU_LEN(pRxPacketInfo)); limPrintMacAddr(pMac, pHdr->sa, LOG2); if (!pMac->fScanOffload) { if (limDeactivateMinChannelTimerDuringScan(pMac) != eSIR_SUCCESS) { vos_mem_vfree(pProbeRsp); return; } } // Validate IE information before processing Probe Response Frame if (limValidateIEInformationInProbeRspFrame(pMac, pRxPacketInfo) != eSIR_SUCCESS) { PELOG1(limLog(pMac, LOG1, FL("Parse error ProbeResponse, length=%d"), frameLen);) vos_mem_vfree(pProbeRsp); return; } /** * Expect Probe Response only when * 1. STA is in scan mode waiting for Beacon/Probe response or * 2. STA is waiting for Beacon/Probe Response to announce * join success or * 3. STA is in IBSS mode in BSS started state or * 4. STA/AP is in learn mode * 5. STA in link established state. In this state, the probe response is * expected for two scenarios: * -- As part of heart beat mechanism, probe req is sent out * -- If QoS Info IE in beacon has a different count for EDCA Params, * and EDCA IE is not present in beacon, * then probe req is sent out to get the EDCA params. * * Ignore Probe Response frame in all other states */ // TO SUPPORT BT-AMP if (((pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) || //mlm state check should be global - 18th oct (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) || //mlm state check should be global - 18th oct (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE) || //mlm state check should be global - 18th oct (psessionEntry->limMlmState == eLIM_MLM_WT_JOIN_BEACON_STATE) || (psessionEntry->limMlmState == eLIM_MLM_LINK_ESTABLISHED_STATE) )|| ((GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_STA_IN_IBSS_ROLE) && (psessionEntry->limMlmState == eLIM_MLM_BSS_STARTED_STATE)) || pMac->fScanOffload) { frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); if (pMac->lim.gLimBackgroundScanMode == eSIR_ROAMING_SCAN) { VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, FL("Probe Resp Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"), MAC_ADDR_ARRAY(pHdr->bssId), (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo))); } // Get pointer to Probe Response frame body pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo); if (sirConvertProbeFrame2Struct(pMac, pBody, frameLen, pProbeRsp) == eSIR_FAILURE || !pProbeRsp->ssidPresent) // Enforce Mandatory IEs { PELOG1(limLog(pMac, LOG1, FL("Parse error ProbeResponse, length=%d"), frameLen);) vos_mem_vfree(pProbeRsp); return; } if (pMac->fScanOffload) { limCheckAndAddBssDescription(pMac, pProbeRsp, pRxPacketInfo, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_TRUE); } //To Support BT-AMP if ((pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) || //mlm state check should be global - 18th oct (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE)) limCheckAndAddBssDescription(pMac, pProbeRsp, pRxPacketInfo, ((pMac->lim.gLimHalScanState == eLIM_HAL_SCANNING_STATE) ? eANI_BOOLEAN_TRUE : eANI_BOOLEAN_FALSE), eANI_BOOLEAN_TRUE); else if (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE) //mlm state check should be global - 18th oct { } else if (psessionEntry->limMlmState == eLIM_MLM_WT_JOIN_BEACON_STATE) { if( psessionEntry->beacon != NULL )//Either Beacon/probe response is required. Hence store it in same buffer. { vos_mem_free(psessionEntry->beacon); psessionEntry->beacon = NULL; } psessionEntry->bcnLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); psessionEntry->beacon = vos_mem_malloc(psessionEntry->bcnLen); if ( NULL == psessionEntry->beacon ) { PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store beacon"));) } else { //Store the Beacon/ProbeRsp. This is sent to csr/hdd in join cnf response. vos_mem_copy(psessionEntry->beacon, WDA_GET_RX_MPDU_DATA(pRxPacketInfo), psessionEntry->bcnLen); } // STA in WT_JOIN_BEACON_STATE limCheckAndAnnounceJoinSuccess(pMac, pProbeRsp, pHdr, psessionEntry); } else if(psessionEntry->limMlmState == eLIM_MLM_LINK_ESTABLISHED_STATE) { tpDphHashNode pStaDs = NULL; /** * Check if this Probe Response is for * our Probe Request sent upon reaching * heart beat threshold */ #if 0 if (wlan_cfgGetStr(pMac, WNI_CFG_BSSID, currentBssId, &cfg) != eSIR_SUCCESS) { /// Could not get BSSID from CFG. Log error. limLog(pMac, LOGP, FL("could not retrieve BSSID")); } #endif //TO SUPPORT BT-AMP sirCopyMacAddr(currentBssId,psessionEntry->bssId); if ( !vos_mem_compare(currentBssId, pHdr->bssId, sizeof(tSirMacAddr)) ) { vos_mem_vfree(pProbeRsp); return; } if (!LIM_IS_CONNECTION_ACTIVE(psessionEntry)) { limLog(pMac, LOGW, FL("Received Probe Resp from AP. So it is alive!!")); if (pProbeRsp->HTInfo.present) limReceivedHBHandler(pMac, (tANI_U8)pProbeRsp->HTInfo.primaryChannel, psessionEntry); else limReceivedHBHandler(pMac, (tANI_U8)pProbeRsp->channelNumber, psessionEntry); } if (psessionEntry->limSystemRole == eLIM_STA_ROLE) { if (pProbeRsp->channelSwitchPresent || pProbeRsp->propIEinfo.propChannelSwitchPresent || pProbeRsp->ecsa_present) { limUpdateChannelSwitch(pMac, pProbeRsp, psessionEntry); } else if (psessionEntry->gLimSpecMgmt.dot11hChanSwState == eLIM_11H_CHANSW_RUNNING) { limCancelDot11hChannelSwitch(pMac, psessionEntry); } } /** * Now Process EDCA Parameters, if EDCAParamSet count is different. * -- While processing beacons in link established state if it is determined that * QoS Info IE has a different count for EDCA Params, * and EDCA IE is not present in beacon, * then probe req is sent out to get the EDCA params. */ pStaDs = dphGetHashEntry(pMac, DPH_STA_HASH_INDEX_PEER, &psessionEntry->dph.dphHashTable); limGetQosMode(psessionEntry, &qosEnabled); limGetWmeMode(psessionEntry, &wmeEnabled); PELOG2(limLog(pMac, LOG2, FL("wmeEdcaPresent: %d wmeEnabled: %d, edcaPresent: %d, qosEnabled: %d, edcaParams.qosInfo.count: %d schObject.gLimEdcaParamSetCount: %d"), pProbeRsp->wmeEdcaPresent, wmeEnabled, pProbeRsp->edcaPresent, qosEnabled, pProbeRsp->edcaParams.qosInfo.count, psessionEntry->gLimEdcaParamSetCount);) if (((pProbeRsp->wmeEdcaPresent && wmeEnabled) || (pProbeRsp->edcaPresent && qosEnabled)) && (pProbeRsp->edcaParams.qosInfo.count != psessionEntry->gLimEdcaParamSetCount)) { if (schBeaconEdcaProcess(pMac, &pProbeRsp->edcaParams, psessionEntry) != eSIR_SUCCESS) PELOGE(limLog(pMac, LOGE, FL("EDCA parameter processing error"));) else if (pStaDs != NULL) { // If needed, downgrade the EDCA parameters limSetActiveEdcaParams(pMac, psessionEntry->gLimEdcaParams, psessionEntry); if (pStaDs->aniPeer == eANI_BOOLEAN_TRUE) limSendEdcaParams(pMac, psessionEntry->gLimEdcaParamsActive, pStaDs->bssId, eANI_BOOLEAN_TRUE); else limSendEdcaParams(pMac, psessionEntry->gLimEdcaParamsActive, pStaDs->bssId, eANI_BOOLEAN_FALSE); } else PELOGE(limLog(pMac, LOGE, FL("Self Entry missing in Hash Table"));) } if (psessionEntry->fWaitForProbeRsp == true) { limLog(pMac, LOGW, FL("Checking probe response for capability change\n") ); limDetectChangeInApCapabilities(pMac, pProbeRsp, psessionEntry); } } else if ((psessionEntry->limSystemRole == eLIM_STA_IN_IBSS_ROLE) && (psessionEntry->limMlmState == eLIM_MLM_BSS_STARTED_STATE)) limHandleIBSScoalescing(pMac, pProbeRsp, pRxPacketInfo,psessionEntry); } // if ((pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) || ... vos_mem_vfree(pProbeRsp); // Ignore Probe Response frame in all other states return; } /*** end limProcessProbeRspFrame() ***/ void limProcessProbeRspFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo) { tANI_U8 *pBody; tANI_U32 frameLen = 0; tpSirMacMgmtHdr pHdr; tSirProbeRespBeacon *pProbeRsp; pProbeRsp = vos_mem_vmalloc(sizeof(tSirProbeRespBeacon)); if ( NULL == pProbeRsp ) { limLog(pMac, LOGE, FL("Unable to allocate memory in limProcessProbeRspFrameNoSession") ); return; } pProbeRsp->ssId.length = 0; pProbeRsp->wpa.length = 0; pProbeRsp->propIEinfo.apName.length = 0; pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo); limLog(pMac, LOG2, FL("Received Probe Response frame with length=%d from "), WDA_GET_RX_MPDU_LEN(pRxPacketInfo)); limPrintMacAddr(pMac, pHdr->sa, LOG2); #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD if (!(WDA_GET_OFFLOADSCANLEARN(pRxPacketInfo) || WDA_GET_ROAMCANDIDATEIND(pRxPacketInfo))) { #endif if (!pMac->fScanOffload) { if (limDeactivateMinChannelTimerDuringScan(pMac) != eSIR_SUCCESS) { vos_mem_vfree(pProbeRsp); return; } } #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD } #endif // Validate IE information before processing Probe Response Frame if (limValidateIEInformationInProbeRspFrame(pMac, pRxPacketInfo) != eSIR_SUCCESS) { PELOG1(limLog(pMac, LOG1,FL("Parse error ProbeResponse, length=%d"), frameLen);) vos_mem_vfree(pProbeRsp); return; } /* Since there is no psessionEntry, PE cannot be in the following states: * - eLIM_MLM_WT_JOIN_BEACON_STATE * - eLIM_MLM_LINK_ESTABLISHED_STATE * - eLIM_MLM_BSS_STARTED_STATE * Hence, expect Probe Response only when * 1. STA is in scan mode waiting for Beacon/Probe response * 2. LFR logic in FW sends up candidate frames * * Ignore Probe Response frame in all other states */ #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD if (WDA_GET_OFFLOADSCANLEARN(pRxPacketInfo)) { frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); if (pMac->lim.gLimBackgroundScanMode == eSIR_ROAMING_SCAN) { VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, FL("Probe Resp Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"), MAC_ADDR_ARRAY(pHdr->bssId), (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo))); } // Get pointer to Probe Response frame body pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo); if (sirConvertProbeFrame2Struct(pMac, pBody, frameLen, pProbeRsp) == eSIR_FAILURE) { limLog(pMac, LOG1, FL("Parse error ProbeResponse, length=%d\n"), frameLen); vos_mem_vfree(pProbeRsp); return; } limLog( pMac, LOG2, FL("Save this probe rsp in LFR cache")); limCheckAndAddBssDescription(pMac, pProbeRsp, pRxPacketInfo, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_TRUE); } else #endif if (pMac->fScanOffload) { frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); // Get pointer to Probe Response frame body pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo); if (sirConvertProbeFrame2Struct(pMac, pBody, frameLen, pProbeRsp) == eSIR_FAILURE) { limLog(pMac, LOG1, FL("Parse error ProbeResponse, length=%d\n"), frameLen); vos_mem_vfree(pProbeRsp); return; } limCheckAndAddBssDescription(pMac, pProbeRsp, pRxPacketInfo, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_TRUE); } else if( (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) || (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) || //mlm state check should be global - 18th oct (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE) ) { frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); if (pMac->lim.gLimBackgroundScanMode == eSIR_ROAMING_SCAN) { VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, FL("Probe Resp Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"), MAC_ADDR_ARRAY(pHdr->bssId), (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo))); } // Get pointer to Probe Response frame body pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo); if (sirConvertProbeFrame2Struct(pMac, pBody, frameLen, pProbeRsp) == eSIR_FAILURE) { limLog(pMac, LOG1, FL("Parse error ProbeResponse, length=%d"), frameLen); vos_mem_vfree(pProbeRsp); return; } if( (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) || (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) ) limCheckAndAddBssDescription(pMac, pProbeRsp, pRxPacketInfo, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE); else if (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE) { } } vos_mem_vfree(pProbeRsp); return; } /*** end limProcessProbeRspFrameNew() ***/