• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * hostapd / WMM (Wi-Fi Multimedia)
3  * Copyright 2002-2003, Instant802 Networks, Inc.
4  * Copyright 2005-2006, Devicescape Software, Inc.
5  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
6  *
7  * This software may be distributed under the terms of the BSD license.
8  * See README for more details.
9  */
10 
11 #include "utils/includes.h"
12 
13 #include "utils/common.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/ieee802_11_common.h"
16 #include "hostapd.h"
17 #include "ieee802_11.h"
18 #include "sta_info.h"
19 #include "ap_config.h"
20 #include "ap_drv_ops.h"
21 #include "wmm.h"
22 
23 
wmm_aci_aifsn(int aifsn,int acm,int aci)24 static inline u8 wmm_aci_aifsn(int aifsn, int acm, int aci)
25 {
26 	u8 ret;
27 	ret = (aifsn << WMM_AC_AIFNS_SHIFT) & WMM_AC_AIFSN_MASK;
28 	if (acm)
29 		ret |= WMM_AC_ACM;
30 	ret |= (aci << WMM_AC_ACI_SHIFT) & WMM_AC_ACI_MASK;
31 	return ret;
32 }
33 
34 
wmm_ecw(int ecwmin,int ecwmax)35 static inline u8 wmm_ecw(int ecwmin, int ecwmax)
36 {
37 	return ((ecwmin << WMM_AC_ECWMIN_SHIFT) & WMM_AC_ECWMIN_MASK) |
38 		((ecwmax << WMM_AC_ECWMAX_SHIFT) & WMM_AC_ECWMAX_MASK);
39 }
40 
41 
42 /*
43  * Add WMM Parameter Element to Beacon, Probe Response, and (Re)Association
44  * Response frames.
45  */
hostapd_eid_wmm(struct hostapd_data * hapd,u8 * eid)46 u8 * hostapd_eid_wmm(struct hostapd_data *hapd, u8 *eid)
47 {
48 	u8 *pos = eid;
49 	struct wmm_parameter_element *wmm =
50 		(struct wmm_parameter_element *) (pos + 2);
51 	int e;
52 
53 	if (!hapd->conf->wmm_enabled)
54 		return eid;
55 	eid[0] = WLAN_EID_VENDOR_SPECIFIC;
56 	wmm->oui[0] = 0x00;
57 	wmm->oui[1] = 0x50;
58 	wmm->oui[2] = 0xf2;
59 	wmm->oui_type = WMM_OUI_TYPE;
60 	wmm->oui_subtype = WMM_OUI_SUBTYPE_PARAMETER_ELEMENT;
61 	wmm->version = WMM_VERSION;
62 	wmm->qos_info = hapd->parameter_set_count & 0xf;
63 
64 	if (hapd->conf->wmm_uapsd &&
65 	    (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_UAPSD))
66 		wmm->qos_info |= 0x80;
67 
68 	wmm->reserved = 0;
69 
70 	/* fill in a parameter set record for each AC */
71 	for (e = 0; e < 4; e++) {
72 		struct wmm_ac_parameter *ac = &wmm->ac[e];
73 		struct hostapd_wmm_ac_params *acp =
74 			&hapd->iconf->wmm_ac_params[e];
75 
76 		ac->aci_aifsn = wmm_aci_aifsn(acp->aifs,
77 					      acp->admission_control_mandatory,
78 					      e);
79 		ac->cw = wmm_ecw(acp->cwmin, acp->cwmax);
80 		ac->txop_limit = host_to_le16(acp->txop_limit);
81 	}
82 
83 	pos = (u8 *) (wmm + 1);
84 	eid[1] = pos - eid - 2; /* element length */
85 
86 	return pos;
87 }
88 
89 
90 /*
91  * This function is called when a station sends an association request with
92  * WMM info element. The function returns 1 on success or 0 on any error in WMM
93  * element. eid does not include Element ID and Length octets.
94  */
hostapd_eid_wmm_valid(struct hostapd_data * hapd,const u8 * eid,size_t len)95 int hostapd_eid_wmm_valid(struct hostapd_data *hapd, const u8 *eid, size_t len)
96 {
97 	struct wmm_information_element *wmm;
98 
99 	wpa_hexdump(MSG_MSGDUMP, "WMM IE", eid, len);
100 
101 	if (len < sizeof(struct wmm_information_element)) {
102 		wpa_printf(MSG_DEBUG, "Too short WMM IE (len=%lu)",
103 			   (unsigned long) len);
104 		return 0;
105 	}
106 
107 	wmm = (struct wmm_information_element *) eid;
108 	wpa_printf(MSG_DEBUG, "Validating WMM IE: OUI %02x:%02x:%02x  "
109 		   "OUI type %d  OUI sub-type %d  version %d  QoS info 0x%x",
110 		   wmm->oui[0], wmm->oui[1], wmm->oui[2], wmm->oui_type,
111 		   wmm->oui_subtype, wmm->version, wmm->qos_info);
112 	if (wmm->oui_subtype != WMM_OUI_SUBTYPE_INFORMATION_ELEMENT ||
113 	    wmm->version != WMM_VERSION) {
114 		wpa_printf(MSG_DEBUG, "Unsupported WMM IE Subtype/Version");
115 		return 0;
116 	}
117 
118 	return 1;
119 }
120 
121 
wmm_send_action(struct hostapd_data * hapd,const u8 * addr,const struct wmm_tspec_element * tspec,u8 action_code,u8 dialogue_token,u8 status_code)122 static void wmm_send_action(struct hostapd_data *hapd, const u8 *addr,
123 			    const struct wmm_tspec_element *tspec,
124 			    u8 action_code, u8 dialogue_token, u8 status_code)
125 {
126 	u8 buf[256];
127 	struct ieee80211_mgmt *m = (struct ieee80211_mgmt *) buf;
128 	struct wmm_tspec_element *t = (struct wmm_tspec_element *)
129 		m->u.action.u.wmm_action.variable;
130 	int len;
131 
132 	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
133 		       HOSTAPD_LEVEL_DEBUG,
134 		       "action response - reason %d", status_code);
135 	os_memset(buf, 0, sizeof(buf));
136 	m->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
137 					WLAN_FC_STYPE_ACTION);
138 	os_memcpy(m->da, addr, ETH_ALEN);
139 	os_memcpy(m->sa, hapd->own_addr, ETH_ALEN);
140 	os_memcpy(m->bssid, hapd->own_addr, ETH_ALEN);
141 	m->u.action.category = WLAN_ACTION_WMM;
142 	m->u.action.u.wmm_action.action_code = action_code;
143 	m->u.action.u.wmm_action.dialog_token = dialogue_token;
144 	m->u.action.u.wmm_action.status_code = status_code;
145 	os_memcpy(t, tspec, sizeof(struct wmm_tspec_element));
146 	len = ((u8 *) (t + 1)) - buf;
147 
148 	if (hostapd_drv_send_mlme(hapd, m, len, 0) < 0)
149 		wpa_printf(MSG_INFO, "wmm_send_action: send failed");
150 }
151 
152 
wmm_process_tspec(struct wmm_tspec_element * tspec)153 int wmm_process_tspec(struct wmm_tspec_element *tspec)
154 {
155 	u64 medium_time;
156 	unsigned int pps, duration;
157 	unsigned int up, psb, dir, tid;
158 	u16 val, surplus;
159 
160 	up = (tspec->ts_info[1] >> 3) & 0x07;
161 	psb = (tspec->ts_info[1] >> 2) & 0x01;
162 	dir = (tspec->ts_info[0] >> 5) & 0x03;
163 	tid = (tspec->ts_info[0] >> 1) & 0x0f;
164 	wpa_printf(MSG_DEBUG, "WMM: TS Info: UP=%d PSB=%d Direction=%d TID=%d",
165 		   up, psb, dir, tid);
166 	val = le_to_host16(tspec->nominal_msdu_size);
167 	wpa_printf(MSG_DEBUG, "WMM: Nominal MSDU Size: %d%s",
168 		   val & 0x7fff, val & 0x8000 ? " (fixed)" : "");
169 	wpa_printf(MSG_DEBUG, "WMM: Mean Data Rate: %u bps",
170 		   le_to_host32(tspec->mean_data_rate));
171 	wpa_printf(MSG_DEBUG, "WMM: Minimum PHY Rate: %u bps",
172 		   le_to_host32(tspec->minimum_phy_rate));
173 	val = le_to_host16(tspec->surplus_bandwidth_allowance);
174 	wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance: %u.%04u",
175 		   val >> 13, 10000 * (val & 0x1fff) / 0x2000);
176 
177 	val = le_to_host16(tspec->nominal_msdu_size);
178 	if (val == 0) {
179 		wpa_printf(MSG_DEBUG, "WMM: Invalid Nominal MSDU Size (0)");
180 		return WMM_ADDTS_STATUS_INVALID_PARAMETERS;
181 	}
182 	/* pps = Ceiling((Mean Data Rate / 8) / Nominal MSDU Size) */
183 	pps = ((le_to_host32(tspec->mean_data_rate) / 8) + val - 1) / val;
184 	wpa_printf(MSG_DEBUG, "WMM: Packets-per-second estimate for TSPEC: %d",
185 		   pps);
186 
187 	if (le_to_host32(tspec->minimum_phy_rate) < 1000000) {
188 		wpa_printf(MSG_DEBUG, "WMM: Too small Minimum PHY Rate");
189 		return WMM_ADDTS_STATUS_INVALID_PARAMETERS;
190 	}
191 
192 	duration = (le_to_host16(tspec->nominal_msdu_size) & 0x7fff) * 8 /
193 		(le_to_host32(tspec->minimum_phy_rate) / 1000000) +
194 		50 /* FIX: proper SIFS + ACK duration */;
195 
196 	/* unsigned binary number with an implicit binary point after the
197 	 * leftmost 3 bits, i.e., 0x2000 = 1.0 */
198 	surplus = le_to_host16(tspec->surplus_bandwidth_allowance);
199 	if (surplus <= 0x2000) {
200 		wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance not "
201 			   "greater than unity");
202 		return WMM_ADDTS_STATUS_INVALID_PARAMETERS;
203 	}
204 
205 	medium_time = (u64) surplus * pps * duration / 0x2000;
206 	wpa_printf(MSG_DEBUG, "WMM: Estimated medium time: %lu",
207 		   (unsigned long) medium_time);
208 
209 	/*
210 	 * TODO: store list of granted (and still active) TSPECs and check
211 	 * whether there is available medium time for this request. For now,
212 	 * just refuse requests that would by themselves take very large
213 	 * portion of the available bandwidth.
214 	 */
215 	if (medium_time > 750000) {
216 		wpa_printf(MSG_DEBUG, "WMM: Refuse TSPEC request for over "
217 			   "75%% of available bandwidth");
218 		return WMM_ADDTS_STATUS_REFUSED;
219 	}
220 
221 	/* Convert to 32 microseconds per second unit */
222 	tspec->medium_time = host_to_le16(medium_time / 32);
223 
224 	return WMM_ADDTS_STATUS_ADMISSION_ACCEPTED;
225 }
226 
227 
wmm_addts_req(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,struct wmm_tspec_element * tspec,size_t len)228 static void wmm_addts_req(struct hostapd_data *hapd,
229 			  const struct ieee80211_mgmt *mgmt,
230 			  struct wmm_tspec_element *tspec, size_t len)
231 {
232 	const u8 *end = ((const u8 *) mgmt) + len;
233 	int res;
234 
235 	if ((const u8 *) (tspec + 1) > end) {
236 		wpa_printf(MSG_DEBUG, "WMM: TSPEC overflow in ADDTS Request");
237 		return;
238 	}
239 
240 	wpa_printf(MSG_DEBUG, "WMM: ADDTS Request (Dialog Token %d) for TSPEC "
241 		   "from " MACSTR,
242 		   mgmt->u.action.u.wmm_action.dialog_token,
243 		   MAC2STR(mgmt->sa));
244 
245 	res = wmm_process_tspec(tspec);
246 	wpa_printf(MSG_DEBUG, "WMM: ADDTS processing result: %d", res);
247 
248 	wmm_send_action(hapd, mgmt->sa, tspec, WMM_ACTION_CODE_ADDTS_RESP,
249 			mgmt->u.action.u.wmm_action.dialog_token, res);
250 }
251 
252 
hostapd_wmm_action(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len)253 void hostapd_wmm_action(struct hostapd_data *hapd,
254 			const struct ieee80211_mgmt *mgmt, size_t len)
255 {
256 	int action_code;
257 	int left = len - IEEE80211_HDRLEN - 4;
258 	const u8 *pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 4;
259 	struct ieee802_11_elems elems;
260 	struct sta_info *sta = ap_get_sta(hapd, mgmt->sa);
261 
262 	/* check that the request comes from a valid station */
263 	if (!sta ||
264 	    (sta->flags & (WLAN_STA_ASSOC | WLAN_STA_WMM)) !=
265 	    (WLAN_STA_ASSOC | WLAN_STA_WMM)) {
266 		hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
267 			       HOSTAPD_LEVEL_DEBUG,
268 			       "wmm action received is not from associated wmm"
269 			       " station");
270 		/* TODO: respond with action frame refused status code */
271 		return;
272 	}
273 
274 	if (left < 0)
275 		return; /* not a valid WMM Action frame */
276 
277 	/* extract the tspec info element */
278 	if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
279 		hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
280 			       HOSTAPD_LEVEL_DEBUG,
281 			       "hostapd_wmm_action - could not parse wmm "
282 			       "action");
283 		/* TODO: respond with action frame invalid parameters status
284 		 * code */
285 		return;
286 	}
287 
288 	if (!elems.wmm_tspec ||
289 	    elems.wmm_tspec_len != (sizeof(struct wmm_tspec_element) - 2)) {
290 		hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
291 			       HOSTAPD_LEVEL_DEBUG,
292 			       "hostapd_wmm_action - missing or wrong length "
293 			       "tspec");
294 		/* TODO: respond with action frame invalid parameters status
295 		 * code */
296 		return;
297 	}
298 
299 	/* TODO: check the request is for an AC with ACM set, if not, refuse
300 	 * request */
301 
302 	action_code = mgmt->u.action.u.wmm_action.action_code;
303 	switch (action_code) {
304 	case WMM_ACTION_CODE_ADDTS_REQ:
305 		wmm_addts_req(hapd, mgmt, (struct wmm_tspec_element *)
306 			      (elems.wmm_tspec - 2), len);
307 		return;
308 #if 0
309 	/* TODO: needed for client implementation */
310 	case WMM_ACTION_CODE_ADDTS_RESP:
311 		wmm_setup_request(hapd, mgmt, len);
312 		return;
313 	/* TODO: handle station teardown requests */
314 	case WMM_ACTION_CODE_DELTS:
315 		wmm_teardown(hapd, mgmt, len);
316 		return;
317 #endif
318 	}
319 
320 	hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
321 		       HOSTAPD_LEVEL_DEBUG,
322 		       "hostapd_wmm_action - unknown action code %d",
323 		       action_code);
324 }
325