1
2
3
4
5
6
7
8#include <linux/kernel.h>
9#include <linux/slab.h>
10#include <linux/module.h>
11#include <linux/netdevice.h>
12#include <linux/wireless.h>
13#include <linux/nl80211.h>
14#include <linux/etherdevice.h>
15#include <net/arp.h>
16#include <net/cfg80211.h>
17#include <net/cfg80211-wext.h>
18#include <net/iw_handler.h>
19#include "core.h"
20#include "nl80211.h"
21#include "wext-compat.h"
22#include "rdev-ops.h"
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68static int bss_entries_limit = 1000;
69module_param(bss_entries_limit, int, 0644);
70MODULE_PARM_DESC(bss_entries_limit,
71 "limit to number of scan BSS entries (per wiphy, default 1000)");
72
73#define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
74
75static void bss_free(struct cfg80211_internal_bss *bss)
76{
77 struct cfg80211_bss_ies *ies;
78
79 if (WARN_ON(atomic_read(&bss->hold)))
80 return;
81
82 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
83 if (ies && !bss->pub.hidden_beacon_bss)
84 kfree_rcu(ies, rcu_head);
85 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
86 if (ies)
87 kfree_rcu(ies, rcu_head);
88
89
90
91
92
93 if (!list_empty(&bss->hidden_list))
94 list_del(&bss->hidden_list);
95
96 kfree(bss);
97}
98
99static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
100 struct cfg80211_internal_bss *bss)
101{
102 lockdep_assert_held(&rdev->bss_lock);
103
104 bss->refcount++;
105 if (bss->pub.hidden_beacon_bss) {
106 bss = container_of(bss->pub.hidden_beacon_bss,
107 struct cfg80211_internal_bss,
108 pub);
109 bss->refcount++;
110 }
111}
112
113static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
114 struct cfg80211_internal_bss *bss)
115{
116 lockdep_assert_held(&rdev->bss_lock);
117
118 if (bss->pub.hidden_beacon_bss) {
119 struct cfg80211_internal_bss *hbss;
120 hbss = container_of(bss->pub.hidden_beacon_bss,
121 struct cfg80211_internal_bss,
122 pub);
123 hbss->refcount--;
124 if (hbss->refcount == 0)
125 bss_free(hbss);
126 }
127 bss->refcount--;
128 if (bss->refcount == 0)
129 bss_free(bss);
130}
131
132static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
133 struct cfg80211_internal_bss *bss)
134{
135 lockdep_assert_held(&rdev->bss_lock);
136
137 if (!list_empty(&bss->hidden_list)) {
138
139
140
141
142 if (!bss->pub.hidden_beacon_bss)
143 return false;
144
145
146
147
148 list_del_init(&bss->hidden_list);
149 }
150
151 list_del_init(&bss->list);
152 rb_erase(&bss->rbn, &rdev->bss_tree);
153 rdev->bss_entries--;
154 WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
155 "rdev bss entries[%d]/list[empty:%d] corruption\n",
156 rdev->bss_entries, list_empty(&rdev->bss_list));
157 bss_ref_put(rdev, bss);
158 return true;
159}
160
161static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
162 unsigned long expire_time)
163{
164 struct cfg80211_internal_bss *bss, *tmp;
165 bool expired = false;
166
167 lockdep_assert_held(&rdev->bss_lock);
168
169 list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
170 if (atomic_read(&bss->hold))
171 continue;
172 if (!time_after(expire_time, bss->ts))
173 continue;
174
175 if (__cfg80211_unlink_bss(rdev, bss))
176 expired = true;
177 }
178
179 if (expired)
180 rdev->bss_generation++;
181}
182
183static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
184{
185 struct cfg80211_internal_bss *bss, *oldest = NULL;
186 bool ret;
187
188 lockdep_assert_held(&rdev->bss_lock);
189
190 list_for_each_entry(bss, &rdev->bss_list, list) {
191 if (atomic_read(&bss->hold))
192 continue;
193
194 if (!list_empty(&bss->hidden_list) &&
195 !bss->pub.hidden_beacon_bss)
196 continue;
197
198 if (oldest && time_before(oldest->ts, bss->ts))
199 continue;
200 oldest = bss;
201 }
202
203 if (WARN_ON(!oldest))
204 return false;
205
206
207
208
209
210
211
212 ret = __cfg80211_unlink_bss(rdev, oldest);
213 WARN_ON(!ret);
214 return ret;
215}
216
217void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
218 bool send_message)
219{
220 struct cfg80211_scan_request *request;
221 struct wireless_dev *wdev;
222 struct sk_buff *msg;
223#ifdef CONFIG_CFG80211_WEXT
224 union iwreq_data wrqu;
225#endif
226
227 ASSERT_RTNL();
228
229 if (rdev->scan_msg) {
230 nl80211_send_scan_msg(rdev, rdev->scan_msg);
231 rdev->scan_msg = NULL;
232 return;
233 }
234
235 request = rdev->scan_req;
236 if (!request)
237 return;
238
239 wdev = request->wdev;
240
241
242
243
244
245
246 if (wdev->netdev)
247 cfg80211_sme_scan_done(wdev->netdev);
248
249 if (!request->info.aborted &&
250 request->flags & NL80211_SCAN_FLAG_FLUSH) {
251
252 spin_lock_bh(&rdev->bss_lock);
253 __cfg80211_bss_expire(rdev, request->scan_start);
254 spin_unlock_bh(&rdev->bss_lock);
255 }
256
257 msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
258
259#ifdef CONFIG_CFG80211_WEXT
260 if (wdev->netdev && !request->info.aborted) {
261 memset(&wrqu, 0, sizeof(wrqu));
262
263 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
264 }
265#endif
266
267 if (wdev->netdev)
268 dev_put(wdev->netdev);
269
270 rdev->scan_req = NULL;
271 kfree(request);
272
273 if (!send_message)
274 rdev->scan_msg = msg;
275 else
276 nl80211_send_scan_msg(rdev, msg);
277}
278
279void __cfg80211_scan_done(struct work_struct *wk)
280{
281 struct cfg80211_registered_device *rdev;
282
283 rdev = container_of(wk, struct cfg80211_registered_device,
284 scan_done_wk);
285
286 rtnl_lock();
287 ___cfg80211_scan_done(rdev, true);
288 rtnl_unlock();
289}
290
291void cfg80211_scan_done(struct cfg80211_scan_request *request,
292 struct cfg80211_scan_info *info)
293{
294 trace_cfg80211_scan_done(request, info);
295 WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req);
296
297 request->info = *info;
298 request->notified = true;
299 queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
300}
301EXPORT_SYMBOL(cfg80211_scan_done);
302
303void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
304 struct cfg80211_sched_scan_request *req)
305{
306 ASSERT_RTNL();
307
308 list_add_rcu(&req->list, &rdev->sched_scan_req_list);
309}
310
311static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
312 struct cfg80211_sched_scan_request *req)
313{
314 ASSERT_RTNL();
315
316 list_del_rcu(&req->list);
317 kfree_rcu(req, rcu_head);
318}
319
320static struct cfg80211_sched_scan_request *
321cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
322{
323 struct cfg80211_sched_scan_request *pos;
324
325 WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
326
327 list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list) {
328 if (pos->reqid == reqid)
329 return pos;
330 }
331 return NULL;
332}
333
334
335
336
337
338
339
340
341
342int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
343 bool want_multi)
344{
345 struct cfg80211_sched_scan_request *pos;
346 int i = 0;
347
348 list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
349
350 if (!i && !pos->reqid)
351 return -EINPROGRESS;
352 i++;
353 }
354
355 if (i) {
356
357 if (!want_multi)
358 return -EINPROGRESS;
359
360
361 if (i == rdev->wiphy.max_sched_scan_reqs)
362 return -ENOSPC;
363 }
364 return 0;
365}
366
367void cfg80211_sched_scan_results_wk(struct work_struct *work)
368{
369 struct cfg80211_registered_device *rdev;
370 struct cfg80211_sched_scan_request *req, *tmp;
371
372 rdev = container_of(work, struct cfg80211_registered_device,
373 sched_scan_res_wk);
374
375 rtnl_lock();
376 list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
377 if (req->report_results) {
378 req->report_results = false;
379 if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
380
381 spin_lock_bh(&rdev->bss_lock);
382 __cfg80211_bss_expire(rdev, req->scan_start);
383 spin_unlock_bh(&rdev->bss_lock);
384 req->scan_start = jiffies;
385 }
386 nl80211_send_sched_scan(req,
387 NL80211_CMD_SCHED_SCAN_RESULTS);
388 }
389 }
390 rtnl_unlock();
391}
392
393void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
394{
395 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
396 struct cfg80211_sched_scan_request *request;
397
398 trace_cfg80211_sched_scan_results(wiphy, reqid);
399
400
401 rcu_read_lock();
402 request = cfg80211_find_sched_scan_req(rdev, reqid);
403 if (request) {
404 request->report_results = true;
405 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
406 }
407 rcu_read_unlock();
408}
409EXPORT_SYMBOL(cfg80211_sched_scan_results);
410
411void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy, u64 reqid)
412{
413 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
414
415 ASSERT_RTNL();
416
417 trace_cfg80211_sched_scan_stopped(wiphy, reqid);
418
419 __cfg80211_stop_sched_scan(rdev, reqid, true);
420}
421EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
422
423void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
424{
425 rtnl_lock();
426 cfg80211_sched_scan_stopped_rtnl(wiphy, reqid);
427 rtnl_unlock();
428}
429EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
430
431int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
432 struct cfg80211_sched_scan_request *req,
433 bool driver_initiated)
434{
435 ASSERT_RTNL();
436
437 if (!driver_initiated) {
438 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
439 if (err)
440 return err;
441 }
442
443 nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
444
445 cfg80211_del_sched_scan_req(rdev, req);
446
447 return 0;
448}
449
450int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
451 u64 reqid, bool driver_initiated)
452{
453 struct cfg80211_sched_scan_request *sched_scan_req;
454
455 ASSERT_RTNL();
456
457 sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
458 if (!sched_scan_req)
459 return -ENOENT;
460
461 return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
462 driver_initiated);
463}
464
465void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
466 unsigned long age_secs)
467{
468 struct cfg80211_internal_bss *bss;
469 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
470
471 spin_lock_bh(&rdev->bss_lock);
472 list_for_each_entry(bss, &rdev->bss_list, list)
473 bss->ts -= age_jiffies;
474 spin_unlock_bh(&rdev->bss_lock);
475}
476
477void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
478{
479 __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
480}
481
482const u8 *cfg80211_find_ie_match(u8 eid, const u8 *ies, int len,
483 const u8 *match, int match_len,
484 int match_offset)
485{
486
487
488
489 if (WARN_ON((match_len && match_offset < 2) ||
490 (!match_len && match_offset)))
491 return NULL;
492
493 while (len >= 2 && len >= ies[1] + 2) {
494 if ((ies[0] == eid) &&
495 (ies[1] + 2 >= match_offset + match_len) &&
496 !memcmp(ies + match_offset, match, match_len))
497 return ies;
498
499 len -= ies[1] + 2;
500 ies += ies[1] + 2;
501 }
502
503 return NULL;
504}
505EXPORT_SYMBOL(cfg80211_find_ie_match);
506
507const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type,
508 const u8 *ies, int len)
509{
510 const u8 *ie;
511 u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
512 int match_len = (oui_type < 0) ? 3 : sizeof(match);
513
514 if (WARN_ON(oui_type > 0xff))
515 return NULL;
516
517 ie = cfg80211_find_ie_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
518 match, match_len, 2);
519
520 if (ie && (ie[1] < 4))
521 return NULL;
522
523 return ie;
524}
525EXPORT_SYMBOL(cfg80211_find_vendor_ie);
526
527static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
528 const u8 *ssid, size_t ssid_len)
529{
530 const struct cfg80211_bss_ies *ies;
531 const u8 *ssidie;
532
533 if (bssid && !ether_addr_equal(a->bssid, bssid))
534 return false;
535
536 if (!ssid)
537 return true;
538
539 ies = rcu_access_pointer(a->ies);
540 if (!ies)
541 return false;
542 ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
543 if (!ssidie)
544 return false;
545 if (ssidie[1] != ssid_len)
546 return false;
547 return memcmp(ssidie + 2, ssid, ssid_len) == 0;
548}
549
550
551
552
553
554
555
556enum bss_compare_mode {
557 BSS_CMP_REGULAR,
558 BSS_CMP_HIDE_ZLEN,
559 BSS_CMP_HIDE_NUL,
560};
561
562static int cmp_bss(struct cfg80211_bss *a,
563 struct cfg80211_bss *b,
564 enum bss_compare_mode mode)
565{
566 const struct cfg80211_bss_ies *a_ies, *b_ies;
567 const u8 *ie1 = NULL;
568 const u8 *ie2 = NULL;
569 int i, r;
570
571 if (a->channel != b->channel)
572 return b->channel->center_freq - a->channel->center_freq;
573
574 a_ies = rcu_access_pointer(a->ies);
575 if (!a_ies)
576 return -1;
577 b_ies = rcu_access_pointer(b->ies);
578 if (!b_ies)
579 return 1;
580
581 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
582 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
583 a_ies->data, a_ies->len);
584 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
585 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
586 b_ies->data, b_ies->len);
587 if (ie1 && ie2) {
588 int mesh_id_cmp;
589
590 if (ie1[1] == ie2[1])
591 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
592 else
593 mesh_id_cmp = ie2[1] - ie1[1];
594
595 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
596 a_ies->data, a_ies->len);
597 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
598 b_ies->data, b_ies->len);
599 if (ie1 && ie2) {
600 if (mesh_id_cmp)
601 return mesh_id_cmp;
602 if (ie1[1] != ie2[1])
603 return ie2[1] - ie1[1];
604 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
605 }
606 }
607
608 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
609 if (r)
610 return r;
611
612 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
613 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
614
615 if (!ie1 && !ie2)
616 return 0;
617
618
619
620
621
622
623
624
625 if (!ie1)
626 return -1;
627 if (!ie2)
628 return 1;
629
630 switch (mode) {
631 case BSS_CMP_HIDE_ZLEN:
632
633
634
635
636
637
638
639
640
641
642
643
644 return ie2[1];
645 case BSS_CMP_REGULAR:
646 default:
647
648 if (ie1[1] != ie2[1])
649 return ie2[1] - ie1[1];
650 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
651 case BSS_CMP_HIDE_NUL:
652 if (ie1[1] != ie2[1])
653 return ie2[1] - ie1[1];
654
655 for (i = 0; i < ie2[1]; i++)
656 if (ie2[i + 2])
657 return -1;
658 return 0;
659 }
660}
661
662static bool cfg80211_bss_type_match(u16 capability,
663 enum nl80211_band band,
664 enum ieee80211_bss_type bss_type)
665{
666 bool ret = true;
667 u16 mask, val;
668
669 if (bss_type == IEEE80211_BSS_TYPE_ANY)
670 return ret;
671
672 if (band == NL80211_BAND_60GHZ) {
673 mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
674 switch (bss_type) {
675 case IEEE80211_BSS_TYPE_ESS:
676 val = WLAN_CAPABILITY_DMG_TYPE_AP;
677 break;
678 case IEEE80211_BSS_TYPE_PBSS:
679 val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
680 break;
681 case IEEE80211_BSS_TYPE_IBSS:
682 val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
683 break;
684 default:
685 return false;
686 }
687 } else {
688 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
689 switch (bss_type) {
690 case IEEE80211_BSS_TYPE_ESS:
691 val = WLAN_CAPABILITY_ESS;
692 break;
693 case IEEE80211_BSS_TYPE_IBSS:
694 val = WLAN_CAPABILITY_IBSS;
695 break;
696 case IEEE80211_BSS_TYPE_MBSS:
697 val = 0;
698 break;
699 default:
700 return false;
701 }
702 }
703
704 ret = ((capability & mask) == val);
705 return ret;
706}
707
708
709struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
710 struct ieee80211_channel *channel,
711 const u8 *bssid,
712 const u8 *ssid, size_t ssid_len,
713 enum ieee80211_bss_type bss_type,
714 enum ieee80211_privacy privacy)
715{
716 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
717 struct cfg80211_internal_bss *bss, *res = NULL;
718 unsigned long now = jiffies;
719 int bss_privacy;
720
721 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
722 privacy);
723
724 spin_lock_bh(&rdev->bss_lock);
725
726 list_for_each_entry(bss, &rdev->bss_list, list) {
727 if (!cfg80211_bss_type_match(bss->pub.capability,
728 bss->pub.channel->band, bss_type))
729 continue;
730
731 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
732 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
733 (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
734 continue;
735 if (channel && bss->pub.channel != channel)
736 continue;
737 if (!is_valid_ether_addr(bss->pub.bssid))
738 continue;
739
740 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
741 !atomic_read(&bss->hold))
742 continue;
743 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
744 res = bss;
745 bss_ref_get(rdev, res);
746 break;
747 }
748 }
749
750 spin_unlock_bh(&rdev->bss_lock);
751 if (!res)
752 return NULL;
753 trace_cfg80211_return_bss(&res->pub);
754 return &res->pub;
755}
756EXPORT_SYMBOL(cfg80211_get_bss);
757
758static void rb_insert_bss(struct cfg80211_registered_device *rdev,
759 struct cfg80211_internal_bss *bss)
760{
761 struct rb_node **p = &rdev->bss_tree.rb_node;
762 struct rb_node *parent = NULL;
763 struct cfg80211_internal_bss *tbss;
764 int cmp;
765
766 while (*p) {
767 parent = *p;
768 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
769
770 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
771
772 if (WARN_ON(!cmp)) {
773
774 return;
775 }
776
777 if (cmp < 0)
778 p = &(*p)->rb_left;
779 else
780 p = &(*p)->rb_right;
781 }
782
783 rb_link_node(&bss->rbn, parent, p);
784 rb_insert_color(&bss->rbn, &rdev->bss_tree);
785}
786
787static struct cfg80211_internal_bss *
788rb_find_bss(struct cfg80211_registered_device *rdev,
789 struct cfg80211_internal_bss *res,
790 enum bss_compare_mode mode)
791{
792 struct rb_node *n = rdev->bss_tree.rb_node;
793 struct cfg80211_internal_bss *bss;
794 int r;
795
796 while (n) {
797 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
798 r = cmp_bss(&res->pub, &bss->pub, mode);
799
800 if (r == 0)
801 return bss;
802 else if (r < 0)
803 n = n->rb_left;
804 else
805 n = n->rb_right;
806 }
807
808 return NULL;
809}
810
811static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
812 struct cfg80211_internal_bss *new)
813{
814 const struct cfg80211_bss_ies *ies;
815 struct cfg80211_internal_bss *bss;
816 const u8 *ie;
817 int i, ssidlen;
818 u8 fold = 0;
819 u32 n_entries = 0;
820
821 ies = rcu_access_pointer(new->pub.beacon_ies);
822 if (WARN_ON(!ies))
823 return false;
824
825 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
826 if (!ie) {
827
828 return true;
829 }
830
831 ssidlen = ie[1];
832 for (i = 0; i < ssidlen; i++)
833 fold |= ie[2 + i];
834
835 if (fold) {
836
837 return true;
838 }
839
840
841
842 list_for_each_entry(bss, &rdev->bss_list, list) {
843
844
845
846
847 n_entries++;
848
849 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
850 continue;
851 if (bss->pub.channel != new->pub.channel)
852 continue;
853 if (bss->pub.scan_width != new->pub.scan_width)
854 continue;
855 if (rcu_access_pointer(bss->pub.beacon_ies))
856 continue;
857 ies = rcu_access_pointer(bss->pub.ies);
858 if (!ies)
859 continue;
860 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
861 if (!ie)
862 continue;
863 if (ssidlen && ie[1] != ssidlen)
864 continue;
865 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
866 continue;
867 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
868 list_del(&bss->hidden_list);
869
870 list_add(&bss->hidden_list, &new->hidden_list);
871 bss->pub.hidden_beacon_bss = &new->pub;
872 new->refcount += bss->refcount;
873 rcu_assign_pointer(bss->pub.beacon_ies,
874 new->pub.beacon_ies);
875 }
876
877 WARN_ONCE(n_entries != rdev->bss_entries,
878 "rdev bss entries[%d]/list[len:%d] corruption\n",
879 rdev->bss_entries, n_entries);
880
881 return true;
882}
883
884
885static struct cfg80211_internal_bss *
886cfg80211_bss_update(struct cfg80211_registered_device *rdev,
887 struct cfg80211_internal_bss *tmp,
888 bool signal_valid)
889{
890 struct cfg80211_internal_bss *found = NULL;
891
892 if (WARN_ON(!tmp->pub.channel))
893 return NULL;
894
895 tmp->ts = jiffies;
896
897 spin_lock_bh(&rdev->bss_lock);
898
899 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
900 spin_unlock_bh(&rdev->bss_lock);
901 return NULL;
902 }
903
904 found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
905
906 if (found) {
907
908 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
909 const struct cfg80211_bss_ies *old;
910
911 old = rcu_access_pointer(found->pub.proberesp_ies);
912
913 rcu_assign_pointer(found->pub.proberesp_ies,
914 tmp->pub.proberesp_ies);
915
916 rcu_assign_pointer(found->pub.ies,
917 tmp->pub.proberesp_ies);
918 if (old)
919 kfree_rcu((struct cfg80211_bss_ies *)old,
920 rcu_head);
921 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
922 const struct cfg80211_bss_ies *old;
923 struct cfg80211_internal_bss *bss;
924
925 if (found->pub.hidden_beacon_bss &&
926 !list_empty(&found->hidden_list)) {
927 const struct cfg80211_bss_ies *f;
928
929
930
931
932
933
934
935
936
937
938
939 f = rcu_access_pointer(tmp->pub.beacon_ies);
940 kfree_rcu((struct cfg80211_bss_ies *)f,
941 rcu_head);
942 goto drop;
943 }
944
945 old = rcu_access_pointer(found->pub.beacon_ies);
946
947 rcu_assign_pointer(found->pub.beacon_ies,
948 tmp->pub.beacon_ies);
949
950
951 if (old == rcu_access_pointer(found->pub.ies))
952 rcu_assign_pointer(found->pub.ies,
953 tmp->pub.beacon_ies);
954
955
956 list_for_each_entry(bss, &found->hidden_list,
957 hidden_list) {
958 const struct cfg80211_bss_ies *ies;
959
960 ies = rcu_access_pointer(bss->pub.beacon_ies);
961 WARN_ON(ies != old);
962
963 rcu_assign_pointer(bss->pub.beacon_ies,
964 tmp->pub.beacon_ies);
965 }
966
967 if (old)
968 kfree_rcu((struct cfg80211_bss_ies *)old,
969 rcu_head);
970 }
971
972 found->pub.beacon_interval = tmp->pub.beacon_interval;
973
974
975
976
977 if (signal_valid)
978 found->pub.signal = tmp->pub.signal;
979 found->pub.capability = tmp->pub.capability;
980 found->ts = tmp->ts;
981 found->ts_boottime = tmp->ts_boottime;
982 found->parent_tsf = tmp->parent_tsf;
983 ether_addr_copy(found->parent_bssid, tmp->parent_bssid);
984 } else {
985 struct cfg80211_internal_bss *new;
986 struct cfg80211_internal_bss *hidden;
987 struct cfg80211_bss_ies *ies;
988
989
990
991
992
993
994 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
995 GFP_ATOMIC);
996 if (!new) {
997 ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
998 if (ies)
999 kfree_rcu(ies, rcu_head);
1000 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1001 if (ies)
1002 kfree_rcu(ies, rcu_head);
1003 goto drop;
1004 }
1005 memcpy(new, tmp, sizeof(*new));
1006 new->refcount = 1;
1007 INIT_LIST_HEAD(&new->hidden_list);
1008
1009 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1010 hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1011 if (!hidden)
1012 hidden = rb_find_bss(rdev, tmp,
1013 BSS_CMP_HIDE_NUL);
1014 if (hidden) {
1015 new->pub.hidden_beacon_bss = &hidden->pub;
1016 list_add(&new->hidden_list,
1017 &hidden->hidden_list);
1018 hidden->refcount++;
1019 rcu_assign_pointer(new->pub.beacon_ies,
1020 hidden->pub.beacon_ies);
1021 }
1022 } else {
1023
1024
1025
1026
1027
1028
1029 if (!cfg80211_combine_bsses(rdev, new)) {
1030 kfree(new);
1031 goto drop;
1032 }
1033 }
1034
1035 if (rdev->bss_entries >= bss_entries_limit &&
1036 !cfg80211_bss_expire_oldest(rdev)) {
1037 kfree(new);
1038 goto drop;
1039 }
1040
1041 list_add_tail(&new->list, &rdev->bss_list);
1042 rdev->bss_entries++;
1043 rb_insert_bss(rdev, new);
1044 found = new;
1045 }
1046
1047 rdev->bss_generation++;
1048 bss_ref_get(rdev, found);
1049 spin_unlock_bh(&rdev->bss_lock);
1050
1051 return found;
1052 drop:
1053 spin_unlock_bh(&rdev->bss_lock);
1054 return NULL;
1055}
1056
1057static struct ieee80211_channel *
1058cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1059 struct ieee80211_channel *channel)
1060{
1061 const u8 *tmp;
1062 u32 freq;
1063 int channel_number = -1;
1064
1065 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
1066 if (tmp && tmp[1] == 1) {
1067 channel_number = tmp[2];
1068 } else {
1069 tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
1070 if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
1071 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
1072
1073 channel_number = htop->primary_chan;
1074 }
1075 }
1076
1077 if (channel_number < 0)
1078 return channel;
1079
1080 freq = ieee80211_channel_to_frequency(channel_number, channel->band);
1081 channel = ieee80211_get_channel(wiphy, freq);
1082 if (!channel)
1083 return NULL;
1084 if (channel->flags & IEEE80211_CHAN_DISABLED)
1085 return NULL;
1086 return channel;
1087}
1088
1089
1090struct cfg80211_bss *
1091cfg80211_inform_bss_data(struct wiphy *wiphy,
1092 struct cfg80211_inform_bss *data,
1093 enum cfg80211_bss_frame_type ftype,
1094 const u8 *bssid, u64 tsf, u16 capability,
1095 u16 beacon_interval, const u8 *ie, size_t ielen,
1096 gfp_t gfp)
1097{
1098 struct cfg80211_bss_ies *ies;
1099 struct ieee80211_channel *channel;
1100 struct cfg80211_internal_bss tmp = {}, *res;
1101 int bss_type;
1102 bool signal_valid;
1103
1104 if (WARN_ON(!wiphy))
1105 return NULL;
1106
1107 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1108 (data->signal < 0 || data->signal > 100)))
1109 return NULL;
1110
1111 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan);
1112 if (!channel)
1113 return NULL;
1114
1115 memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
1116 tmp.pub.channel = channel;
1117 tmp.pub.scan_width = data->scan_width;
1118 tmp.pub.signal = data->signal;
1119 tmp.pub.beacon_interval = beacon_interval;
1120 tmp.pub.capability = capability;
1121 tmp.ts_boottime = data->boottime_ns;
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131 ies = kzalloc(sizeof(*ies) + ielen, gfp);
1132 if (!ies)
1133 return NULL;
1134 ies->len = ielen;
1135 ies->tsf = tsf;
1136 ies->from_beacon = false;
1137 memcpy(ies->data, ie, ielen);
1138
1139 switch (ftype) {
1140 case CFG80211_BSS_FTYPE_BEACON:
1141 ies->from_beacon = true;
1142
1143 case CFG80211_BSS_FTYPE_UNKNOWN:
1144 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1145 break;
1146 case CFG80211_BSS_FTYPE_PRESP:
1147 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1148 break;
1149 }
1150 rcu_assign_pointer(tmp.pub.ies, ies);
1151
1152 signal_valid = abs(data->chan->center_freq - channel->center_freq) <=
1153 wiphy->max_adj_channel_rssi_comp;
1154 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
1155 if (!res)
1156 return NULL;
1157
1158 if (channel->band == NL80211_BAND_60GHZ) {
1159 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1160 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1161 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1162 regulatory_hint_found_beacon(wiphy, channel, gfp);
1163 } else {
1164 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1165 regulatory_hint_found_beacon(wiphy, channel, gfp);
1166 }
1167
1168 trace_cfg80211_return_bss(&res->pub);
1169
1170 return &res->pub;
1171}
1172EXPORT_SYMBOL(cfg80211_inform_bss_data);
1173
1174
1175struct cfg80211_bss *
1176cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
1177 struct cfg80211_inform_bss *data,
1178 struct ieee80211_mgmt *mgmt, size_t len,
1179 gfp_t gfp)
1180
1181{
1182 struct cfg80211_internal_bss tmp = {}, *res;
1183 struct cfg80211_bss_ies *ies;
1184 struct ieee80211_channel *channel;
1185 bool signal_valid;
1186 size_t ielen = len - offsetof(struct ieee80211_mgmt,
1187 u.probe_resp.variable);
1188 int bss_type;
1189
1190 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
1191 offsetof(struct ieee80211_mgmt, u.beacon.variable));
1192
1193 trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
1194
1195 if (WARN_ON(!mgmt))
1196 return NULL;
1197
1198 if (WARN_ON(!wiphy))
1199 return NULL;
1200
1201 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1202 (data->signal < 0 || data->signal > 100)))
1203 return NULL;
1204
1205 if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
1206 return NULL;
1207
1208 channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
1209 ielen, data->chan);
1210 if (!channel)
1211 return NULL;
1212
1213 ies = kzalloc(sizeof(*ies) + ielen, gfp);
1214 if (!ies)
1215 return NULL;
1216 ies->len = ielen;
1217 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
1218 ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
1219 memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
1220
1221 if (ieee80211_is_probe_resp(mgmt->frame_control))
1222 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1223 else
1224 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1225 rcu_assign_pointer(tmp.pub.ies, ies);
1226
1227 memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
1228 tmp.pub.channel = channel;
1229 tmp.pub.scan_width = data->scan_width;
1230 tmp.pub.signal = data->signal;
1231 tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
1232 tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
1233 tmp.ts_boottime = data->boottime_ns;
1234 tmp.parent_tsf = data->parent_tsf;
1235 ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
1236
1237 signal_valid = abs(data->chan->center_freq - channel->center_freq) <=
1238 wiphy->max_adj_channel_rssi_comp;
1239 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
1240 if (!res)
1241 return NULL;
1242
1243 if (channel->band == NL80211_BAND_60GHZ) {
1244 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1245 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1246 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1247 regulatory_hint_found_beacon(wiphy, channel, gfp);
1248 } else {
1249 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1250 regulatory_hint_found_beacon(wiphy, channel, gfp);
1251 }
1252
1253 trace_cfg80211_return_bss(&res->pub);
1254
1255 return &res->pub;
1256}
1257EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
1258
1259void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1260{
1261 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1262 struct cfg80211_internal_bss *bss;
1263
1264 if (!pub)
1265 return;
1266
1267 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1268
1269 spin_lock_bh(&rdev->bss_lock);
1270 bss_ref_get(rdev, bss);
1271 spin_unlock_bh(&rdev->bss_lock);
1272}
1273EXPORT_SYMBOL(cfg80211_ref_bss);
1274
1275void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1276{
1277 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1278 struct cfg80211_internal_bss *bss;
1279
1280 if (!pub)
1281 return;
1282
1283 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1284
1285 spin_lock_bh(&rdev->bss_lock);
1286 bss_ref_put(rdev, bss);
1287 spin_unlock_bh(&rdev->bss_lock);
1288}
1289EXPORT_SYMBOL(cfg80211_put_bss);
1290
1291void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1292{
1293 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1294 struct cfg80211_internal_bss *bss;
1295
1296 if (WARN_ON(!pub))
1297 return;
1298
1299 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1300
1301 spin_lock_bh(&rdev->bss_lock);
1302 if (!list_empty(&bss->list)) {
1303 if (__cfg80211_unlink_bss(rdev, bss))
1304 rdev->bss_generation++;
1305 }
1306 spin_unlock_bh(&rdev->bss_lock);
1307}
1308EXPORT_SYMBOL(cfg80211_unlink_bss);
1309
1310#ifdef CONFIG_CFG80211_WEXT
1311static struct cfg80211_registered_device *
1312cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
1313{
1314 struct cfg80211_registered_device *rdev;
1315 struct net_device *dev;
1316
1317 ASSERT_RTNL();
1318
1319 dev = dev_get_by_index(net, ifindex);
1320 if (!dev)
1321 return ERR_PTR(-ENODEV);
1322 if (dev->ieee80211_ptr)
1323 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
1324 else
1325 rdev = ERR_PTR(-ENODEV);
1326 dev_put(dev);
1327 return rdev;
1328}
1329
1330int cfg80211_wext_siwscan(struct net_device *dev,
1331 struct iw_request_info *info,
1332 union iwreq_data *wrqu, char *extra)
1333{
1334 struct cfg80211_registered_device *rdev;
1335 struct wiphy *wiphy;
1336 struct iw_scan_req *wreq = NULL;
1337 struct cfg80211_scan_request *creq = NULL;
1338 int i, err, n_channels = 0;
1339 enum nl80211_band band;
1340
1341 if (!netif_running(dev))
1342 return -ENETDOWN;
1343
1344 if (wrqu->data.length == sizeof(struct iw_scan_req))
1345 wreq = (struct iw_scan_req *)extra;
1346
1347 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1348
1349 if (IS_ERR(rdev))
1350 return PTR_ERR(rdev);
1351
1352 if (rdev->scan_req || rdev->scan_msg) {
1353 err = -EBUSY;
1354 goto out;
1355 }
1356
1357 wiphy = &rdev->wiphy;
1358
1359
1360 if (wreq && wreq->num_channels)
1361 n_channels = wreq->num_channels;
1362 else
1363 n_channels = ieee80211_get_num_supported_channels(wiphy);
1364
1365 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
1366 n_channels * sizeof(void *),
1367 GFP_ATOMIC);
1368 if (!creq) {
1369 err = -ENOMEM;
1370 goto out;
1371 }
1372
1373 creq->wiphy = wiphy;
1374 creq->wdev = dev->ieee80211_ptr;
1375
1376 creq->ssids = (void *)&creq->channels[n_channels];
1377 creq->n_channels = n_channels;
1378 creq->n_ssids = 1;
1379 creq->scan_start = jiffies;
1380
1381
1382 i = 0;
1383 for (band = 0; band < NUM_NL80211_BANDS; band++) {
1384 int j;
1385
1386 if (!wiphy->bands[band])
1387 continue;
1388
1389 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
1390
1391 if (wiphy->bands[band]->channels[j].flags &
1392 IEEE80211_CHAN_DISABLED)
1393 continue;
1394
1395
1396
1397
1398
1399 if (wreq && wreq->num_channels) {
1400 int k;
1401 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
1402 for (k = 0; k < wreq->num_channels; k++) {
1403 struct iw_freq *freq =
1404 &wreq->channel_list[k];
1405 int wext_freq =
1406 cfg80211_wext_freq(freq);
1407
1408 if (wext_freq == wiphy_freq)
1409 goto wext_freq_found;
1410 }
1411 goto wext_freq_not_found;
1412 }
1413
1414 wext_freq_found:
1415 creq->channels[i] = &wiphy->bands[band]->channels[j];
1416 i++;
1417 wext_freq_not_found: ;
1418 }
1419 }
1420
1421 if (!i) {
1422 err = -EINVAL;
1423 goto out;
1424 }
1425
1426
1427 creq->n_channels = i;
1428
1429
1430 if (wreq) {
1431 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
1432 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
1433 err = -EINVAL;
1434 goto out;
1435 }
1436 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
1437 creq->ssids[0].ssid_len = wreq->essid_len;
1438 }
1439 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
1440 creq->n_ssids = 0;
1441 }
1442
1443 for (i = 0; i < NUM_NL80211_BANDS; i++)
1444 if (wiphy->bands[i])
1445 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
1446
1447 eth_broadcast_addr(creq->bssid);
1448
1449 rdev->scan_req = creq;
1450 err = rdev_scan(rdev, creq);
1451 if (err) {
1452 rdev->scan_req = NULL;
1453
1454 } else {
1455 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
1456
1457 creq = NULL;
1458 dev_hold(dev);
1459 }
1460 out:
1461 kfree(creq);
1462 return err;
1463}
1464EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
1465
1466static char *ieee80211_scan_add_ies(struct iw_request_info *info,
1467 const struct cfg80211_bss_ies *ies,
1468 char *current_ev, char *end_buf)
1469{
1470 const u8 *pos, *end, *next;
1471 struct iw_event iwe;
1472
1473 if (!ies)
1474 return current_ev;
1475
1476
1477
1478
1479
1480 pos = ies->data;
1481 end = pos + ies->len;
1482
1483 while (end - pos > IW_GENERIC_IE_MAX) {
1484 next = pos + 2 + pos[1];
1485 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
1486 next = next + 2 + next[1];
1487
1488 memset(&iwe, 0, sizeof(iwe));
1489 iwe.cmd = IWEVGENIE;
1490 iwe.u.data.length = next - pos;
1491 current_ev = iwe_stream_add_point_check(info, current_ev,
1492 end_buf, &iwe,
1493 (void *)pos);
1494 if (IS_ERR(current_ev))
1495 return current_ev;
1496 pos = next;
1497 }
1498
1499 if (end > pos) {
1500 memset(&iwe, 0, sizeof(iwe));
1501 iwe.cmd = IWEVGENIE;
1502 iwe.u.data.length = end - pos;
1503 current_ev = iwe_stream_add_point_check(info, current_ev,
1504 end_buf, &iwe,
1505 (void *)pos);
1506 if (IS_ERR(current_ev))
1507 return current_ev;
1508 }
1509
1510 return current_ev;
1511}
1512
1513static char *
1514ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
1515 struct cfg80211_internal_bss *bss, char *current_ev,
1516 char *end_buf)
1517{
1518 const struct cfg80211_bss_ies *ies;
1519 struct iw_event iwe;
1520 const u8 *ie;
1521 u8 buf[50];
1522 u8 *cfg, *p, *tmp;
1523 int rem, i, sig;
1524 bool ismesh = false;
1525
1526 memset(&iwe, 0, sizeof(iwe));
1527 iwe.cmd = SIOCGIWAP;
1528 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
1529 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
1530 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
1531 IW_EV_ADDR_LEN);
1532 if (IS_ERR(current_ev))
1533 return current_ev;
1534
1535 memset(&iwe, 0, sizeof(iwe));
1536 iwe.cmd = SIOCGIWFREQ;
1537 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
1538 iwe.u.freq.e = 0;
1539 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
1540 IW_EV_FREQ_LEN);
1541 if (IS_ERR(current_ev))
1542 return current_ev;
1543
1544 memset(&iwe, 0, sizeof(iwe));
1545 iwe.cmd = SIOCGIWFREQ;
1546 iwe.u.freq.m = bss->pub.channel->center_freq;
1547 iwe.u.freq.e = 6;
1548 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
1549 IW_EV_FREQ_LEN);
1550 if (IS_ERR(current_ev))
1551 return current_ev;
1552
1553 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
1554 memset(&iwe, 0, sizeof(iwe));
1555 iwe.cmd = IWEVQUAL;
1556 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
1557 IW_QUAL_NOISE_INVALID |
1558 IW_QUAL_QUAL_UPDATED;
1559 switch (wiphy->signal_type) {
1560 case CFG80211_SIGNAL_TYPE_MBM:
1561 sig = bss->pub.signal / 100;
1562 iwe.u.qual.level = sig;
1563 iwe.u.qual.updated |= IW_QUAL_DBM;
1564 if (sig < -110)
1565 sig = -110;
1566 else if (sig > -40)
1567 sig = -40;
1568
1569 iwe.u.qual.qual = sig + 110;
1570 break;
1571 case CFG80211_SIGNAL_TYPE_UNSPEC:
1572 iwe.u.qual.level = bss->pub.signal;
1573
1574 iwe.u.qual.qual = bss->pub.signal;
1575 break;
1576 default:
1577
1578 break;
1579 }
1580 current_ev = iwe_stream_add_event_check(info, current_ev,
1581 end_buf, &iwe,
1582 IW_EV_QUAL_LEN);
1583 if (IS_ERR(current_ev))
1584 return current_ev;
1585 }
1586
1587 memset(&iwe, 0, sizeof(iwe));
1588 iwe.cmd = SIOCGIWENCODE;
1589 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
1590 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
1591 else
1592 iwe.u.data.flags = IW_ENCODE_DISABLED;
1593 iwe.u.data.length = 0;
1594 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
1595 &iwe, "");
1596 if (IS_ERR(current_ev))
1597 return current_ev;
1598
1599 rcu_read_lock();
1600 ies = rcu_dereference(bss->pub.ies);
1601 rem = ies->len;
1602 ie = ies->data;
1603
1604 while (rem >= 2) {
1605
1606 if (ie[1] > rem - 2)
1607 break;
1608
1609 switch (ie[0]) {
1610 case WLAN_EID_SSID:
1611 memset(&iwe, 0, sizeof(iwe));
1612 iwe.cmd = SIOCGIWESSID;
1613 iwe.u.data.length = ie[1];
1614 iwe.u.data.flags = 1;
1615 current_ev = iwe_stream_add_point_check(info,
1616 current_ev,
1617 end_buf, &iwe,
1618 (u8 *)ie + 2);
1619 if (IS_ERR(current_ev))
1620 goto unlock;
1621 break;
1622 case WLAN_EID_MESH_ID:
1623 memset(&iwe, 0, sizeof(iwe));
1624 iwe.cmd = SIOCGIWESSID;
1625 iwe.u.data.length = ie[1];
1626 iwe.u.data.flags = 1;
1627 current_ev = iwe_stream_add_point_check(info,
1628 current_ev,
1629 end_buf, &iwe,
1630 (u8 *)ie + 2);
1631 if (IS_ERR(current_ev))
1632 goto unlock;
1633 break;
1634 case WLAN_EID_MESH_CONFIG:
1635 ismesh = true;
1636 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1637 break;
1638 cfg = (u8 *)ie + 2;
1639 memset(&iwe, 0, sizeof(iwe));
1640 iwe.cmd = IWEVCUSTOM;
1641 sprintf(buf, "Mesh Network Path Selection Protocol ID: "
1642 "0x%02X", cfg[0]);
1643 iwe.u.data.length = strlen(buf);
1644 current_ev = iwe_stream_add_point_check(info,
1645 current_ev,
1646 end_buf,
1647 &iwe, buf);
1648 if (IS_ERR(current_ev))
1649 goto unlock;
1650 sprintf(buf, "Path Selection Metric ID: 0x%02X",
1651 cfg[1]);
1652 iwe.u.data.length = strlen(buf);
1653 current_ev = iwe_stream_add_point_check(info,
1654 current_ev,
1655 end_buf,
1656 &iwe, buf);
1657 if (IS_ERR(current_ev))
1658 goto unlock;
1659 sprintf(buf, "Congestion Control Mode ID: 0x%02X",
1660 cfg[2]);
1661 iwe.u.data.length = strlen(buf);
1662 current_ev = iwe_stream_add_point_check(info,
1663 current_ev,
1664 end_buf,
1665 &iwe, buf);
1666 if (IS_ERR(current_ev))
1667 goto unlock;
1668 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1669 iwe.u.data.length = strlen(buf);
1670 current_ev = iwe_stream_add_point_check(info,
1671 current_ev,
1672 end_buf,
1673 &iwe, buf);
1674 if (IS_ERR(current_ev))
1675 goto unlock;
1676 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
1677 iwe.u.data.length = strlen(buf);
1678 current_ev = iwe_stream_add_point_check(info,
1679 current_ev,
1680 end_buf,
1681 &iwe, buf);
1682 if (IS_ERR(current_ev))
1683 goto unlock;
1684 sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
1685 iwe.u.data.length = strlen(buf);
1686 current_ev = iwe_stream_add_point_check(info,
1687 current_ev,
1688 end_buf,
1689 &iwe, buf);
1690 if (IS_ERR(current_ev))
1691 goto unlock;
1692 sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1693 iwe.u.data.length = strlen(buf);
1694 current_ev = iwe_stream_add_point_check(info,
1695 current_ev,
1696 end_buf,
1697 &iwe, buf);
1698 if (IS_ERR(current_ev))
1699 goto unlock;
1700 break;
1701 case WLAN_EID_SUPP_RATES:
1702 case WLAN_EID_EXT_SUPP_RATES:
1703
1704 p = current_ev + iwe_stream_lcp_len(info);
1705
1706 memset(&iwe, 0, sizeof(iwe));
1707 iwe.cmd = SIOCGIWRATE;
1708
1709 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
1710
1711 for (i = 0; i < ie[1]; i++) {
1712 iwe.u.bitrate.value =
1713 ((ie[i + 2] & 0x7f) * 500000);
1714 tmp = p;
1715 p = iwe_stream_add_value(info, current_ev, p,
1716 end_buf, &iwe,
1717 IW_EV_PARAM_LEN);
1718 if (p == tmp) {
1719 current_ev = ERR_PTR(-E2BIG);
1720 goto unlock;
1721 }
1722 }
1723 current_ev = p;
1724 break;
1725 }
1726 rem -= ie[1] + 2;
1727 ie += ie[1] + 2;
1728 }
1729
1730 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
1731 ismesh) {
1732 memset(&iwe, 0, sizeof(iwe));
1733 iwe.cmd = SIOCGIWMODE;
1734 if (ismesh)
1735 iwe.u.mode = IW_MODE_MESH;
1736 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
1737 iwe.u.mode = IW_MODE_MASTER;
1738 else
1739 iwe.u.mode = IW_MODE_ADHOC;
1740 current_ev = iwe_stream_add_event_check(info, current_ev,
1741 end_buf, &iwe,
1742 IW_EV_UINT_LEN);
1743 if (IS_ERR(current_ev))
1744 goto unlock;
1745 }
1746
1747 memset(&iwe, 0, sizeof(iwe));
1748 iwe.cmd = IWEVCUSTOM;
1749 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
1750 iwe.u.data.length = strlen(buf);
1751 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
1752 &iwe, buf);
1753 if (IS_ERR(current_ev))
1754 goto unlock;
1755 memset(&iwe, 0, sizeof(iwe));
1756 iwe.cmd = IWEVCUSTOM;
1757 sprintf(buf, " Last beacon: %ums ago",
1758 elapsed_jiffies_msecs(bss->ts));
1759 iwe.u.data.length = strlen(buf);
1760 current_ev = iwe_stream_add_point_check(info, current_ev,
1761 end_buf, &iwe, buf);
1762 if (IS_ERR(current_ev))
1763 goto unlock;
1764
1765 current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
1766
1767 unlock:
1768 rcu_read_unlock();
1769 return current_ev;
1770}
1771
1772
1773static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
1774 struct iw_request_info *info,
1775 char *buf, size_t len)
1776{
1777 char *current_ev = buf;
1778 char *end_buf = buf + len;
1779 struct cfg80211_internal_bss *bss;
1780 int err = 0;
1781
1782 spin_lock_bh(&rdev->bss_lock);
1783 cfg80211_bss_expire(rdev);
1784
1785 list_for_each_entry(bss, &rdev->bss_list, list) {
1786 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
1787 err = -E2BIG;
1788 break;
1789 }
1790 current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
1791 current_ev, end_buf);
1792 if (IS_ERR(current_ev)) {
1793 err = PTR_ERR(current_ev);
1794 break;
1795 }
1796 }
1797 spin_unlock_bh(&rdev->bss_lock);
1798
1799 if (err)
1800 return err;
1801 return current_ev - buf;
1802}
1803
1804
1805int cfg80211_wext_giwscan(struct net_device *dev,
1806 struct iw_request_info *info,
1807 struct iw_point *data, char *extra)
1808{
1809 struct cfg80211_registered_device *rdev;
1810 int res;
1811
1812 if (!netif_running(dev))
1813 return -ENETDOWN;
1814
1815 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1816
1817 if (IS_ERR(rdev))
1818 return PTR_ERR(rdev);
1819
1820 if (rdev->scan_req || rdev->scan_msg)
1821 return -EAGAIN;
1822
1823 res = ieee80211_scan_results(rdev, info, extra, data->length);
1824 data->length = 0;
1825 if (res >= 0) {
1826 data->length = res;
1827 res = 0;
1828 }
1829
1830 return res;
1831}
1832EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
1833#endif
1834