1 /*
2 * hostapd / WMM (Wi-Fi Multimedia)
3 * Copyright 2002-2003, Instant802 Networks, Inc.
4 * Copyright 2005-2006, Devicescape Software, Inc.
5 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 * Alternatively, this software may be distributed under the terms of BSD
12 * license.
13 *
14 * See README and COPYING for more details.
15 */
16
17 #include "utils/includes.h"
18
19 #include "utils/common.h"
20 #include "common/ieee802_11_defs.h"
21 #include "common/ieee802_11_common.h"
22 #include "hostapd.h"
23 #include "ieee802_11.h"
24 #include "sta_info.h"
25 #include "ap_config.h"
26 #include "ap_drv_ops.h"
27 #include "wmm.h"
28
29
30 /* TODO: maintain separate sequence and fragment numbers for each AC
31 * TODO: IGMP snooping to track which multicasts to forward - and use QOS-DATA
32 * if only WMM stations are receiving a certain group */
33
34
wmm_aci_aifsn(int aifsn,int acm,int aci)35 static inline u8 wmm_aci_aifsn(int aifsn, int acm, int aci)
36 {
37 u8 ret;
38 ret = (aifsn << WMM_AC_AIFNS_SHIFT) & WMM_AC_AIFSN_MASK;
39 if (acm)
40 ret |= WMM_AC_ACM;
41 ret |= (aci << WMM_AC_ACI_SHIFT) & WMM_AC_ACI_MASK;
42 return ret;
43 }
44
45
wmm_ecw(int ecwmin,int ecwmax)46 static inline u8 wmm_ecw(int ecwmin, int ecwmax)
47 {
48 return ((ecwmin << WMM_AC_ECWMIN_SHIFT) & WMM_AC_ECWMIN_MASK) |
49 ((ecwmax << WMM_AC_ECWMAX_SHIFT) & WMM_AC_ECWMAX_MASK);
50 }
51
52
53 /*
54 * Add WMM Parameter Element to Beacon, Probe Response, and (Re)Association
55 * Response frames.
56 */
hostapd_eid_wmm(struct hostapd_data * hapd,u8 * eid)57 u8 * hostapd_eid_wmm(struct hostapd_data *hapd, u8 *eid)
58 {
59 u8 *pos = eid;
60 struct wmm_parameter_element *wmm =
61 (struct wmm_parameter_element *) (pos + 2);
62 int e;
63
64 if (!hapd->conf->wmm_enabled)
65 return eid;
66 eid[0] = WLAN_EID_VENDOR_SPECIFIC;
67 wmm->oui[0] = 0x00;
68 wmm->oui[1] = 0x50;
69 wmm->oui[2] = 0xf2;
70 wmm->oui_type = WMM_OUI_TYPE;
71 wmm->oui_subtype = WMM_OUI_SUBTYPE_PARAMETER_ELEMENT;
72 wmm->version = WMM_VERSION;
73 wmm->qos_info = hapd->parameter_set_count & 0xf;
74
75 if (hapd->conf->wmm_uapsd)
76 wmm->qos_info |= 0x80;
77
78 wmm->reserved = 0;
79
80 /* fill in a parameter set record for each AC */
81 for (e = 0; e < 4; e++) {
82 struct wmm_ac_parameter *ac = &wmm->ac[e];
83 struct hostapd_wmm_ac_params *acp =
84 &hapd->iconf->wmm_ac_params[e];
85
86 ac->aci_aifsn = wmm_aci_aifsn(acp->aifs,
87 acp->admission_control_mandatory,
88 e);
89 ac->cw = wmm_ecw(acp->cwmin, acp->cwmax);
90 ac->txop_limit = host_to_le16(acp->txop_limit);
91 }
92
93 pos = (u8 *) (wmm + 1);
94 eid[1] = pos - eid - 2; /* element length */
95
96 return pos;
97 }
98
99
100 /* This function is called when a station sends an association request with
101 * WMM info element. The function returns zero on success or non-zero on any
102 * error in WMM element. eid does not include Element ID and Length octets. */
hostapd_eid_wmm_valid(struct hostapd_data * hapd,const u8 * eid,size_t len)103 int hostapd_eid_wmm_valid(struct hostapd_data *hapd, const u8 *eid, size_t len)
104 {
105 struct wmm_information_element *wmm;
106
107 wpa_hexdump(MSG_MSGDUMP, "WMM IE", eid, len);
108
109 if (len < sizeof(struct wmm_information_element)) {
110 wpa_printf(MSG_DEBUG, "Too short WMM IE (len=%lu)",
111 (unsigned long) len);
112 return -1;
113 }
114
115 wmm = (struct wmm_information_element *) eid;
116 wpa_printf(MSG_DEBUG, "Validating WMM IE: OUI %02x:%02x:%02x "
117 "OUI type %d OUI sub-type %d version %d QoS info 0x%x",
118 wmm->oui[0], wmm->oui[1], wmm->oui[2], wmm->oui_type,
119 wmm->oui_subtype, wmm->version, wmm->qos_info);
120 if (wmm->oui_subtype != WMM_OUI_SUBTYPE_INFORMATION_ELEMENT ||
121 wmm->version != WMM_VERSION) {
122 wpa_printf(MSG_DEBUG, "Unsupported WMM IE Subtype/Version");
123 return -1;
124 }
125
126 return 0;
127 }
128
129
wmm_send_action(struct hostapd_data * hapd,const u8 * addr,const struct wmm_tspec_element * tspec,u8 action_code,u8 dialogue_token,u8 status_code)130 static void wmm_send_action(struct hostapd_data *hapd, const u8 *addr,
131 const struct wmm_tspec_element *tspec,
132 u8 action_code, u8 dialogue_token, u8 status_code)
133 {
134 u8 buf[256];
135 struct ieee80211_mgmt *m = (struct ieee80211_mgmt *) buf;
136 struct wmm_tspec_element *t = (struct wmm_tspec_element *)
137 m->u.action.u.wmm_action.variable;
138 int len;
139
140 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
141 HOSTAPD_LEVEL_DEBUG,
142 "action response - reason %d", status_code);
143 os_memset(buf, 0, sizeof(buf));
144 m->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
145 WLAN_FC_STYPE_ACTION);
146 os_memcpy(m->da, addr, ETH_ALEN);
147 os_memcpy(m->sa, hapd->own_addr, ETH_ALEN);
148 os_memcpy(m->bssid, hapd->own_addr, ETH_ALEN);
149 m->u.action.category = WLAN_ACTION_WMM;
150 m->u.action.u.wmm_action.action_code = action_code;
151 m->u.action.u.wmm_action.dialog_token = dialogue_token;
152 m->u.action.u.wmm_action.status_code = status_code;
153 os_memcpy(t, tspec, sizeof(struct wmm_tspec_element));
154 len = ((u8 *) (t + 1)) - buf;
155
156 if (hostapd_drv_send_mlme(hapd, m, len) < 0)
157 perror("wmm_send_action: send");
158 }
159
160
wmm_process_tspec(struct wmm_tspec_element * tspec)161 int wmm_process_tspec(struct wmm_tspec_element *tspec)
162 {
163 int medium_time, pps, duration;
164 int up, psb, dir, tid;
165 u16 val, surplus;
166
167 up = (tspec->ts_info[1] >> 3) & 0x07;
168 psb = (tspec->ts_info[1] >> 2) & 0x01;
169 dir = (tspec->ts_info[0] >> 5) & 0x03;
170 tid = (tspec->ts_info[0] >> 1) & 0x0f;
171 wpa_printf(MSG_DEBUG, "WMM: TS Info: UP=%d PSB=%d Direction=%d TID=%d",
172 up, psb, dir, tid);
173 val = le_to_host16(tspec->nominal_msdu_size);
174 wpa_printf(MSG_DEBUG, "WMM: Nominal MSDU Size: %d%s",
175 val & 0x7fff, val & 0x8000 ? " (fixed)" : "");
176 wpa_printf(MSG_DEBUG, "WMM: Mean Data Rate: %u bps",
177 le_to_host32(tspec->mean_data_rate));
178 wpa_printf(MSG_DEBUG, "WMM: Minimum PHY Rate: %u bps",
179 le_to_host32(tspec->minimum_phy_rate));
180 val = le_to_host16(tspec->surplus_bandwidth_allowance);
181 wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance: %u.%04u",
182 val >> 13, 10000 * (val & 0x1fff) / 0x2000);
183
184 val = le_to_host16(tspec->nominal_msdu_size);
185 if (val == 0) {
186 wpa_printf(MSG_DEBUG, "WMM: Invalid Nominal MSDU Size (0)");
187 return WMM_ADDTS_STATUS_INVALID_PARAMETERS;
188 }
189 /* pps = Ceiling((Mean Data Rate / 8) / Nominal MSDU Size) */
190 pps = ((le_to_host32(tspec->mean_data_rate) / 8) + val - 1) / val;
191 wpa_printf(MSG_DEBUG, "WMM: Packets-per-second estimate for TSPEC: %d",
192 pps);
193
194 if (le_to_host32(tspec->minimum_phy_rate) < 1000000) {
195 wpa_printf(MSG_DEBUG, "WMM: Too small Minimum PHY Rate");
196 return WMM_ADDTS_STATUS_INVALID_PARAMETERS;
197 }
198
199 duration = (le_to_host16(tspec->nominal_msdu_size) & 0x7fff) * 8 /
200 (le_to_host32(tspec->minimum_phy_rate) / 1000000) +
201 50 /* FIX: proper SIFS + ACK duration */;
202
203 /* unsigned binary number with an implicit binary point after the
204 * leftmost 3 bits, i.e., 0x2000 = 1.0 */
205 surplus = le_to_host16(tspec->surplus_bandwidth_allowance);
206 if (surplus <= 0x2000) {
207 wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance not "
208 "greater than unity");
209 return WMM_ADDTS_STATUS_INVALID_PARAMETERS;
210 }
211
212 medium_time = surplus * pps * duration / 0x2000;
213 wpa_printf(MSG_DEBUG, "WMM: Estimated medium time: %u", medium_time);
214
215 /*
216 * TODO: store list of granted (and still active) TSPECs and check
217 * whether there is available medium time for this request. For now,
218 * just refuse requests that would by themselves take very large
219 * portion of the available bandwidth.
220 */
221 if (medium_time > 750000) {
222 wpa_printf(MSG_DEBUG, "WMM: Refuse TSPEC request for over "
223 "75%% of available bandwidth");
224 return WMM_ADDTS_STATUS_REFUSED;
225 }
226
227 /* Convert to 32 microseconds per second unit */
228 tspec->medium_time = host_to_le16(medium_time / 32);
229
230 return WMM_ADDTS_STATUS_ADMISSION_ACCEPTED;
231 }
232
233
wmm_addts_req(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,struct wmm_tspec_element * tspec,size_t len)234 static void wmm_addts_req(struct hostapd_data *hapd,
235 const struct ieee80211_mgmt *mgmt,
236 struct wmm_tspec_element *tspec, size_t len)
237 {
238 const u8 *end = ((const u8 *) mgmt) + len;
239 int res;
240
241 if ((const u8 *) (tspec + 1) > end) {
242 wpa_printf(MSG_DEBUG, "WMM: TSPEC overflow in ADDTS Request");
243 return;
244 }
245
246 wpa_printf(MSG_DEBUG, "WMM: ADDTS Request (Dialog Token %d) for TSPEC "
247 "from " MACSTR,
248 mgmt->u.action.u.wmm_action.dialog_token,
249 MAC2STR(mgmt->sa));
250
251 res = wmm_process_tspec(tspec);
252 wpa_printf(MSG_DEBUG, "WMM: ADDTS processing result: %d", res);
253
254 wmm_send_action(hapd, mgmt->sa, tspec, WMM_ACTION_CODE_ADDTS_RESP,
255 mgmt->u.action.u.wmm_action.dialog_token, res);
256 }
257
258
hostapd_wmm_action(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len)259 void hostapd_wmm_action(struct hostapd_data *hapd,
260 const struct ieee80211_mgmt *mgmt, size_t len)
261 {
262 int action_code;
263 int left = len - IEEE80211_HDRLEN - 4;
264 const u8 *pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 4;
265 struct ieee802_11_elems elems;
266 struct sta_info *sta = ap_get_sta(hapd, mgmt->sa);
267
268 /* check that the request comes from a valid station */
269 if (!sta ||
270 (sta->flags & (WLAN_STA_ASSOC | WLAN_STA_WMM)) !=
271 (WLAN_STA_ASSOC | WLAN_STA_WMM)) {
272 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
273 HOSTAPD_LEVEL_DEBUG,
274 "wmm action received is not from associated wmm"
275 " station");
276 /* TODO: respond with action frame refused status code */
277 return;
278 }
279
280 /* extract the tspec info element */
281 if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
282 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
283 HOSTAPD_LEVEL_DEBUG,
284 "hostapd_wmm_action - could not parse wmm "
285 "action");
286 /* TODO: respond with action frame invalid parameters status
287 * code */
288 return;
289 }
290
291 if (!elems.wmm_tspec ||
292 elems.wmm_tspec_len != (sizeof(struct wmm_tspec_element) - 2)) {
293 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
294 HOSTAPD_LEVEL_DEBUG,
295 "hostapd_wmm_action - missing or wrong length "
296 "tspec");
297 /* TODO: respond with action frame invalid parameters status
298 * code */
299 return;
300 }
301
302 /* TODO: check the request is for an AC with ACM set, if not, refuse
303 * request */
304
305 action_code = mgmt->u.action.u.wmm_action.action_code;
306 switch (action_code) {
307 case WMM_ACTION_CODE_ADDTS_REQ:
308 wmm_addts_req(hapd, mgmt, (struct wmm_tspec_element *)
309 (elems.wmm_tspec - 2), len);
310 return;
311 #if 0
312 /* TODO: needed for client implementation */
313 case WMM_ACTION_CODE_ADDTS_RESP:
314 wmm_setup_request(hapd, mgmt, len);
315 return;
316 /* TODO: handle station teardown requests */
317 case WMM_ACTION_CODE_DELTS:
318 wmm_teardown(hapd, mgmt, len);
319 return;
320 #endif
321 }
322
323 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
324 HOSTAPD_LEVEL_DEBUG,
325 "hostapd_wmm_action - unknown action code %d",
326 action_code);
327 }
328