?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[linux/fpc-iii.git] / net / wireless / scan.c
blob9f0901f3e42b60db2c6aee7927b2b0ddc0ab7759
1 /*
2 * cfg80211 scan result handling
3 *
4 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
5 * Copyright 2013-2014 Intel Mobile Communications GmbH
6 * Copyright 2016 Intel Deutschland GmbH
7 */
8 #include <linux/kernel.h>
9 #include <linux/slab.h>
10 #include <linux/module.h>
11 #include <linux/netdevice.h>
12 #include <linux/wireless.h>
13 #include <linux/nl80211.h>
14 #include <linux/etherdevice.h>
15 #include <net/arp.h>
16 #include <net/cfg80211.h>
17 #include <net/cfg80211-wext.h>
18 #include <net/iw_handler.h>
19 #include "core.h"
20 #include "nl80211.h"
21 #include "wext-compat.h"
22 #include "rdev-ops.h"
23
24 /**
25 * DOC: BSS tree/list structure
26 *
27 * At the top level, the BSS list is kept in both a list in each
28 * registered device (@bss_list) as well as an RB-tree for faster
29 * lookup. In the RB-tree, entries can be looked up using their
30 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
31 * for other BSSes.
32 *
33 * Due to the possibility of hidden SSIDs, there's a second level
34 * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
35 * The hidden_list connects all BSSes belonging to a single AP
36 * that has a hidden SSID, and connects beacon and probe response
37 * entries. For a probe response entry for a hidden SSID, the
38 * hidden_beacon_bss pointer points to the BSS struct holding the
39 * beacon's information.
40 *
41 * Reference counting is done for all these references except for
42 * the hidden_list, so that a beacon BSS struct that is otherwise
43 * not referenced has one reference for being on the bss_list and
44 * one for each probe response entry that points to it using the
45 * hidden_beacon_bss pointer. When a BSS struct that has such a
46 * pointer is get/put, the refcount update is also propagated to
47 * the referenced struct, this ensure that it cannot get removed
48 * while somebody is using the probe response version.
49 *
50 * Note that the hidden_beacon_bss pointer never changes, due to
51 * the reference counting. Therefore, no locking is needed for
52 * it.
53 *
54 * Also note that the hidden_beacon_bss pointer is only relevant
55 * if the driver uses something other than the IEs, e.g. private
56 * data stored stored in the BSS struct, since the beacon IEs are
57 * also linked into the probe response struct.
58 */
59
60 /*
61 * Limit the number of BSS entries stored in mac80211. Each one is
62 * a bit over 4k at most, so this limits to roughly 4-5M of memory.
63 * If somebody wants to really attack this though, they'd likely
64 * use small beacons, and only one type of frame, limiting each of
65 * the entries to a much smaller size (in order to generate more
66 * entries in total, so overhead is bigger.)
67 */
68 static int bss_entries_limit = 1000;
69 module_param(bss_entries_limit, int, 0644);
70 MODULE_PARM_DESC(bss_entries_limit,
71 "limit to number of scan BSS entries (per wiphy, default 1000)");
72
73 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
74
75 static void bss_free(struct cfg80211_internal_bss *bss)
76 {
77 struct cfg80211_bss_ies *ies;
78
79 if (WARN_ON(atomic_read(&bss->hold)))
80 return;
81
82 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
83 if (ies && !bss->pub.hidden_beacon_bss)
84 kfree_rcu(ies, rcu_head);
85 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
86 if (ies)
87 kfree_rcu(ies, rcu_head);
88
89 /*
90 * This happens when the module is removed, it doesn't
91 * really matter any more save for completeness
92 */
93 if (!list_empty(&bss->hidden_list))
94 list_del(&bss->hidden_list);
95
96 kfree(bss);
97 }
98
99 static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
100 struct cfg80211_internal_bss *bss)
101 {
102 lockdep_assert_held(&rdev->bss_lock);
103
104 bss->refcount++;
105 if (bss->pub.hidden_beacon_bss) {
106 bss = container_of(bss->pub.hidden_beacon_bss,
107 struct cfg80211_internal_bss,
108 pub);
109 bss->refcount++;
110 }
111 }
112
113 static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
114 struct cfg80211_internal_bss *bss)
115 {
116 lockdep_assert_held(&rdev->bss_lock);
117
118 if (bss->pub.hidden_beacon_bss) {
119 struct cfg80211_internal_bss *hbss;
120 hbss = container_of(bss->pub.hidden_beacon_bss,
121 struct cfg80211_internal_bss,
122 pub);
123 hbss->refcount--;
124 if (hbss->refcount == 0)
125 bss_free(hbss);
126 }
127 bss->refcount--;
128 if (bss->refcount == 0)
129 bss_free(bss);
130 }
131
132 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
133 struct cfg80211_internal_bss *bss)
134 {
135 lockdep_assert_held(&rdev->bss_lock);
136
137 if (!list_empty(&bss->hidden_list)) {
138 /*
139 * don't remove the beacon entry if it has
140 * probe responses associated with it
141 */
142 if (!bss->pub.hidden_beacon_bss)
143 return false;
144 /*
145 * if it's a probe response entry break its
146 * link to the other entries in the group
147 */
148 list_del_init(&bss->hidden_list);
149 }
150
151 list_del_init(&bss->list);
152 rb_erase(&bss->rbn, &rdev->bss_tree);
153 rdev->bss_entries--;
154 WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
155 "rdev bss entries[%d]/list[empty:%d] corruption\n",
156 rdev->bss_entries, list_empty(&rdev->bss_list));
157 bss_ref_put(rdev, bss);
158 return true;
159 }
160
161 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
162 unsigned long expire_time)
163 {
164 struct cfg80211_internal_bss *bss, *tmp;
165 bool expired = false;
166
167 lockdep_assert_held(&rdev->bss_lock);
168
169 list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
170 if (atomic_read(&bss->hold))
171 continue;
172 if (!time_after(expire_time, bss->ts))
173 continue;
174
175 if (__cfg80211_unlink_bss(rdev, bss))
176 expired = true;
177 }
178
179 if (expired)
180 rdev->bss_generation++;
181 }
182
183 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
184 {
185 struct cfg80211_internal_bss *bss, *oldest = NULL;
186 bool ret;
187
188 lockdep_assert_held(&rdev->bss_lock);
189
190 list_for_each_entry(bss, &rdev->bss_list, list) {
191 if (atomic_read(&bss->hold))
192 continue;
193
194 if (!list_empty(&bss->hidden_list) &&
195 !bss->pub.hidden_beacon_bss)
196 continue;
197
198 if (oldest && time_before(oldest->ts, bss->ts))
199 continue;
200 oldest = bss;
201 }
202
203 if (WARN_ON(!oldest))
204 return false;
205
206 /*
207 * The callers make sure to increase rdev->bss_generation if anything
208 * gets removed (and a new entry added), so there's no need to also do
209 * it here.
210 */
211
212 ret = __cfg80211_unlink_bss(rdev, oldest);
213 WARN_ON(!ret);
214 return ret;
215 }
216
217 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
218 bool send_message)
219 {
220 struct cfg80211_scan_request *request;
221 struct wireless_dev *wdev;
222 struct sk_buff *msg;
223 #ifdef CONFIG_CFG80211_WEXT
224 union iwreq_data wrqu;
225 #endif
226
227 ASSERT_RTNL();
228
229 if (rdev->scan_msg) {
230 nl80211_send_scan_msg(rdev, rdev->scan_msg);
231 rdev->scan_msg = NULL;
232 return;
233 }
234
235 request = rdev->scan_req;
236 if (!request)
237 return;
238
239 wdev = request->wdev;
240
241 /*
242 * This must be before sending the other events!
243 * Otherwise, wpa_supplicant gets completely confused with
244 * wext events.
245 */
246 if (wdev->netdev)
247 cfg80211_sme_scan_done(wdev->netdev);
248
249 if (!request->info.aborted &&
250 request->flags & NL80211_SCAN_FLAG_FLUSH) {
251 /* flush entries from previous scans */
252 spin_lock_bh(&rdev->bss_lock);
253 __cfg80211_bss_expire(rdev, request->scan_start);
254 spin_unlock_bh(&rdev->bss_lock);
255 }
256
257 msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
258
259 #ifdef CONFIG_CFG80211_WEXT
260 if (wdev->netdev && !request->info.aborted) {
261 memset(&wrqu, 0, sizeof(wrqu));
262
263 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
264 }
265 #endif
266
267 if (wdev->netdev)
268 dev_put(wdev->netdev);
269
270 rdev->scan_req = NULL;
271 kfree(request);
272
273 if (!send_message)
274 rdev->scan_msg = msg;
275 else
276 nl80211_send_scan_msg(rdev, msg);
277 }
278
279 void __cfg80211_scan_done(struct work_struct *wk)
280 {
281 struct cfg80211_registered_device *rdev;
282
283 rdev = container_of(wk, struct cfg80211_registered_device,
284 scan_done_wk);
285
286 rtnl_lock();
287 ___cfg80211_scan_done(rdev, true);
288 rtnl_unlock();
289 }
290
291 void cfg80211_scan_done(struct cfg80211_scan_request *request,
292 struct cfg80211_scan_info *info)
293 {
294 trace_cfg80211_scan_done(request, info);
295 WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req);
296
297 request->info = *info;
298 request->notified = true;
299 queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
300 }
301 EXPORT_SYMBOL(cfg80211_scan_done);
302
303 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
304 struct cfg80211_sched_scan_request *req)
305 {
306 ASSERT_RTNL();
307
308 list_add_rcu(&req->list, &rdev->sched_scan_req_list);
309 }
310
311 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
312 struct cfg80211_sched_scan_request *req)
313 {
314 ASSERT_RTNL();
315
316 list_del_rcu(&req->list);
317 kfree_rcu(req, rcu_head);
318 }
319
320 static struct cfg80211_sched_scan_request *
321 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
322 {
323 struct cfg80211_sched_scan_request *pos;
324
325 WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
326
327 list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list) {
328 if (pos->reqid == reqid)
329 return pos;
330 }
331 return NULL;
332 }
333
334 /*
335 * Determines if a scheduled scan request can be handled. When a legacy
336 * scheduled scan is running no other scheduled scan is allowed regardless
337 * whether the request is for legacy or multi-support scan. When a multi-support
338 * scheduled scan is running a request for legacy scan is not allowed. In this
339 * case a request for multi-support scan can be handled if resources are
340 * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
341 */
342 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
343 bool want_multi)
344 {
345 struct cfg80211_sched_scan_request *pos;
346 int i = 0;
347
348 list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
349 /* request id zero means legacy in progress */
350 if (!i && !pos->reqid)
351 return -EINPROGRESS;
352 i++;
353 }
354
355 if (i) {
356 /* no legacy allowed when multi request(s) are active */
357 if (!want_multi)
358 return -EINPROGRESS;
359
360 /* resource limit reached */
361 if (i == rdev->wiphy.max_sched_scan_reqs)
362 return -ENOSPC;
363 }
364 return 0;
365 }
366
367 void cfg80211_sched_scan_results_wk(struct work_struct *work)
368 {
369 struct cfg80211_registered_device *rdev;
370 struct cfg80211_sched_scan_request *req, *tmp;
371
372 rdev = container_of(work, struct cfg80211_registered_device,
373 sched_scan_res_wk);
374
375 rtnl_lock();
376 list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
377 if (req->report_results) {
378 req->report_results = false;
379 if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
380 /* flush entries from previous scans */
381 spin_lock_bh(&rdev->bss_lock);
382 __cfg80211_bss_expire(rdev, req->scan_start);
383 spin_unlock_bh(&rdev->bss_lock);
384 req->scan_start = jiffies;
385 }
386 nl80211_send_sched_scan(req,
387 NL80211_CMD_SCHED_SCAN_RESULTS);
388 }
389 }
390 rtnl_unlock();
391 }
392
393 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
394 {
395 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
396 struct cfg80211_sched_scan_request *request;
397
398 trace_cfg80211_sched_scan_results(wiphy, reqid);
399 /* ignore if we're not scanning */
400
401 rcu_read_lock();
402 request = cfg80211_find_sched_scan_req(rdev, reqid);
403 if (request) {
404 request->report_results = true;
405 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
406 }
407 rcu_read_unlock();
408 }
409 EXPORT_SYMBOL(cfg80211_sched_scan_results);
410
411 void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy, u64 reqid)
412 {
413 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
414
415 ASSERT_RTNL();
416
417 trace_cfg80211_sched_scan_stopped(wiphy, reqid);
418
419 __cfg80211_stop_sched_scan(rdev, reqid, true);
420 }
421 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
422
423 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
424 {
425 rtnl_lock();
426 cfg80211_sched_scan_stopped_rtnl(wiphy, reqid);
427 rtnl_unlock();
428 }
429 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
430
431 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
432 struct cfg80211_sched_scan_request *req,
433 bool driver_initiated)
434 {
435 ASSERT_RTNL();
436
437 if (!driver_initiated) {
438 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
439 if (err)
440 return err;
441 }
442
443 nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
444
445 cfg80211_del_sched_scan_req(rdev, req);
446
447 return 0;
448 }
449
450 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
451 u64 reqid, bool driver_initiated)
452 {
453 struct cfg80211_sched_scan_request *sched_scan_req;
454
455 ASSERT_RTNL();
456
457 sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
458 if (!sched_scan_req)
459 return -ENOENT;
460
461 return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
462 driver_initiated);
463 }
464
465 void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
466 unsigned long age_secs)
467 {
468 struct cfg80211_internal_bss *bss;
469 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
470
471 spin_lock_bh(&rdev->bss_lock);
472 list_for_each_entry(bss, &rdev->bss_list, list)
473 bss->ts -= age_jiffies;
474 spin_unlock_bh(&rdev->bss_lock);
475 }
476
477 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
478 {
479 __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
480 }
481
482 const u8 *cfg80211_find_ie_match(u8 eid, const u8 *ies, int len,
483 const u8 *match, int match_len,
484 int match_offset)
485 {
486 /* match_offset can't be smaller than 2, unless match_len is
487 * zero, in which case match_offset must be zero as well.
488 */
489 if (WARN_ON((match_len && match_offset < 2) ||
490 (!match_len && match_offset)))
491 return NULL;
492
493 while (len >= 2 && len >= ies[1] + 2) {
494 if ((ies[0] == eid) &&
495 (ies[1] + 2 >= match_offset + match_len) &&
496 !memcmp(ies + match_offset, match, match_len))
497 return ies;
498
499 len -= ies[1] + 2;
500 ies += ies[1] + 2;
501 }
502
503 return NULL;
504 }
505 EXPORT_SYMBOL(cfg80211_find_ie_match);
506
507 const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type,
508 const u8 *ies, int len)
509 {
510 const u8 *ie;
511 u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
512 int match_len = (oui_type < 0) ? 3 : sizeof(match);
513
514 if (WARN_ON(oui_type > 0xff))
515 return NULL;
516
517 ie = cfg80211_find_ie_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
518 match, match_len, 2);
519
520 if (ie && (ie[1] < 4))
521 return NULL;
522
523 return ie;
524 }
525 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
526
527 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
528 const u8 *ssid, size_t ssid_len)
529 {
530 const struct cfg80211_bss_ies *ies;
531 const u8 *ssidie;
532
533 if (bssid && !ether_addr_equal(a->bssid, bssid))
534 return false;
535
536 if (!ssid)
537 return true;
538
539 ies = rcu_access_pointer(a->ies);
540 if (!ies)
541 return false;
542 ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
543 if (!ssidie)
544 return false;
545 if (ssidie[1] != ssid_len)
546 return false;
547 return memcmp(ssidie + 2, ssid, ssid_len) == 0;
548 }
549
550 /**
551 * enum bss_compare_mode - BSS compare mode
552 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
553 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
554 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
555 */
556 enum bss_compare_mode {
557 BSS_CMP_REGULAR,
558 BSS_CMP_HIDE_ZLEN,
559 BSS_CMP_HIDE_NUL,
560 };
561
562 static int cmp_bss(struct cfg80211_bss *a,
563 struct cfg80211_bss *b,
564 enum bss_compare_mode mode)
565 {
566 const struct cfg80211_bss_ies *a_ies, *b_ies;
567 const u8 *ie1 = NULL;
568 const u8 *ie2 = NULL;
569 int i, r;
570
571 if (a->channel != b->channel)
572 return b->channel->center_freq - a->channel->center_freq;
573
574 a_ies = rcu_access_pointer(a->ies);
575 if (!a_ies)
576 return -1;
577 b_ies = rcu_access_pointer(b->ies);
578 if (!b_ies)
579 return 1;
580
581 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
582 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
583 a_ies->data, a_ies->len);
584 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
585 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
586 b_ies->data, b_ies->len);
587 if (ie1 && ie2) {
588 int mesh_id_cmp;
589
590 if (ie1[1] == ie2[1])
591 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
592 else
593 mesh_id_cmp = ie2[1] - ie1[1];
594
595 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
596 a_ies->data, a_ies->len);
597 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
598 b_ies->data, b_ies->len);
599 if (ie1 && ie2) {
600 if (mesh_id_cmp)
601 return mesh_id_cmp;
602 if (ie1[1] != ie2[1])
603 return ie2[1] - ie1[1];
604 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
605 }
606 }
607
608 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
609 if (r)
610 return r;
611
612 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
613 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
614
615 if (!ie1 && !ie2)
616 return 0;
617
618 /*
619 * Note that with "hide_ssid", the function returns a match if
620 * the already-present BSS ("b") is a hidden SSID beacon for
621 * the new BSS ("a").
622 */
623
624 /* sort missing IE before (left of) present IE */
625 if (!ie1)
626 return -1;
627 if (!ie2)
628 return 1;
629
630 switch (mode) {
631 case BSS_CMP_HIDE_ZLEN:
632 /*
633 * In ZLEN mode we assume the BSS entry we're
634 * looking for has a zero-length SSID. So if
635 * the one we're looking at right now has that,
636 * return 0. Otherwise, return the difference
637 * in length, but since we're looking for the
638 * 0-length it's really equivalent to returning
639 * the length of the one we're looking at.
640 *
641 * No content comparison is needed as we assume
642 * the content length is zero.
643 */
644 return ie2[1];
645 case BSS_CMP_REGULAR:
646 default:
647 /* sort by length first, then by contents */
648 if (ie1[1] != ie2[1])
649 return ie2[1] - ie1[1];
650 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
651 case BSS_CMP_HIDE_NUL:
652 if (ie1[1] != ie2[1])
653 return ie2[1] - ie1[1];
654 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
655 for (i = 0; i < ie2[1]; i++)
656 if (ie2[i + 2])
657 return -1;
658 return 0;
659 }
660 }
661
662 static bool cfg80211_bss_type_match(u16 capability,
663 enum nl80211_band band,
664 enum ieee80211_bss_type bss_type)
665 {
666 bool ret = true;
667 u16 mask, val;
668
669 if (bss_type == IEEE80211_BSS_TYPE_ANY)
670 return ret;
671
672 if (band == NL80211_BAND_60GHZ) {
673 mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
674 switch (bss_type) {
675 case IEEE80211_BSS_TYPE_ESS:
676 val = WLAN_CAPABILITY_DMG_TYPE_AP;
677 break;
678 case IEEE80211_BSS_TYPE_PBSS:
679 val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
680 break;
681 case IEEE80211_BSS_TYPE_IBSS:
682 val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
683 break;
684 default:
685 return false;
686 }
687 } else {
688 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
689 switch (bss_type) {
690 case IEEE80211_BSS_TYPE_ESS:
691 val = WLAN_CAPABILITY_ESS;
692 break;
693 case IEEE80211_BSS_TYPE_IBSS:
694 val = WLAN_CAPABILITY_IBSS;
695 break;
696 case IEEE80211_BSS_TYPE_MBSS:
697 val = 0;
698 break;
699 default:
700 return false;
701 }
702 }
703
704 ret = ((capability & mask) == val);
705 return ret;
706 }
707
708 /* Returned bss is reference counted and must be cleaned up appropriately. */
709 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
710 struct ieee80211_channel *channel,
711 const u8 *bssid,
712 const u8 *ssid, size_t ssid_len,
713 enum ieee80211_bss_type bss_type,
714 enum ieee80211_privacy privacy)
715 {
716 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
717 struct cfg80211_internal_bss *bss, *res = NULL;
718 unsigned long now = jiffies;
719 int bss_privacy;
720
721 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
722 privacy);
723
724 spin_lock_bh(&rdev->bss_lock);
725
726 list_for_each_entry(bss, &rdev->bss_list, list) {
727 if (!cfg80211_bss_type_match(bss->pub.capability,
728 bss->pub.channel->band, bss_type))
729 continue;
730
731 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
732 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
733 (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
734 continue;
735 if (channel && bss->pub.channel != channel)
736 continue;
737 if (!is_valid_ether_addr(bss->pub.bssid))
738 continue;
739 /* Don't get expired BSS structs */
740 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
741 !atomic_read(&bss->hold))
742 continue;
743 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
744 res = bss;
745 bss_ref_get(rdev, res);
746 break;
747 }
748 }
749
750 spin_unlock_bh(&rdev->bss_lock);
751 if (!res)
752 return NULL;
753 trace_cfg80211_return_bss(&res->pub);
754 return &res->pub;
755 }
756 EXPORT_SYMBOL(cfg80211_get_bss);
757
758 static void rb_insert_bss(struct cfg80211_registered_device *rdev,
759 struct cfg80211_internal_bss *bss)
760 {
761 struct rb_node **p = &rdev->bss_tree.rb_node;
762 struct rb_node *parent = NULL;
763 struct cfg80211_internal_bss *tbss;
764 int cmp;
765
766 while (*p) {
767 parent = *p;
768 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
769
770 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
771
772 if (WARN_ON(!cmp)) {
773 /* will sort of leak this BSS */
774 return;
775 }
776
777 if (cmp < 0)
778 p = &(*p)->rb_left;
779 else
780 p = &(*p)->rb_right;
781 }
782
783 rb_link_node(&bss->rbn, parent, p);
784 rb_insert_color(&bss->rbn, &rdev->bss_tree);
785 }
786
787 static struct cfg80211_internal_bss *
788 rb_find_bss(struct cfg80211_registered_device *rdev,
789 struct cfg80211_internal_bss *res,
790 enum bss_compare_mode mode)
791 {
792 struct rb_node *n = rdev->bss_tree.rb_node;
793 struct cfg80211_internal_bss *bss;
794 int r;
795
796 while (n) {
797 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
798 r = cmp_bss(&res->pub, &bss->pub, mode);
799
800 if (r == 0)
801 return bss;
802 else if (r < 0)
803 n = n->rb_left;
804 else
805 n = n->rb_right;
806 }
807
808 return NULL;
809 }
810
811 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
812 struct cfg80211_internal_bss *new)
813 {
814 const struct cfg80211_bss_ies *ies;
815 struct cfg80211_internal_bss *bss;
816 const u8 *ie;
817 int i, ssidlen;
818 u8 fold = 0;
819 u32 n_entries = 0;
820
821 ies = rcu_access_pointer(new->pub.beacon_ies);
822 if (WARN_ON(!ies))
823 return false;
824
825 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
826 if (!ie) {
827 /* nothing to do */
828 return true;
829 }
830
831 ssidlen = ie[1];
832 for (i = 0; i < ssidlen; i++)
833 fold |= ie[2 + i];
834
835 if (fold) {
836 /* not a hidden SSID */
837 return true;
838 }
839
840 /* This is the bad part ... */
841
842 list_for_each_entry(bss, &rdev->bss_list, list) {
843 /*
844 * we're iterating all the entries anyway, so take the
845 * opportunity to validate the list length accounting
846 */
847 n_entries++;
848
849 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
850 continue;
851 if (bss->pub.channel != new->pub.channel)
852 continue;
853 if (bss->pub.scan_width != new->pub.scan_width)
854 continue;
855 if (rcu_access_pointer(bss->pub.beacon_ies))
856 continue;
857 ies = rcu_access_pointer(bss->pub.ies);
858 if (!ies)
859 continue;
860 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
861 if (!ie)
862 continue;
863 if (ssidlen && ie[1] != ssidlen)
864 continue;
865 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
866 continue;
867 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
868 list_del(&bss->hidden_list);
869 /* combine them */
870 list_add(&bss->hidden_list, &new->hidden_list);
871 bss->pub.hidden_beacon_bss = &new->pub;
872 new->refcount += bss->refcount;
873 rcu_assign_pointer(bss->pub.beacon_ies,
874 new->pub.beacon_ies);
875 }
876
877 WARN_ONCE(n_entries != rdev->bss_entries,
878 "rdev bss entries[%d]/list[len:%d] corruption\n",
879 rdev->bss_entries, n_entries);
880
881 return true;
882 }
883
884 /* Returned bss is reference counted and must be cleaned up appropriately. */
885 static struct cfg80211_internal_bss *
886 cfg80211_bss_update(struct cfg80211_registered_device *rdev,
887 struct cfg80211_internal_bss *tmp,
888 bool signal_valid)
889 {
890 struct cfg80211_internal_bss *found = NULL;
891
892 if (WARN_ON(!tmp->pub.channel))
893 return NULL;
894
895 tmp->ts = jiffies;
896
897 spin_lock_bh(&rdev->bss_lock);
898
899 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
900 spin_unlock_bh(&rdev->bss_lock);
901 return NULL;
902 }
903
904 found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
905
906 if (found) {
907 /* Update IEs */
908 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
909 const struct cfg80211_bss_ies *old;
910
911 old = rcu_access_pointer(found->pub.proberesp_ies);
912
913 rcu_assign_pointer(found->pub.proberesp_ies,
914 tmp->pub.proberesp_ies);
915 /* Override possible earlier Beacon frame IEs */
916 rcu_assign_pointer(found->pub.ies,
917 tmp->pub.proberesp_ies);
918 if (old)
919 kfree_rcu((struct cfg80211_bss_ies *)old,
920 rcu_head);
921 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
922 const struct cfg80211_bss_ies *old;
923 struct cfg80211_internal_bss *bss;
924
925 if (found->pub.hidden_beacon_bss &&
926 !list_empty(&found->hidden_list)) {
927 const struct cfg80211_bss_ies *f;
928
929 /*
930 * The found BSS struct is one of the probe
931 * response members of a group, but we're
932 * receiving a beacon (beacon_ies in the tmp
933 * bss is used). This can only mean that the
934 * AP changed its beacon from not having an
935 * SSID to showing it, which is confusing so
936 * drop this information.
937 */
938
939 f = rcu_access_pointer(tmp->pub.beacon_ies);
940 kfree_rcu((struct cfg80211_bss_ies *)f,
941 rcu_head);
942 goto drop;
943 }
944
945 old = rcu_access_pointer(found->pub.beacon_ies);
946
947 rcu_assign_pointer(found->pub.beacon_ies,
948 tmp->pub.beacon_ies);
949
950 /* Override IEs if they were from a beacon before */
951 if (old == rcu_access_pointer(found->pub.ies))
952 rcu_assign_pointer(found->pub.ies,
953 tmp->pub.beacon_ies);
954
955 /* Assign beacon IEs to all sub entries */
956 list_for_each_entry(bss, &found->hidden_list,
957 hidden_list) {
958 const struct cfg80211_bss_ies *ies;
959
960 ies = rcu_access_pointer(bss->pub.beacon_ies);
961 WARN_ON(ies != old);
962
963 rcu_assign_pointer(bss->pub.beacon_ies,
964 tmp->pub.beacon_ies);
965 }
966
967 if (old)
968 kfree_rcu((struct cfg80211_bss_ies *)old,
969 rcu_head);
970 }
971
972 found->pub.beacon_interval = tmp->pub.beacon_interval;
973 /*
974 * don't update the signal if beacon was heard on
975 * adjacent channel.
976 */
977 if (signal_valid)
978 found->pub.signal = tmp->pub.signal;
979 found->pub.capability = tmp->pub.capability;
980 found->ts = tmp->ts;
981 found->ts_boottime = tmp->ts_boottime;
982 found->parent_tsf = tmp->parent_tsf;
983 ether_addr_copy(found->parent_bssid, tmp->parent_bssid);
984 } else {
985 struct cfg80211_internal_bss *new;
986 struct cfg80211_internal_bss *hidden;
987 struct cfg80211_bss_ies *ies;
988
989 /*
990 * create a copy -- the "res" variable that is passed in
991 * is allocated on the stack since it's not needed in the
992 * more common case of an update
993 */
994 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
995 GFP_ATOMIC);
996 if (!new) {
997 ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
998 if (ies)
999 kfree_rcu(ies, rcu_head);
1000 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1001 if (ies)
1002 kfree_rcu(ies, rcu_head);
1003 goto drop;
1004 }
1005 memcpy(new, tmp, sizeof(*new));
1006 new->refcount = 1;
1007 INIT_LIST_HEAD(&new->hidden_list);
1008
1009 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1010 hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1011 if (!hidden)
1012 hidden = rb_find_bss(rdev, tmp,
1013 BSS_CMP_HIDE_NUL);
1014 if (hidden) {
1015 new->pub.hidden_beacon_bss = &hidden->pub;
1016 list_add(&new->hidden_list,
1017 &hidden->hidden_list);
1018 hidden->refcount++;
1019 rcu_assign_pointer(new->pub.beacon_ies,
1020 hidden->pub.beacon_ies);
1021 }
1022 } else {
1023 /*
1024 * Ok so we found a beacon, and don't have an entry. If
1025 * it's a beacon with hidden SSID, we might be in for an
1026 * expensive search for any probe responses that should
1027 * be grouped with this beacon for updates ...
1028 */
1029 if (!cfg80211_combine_bsses(rdev, new)) {
1030 kfree(new);
1031 goto drop;
1032 }
1033 }
1034
1035 if (rdev->bss_entries >= bss_entries_limit &&
1036 !cfg80211_bss_expire_oldest(rdev)) {
1037 kfree(new);
1038 goto drop;
1039 }
1040
1041 list_add_tail(&new->list, &rdev->bss_list);
1042 rdev->bss_entries++;
1043 rb_insert_bss(rdev, new);
1044 found = new;
1045 }
1046
1047 rdev->bss_generation++;
1048 bss_ref_get(rdev, found);
1049 spin_unlock_bh(&rdev->bss_lock);
1050
1051 return found;
1052 drop:
1053 spin_unlock_bh(&rdev->bss_lock);
1054 return NULL;
1055 }
1056
1057 static struct ieee80211_channel *
1058 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1059 struct ieee80211_channel *channel)
1060 {
1061 const u8 *tmp;
1062 u32 freq;
1063 int channel_number = -1;
1064
1065 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
1066 if (tmp && tmp[1] == 1) {
1067 channel_number = tmp[2];
1068 } else {
1069 tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
1070 if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
1071 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
1072
1073 channel_number = htop->primary_chan;
1074 }
1075 }
1076
1077 if (channel_number < 0)
1078 return channel;
1079
1080 freq = ieee80211_channel_to_frequency(channel_number, channel->band);
1081 channel = ieee80211_get_channel(wiphy, freq);
1082 if (!channel)
1083 return NULL;
1084 if (channel->flags & IEEE80211_CHAN_DISABLED)
1085 return NULL;
1086 return channel;
1087 }
1088
1089 /* Returned bss is reference counted and must be cleaned up appropriately. */
1090 struct cfg80211_bss *
1091 cfg80211_inform_bss_data(struct wiphy *wiphy,
1092 struct cfg80211_inform_bss *data,
1093 enum cfg80211_bss_frame_type ftype,
1094 const u8 *bssid, u64 tsf, u16 capability,
1095 u16 beacon_interval, const u8 *ie, size_t ielen,
1096 gfp_t gfp)
1097 {
1098 struct cfg80211_bss_ies *ies;
1099 struct ieee80211_channel *channel;
1100 struct cfg80211_internal_bss tmp = {}, *res;
1101 int bss_type;
1102 bool signal_valid;
1103
1104 if (WARN_ON(!wiphy))
1105 return NULL;
1106
1107 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1108 (data->signal < 0 || data->signal > 100)))
1109 return NULL;
1110
1111 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan);
1112 if (!channel)
1113 return NULL;
1114
1115 memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
1116 tmp.pub.channel = channel;
1117 tmp.pub.scan_width = data->scan_width;
1118 tmp.pub.signal = data->signal;
1119 tmp.pub.beacon_interval = beacon_interval;
1120 tmp.pub.capability = capability;
1121 tmp.ts_boottime = data->boottime_ns;
1122
1123 /*
1124 * If we do not know here whether the IEs are from a Beacon or Probe
1125 * Response frame, we need to pick one of the options and only use it
1126 * with the driver that does not provide the full Beacon/Probe Response
1127 * frame. Use Beacon frame pointer to avoid indicating that this should
1128 * override the IEs pointer should we have received an earlier
1129 * indication of Probe Response data.
1130 */
1131 ies = kzalloc(sizeof(*ies) + ielen, gfp);
1132 if (!ies)
1133 return NULL;
1134 ies->len = ielen;
1135 ies->tsf = tsf;
1136 ies->from_beacon = false;
1137 memcpy(ies->data, ie, ielen);
1138
1139 switch (ftype) {
1140 case CFG80211_BSS_FTYPE_BEACON:
1141 ies->from_beacon = true;
1142 /* fall through to assign */
1143 case CFG80211_BSS_FTYPE_UNKNOWN:
1144 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1145 break;
1146 case CFG80211_BSS_FTYPE_PRESP:
1147 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1148 break;
1149 }
1150 rcu_assign_pointer(tmp.pub.ies, ies);
1151
1152 signal_valid = abs(data->chan->center_freq - channel->center_freq) <=
1153 wiphy->max_adj_channel_rssi_comp;
1154 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
1155 if (!res)
1156 return NULL;
1157
1158 if (channel->band == NL80211_BAND_60GHZ) {
1159 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1160 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1161 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1162 regulatory_hint_found_beacon(wiphy, channel, gfp);
1163 } else {
1164 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1165 regulatory_hint_found_beacon(wiphy, channel, gfp);
1166 }
1167
1168 trace_cfg80211_return_bss(&res->pub);
1169 /* cfg80211_bss_update gives us a referenced result */
1170 return &res->pub;
1171 }
1172 EXPORT_SYMBOL(cfg80211_inform_bss_data);
1173
1174 /* cfg80211_inform_bss_width_frame helper */
1175 struct cfg80211_bss *
1176 cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
1177 struct cfg80211_inform_bss *data,
1178 struct ieee80211_mgmt *mgmt, size_t len,
1179 gfp_t gfp)
1180
1181 {
1182 struct cfg80211_internal_bss tmp = {}, *res;
1183 struct cfg80211_bss_ies *ies;
1184 struct ieee80211_channel *channel;
1185 bool signal_valid;
1186 size_t ielen = len - offsetof(struct ieee80211_mgmt,
1187 u.probe_resp.variable);
1188 int bss_type;
1189
1190 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
1191 offsetof(struct ieee80211_mgmt, u.beacon.variable));
1192
1193 trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
1194
1195 if (WARN_ON(!mgmt))
1196 return NULL;
1197
1198 if (WARN_ON(!wiphy))
1199 return NULL;
1200
1201 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1202 (data->signal < 0 || data->signal > 100)))
1203 return NULL;
1204
1205 if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
1206 return NULL;
1207
1208 channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
1209 ielen, data->chan);
1210 if (!channel)
1211 return NULL;
1212
1213 ies = kzalloc(sizeof(*ies) + ielen, gfp);
1214 if (!ies)
1215 return NULL;
1216 ies->len = ielen;
1217 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
1218 ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
1219 memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
1220
1221 if (ieee80211_is_probe_resp(mgmt->frame_control))
1222 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1223 else
1224 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1225 rcu_assign_pointer(tmp.pub.ies, ies);
1226
1227 memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
1228 tmp.pub.channel = channel;
1229 tmp.pub.scan_width = data->scan_width;
1230 tmp.pub.signal = data->signal;
1231 tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
1232 tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
1233 tmp.ts_boottime = data->boottime_ns;
1234 tmp.parent_tsf = data->parent_tsf;
1235 ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
1236
1237 signal_valid = abs(data->chan->center_freq - channel->center_freq) <=
1238 wiphy->max_adj_channel_rssi_comp;
1239 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
1240 if (!res)
1241 return NULL;
1242
1243 if (channel->band == NL80211_BAND_60GHZ) {
1244 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1245 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1246 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1247 regulatory_hint_found_beacon(wiphy, channel, gfp);
1248 } else {
1249 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1250 regulatory_hint_found_beacon(wiphy, channel, gfp);
1251 }
1252
1253 trace_cfg80211_return_bss(&res->pub);
1254 /* cfg80211_bss_update gives us a referenced result */
1255 return &res->pub;
1256 }
1257 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
1258
1259 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1260 {
1261 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1262 struct cfg80211_internal_bss *bss;
1263
1264 if (!pub)
1265 return;
1266
1267 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1268
1269 spin_lock_bh(&rdev->bss_lock);
1270 bss_ref_get(rdev, bss);
1271 spin_unlock_bh(&rdev->bss_lock);
1272 }
1273 EXPORT_SYMBOL(cfg80211_ref_bss);
1274
1275 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1276 {
1277 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1278 struct cfg80211_internal_bss *bss;
1279
1280 if (!pub)
1281 return;
1282
1283 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1284
1285 spin_lock_bh(&rdev->bss_lock);
1286 bss_ref_put(rdev, bss);
1287 spin_unlock_bh(&rdev->bss_lock);
1288 }
1289 EXPORT_SYMBOL(cfg80211_put_bss);
1290
1291 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1292 {
1293 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1294 struct cfg80211_internal_bss *bss;
1295
1296 if (WARN_ON(!pub))
1297 return;
1298
1299 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1300
1301 spin_lock_bh(&rdev->bss_lock);
1302 if (!list_empty(&bss->list)) {
1303 if (__cfg80211_unlink_bss(rdev, bss))
1304 rdev->bss_generation++;
1305 }
1306 spin_unlock_bh(&rdev->bss_lock);
1307 }
1308 EXPORT_SYMBOL(cfg80211_unlink_bss);
1309
1310 #ifdef CONFIG_CFG80211_WEXT
1311 static struct cfg80211_registered_device *
1312 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
1313 {
1314 struct cfg80211_registered_device *rdev;
1315 struct net_device *dev;
1316
1317 ASSERT_RTNL();
1318
1319 dev = dev_get_by_index(net, ifindex);
1320 if (!dev)
1321 return ERR_PTR(-ENODEV);
1322 if (dev->ieee80211_ptr)
1323 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
1324 else
1325 rdev = ERR_PTR(-ENODEV);
1326 dev_put(dev);
1327 return rdev;
1328 }
1329
1330 int cfg80211_wext_siwscan(struct net_device *dev,
1331 struct iw_request_info *info,
1332 union iwreq_data *wrqu, char *extra)
1333 {
1334 struct cfg80211_registered_device *rdev;
1335 struct wiphy *wiphy;
1336 struct iw_scan_req *wreq = NULL;
1337 struct cfg80211_scan_request *creq = NULL;
1338 int i, err, n_channels = 0;
1339 enum nl80211_band band;
1340
1341 if (!netif_running(dev))
1342 return -ENETDOWN;
1343
1344 if (wrqu->data.length == sizeof(struct iw_scan_req))
1345 wreq = (struct iw_scan_req *)extra;
1346
1347 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1348
1349 if (IS_ERR(rdev))
1350 return PTR_ERR(rdev);
1351
1352 if (rdev->scan_req || rdev->scan_msg) {
1353 err = -EBUSY;
1354 goto out;
1355 }
1356
1357 wiphy = &rdev->wiphy;
1358
1359 /* Determine number of channels, needed to allocate creq */
1360 if (wreq && wreq->num_channels)
1361 n_channels = wreq->num_channels;
1362 else
1363 n_channels = ieee80211_get_num_supported_channels(wiphy);
1364
1365 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
1366 n_channels * sizeof(void *),
1367 GFP_ATOMIC);
1368 if (!creq) {
1369 err = -ENOMEM;
1370 goto out;
1371 }
1372
1373 creq->wiphy = wiphy;
1374 creq->wdev = dev->ieee80211_ptr;
1375 /* SSIDs come after channels */
1376 creq->ssids = (void *)&creq->channels[n_channels];
1377 creq->n_channels = n_channels;
1378 creq->n_ssids = 1;
1379 creq->scan_start = jiffies;
1380
1381 /* translate "Scan on frequencies" request */
1382 i = 0;
1383 for (band = 0; band < NUM_NL80211_BANDS; band++) {
1384 int j;
1385
1386 if (!wiphy->bands[band])
1387 continue;
1388
1389 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
1390 /* ignore disabled channels */
1391 if (wiphy->bands[band]->channels[j].flags &
1392 IEEE80211_CHAN_DISABLED)
1393 continue;
1394
1395 /* If we have a wireless request structure and the
1396 * wireless request specifies frequencies, then search
1397 * for the matching hardware channel.
1398 */
1399 if (wreq && wreq->num_channels) {
1400 int k;
1401 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
1402 for (k = 0; k < wreq->num_channels; k++) {
1403 struct iw_freq *freq =
1404 &wreq->channel_list[k];
1405 int wext_freq =
1406 cfg80211_wext_freq(freq);
1407
1408 if (wext_freq == wiphy_freq)
1409 goto wext_freq_found;
1410 }
1411 goto wext_freq_not_found;
1412 }
1413
1414 wext_freq_found:
1415 creq->channels[i] = &wiphy->bands[band]->channels[j];
1416 i++;
1417 wext_freq_not_found: ;
1418 }
1419 }
1420 /* No channels found? */
1421 if (!i) {
1422 err = -EINVAL;
1423 goto out;
1424 }
1425
1426 /* Set real number of channels specified in creq->channels[] */
1427 creq->n_channels = i;
1428
1429 /* translate "Scan for SSID" request */
1430 if (wreq) {
1431 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
1432 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
1433 err = -EINVAL;
1434 goto out;
1435 }
1436 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
1437 creq->ssids[0].ssid_len = wreq->essid_len;
1438 }
1439 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
1440 creq->n_ssids = 0;
1441 }
1442
1443 for (i = 0; i < NUM_NL80211_BANDS; i++)
1444 if (wiphy->bands[i])
1445 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
1446
1447 eth_broadcast_addr(creq->bssid);
1448
1449 rdev->scan_req = creq;
1450 err = rdev_scan(rdev, creq);
1451 if (err) {
1452 rdev->scan_req = NULL;
1453 /* creq will be freed below */
1454 } else {
1455 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
1456 /* creq now owned by driver */
1457 creq = NULL;
1458 dev_hold(dev);
1459 }
1460 out:
1461 kfree(creq);
1462 return err;
1463 }
1464 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
1465
1466 static char *ieee80211_scan_add_ies(struct iw_request_info *info,
1467 const struct cfg80211_bss_ies *ies,
1468 char *current_ev, char *end_buf)
1469 {
1470 const u8 *pos, *end, *next;
1471 struct iw_event iwe;
1472
1473 if (!ies)
1474 return current_ev;
1475
1476 /*
1477 * If needed, fragment the IEs buffer (at IE boundaries) into short
1478 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
1479 */
1480 pos = ies->data;
1481 end = pos + ies->len;
1482
1483 while (end - pos > IW_GENERIC_IE_MAX) {
1484 next = pos + 2 + pos[1];
1485 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
1486 next = next + 2 + next[1];
1487
1488 memset(&iwe, 0, sizeof(iwe));
1489 iwe.cmd = IWEVGENIE;
1490 iwe.u.data.length = next - pos;
1491 current_ev = iwe_stream_add_point_check(info, current_ev,
1492 end_buf, &iwe,
1493 (void *)pos);
1494 if (IS_ERR(current_ev))
1495 return current_ev;
1496 pos = next;
1497 }
1498
1499 if (end > pos) {
1500 memset(&iwe, 0, sizeof(iwe));
1501 iwe.cmd = IWEVGENIE;
1502 iwe.u.data.length = end - pos;
1503 current_ev = iwe_stream_add_point_check(info, current_ev,
1504 end_buf, &iwe,
1505 (void *)pos);
1506 if (IS_ERR(current_ev))
1507 return current_ev;
1508 }
1509
1510 return current_ev;
1511 }
1512
1513 static char *
1514 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
1515 struct cfg80211_internal_bss *bss, char *current_ev,
1516 char *end_buf)
1517 {
1518 const struct cfg80211_bss_ies *ies;
1519 struct iw_event iwe;
1520 const u8 *ie;
1521 u8 buf[50];
1522 u8 *cfg, *p, *tmp;
1523 int rem, i, sig;
1524 bool ismesh = false;
1525
1526 memset(&iwe, 0, sizeof(iwe));
1527 iwe.cmd = SIOCGIWAP;
1528 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
1529 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
1530 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
1531 IW_EV_ADDR_LEN);
1532 if (IS_ERR(current_ev))
1533 return current_ev;
1534
1535 memset(&iwe, 0, sizeof(iwe));
1536 iwe.cmd = SIOCGIWFREQ;
1537 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
1538 iwe.u.freq.e = 0;
1539 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
1540 IW_EV_FREQ_LEN);
1541 if (IS_ERR(current_ev))
1542 return current_ev;
1543
1544 memset(&iwe, 0, sizeof(iwe));
1545 iwe.cmd = SIOCGIWFREQ;
1546 iwe.u.freq.m = bss->pub.channel->center_freq;
1547 iwe.u.freq.e = 6;
1548 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
1549 IW_EV_FREQ_LEN);
1550 if (IS_ERR(current_ev))
1551 return current_ev;
1552
1553 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
1554 memset(&iwe, 0, sizeof(iwe));
1555 iwe.cmd = IWEVQUAL;
1556 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
1557 IW_QUAL_NOISE_INVALID |
1558 IW_QUAL_QUAL_UPDATED;
1559 switch (wiphy->signal_type) {
1560 case CFG80211_SIGNAL_TYPE_MBM:
1561 sig = bss->pub.signal / 100;
1562 iwe.u.qual.level = sig;
1563 iwe.u.qual.updated |= IW_QUAL_DBM;
1564 if (sig < -110) /* rather bad */
1565 sig = -110;
1566 else if (sig > -40) /* perfect */
1567 sig = -40;
1568 /* will give a range of 0 .. 70 */
1569 iwe.u.qual.qual = sig + 110;
1570 break;
1571 case CFG80211_SIGNAL_TYPE_UNSPEC:
1572 iwe.u.qual.level = bss->pub.signal;
1573 /* will give range 0 .. 100 */
1574 iwe.u.qual.qual = bss->pub.signal;
1575 break;
1576 default:
1577 /* not reached */
1578 break;
1579 }
1580 current_ev = iwe_stream_add_event_check(info, current_ev,
1581 end_buf, &iwe,
1582 IW_EV_QUAL_LEN);
1583 if (IS_ERR(current_ev))
1584 return current_ev;
1585 }
1586
1587 memset(&iwe, 0, sizeof(iwe));
1588 iwe.cmd = SIOCGIWENCODE;
1589 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
1590 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
1591 else
1592 iwe.u.data.flags = IW_ENCODE_DISABLED;
1593 iwe.u.data.length = 0;
1594 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
1595 &iwe, "");
1596 if (IS_ERR(current_ev))
1597 return current_ev;
1598
1599 rcu_read_lock();
1600 ies = rcu_dereference(bss->pub.ies);
1601 rem = ies->len;
1602 ie = ies->data;
1603
1604 while (rem >= 2) {
1605 /* invalid data */
1606 if (ie[1] > rem - 2)
1607 break;
1608
1609 switch (ie[0]) {
1610 case WLAN_EID_SSID:
1611 memset(&iwe, 0, sizeof(iwe));
1612 iwe.cmd = SIOCGIWESSID;
1613 iwe.u.data.length = ie[1];
1614 iwe.u.data.flags = 1;
1615 current_ev = iwe_stream_add_point_check(info,
1616 current_ev,
1617 end_buf, &iwe,
1618 (u8 *)ie + 2);
1619 if (IS_ERR(current_ev))
1620 goto unlock;
1621 break;
1622 case WLAN_EID_MESH_ID:
1623 memset(&iwe, 0, sizeof(iwe));
1624 iwe.cmd = SIOCGIWESSID;
1625 iwe.u.data.length = ie[1];
1626 iwe.u.data.flags = 1;
1627 current_ev = iwe_stream_add_point_check(info,
1628 current_ev,
1629 end_buf, &iwe,
1630 (u8 *)ie + 2);
1631 if (IS_ERR(current_ev))
1632 goto unlock;
1633 break;
1634 case WLAN_EID_MESH_CONFIG:
1635 ismesh = true;
1636 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1637 break;
1638 cfg = (u8 *)ie + 2;
1639 memset(&iwe, 0, sizeof(iwe));
1640 iwe.cmd = IWEVCUSTOM;
1641 sprintf(buf, "Mesh Network Path Selection Protocol ID: "
1642 "0x%02X", cfg[0]);
1643 iwe.u.data.length = strlen(buf);
1644 current_ev = iwe_stream_add_point_check(info,
1645 current_ev,
1646 end_buf,
1647 &iwe, buf);
1648 if (IS_ERR(current_ev))
1649 goto unlock;
1650 sprintf(buf, "Path Selection Metric ID: 0x%02X",
1651 cfg[1]);
1652 iwe.u.data.length = strlen(buf);
1653 current_ev = iwe_stream_add_point_check(info,
1654 current_ev,
1655 end_buf,
1656 &iwe, buf);
1657 if (IS_ERR(current_ev))
1658 goto unlock;
1659 sprintf(buf, "Congestion Control Mode ID: 0x%02X",
1660 cfg[2]);
1661 iwe.u.data.length = strlen(buf);
1662 current_ev = iwe_stream_add_point_check(info,
1663 current_ev,
1664 end_buf,
1665 &iwe, buf);
1666 if (IS_ERR(current_ev))
1667 goto unlock;
1668 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1669 iwe.u.data.length = strlen(buf);
1670 current_ev = iwe_stream_add_point_check(info,
1671 current_ev,
1672 end_buf,
1673 &iwe, buf);
1674 if (IS_ERR(current_ev))
1675 goto unlock;
1676 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
1677 iwe.u.data.length = strlen(buf);
1678 current_ev = iwe_stream_add_point_check(info,
1679 current_ev,
1680 end_buf,
1681 &iwe, buf);
1682 if (IS_ERR(current_ev))
1683 goto unlock;
1684 sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
1685 iwe.u.data.length = strlen(buf);
1686 current_ev = iwe_stream_add_point_check(info,
1687 current_ev,
1688 end_buf,
1689 &iwe, buf);
1690 if (IS_ERR(current_ev))
1691 goto unlock;
1692 sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1693 iwe.u.data.length = strlen(buf);
1694 current_ev = iwe_stream_add_point_check(info,
1695 current_ev,
1696 end_buf,
1697 &iwe, buf);
1698 if (IS_ERR(current_ev))
1699 goto unlock;
1700 break;
1701 case WLAN_EID_SUPP_RATES:
1702 case WLAN_EID_EXT_SUPP_RATES:
1703 /* display all supported rates in readable format */
1704 p = current_ev + iwe_stream_lcp_len(info);
1705
1706 memset(&iwe, 0, sizeof(iwe));
1707 iwe.cmd = SIOCGIWRATE;
1708 /* Those two flags are ignored... */
1709 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
1710
1711 for (i = 0; i < ie[1]; i++) {
1712 iwe.u.bitrate.value =
1713 ((ie[i + 2] & 0x7f) * 500000);
1714 tmp = p;
1715 p = iwe_stream_add_value(info, current_ev, p,
1716 end_buf, &iwe,
1717 IW_EV_PARAM_LEN);
1718 if (p == tmp) {
1719 current_ev = ERR_PTR(-E2BIG);
1720 goto unlock;
1721 }
1722 }
1723 current_ev = p;
1724 break;
1725 }
1726 rem -= ie[1] + 2;
1727 ie += ie[1] + 2;
1728 }
1729
1730 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
1731 ismesh) {
1732 memset(&iwe, 0, sizeof(iwe));
1733 iwe.cmd = SIOCGIWMODE;
1734 if (ismesh)
1735 iwe.u.mode = IW_MODE_MESH;
1736 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
1737 iwe.u.mode = IW_MODE_MASTER;
1738 else
1739 iwe.u.mode = IW_MODE_ADHOC;
1740 current_ev = iwe_stream_add_event_check(info, current_ev,
1741 end_buf, &iwe,
1742 IW_EV_UINT_LEN);
1743 if (IS_ERR(current_ev))
1744 goto unlock;
1745 }
1746
1747 memset(&iwe, 0, sizeof(iwe));
1748 iwe.cmd = IWEVCUSTOM;
1749 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
1750 iwe.u.data.length = strlen(buf);
1751 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
1752 &iwe, buf);
1753 if (IS_ERR(current_ev))
1754 goto unlock;
1755 memset(&iwe, 0, sizeof(iwe));
1756 iwe.cmd = IWEVCUSTOM;
1757 sprintf(buf, " Last beacon: %ums ago",
1758 elapsed_jiffies_msecs(bss->ts));
1759 iwe.u.data.length = strlen(buf);
1760 current_ev = iwe_stream_add_point_check(info, current_ev,
1761 end_buf, &iwe, buf);
1762 if (IS_ERR(current_ev))
1763 goto unlock;
1764
1765 current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
1766
1767 unlock:
1768 rcu_read_unlock();
1769 return current_ev;
1770 }
1771
1772
1773 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
1774 struct iw_request_info *info,
1775 char *buf, size_t len)
1776 {
1777 char *current_ev = buf;
1778 char *end_buf = buf + len;
1779 struct cfg80211_internal_bss *bss;
1780 int err = 0;
1781
1782 spin_lock_bh(&rdev->bss_lock);
1783 cfg80211_bss_expire(rdev);
1784
1785 list_for_each_entry(bss, &rdev->bss_list, list) {
1786 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
1787 err = -E2BIG;
1788 break;
1789 }
1790 current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
1791 current_ev, end_buf);
1792 if (IS_ERR(current_ev)) {
1793 err = PTR_ERR(current_ev);
1794 break;
1795 }
1796 }
1797 spin_unlock_bh(&rdev->bss_lock);
1798
1799 if (err)
1800 return err;
1801 return current_ev - buf;
1802 }
1803
1804
1805 int cfg80211_wext_giwscan(struct net_device *dev,
1806 struct iw_request_info *info,
1807 struct iw_point *data, char *extra)
1808 {
1809 struct cfg80211_registered_device *rdev;
1810 int res;
1811
1812 if (!netif_running(dev))
1813 return -ENETDOWN;
1814
1815 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1816
1817 if (IS_ERR(rdev))
1818 return PTR_ERR(rdev);
1819
1820 if (rdev->scan_req || rdev->scan_msg)
1821 return -EAGAIN;
1822
1823 res = ieee80211_scan_results(rdev, info, extra, data->length);
1824 data->length = 0;
1825 if (res >= 0) {
1826 data->length = res;
1827 res = 0;
1828 }
1829
1830 return res;
1831 }
1832 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
1833 #endif
Linux with added FPC-III support