[PATCH v2 1/3] cfg80211: Allow a scan request for a specific BSSID

[PATCH v2 1/3] cfg80211: Allow a scan request for a specific BSSID

[Jouni Malinen]

This allows scans for a specific BSSID to be optimized by the user space
application by requesting the driver to set the Probe Request frame
BSSID field (Address 3) to the specified BSSID instead of the wildcard
BSSID. This prevents other APs from replying which reduces airtime need
and latency in getting the response from the target AP through.

This is an optimization and as such, it is acceptable for some of the
drivers not to support the mechanism. If not supported, the wildcard
BSSID will be used and more responses may be received.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---

Notes:
    v2: Updated two forgotten rdev_scan() callers

 include/net/cfg80211.h       | 2 ++
 include/uapi/linux/nl80211.h | 4 +++-
 net/wireless/nl80211.c       | 6 ++++++
 net/wireless/scan.c          | 2 ++
 net/wireless/sme.c           | 2 ++
 5 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 9e1b24c..14c0c43 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1455,6 +1455,7 @@ struct cfg80211_ssid {
  * @mac_addr_mask: MAC address mask used with randomisation, bits that
  *	are 0 in the mask should be randomised, bits that are 1 should
  *	be taken from the @mac_addr
+ * @bssid: BSSID to scan for (most commonly, the wildcard BSSID)
  */
 struct cfg80211_scan_request {
 	struct cfg80211_ssid *ssids;
@@ -1471,6 +1472,7 @@ struct cfg80211_scan_request {
 
 	u8 mac_addr[ETH_ALEN] __aligned(2);
 	u8 mac_addr_mask[ETH_ALEN] __aligned(2);
+	u8 bssid[ETH_ALEN] __aligned(2);
 
 	/* internal */
 	struct wiphy *wiphy;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 5a30a75..23bf066 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -322,7 +322,9 @@
  * @NL80211_CMD_GET_SCAN: get scan results
  * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters
  *	%NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
- *	probe requests at CCK rate or not.
+ *	probe requests at CCK rate or not. %NL80211_ATTR_MAC can be used to
+ *	specify a BSSID to scan for; if not included, the wildcard BSSID will
+ *	be used.
  * @NL80211_CMD_NEW_SCAN_RESULTS: scan notification (as a reply to
  *	NL80211_CMD_GET_SCAN and on the "scan" multicast group)
  * @NL80211_CMD_SCAN_ABORTED: scan was aborted, for unspecified reasons,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 98c9242..1b43f78 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5996,6 +5996,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 	request->no_cck =
 		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
 
+	if (info->attrs[NL80211_ATTR_MAC])
+		memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
+		       ETH_ALEN);
+	else
+		eth_broadcast_addr(request->bssid);
+
 	request->wdev = wdev;
 	request->wiphy = &rdev->wiphy;
 	request->scan_start = jiffies;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 14d5369..50ea8e3 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1293,6 +1293,8 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 		if (wiphy->bands[i])
 			creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
 
+	eth_broadcast_addr(creq->bssid);
+
 	rdev->scan_req = creq;
 	err = rdev_scan(rdev, creq);
 	if (err) {
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 5445581..65882d2 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -119,6 +119,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
 		wdev->conn->params.ssid_len);
 	request->ssids[0].ssid_len = wdev->conn->params.ssid_len;
 
+	eth_broadcast_addr(request->bssid);
+
 	request->wdev = wdev;
 	request->wiphy = &rdev->wiphy;
 	request->scan_start = jiffies;
-- 
1.9.1

[PATCH v2 2/3] mac80211: Support a scan request for a specific BSSID

[Jouni Malinen]

If the cfg80211 scan trigger operation specifies a single BSSID, use
that value instead of the wildcard BSSID in the Probe Request frames.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---

Notes:
    v2: Fix bssid setting for hw_scan

 net/mac80211/scan.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index ae980ce..70f9d5a 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -303,6 +303,7 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
 	ether_addr_copy(local->hw_scan_req->req.mac_addr, req->mac_addr);
 	ether_addr_copy(local->hw_scan_req->req.mac_addr_mask,
 			req->mac_addr_mask);
+	ether_addr_copy(local->hw_scan_req->req.bssid, req->bssid);
 
 	return true;
 }
@@ -497,7 +498,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
 
 	for (i = 0; i < scan_req->n_ssids; i++)
 		ieee80211_send_probe_req(
-			sdata, local->scan_addr, NULL,
+			sdata, local->scan_addr, scan_req->bssid,
 			scan_req->ssids[i].ssid, scan_req->ssids[i].ssid_len,
 			scan_req->ie, scan_req->ie_len,
 			scan_req->rates[band], false,
@@ -562,6 +563,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 			req->n_channels * sizeof(req->channels[0]);
 		local->hw_scan_req->req.ie = ies;
 		local->hw_scan_req->req.flags = req->flags;
+		eth_broadcast_addr(local->hw_scan_req->req.bssid);
 
 		local->hw_scan_band = 0;
 
-- 
1.9.1

[PATCH v2 3/3] mac80211_hwsim: Support a hw scan request for a specific BSSID

[Jouni Malinen]

If the hw scan request specifies a single BSSID, use that value instead
of the wildcard BSSID in the Probe Request frames.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---
 drivers/net/wireless/mac80211_hwsim.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a723a85..281c6b7 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1909,6 +1909,7 @@ static void hw_scan_work(struct work_struct *work)
 		/* send probes */
 		for (i = 0; i < req->n_ssids; i++) {
 			struct sk_buff *probe;
+			struct ieee80211_mgmt *mgmt;
 
 			probe = ieee80211_probereq_get(hwsim->hw,
 						       hwsim->scan_addr,
@@ -1918,6 +1919,10 @@ static void hw_scan_work(struct work_struct *work)
 			if (!probe)
 				continue;
 
+			mgmt = (struct ieee80211_mgmt *) probe->data;
+			memcpy(mgmt->da, req->bssid, ETH_ALEN);
+			memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
+
 			if (req->ie_len)
 				memcpy(skb_put(probe, req->ie_len), req->ie,
 				       req->ie_len);
-- 
1.9.1

Re: [PATCH v2 1/3] cfg80211: Allow a scan request for a specific BSSID

[Johannes Berg]

On Fri, 2016-02-26 at 22:12 +0200, Jouni Malinen wrote:
> This allows scans for a specific BSSID to be optimized by the user
> space
> application by requesting the driver to set the Probe Request frame
> BSSID field (Address 3) to the specified BSSID instead of the
> wildcard
> BSSID. This prevents other APs from replying which reduces airtime
> need
> and latency in getting the response from the target AP through.
> 
> This is an optimization and as such, it is acceptable for some of the
> drivers not to support the mechanism. If not supported, the wildcard
> BSSID will be used and more responses may be received.
> 
Applied all three.

johannes

Re: [PATCH v2 1/3] cfg80211: Allow a scan request for a specific BSSID

[Luca Coelho]

Looks good.  A couple of small comments.

On Fri, 2016-02-26 at 22:12 +0200, Jouni Malinen wrote:
> This allows scans for a specific BSSID to be optimized by the user space
> application by requesting the driver to set the Probe Request frame
> BSSID field (Address 3) to the specified BSSID instead of the wildcard
> BSSID. This prevents other APs from replying which reduces airtime need
> and latency in getting the response from the target AP through.
> 
> This is an optimization and as such, it is acceptable for some of the
> drivers not to support the mechanism. If not supported, the wildcard
> BSSID will be used and more responses may be received.

Receiving more responses than what we asked for is always possible,
because we don't filter out other things we may receive at the same
time.  It's like requesting for a specific SSID, it just means that the
SSID will be used in the probe requests, but it doesn't guarantee that
other results will not be returned.


> Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
> ---
> 
> Notes:
>     v2: Updated two forgotten rdev_scan() callers
> 
>  include/net/cfg80211.h       | 2 ++
>  include/uapi/linux/nl80211.h | 4 +++-
>  net/wireless/nl80211.c       | 6 ++++++
>  net/wireless/scan.c          | 2 ++
>  net/wireless/sme.c           | 2 ++
>  5 files changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index 9e1b24c..14c0c43 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -1455,6 +1455,7 @@ struct cfg80211_ssid {
>   * @mac_addr_mask: MAC address mask used with randomisation, bits that
>   *	are 0 in the mask should be randomised, bits that are 1 should
>   *	be taken from the @mac_addr
> + * @bssid: BSSID to scan for (most commonly, the wildcard BSSID)
>   */
>  struct cfg80211_scan_request {
>  	struct cfg80211_ssid *ssids;
> @@ -1471,6 +1472,7 @@ struct cfg80211_scan_request {
>  
>  	u8 mac_addr[ETH_ALEN] __aligned(2);
>  	u8 mac_addr_mask[ETH_ALEN] __aligned(2);
> +	u8 bssid[ETH_ALEN] __aligned(2);
>  
>  	/* internal */
>  	struct wiphy *wiphy;
> diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
> index 5a30a75..23bf066 100644
> --- a/include/uapi/linux/nl80211.h
> +++ b/include/uapi/linux/nl80211.h
> @@ -322,7 +322,9 @@
>   * @NL80211_CMD_GET_SCAN: get scan results
>   * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters
>   *	%NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
> - *	probe requests at CCK rate or not.
> + *	probe requests at CCK rate or not. %NL80211_ATTR_MAC can be used to
> + *	specify a BSSID to scan for; if not included, the wildcard BSSID will
> + *	be used.

Maybe you could be explicit here about the possibility of receiving
more results than requested?

--
Cheers,
Luca.

Re: [PATCH v2 1/3] cfg80211: Allow a scan request for a specific BSSID

[Malinen, Jouni]

T24gRnJpLCBNYXIgMDQsIDIwMTYgYXQgMTA6MDc6NTZBTSArMDIwMCwgTHVjYSBDb2VsaG8gd3Jv
dGU6DQo+IE9uIEZyaSwgMjAxNi0wMi0yNiBhdCAyMjoxMiArMDIwMCwgSm91bmkgTWFsaW5lbiB3
cm90ZToNCj4gPiBUaGlzIGlzIGFuIG9wdGltaXphdGlvbiBhbmQgYXMgc3VjaCwgaXQgaXMgYWNj
ZXB0YWJsZSBmb3Igc29tZSBvZiB0aGUNCj4gPiBkcml2ZXJzIG5vdCB0byBzdXBwb3J0IHRoZSBt
ZWNoYW5pc20uIElmIG5vdCBzdXBwb3J0ZWQsIHRoZSB3aWxkY2FyZA0KPiA+IEJTU0lEIHdpbGwg
YmUgdXNlZCBhbmQgbW9yZSByZXNwb25zZXMgbWF5IGJlIHJlY2VpdmVkLg0KPiANCj4gUmVjZWl2
aW5nIG1vcmUgcmVzcG9uc2VzIHRoYW4gd2hhdCB3ZSBhc2tlZCBmb3IgaXMgYWx3YXlzIHBvc3Np
YmxlLA0KPiBiZWNhdXNlIHdlIGRvbid0IGZpbHRlciBvdXQgb3RoZXIgdGhpbmdzIHdlIG1heSBy
ZWNlaXZlIGF0IHRoZSBzYW1lDQo+IHRpbWUuIMKgSXQncyBsaWtlIHJlcXVlc3RpbmcgZm9yIGEg
c3BlY2lmaWMgU1NJRCwgaXQganVzdCBtZWFucyB0aGF0IHRoZQ0KPiBTU0lEIHdpbGwgYmUgdXNl
ZCBpbiB0aGUgcHJvYmUgcmVxdWVzdHMsIGJ1dCBpdCBkb2Vzbid0IGd1YXJhbnRlZSB0aGF0DQo+
IG90aGVyIHJlc3VsdHMgd2lsbCBub3QgYmUgcmV0dXJuZWQuDQoNClN1cmUuIFRoaXMgIm1vcmUg
cmVzcG9uc2VzIiBpcyByZWZlcnJpbmcgdG8gbm90IGJlaW5nIGFibGUgdG8gZ2V0IHRoZQ0KYmVu
ZWZpdCBmcm9tIHNhdmVkIGFpcnRpbWU7IG5vdCBvbiB3aGF0IHdlIG1pZ2h0IGFkZCBpbnRvIHRo
ZSBjZmc4MDIxMQ0KQlNTIHRhYmxlLiBXZSBkb24ndCBldmVuIGhhdmUgYW4gZXhwbGljaXQgbWVj
aGFuaXNtIGZvciByZXBvcnRpbmcNCnJlc3VsdHMgZnJvbSBhIHNpbmdsZSBzY2FuIGl0ZXJhdGlv
bi4NCg0KPiA+IGRpZmYgLS1naXQgYS9pbmNsdWRlL3VhcGkvbGludXgvbmw4MDIxMS5oIGIvaW5j
bHVkZS91YXBpL2xpbnV4L25sODAyMTEuaA0KPiA+IEBAIC0zMjIsNyArMzIyLDkgQEANCj4gPiDC
oCAqIEBOTDgwMjExX0NNRF9HRVRfU0NBTjogZ2V0IHNjYW4gcmVzdWx0cw0KPiA+IMKgICogQE5M
ODAyMTFfQ01EX1RSSUdHRVJfU0NBTjogdHJpZ2dlciBhIG5ldyBzY2FuIHdpdGggdGhlIGdpdmVu
IHBhcmFtZXRlcnMNCj4gPiDCoCAqCSVOTDgwMjExX0FUVFJfVFhfTk9fQ0NLX1JBVEUgaXMgdXNl
ZCB0byBkZWNpZGUgd2hldGhlciB0byBzZW5kIHRoZQ0KPiA+IC0gKglwcm9iZSByZXF1ZXN0cyBh
dCBDQ0sgcmF0ZSBvciBub3QuDQo+ID4gKyAqCXByb2JlIHJlcXVlc3RzIGF0IENDSyByYXRlIG9y
IG5vdC4gJU5MODAyMTFfQVRUUl9NQUMgY2FuIGJlIHVzZWQgdG8NCj4gPiArICoJc3BlY2lmeSBh
IEJTU0lEIHRvIHNjYW4gZm9yOyBpZiBub3QgaW5jbHVkZWQsIHRoZSB3aWxkY2FyZCBCU1NJRCB3
aWxsDQo+ID4gKyAqCWJlIHVzZWQuDQo+IA0KPiBNYXliZSB5b3UgY291bGQgYmUgZXhwbGljaXQg
aGVyZSBhYm91dCB0aGUgcG9zc2liaWxpdHkgb2YgcmVjZWl2aW5nDQo+IG1vcmUgcmVzdWx0cyB0
aGFuIHJlcXVlc3RlZD8NCg0KV2hpY2ggInJlY2VpdmluZyIgYXJlIHlvdSByZWZlcnJpbmcgdG8g
aGVyZT8gSSBkb24ndCBzZWUgbXVjaCBwb2ludCBpbg0KZG9jdW1lbnRpbmcgdGhlIGFpcnRpbWUg
b3B0aW1pemF0aW9uIGhlcmUgYW5kIGFzIGZhciBhcyByZWNlaXZpbmcNCnJlc3VsdHMgdGhyb3Vn
aCBubDgwMjExIGlzIGNvbmNlcm5lZCwgdGhlIG9ubHkgb3B0aW9uIGZvciBpdCB0b2RheSBpcyB0
bw0KdXNlIE5MODAyMTFfQ01EX0dFVF9TQ0FOIGFuZCB0aGF0IHJldHVybnMgdGhlIGN1cnJlbnQg
Y29udGVudHMgb2YgdGhlDQpCU1MgdGFibGUgcmF0aGVyIHRoYW4gcmV0dXJucyBmcm9tIGFueSBz
cGVjaWZpYyBzY2FuLCBzbyBJJ20gbm90IHN1cmUNCndoYXQgZXhhY3RseSB5b3Ugd291bGQgbGlr
ZSB0byBhZGQgaGVyZS4NCg0KSSB3YXMgZ29pbmcgdG8gbm90ZSB0aGF0IHRoaXMgaXMgc2ltaWxh
ciB0byBob3cgTkw4MDIxMV9BVFRSX1NDQU5fU1NJRFMNCmlzIGRvY3VtZW50ZWQsIGJ1dCBhY3R1
YWxseSwgdGhhdCBvbmUgaXMgbm90IG1lbnRpb25lZCBhdCBhbGwgd2l0aA0KTkw4MDIxMV9DTURf
VFJJR0dFUl9TQ0FOIGN1cnJlbnRseS4uIE5vciBpcyB0aGUgZGV0YWlscyBvZiB3aGF0DQpOTDgw
MjExX0NNRF9HRVRfU0NBTiByZXR1cm5zLg0KIA0KLS0gDQpKb3VuaSBNYWxpbmVuICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQR1AgaWQgRUZDODk1RkE=

Re: [PATCH v2 1/3] cfg80211: Allow a scan request for a specific BSSID

[Luca Coelho]

On Fri, 2016-03-04 at 09:15 +0000, Malinen, Jouni wrote:
> On Fri, Mar 04, 2016 at 10:07:56AM +0200, Luca Coelho wrote:
> > On Fri, 2016-02-26 at 22:12 +0200, Jouni Malinen wrote:
> > > This is an optimization and as such, it is acceptable for some of
> > > the
> > > drivers not to support the mechanism. If not supported, the
> > > wildcard
> > > BSSID will be used and more responses may be received.
> > 
> > Receiving more responses than what we asked for is always possible,
> > because we don't filter out other things we may receive at the same
> > time.  It's like requesting for a specific SSID, it just means that
> > the
> > SSID will be used in the probe requests, but it doesn't guarantee
> > that
> > other results will not be returned.
> 
> Sure. This "more responses" is referring to not being able to get the
> benefit from saved airtime; not on what we might add into the
> cfg80211
> BSS table. We don't even have an explicit mechanism for reporting
> results from a single scan iteration.

Right.


> > > diff --git a/include/uapi/linux/nl80211.h
> > > b/include/uapi/linux/nl80211.h
> > > @@ -322,7 +322,9 @@
> > >   * @NL80211_CMD_GET_SCAN: get scan results
> > >   * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given
> > > parameters
> > >   *	%NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether
> > > to send the
> > > - *	probe requests at CCK rate or not.
> > > + *	probe requests at CCK rate or not. %NL80211_ATTR_MAC
> > > can be used to
> > > + *	specify a BSSID to scan for; if not included, the
> > > wildcard BSSID will
> > > + *	be used.
> > 
> > Maybe you could be explicit here about the possibility of receiving
> > more results than requested?
> 
> Which "receiving" are you referring to here? I don't see much point
> in
> documenting the airtime optimization here and as far as receiving
> results through nl80211 is concerned, the only option for it today is
> to
> use NL80211_CMD_GET_SCAN and that returns the current contents of the
> BSS table rather than returns from any specific scan, so I'm not sure
> what exactly you would like to add here.
> 
> I was going to note that this is similar to how
> NL80211_ATTR_SCAN_SSIDS
> is documented, but actually, that one is not mentioned at all with
> NL80211_CMD_TRIGGER_SCAN currently.. Nor is the details of what
> NL80211_CMD_GET_SCAN returns.

Okay, fair enough.  It's true that understanding how the scan API works
from the nl80211 documentation is pretty hard today.  That's what I
wanted to address, but this should probably be another task in itself.
;)

Reviewed-by: Luca Coelho <luciano.coelho@intel.com>

--
Cheers,
Luca.