scan.c 39.5 KB
Newer Older
1 2 3 4 5 6
/*
 * cfg80211 scan result handling
 *
 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
 */
#include <linux/kernel.h>
7
#include <linux/slab.h>
8 9 10 11 12 13 14
#include <linux/module.h>
#include <linux/netdevice.h>
#include <linux/wireless.h>
#include <linux/nl80211.h>
#include <linux/etherdevice.h>
#include <net/arp.h>
#include <net/cfg80211.h>
15
#include <net/cfg80211-wext.h>
16 17 18
#include <net/iw_handler.h>
#include "core.h"
#include "nl80211.h"
19
#include "wext-compat.h"
20
#include "rdev-ops.h"
21

22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
/**
 * DOC: BSS tree/list structure
 *
 * At the top level, the BSS list is kept in both a list in each
 * registered device (@bss_list) as well as an RB-tree for faster
 * lookup. In the RB-tree, entries can be looked up using their
 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
 * for other BSSes.
 *
 * Due to the possibility of hidden SSIDs, there's a second level
 * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
 * The hidden_list connects all BSSes belonging to a single AP
 * that has a hidden SSID, and connects beacon and probe response
 * entries. For a probe response entry for a hidden SSID, the
 * hidden_beacon_bss pointer points to the BSS struct holding the
 * beacon's information.
 *
 * Reference counting is done for all these references except for
 * the hidden_list, so that a beacon BSS struct that is otherwise
 * not referenced has one reference for being on the bss_list and
 * one for each probe response entry that points to it using the
 * hidden_beacon_bss pointer. When a BSS struct that has such a
 * pointer is get/put, the refcount update is also propagated to
 * the referenced struct, this ensure that it cannot get removed
 * while somebody is using the probe response version.
 *
 * Note that the hidden_beacon_bss pointer never changes, due to
 * the reference counting. Therefore, no locking is needed for
 * it.
 *
 * Also note that the hidden_beacon_bss pointer is only relevant
 * if the driver uses something other than the IEs, e.g. private
 * data stored stored in the BSS struct, since the beacon IEs are
 * also linked into the probe response struct.
 */

58
#define IEEE80211_SCAN_RESULT_EXPIRE	(30 * HZ)
59

60
static void bss_free(struct cfg80211_internal_bss *bss)
61
{
62
	struct cfg80211_bss_ies *ies;
63 64 65 66

	if (WARN_ON(atomic_read(&bss->hold)))
		return;

67
	ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
68
	if (ies && !bss->pub.hidden_beacon_bss)
69 70 71 72
		kfree_rcu(ies, rcu_head);
	ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
	if (ies)
		kfree_rcu(ies, rcu_head);
73

74 75 76 77 78 79 80
	/*
	 * This happens when the module is removed, it doesn't
	 * really matter any more save for completeness
	 */
	if (!list_empty(&bss->hidden_list))
		list_del(&bss->hidden_list);

81 82 83
	kfree(bss);
}

84
static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
85
			       struct cfg80211_internal_bss *bss)
J
Johannes Berg 已提交
86
{
87
	lockdep_assert_held(&rdev->bss_lock);
88 89 90 91 92 93 94 95

	bss->refcount++;
	if (bss->pub.hidden_beacon_bss) {
		bss = container_of(bss->pub.hidden_beacon_bss,
				   struct cfg80211_internal_bss,
				   pub);
		bss->refcount++;
	}
J
Johannes Berg 已提交
96 97
}

98
static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
99
			       struct cfg80211_internal_bss *bss)
J
Johannes Berg 已提交
100
{
101
	lockdep_assert_held(&rdev->bss_lock);
102 103 104 105 106 107 108 109 110 111 112 113 114

	if (bss->pub.hidden_beacon_bss) {
		struct cfg80211_internal_bss *hbss;
		hbss = container_of(bss->pub.hidden_beacon_bss,
				    struct cfg80211_internal_bss,
				    pub);
		hbss->refcount--;
		if (hbss->refcount == 0)
			bss_free(hbss);
	}
	bss->refcount--;
	if (bss->refcount == 0)
		bss_free(bss);
J
Johannes Berg 已提交
115 116
}

117
static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
118 119
				  struct cfg80211_internal_bss *bss)
{
120
	lockdep_assert_held(&rdev->bss_lock);
121

122 123 124 125 126 127 128 129 130 131 132 133 134 135
	if (!list_empty(&bss->hidden_list)) {
		/*
		 * don't remove the beacon entry if it has
		 * probe responses associated with it
		 */
		if (!bss->pub.hidden_beacon_bss)
			return false;
		/*
		 * if it's a probe response entry break its
		 * link to the other entries in the group
		 */
		list_del_init(&bss->hidden_list);
	}

136
	list_del_init(&bss->list);
137 138
	rb_erase(&bss->rbn, &rdev->bss_tree);
	bss_ref_put(rdev, bss);
139
	return true;
140 141
}

142
static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
143 144 145 146 147
				  unsigned long expire_time)
{
	struct cfg80211_internal_bss *bss, *tmp;
	bool expired = false;

148
	lockdep_assert_held(&rdev->bss_lock);
149

150
	list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
151 152 153 154 155
		if (atomic_read(&bss->hold))
			continue;
		if (!time_after(expire_time, bss->ts))
			continue;

156
		if (__cfg80211_unlink_bss(rdev, bss))
157
			expired = true;
158 159 160
	}

	if (expired)
161
		rdev->bss_generation++;
162 163
}

164 165
void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
			   bool send_message)
166
{
J
Johannes Berg 已提交
167
	struct cfg80211_scan_request *request;
J
Johannes Berg 已提交
168
	struct wireless_dev *wdev;
169
	struct sk_buff *msg;
J
Johannes Berg 已提交
170
#ifdef CONFIG_CFG80211_WEXT
171 172 173
	union iwreq_data wrqu;
#endif

174
	ASSERT_RTNL();
175

176 177 178 179 180
	if (rdev->scan_msg) {
		nl80211_send_scan_result(rdev, rdev->scan_msg);
		rdev->scan_msg = NULL;
		return;
	}
J
Johannes Berg 已提交
181

182
	request = rdev->scan_req;
183 184 185
	if (!request)
		return;

J
Johannes Berg 已提交
186
	wdev = request->wdev;
187

188 189 190 191 192
	/*
	 * This must be before sending the other events!
	 * Otherwise, wpa_supplicant gets completely confused with
	 * wext events.
	 */
J
Johannes Berg 已提交
193 194
	if (wdev->netdev)
		cfg80211_sme_scan_done(wdev->netdev);
195

196 197 198 199 200 201
	if (!request->aborted &&
	    request->flags & NL80211_SCAN_FLAG_FLUSH) {
		/* flush entries from previous scans */
		spin_lock_bh(&rdev->bss_lock);
		__cfg80211_bss_expire(rdev, request->scan_start);
		spin_unlock_bh(&rdev->bss_lock);
202
	}
203

204 205
	msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);

J
Johannes Berg 已提交
206
#ifdef CONFIG_CFG80211_WEXT
J
Johannes Berg 已提交
207
	if (wdev->netdev && !request->aborted) {
208 209
		memset(&wrqu, 0, sizeof(wrqu));

J
Johannes Berg 已提交
210
		wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
211 212 213
	}
#endif

J
Johannes Berg 已提交
214 215
	if (wdev->netdev)
		dev_put(wdev->netdev);
216

217
	rdev->scan_req = NULL;
218
	kfree(request);
219 220 221 222 223

	if (!send_message)
		rdev->scan_msg = msg;
	else
		nl80211_send_scan_result(rdev, msg);
224
}
J
Johannes Berg 已提交
225

226 227 228 229 230 231 232
void __cfg80211_scan_done(struct work_struct *wk)
{
	struct cfg80211_registered_device *rdev;

	rdev = container_of(wk, struct cfg80211_registered_device,
			    scan_done_wk);

233
	rtnl_lock();
234
	___cfg80211_scan_done(rdev, true);
235
	rtnl_unlock();
236 237
}

J
Johannes Berg 已提交
238 239
void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
{
240
	trace_cfg80211_scan_done(request, aborted);
241
	WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req);
J
Johannes Berg 已提交
242 243

	request->aborted = aborted;
244
	request->notified = true;
245
	queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
J
Johannes Berg 已提交
246
}
247 248
EXPORT_SYMBOL(cfg80211_scan_done);

249 250 251
void __cfg80211_sched_scan_results(struct work_struct *wk)
{
	struct cfg80211_registered_device *rdev;
252
	struct cfg80211_sched_scan_request *request;
253 254 255 256

	rdev = container_of(wk, struct cfg80211_registered_device,
			    sched_scan_results_wk);

257
	rtnl_lock();
258

259 260
	request = rdev->sched_scan_req;

261
	/* we don't have sched_scan_req anymore if the scan is stopping */
262 263 264 265 266 267 268 269 270 271 272
	if (request) {
		if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
			/* flush entries from previous scans */
			spin_lock_bh(&rdev->bss_lock);
			__cfg80211_bss_expire(rdev, request->scan_start);
			spin_unlock_bh(&rdev->bss_lock);
			request->scan_start =
				jiffies + msecs_to_jiffies(request->interval);
		}
		nl80211_send_sched_scan_results(rdev, request->dev);
	}
273

274
	rtnl_unlock();
275 276 277 278
}

void cfg80211_sched_scan_results(struct wiphy *wiphy)
{
279
	trace_cfg80211_sched_scan_results(wiphy);
280
	/* ignore if we're not scanning */
281
	if (wiphy_to_rdev(wiphy)->sched_scan_req)
282
		queue_work(cfg80211_wq,
283
			   &wiphy_to_rdev(wiphy)->sched_scan_results_wk);
284 285 286
}
EXPORT_SYMBOL(cfg80211_sched_scan_results);

287
void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy)
288
{
289
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
290

291 292
	ASSERT_RTNL();

293 294
	trace_cfg80211_sched_scan_stopped(wiphy);

295
	__cfg80211_stop_sched_scan(rdev, true);
296 297 298 299 300 301 302
}
EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);

void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
{
	rtnl_lock();
	cfg80211_sched_scan_stopped_rtnl(wiphy);
303
	rtnl_unlock();
304 305 306 307 308 309 310 311
}
EXPORT_SYMBOL(cfg80211_sched_scan_stopped);

int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
			       bool driver_initiated)
{
	struct net_device *dev;

312
	ASSERT_RTNL();
313 314

	if (!rdev->sched_scan_req)
315
		return -ENOENT;
316 317 318

	dev = rdev->sched_scan_req->dev;

319
	if (!driver_initiated) {
320
		int err = rdev_sched_scan_stop(rdev, dev);
321 322 323
		if (err)
			return err;
	}
324 325 326 327 328 329

	nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);

	kfree(rdev->sched_scan_req);
	rdev->sched_scan_req = NULL;

330
	return 0;
331 332
}

333
void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
334 335 336 337 338
                      unsigned long age_secs)
{
	struct cfg80211_internal_bss *bss;
	unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);

339 340
	spin_lock_bh(&rdev->bss_lock);
	list_for_each_entry(bss, &rdev->bss_list, list)
341
		bss->ts -= age_jiffies;
342
	spin_unlock_bh(&rdev->bss_lock);
343 344
}

345
void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
346
{
347
	__cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
348 349
}

350
const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
351
{
352
	while (len > 2 && ies[0] != eid) {
353 354 355 356 357 358 359 360 361
		len -= ies[1] + 2;
		ies += ies[1] + 2;
	}
	if (len < 2)
		return NULL;
	if (len < 2 + ies[1])
		return NULL;
	return ies;
}
362
EXPORT_SYMBOL(cfg80211_find_ie);
363

364 365 366 367 368 369 370 371 372 373 374 375 376 377
const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
				  const u8 *ies, int len)
{
	struct ieee80211_vendor_ie *ie;
	const u8 *pos = ies, *end = ies + len;
	int ie_oui;

	while (pos < end) {
		pos = cfg80211_find_ie(WLAN_EID_VENDOR_SPECIFIC, pos,
				       end - pos);
		if (!pos)
			return NULL;

		ie = (struct ieee80211_vendor_ie *)pos;
378 379 380 381 382 383 384

		/* make sure we can access ie->len */
		BUILD_BUG_ON(offsetof(struct ieee80211_vendor_ie, len) != 1);

		if (ie->len < sizeof(*ie))
			goto cont;

385 386 387
		ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
		if (ie_oui == oui && ie->oui_type == oui_type)
			return pos;
388
cont:
389 390 391 392 393 394
		pos += 2 + ie->len;
	}
	return NULL;
}
EXPORT_SYMBOL(cfg80211_find_vendor_ie);

395
static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
396 397
		   const u8 *ssid, size_t ssid_len)
{
398
	const struct cfg80211_bss_ies *ies;
399 400
	const u8 *ssidie;

401
	if (bssid && !ether_addr_equal(a->bssid, bssid))
402 403
		return false;

404 405 406
	if (!ssid)
		return true;

407 408 409 410
	ies = rcu_access_pointer(a->ies);
	if (!ies)
		return false;
	ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
411 412 413 414 415 416 417
	if (!ssidie)
		return false;
	if (ssidie[1] != ssid_len)
		return false;
	return memcmp(ssidie + 2, ssid, ssid_len) == 0;
}

418 419 420 421 422 423 424 425 426 427 428 429
/**
 * enum bss_compare_mode - BSS compare mode
 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
 */
enum bss_compare_mode {
	BSS_CMP_REGULAR,
	BSS_CMP_HIDE_ZLEN,
	BSS_CMP_HIDE_NUL,
};

430
static int cmp_bss(struct cfg80211_bss *a,
431
		   struct cfg80211_bss *b,
432
		   enum bss_compare_mode mode)
433
{
434
	const struct cfg80211_bss_ies *a_ies, *b_ies;
435 436
	const u8 *ie1 = NULL;
	const u8 *ie2 = NULL;
437
	int i, r;
438

439 440
	if (a->channel != b->channel)
		return b->channel->center_freq - a->channel->center_freq;
441

442 443 444 445 446 447 448
	a_ies = rcu_access_pointer(a->ies);
	if (!a_ies)
		return -1;
	b_ies = rcu_access_pointer(b->ies);
	if (!b_ies)
		return 1;

449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479
	if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
		ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
				       a_ies->data, a_ies->len);
	if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
		ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
				       b_ies->data, b_ies->len);
	if (ie1 && ie2) {
		int mesh_id_cmp;

		if (ie1[1] == ie2[1])
			mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
		else
			mesh_id_cmp = ie2[1] - ie1[1];

		ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
				       a_ies->data, a_ies->len);
		ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
				       b_ies->data, b_ies->len);
		if (ie1 && ie2) {
			if (mesh_id_cmp)
				return mesh_id_cmp;
			if (ie1[1] != ie2[1])
				return ie2[1] - ie1[1];
			return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
		}
	}

	r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
	if (r)
		return r;

480 481
	ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
	ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
482

483 484 485
	if (!ie1 && !ie2)
		return 0;

J
Johannes Berg 已提交
486
	/*
487 488 489
	 * Note that with "hide_ssid", the function returns a match if
	 * the already-present BSS ("b") is a hidden SSID beacon for
	 * the new BSS ("a").
J
Johannes Berg 已提交
490
	 */
491 492 493 494 495 496 497

	/* sort missing IE before (left of) present IE */
	if (!ie1)
		return -1;
	if (!ie2)
		return 1;

498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517
	switch (mode) {
	case BSS_CMP_HIDE_ZLEN:
		/*
		 * In ZLEN mode we assume the BSS entry we're
		 * looking for has a zero-length SSID. So if
		 * the one we're looking at right now has that,
		 * return 0. Otherwise, return the difference
		 * in length, but since we're looking for the
		 * 0-length it's really equivalent to returning
		 * the length of the one we're looking at.
		 *
		 * No content comparison is needed as we assume
		 * the content length is zero.
		 */
		return ie2[1];
	case BSS_CMP_REGULAR:
	default:
		/* sort by length first, then by contents */
		if (ie1[1] != ie2[1])
			return ie2[1] - ie1[1];
518
		return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
519 520 521 522 523 524 525 526 527
	case BSS_CMP_HIDE_NUL:
		if (ie1[1] != ie2[1])
			return ie2[1] - ie1[1];
		/* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
		for (i = 0; i < ie2[1]; i++)
			if (ie2[i + 2])
				return -1;
		return 0;
	}
528 529
}

530
/* Returned bss is reference counted and must be cleaned up appropriately. */
531 532 533
struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
				      struct ieee80211_channel *channel,
				      const u8 *bssid,
534 535
				      const u8 *ssid, size_t ssid_len,
				      u16 capa_mask, u16 capa_val)
536
{
537
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
538
	struct cfg80211_internal_bss *bss, *res = NULL;
539
	unsigned long now = jiffies;
540

541 542 543
	trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, capa_mask,
			       capa_val);

544
	spin_lock_bh(&rdev->bss_lock);
545

546
	list_for_each_entry(bss, &rdev->bss_list, list) {
547 548
		if ((bss->pub.capability & capa_mask) != capa_val)
			continue;
549 550
		if (channel && bss->pub.channel != channel)
			continue;
551 552
		if (!is_valid_ether_addr(bss->pub.bssid))
			continue;
553 554 555 556
		/* Don't get expired BSS structs */
		if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
		    !atomic_read(&bss->hold))
			continue;
557 558
		if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
			res = bss;
559
			bss_ref_get(rdev, res);
560 561 562 563
			break;
		}
	}

564
	spin_unlock_bh(&rdev->bss_lock);
565 566
	if (!res)
		return NULL;
567
	trace_cfg80211_return_bss(&res->pub);
568 569 570 571
	return &res->pub;
}
EXPORT_SYMBOL(cfg80211_get_bss);

572
static void rb_insert_bss(struct cfg80211_registered_device *rdev,
573 574
			  struct cfg80211_internal_bss *bss)
{
575
	struct rb_node **p = &rdev->bss_tree.rb_node;
576 577 578 579 580 581 582 583
	struct rb_node *parent = NULL;
	struct cfg80211_internal_bss *tbss;
	int cmp;

	while (*p) {
		parent = *p;
		tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);

584
		cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
585 586 587 588 589 590 591 592 593 594 595 596 597

		if (WARN_ON(!cmp)) {
			/* will sort of leak this BSS */
			return;
		}

		if (cmp < 0)
			p = &(*p)->rb_left;
		else
			p = &(*p)->rb_right;
	}

	rb_link_node(&bss->rbn, parent, p);
598
	rb_insert_color(&bss->rbn, &rdev->bss_tree);
599 600 601
}

static struct cfg80211_internal_bss *
602
rb_find_bss(struct cfg80211_registered_device *rdev,
603
	    struct cfg80211_internal_bss *res,
604
	    enum bss_compare_mode mode)
605
{
606
	struct rb_node *n = rdev->bss_tree.rb_node;
607 608 609 610 611
	struct cfg80211_internal_bss *bss;
	int r;

	while (n) {
		bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
612
		r = cmp_bss(&res->pub, &bss->pub, mode);
613 614 615 616 617 618 619 620 621 622 623 624

		if (r == 0)
			return bss;
		else if (r < 0)
			n = n->rb_left;
		else
			n = n->rb_right;
	}

	return NULL;
}

625
static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
626
				   struct cfg80211_internal_bss *new)
627
{
628
	const struct cfg80211_bss_ies *ies;
629 630 631 632
	struct cfg80211_internal_bss *bss;
	const u8 *ie;
	int i, ssidlen;
	u8 fold = 0;
633

634
	ies = rcu_access_pointer(new->pub.beacon_ies);
635
	if (WARN_ON(!ies))
636
		return false;
637

638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654
	ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
	if (!ie) {
		/* nothing to do */
		return true;
	}

	ssidlen = ie[1];
	for (i = 0; i < ssidlen; i++)
		fold |= ie[2 + i];

	if (fold) {
		/* not a hidden SSID */
		return true;
	}

	/* This is the bad part ... */

655
	list_for_each_entry(bss, &rdev->bss_list, list) {
656 657 658 659
		if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
			continue;
		if (bss->pub.channel != new->pub.channel)
			continue;
660 661
		if (bss->pub.scan_width != new->pub.scan_width)
			continue;
662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684
		if (rcu_access_pointer(bss->pub.beacon_ies))
			continue;
		ies = rcu_access_pointer(bss->pub.ies);
		if (!ies)
			continue;
		ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
		if (!ie)
			continue;
		if (ssidlen && ie[1] != ssidlen)
			continue;
		if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
			continue;
		if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
			list_del(&bss->hidden_list);
		/* combine them */
		list_add(&bss->hidden_list, &new->hidden_list);
		bss->pub.hidden_beacon_bss = &new->pub;
		new->refcount += bss->refcount;
		rcu_assign_pointer(bss->pub.beacon_ies,
				   new->pub.beacon_ies);
	}

	return true;
685 686
}

687
/* Returned bss is reference counted and must be cleaned up appropriately. */
688
static struct cfg80211_internal_bss *
689
cfg80211_bss_update(struct cfg80211_registered_device *rdev,
690 691
		    struct cfg80211_internal_bss *tmp,
		    bool signal_valid)
692 693 694
{
	struct cfg80211_internal_bss *found = NULL;

695
	if (WARN_ON(!tmp->pub.channel))
696 697
		return NULL;

698
	tmp->ts = jiffies;
699

700
	spin_lock_bh(&rdev->bss_lock);
701

702
	if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
703
		spin_unlock_bh(&rdev->bss_lock);
704 705 706
		return NULL;
	}

707
	found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
708

709
	if (found) {
710
		/* Update IEs */
711 712 713 714
		if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
			const struct cfg80211_bss_ies *old;

			old = rcu_access_pointer(found->pub.proberesp_ies);
715

716 717
			rcu_assign_pointer(found->pub.proberesp_ies,
					   tmp->pub.proberesp_ies);
718
			/* Override possible earlier Beacon frame IEs */
719 720 721 722 723 724
			rcu_assign_pointer(found->pub.ies,
					   tmp->pub.proberesp_ies);
			if (old)
				kfree_rcu((struct cfg80211_bss_ies *)old,
					  rcu_head);
		} else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
725
			const struct cfg80211_bss_ies *old;
726 727 728 729
			struct cfg80211_internal_bss *bss;

			if (found->pub.hidden_beacon_bss &&
			    !list_empty(&found->hidden_list)) {
730 731
				const struct cfg80211_bss_ies *f;

732 733 734 735 736 737 738 739 740
				/*
				 * The found BSS struct is one of the probe
				 * response members of a group, but we're
				 * receiving a beacon (beacon_ies in the tmp
				 * bss is used). This can only mean that the
				 * AP changed its beacon from not having an
				 * SSID to showing it, which is confusing so
				 * drop this information.
				 */
741 742 743 744

				f = rcu_access_pointer(tmp->pub.beacon_ies);
				kfree_rcu((struct cfg80211_bss_ies *)f,
					  rcu_head);
745 746
				goto drop;
			}
747

748 749 750 751
			old = rcu_access_pointer(found->pub.beacon_ies);

			rcu_assign_pointer(found->pub.beacon_ies,
					   tmp->pub.beacon_ies);
752 753

			/* Override IEs if they were from a beacon before */
754
			if (old == rcu_access_pointer(found->pub.ies))
755 756
				rcu_assign_pointer(found->pub.ies,
						   tmp->pub.beacon_ies);
757

758 759 760 761 762 763 764 765 766 767 768 769
			/* Assign beacon IEs to all sub entries */
			list_for_each_entry(bss, &found->hidden_list,
					    hidden_list) {
				const struct cfg80211_bss_ies *ies;

				ies = rcu_access_pointer(bss->pub.beacon_ies);
				WARN_ON(ies != old);

				rcu_assign_pointer(bss->pub.beacon_ies,
						   tmp->pub.beacon_ies);
			}

770 771 772 773
			if (old)
				kfree_rcu((struct cfg80211_bss_ies *)old,
					  rcu_head);
		}
774 775

		found->pub.beacon_interval = tmp->pub.beacon_interval;
776 777 778 779 780 781
		/*
		 * don't update the signal if beacon was heard on
		 * adjacent channel.
		 */
		if (signal_valid)
			found->pub.signal = tmp->pub.signal;
782 783
		found->pub.capability = tmp->pub.capability;
		found->ts = tmp->ts;
784
	} else {
785
		struct cfg80211_internal_bss *new;
786
		struct cfg80211_internal_bss *hidden;
787
		struct cfg80211_bss_ies *ies;
788

789 790 791 792 793
		/*
		 * create a copy -- the "res" variable that is passed in
		 * is allocated on the stack since it's not needed in the
		 * more common case of an update
		 */
794
		new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
795 796 797 798 799 800 801 802
			      GFP_ATOMIC);
		if (!new) {
			ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
			if (ies)
				kfree_rcu(ies, rcu_head);
			ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
			if (ies)
				kfree_rcu(ies, rcu_head);
803
			goto drop;
804 805
		}
		memcpy(new, tmp, sizeof(*new));
806 807 808 809
		new->refcount = 1;
		INIT_LIST_HEAD(&new->hidden_list);

		if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
810
			hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
811
			if (!hidden)
812
				hidden = rb_find_bss(rdev, tmp,
813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828
						     BSS_CMP_HIDE_NUL);
			if (hidden) {
				new->pub.hidden_beacon_bss = &hidden->pub;
				list_add(&new->hidden_list,
					 &hidden->hidden_list);
				hidden->refcount++;
				rcu_assign_pointer(new->pub.beacon_ies,
						   hidden->pub.beacon_ies);
			}
		} else {
			/*
			 * Ok so we found a beacon, and don't have an entry. If
			 * it's a beacon with hidden SSID, we might be in for an
			 * expensive search for any probe responses that should
			 * be grouped with this beacon for updates ...
			 */
829
			if (!cfg80211_combine_bsses(rdev, new)) {
830 831 832 833 834
				kfree(new);
				goto drop;
			}
		}

835 836
		list_add_tail(&new->list, &rdev->bss_list);
		rb_insert_bss(rdev, new);
837
		found = new;
838 839
	}

840 841 842
	rdev->bss_generation++;
	bss_ref_get(rdev, found);
	spin_unlock_bh(&rdev->bss_lock);
843 844

	return found;
845
 drop:
846
	spin_unlock_bh(&rdev->bss_lock);
847
	return NULL;
848 849
}

850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881
static struct ieee80211_channel *
cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
			 struct ieee80211_channel *channel)
{
	const u8 *tmp;
	u32 freq;
	int channel_number = -1;

	tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
	if (tmp && tmp[1] == 1) {
		channel_number = tmp[2];
	} else {
		tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
		if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
			struct ieee80211_ht_operation *htop = (void *)(tmp + 2);

			channel_number = htop->primary_chan;
		}
	}

	if (channel_number < 0)
		return channel;

	freq = ieee80211_channel_to_frequency(channel_number, channel->band);
	channel = ieee80211_get_channel(wiphy, freq);
	if (!channel)
		return NULL;
	if (channel->flags & IEEE80211_CHAN_DISABLED)
		return NULL;
	return channel;
}

882
/* Returned bss is reference counted and must be cleaned up appropriately. */
883
struct cfg80211_bss*
884
cfg80211_inform_bss_width(struct wiphy *wiphy,
885
			  struct ieee80211_channel *rx_channel,
886
			  enum nl80211_bss_scan_width scan_width,
887
			  enum cfg80211_bss_frame_type ftype,
888 889 890
			  const u8 *bssid, u64 tsf, u16 capability,
			  u16 beacon_interval, const u8 *ie, size_t ielen,
			  s32 signal, gfp_t gfp)
891
{
892
	struct cfg80211_bss_ies *ies;
893
	struct ieee80211_channel *channel;
894
	struct cfg80211_internal_bss tmp = {}, *res;
895
	bool signal_valid;
896 897 898 899

	if (WARN_ON(!wiphy))
		return NULL;

S
Sujith 已提交
900
	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
901 902 903
			(signal < 0 || signal > 100)))
		return NULL;

904
	channel = cfg80211_get_bss_channel(wiphy, ie, ielen, rx_channel);
905 906 907
	if (!channel)
		return NULL;

908 909
	memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
	tmp.pub.channel = channel;
910
	tmp.pub.scan_width = scan_width;
911 912 913
	tmp.pub.signal = signal;
	tmp.pub.beacon_interval = beacon_interval;
	tmp.pub.capability = capability;
914
	/*
915
	 * If we do not know here whether the IEs are from a Beacon or Probe
916 917 918
	 * Response frame, we need to pick one of the options and only use it
	 * with the driver that does not provide the full Beacon/Probe Response
	 * frame. Use Beacon frame pointer to avoid indicating that this should
919
	 * override the IEs pointer should we have received an earlier
920
	 * indication of Probe Response data.
921
	 */
922
	ies = kzalloc(sizeof(*ies) + ielen, gfp);
923 924 925
	if (!ies)
		return NULL;
	ies->len = ielen;
J
Johannes Berg 已提交
926
	ies->tsf = tsf;
927
	ies->from_beacon = false;
928
	memcpy(ies->data, ie, ielen);
929

930 931 932 933 934 935 936 937 938 939 940
	switch (ftype) {
	case CFG80211_BSS_FTYPE_BEACON:
		ies->from_beacon = true;
		/* fall through to assign */
	case CFG80211_BSS_FTYPE_UNKNOWN:
		rcu_assign_pointer(tmp.pub.beacon_ies, ies);
		break;
	case CFG80211_BSS_FTYPE_PRESP:
		rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
		break;
	}
941
	rcu_assign_pointer(tmp.pub.ies, ies);
942

943 944 945
	signal_valid = abs(rx_channel->center_freq - channel->center_freq) <=
		wiphy->max_adj_channel_rssi_comp;
	res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
946 947 948 949 950 951
	if (!res)
		return NULL;

	if (res->pub.capability & WLAN_CAPABILITY_ESS)
		regulatory_hint_found_beacon(wiphy, channel, gfp);

952
	trace_cfg80211_return_bss(&res->pub);
953 954 955
	/* cfg80211_bss_update gives us a referenced result */
	return &res->pub;
}
956
EXPORT_SYMBOL(cfg80211_inform_bss_width);
957

958
/* Returned bss is reference counted and must be cleaned up appropriately. */
959
struct cfg80211_bss *
960
cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
961
				struct ieee80211_channel *rx_channel,
962 963 964
				enum nl80211_bss_scan_width scan_width,
				struct ieee80211_mgmt *mgmt, size_t len,
				s32 signal, gfp_t gfp)
965
{
966 967
	struct cfg80211_internal_bss tmp = {}, *res;
	struct cfg80211_bss_ies *ies;
968
	struct ieee80211_channel *channel;
969
	bool signal_valid;
970 971
	size_t ielen = len - offsetof(struct ieee80211_mgmt,
				      u.probe_resp.variable);
972

973 974 975
	BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
			offsetof(struct ieee80211_mgmt, u.beacon.variable));

976
	trace_cfg80211_inform_bss_width_frame(wiphy, rx_channel, scan_width, mgmt,
977
					      len, signal);
978

979 980 981 982 983
	if (WARN_ON(!mgmt))
		return NULL;

	if (WARN_ON(!wiphy))
		return NULL;
984

S
Sujith 已提交
985
	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
H
Hila Gonen 已提交
986
		    (signal < 0 || signal > 100)))
987 988
		return NULL;

989
	if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
990 991
		return NULL;

992
	channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
993
					   ielen, rx_channel);
994 995 996
	if (!channel)
		return NULL;

997
	ies = kzalloc(sizeof(*ies) + ielen, gfp);
998
	if (!ies)
999
		return NULL;
1000
	ies->len = ielen;
J
Johannes Berg 已提交
1001
	ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
1002
	ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
1003
	memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
1004

1005 1006 1007 1008 1009 1010 1011 1012
	if (ieee80211_is_probe_resp(mgmt->frame_control))
		rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
	else
		rcu_assign_pointer(tmp.pub.beacon_ies, ies);
	rcu_assign_pointer(tmp.pub.ies, ies);
	
	memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
	tmp.pub.channel = channel;
1013
	tmp.pub.scan_width = scan_width;
1014 1015 1016 1017
	tmp.pub.signal = signal;
	tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
	tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);

1018 1019 1020
	signal_valid = abs(rx_channel->center_freq - channel->center_freq) <=
		wiphy->max_adj_channel_rssi_comp;
	res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
1021 1022 1023
	if (!res)
		return NULL;

1024 1025 1026
	if (res->pub.capability & WLAN_CAPABILITY_ESS)
		regulatory_hint_found_beacon(wiphy, channel, gfp);

1027
	trace_cfg80211_return_bss(&res->pub);
1028 1029 1030
	/* cfg80211_bss_update gives us a referenced result */
	return &res->pub;
}
1031
EXPORT_SYMBOL(cfg80211_inform_bss_width_frame);
1032

1033
void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1034
{
1035
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1036 1037 1038 1039 1040 1041
	struct cfg80211_internal_bss *bss;

	if (!pub)
		return;

	bss = container_of(pub, struct cfg80211_internal_bss, pub);
1042

1043 1044 1045
	spin_lock_bh(&rdev->bss_lock);
	bss_ref_get(rdev, bss);
	spin_unlock_bh(&rdev->bss_lock);
1046 1047 1048
}
EXPORT_SYMBOL(cfg80211_ref_bss);

1049
void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1050
{
1051
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1052 1053 1054 1055 1056 1057
	struct cfg80211_internal_bss *bss;

	if (!pub)
		return;

	bss = container_of(pub, struct cfg80211_internal_bss, pub);
1058

1059 1060 1061
	spin_lock_bh(&rdev->bss_lock);
	bss_ref_put(rdev, bss);
	spin_unlock_bh(&rdev->bss_lock);
1062 1063 1064
}
EXPORT_SYMBOL(cfg80211_put_bss);

1065 1066
void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
{
1067
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1068 1069 1070 1071 1072 1073 1074
	struct cfg80211_internal_bss *bss;

	if (WARN_ON(!pub))
		return;

	bss = container_of(pub, struct cfg80211_internal_bss, pub);

1075
	spin_lock_bh(&rdev->bss_lock);
J
Johannes Berg 已提交
1076
	if (!list_empty(&bss->list)) {
1077 1078
		if (__cfg80211_unlink_bss(rdev, bss))
			rdev->bss_generation++;
J
Johannes Berg 已提交
1079
	}
1080
	spin_unlock_bh(&rdev->bss_lock);
1081 1082 1083
}
EXPORT_SYMBOL(cfg80211_unlink_bss);

J
Johannes Berg 已提交
1084
#ifdef CONFIG_CFG80211_WEXT
1085 1086 1087
static struct cfg80211_registered_device *
cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
{
1088
	struct cfg80211_registered_device *rdev;
1089 1090
	struct net_device *dev;

1091 1092
	ASSERT_RTNL();

1093 1094
	dev = dev_get_by_index(net, ifindex);
	if (!dev)
1095 1096
		return ERR_PTR(-ENODEV);
	if (dev->ieee80211_ptr)
1097
		rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
1098
	else
1099 1100 1101 1102 1103
		rdev = ERR_PTR(-ENODEV);
	dev_put(dev);
	return rdev;
}

1104 1105 1106 1107 1108 1109 1110
int cfg80211_wext_siwscan(struct net_device *dev,
			  struct iw_request_info *info,
			  union iwreq_data *wrqu, char *extra)
{
	struct cfg80211_registered_device *rdev;
	struct wiphy *wiphy;
	struct iw_scan_req *wreq = NULL;
1111
	struct cfg80211_scan_request *creq = NULL;
1112 1113 1114 1115 1116 1117
	int i, err, n_channels = 0;
	enum ieee80211_band band;

	if (!netif_running(dev))
		return -ENETDOWN;

1118 1119 1120
	if (wrqu->data.length == sizeof(struct iw_scan_req))
		wreq = (struct iw_scan_req *)extra;

1121
	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1122 1123 1124 1125

	if (IS_ERR(rdev))
		return PTR_ERR(rdev);

1126
	if (rdev->scan_req || rdev->scan_msg) {
1127 1128 1129 1130 1131 1132
		err = -EBUSY;
		goto out;
	}

	wiphy = &rdev->wiphy;

1133 1134 1135
	/* Determine number of channels, needed to allocate creq */
	if (wreq && wreq->num_channels)
		n_channels = wreq->num_channels;
1136 1137
	else
		n_channels = ieee80211_get_num_supported_channels(wiphy);
1138 1139 1140 1141 1142 1143 1144 1145 1146 1147

	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
		       n_channels * sizeof(void *),
		       GFP_ATOMIC);
	if (!creq) {
		err = -ENOMEM;
		goto out;
	}

	creq->wiphy = wiphy;
J
Johannes Berg 已提交
1148
	creq->wdev = dev->ieee80211_ptr;
1149 1150
	/* SSIDs come after channels */
	creq->ssids = (void *)&creq->channels[n_channels];
1151 1152
	creq->n_channels = n_channels;
	creq->n_ssids = 1;
1153
	creq->scan_start = jiffies;
1154

1155
	/* translate "Scan on frequencies" request */
1156 1157 1158
	i = 0;
	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
		int j;
J
Johannes Berg 已提交
1159

1160 1161
		if (!wiphy->bands[band])
			continue;
J
Johannes Berg 已提交
1162

1163
		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
J
Johannes Berg 已提交
1164 1165 1166 1167
			/* ignore disabled channels */
			if (wiphy->bands[band]->channels[j].flags &
						IEEE80211_CHAN_DISABLED)
				continue;
1168 1169 1170 1171 1172 1173 1174 1175 1176

			/* If we have a wireless request structure and the
			 * wireless request specifies frequencies, then search
			 * for the matching hardware channel.
			 */
			if (wreq && wreq->num_channels) {
				int k;
				int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
				for (k = 0; k < wreq->num_channels; k++) {
1177 1178 1179 1180 1181
					struct iw_freq *freq =
						&wreq->channel_list[k];
					int wext_freq =
						cfg80211_wext_freq(freq);

1182 1183 1184 1185 1186 1187 1188
					if (wext_freq == wiphy_freq)
						goto wext_freq_found;
				}
				goto wext_freq_not_found;
			}

		wext_freq_found:
1189 1190
			creq->channels[i] = &wiphy->bands[band]->channels[j];
			i++;
1191
		wext_freq_not_found: ;
1192 1193
		}
	}
1194 1195 1196 1197 1198
	/* No channels found? */
	if (!i) {
		err = -EINVAL;
		goto out;
	}
1199

1200 1201
	/* Set real number of channels specified in creq->channels[] */
	creq->n_channels = i;
1202

1203 1204
	/* translate "Scan for SSID" request */
	if (wreq) {
1205
		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
1206 1207 1208 1209
			if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
				err = -EINVAL;
				goto out;
			}
1210 1211 1212 1213 1214 1215 1216
			memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
			creq->ssids[0].ssid_len = wreq->essid_len;
		}
		if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
			creq->n_ssids = 0;
	}

1217
	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
1218 1219
		if (wiphy->bands[i])
			creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
1220

1221
	rdev->scan_req = creq;
1222
	err = rdev_scan(rdev, creq);
1223 1224
	if (err) {
		rdev->scan_req = NULL;
1225
		/* creq will be freed below */
1226
	} else {
J
Johannes Berg 已提交
1227
		nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
1228 1229
		/* creq now owned by driver */
		creq = NULL;
1230 1231
		dev_hold(dev);
	}
1232
 out:
1233
	kfree(creq);
1234 1235
	return err;
}
1236
EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
1237 1238

static void ieee80211_scan_add_ies(struct iw_request_info *info,
1239
				   const struct cfg80211_bss_ies *ies,
1240 1241
				   char **current_ev, char *end_buf)
{
1242
	const u8 *pos, *end, *next;
1243 1244
	struct iw_event iwe;

1245
	if (!ies)
1246 1247 1248 1249 1250 1251
		return;

	/*
	 * If needed, fragment the IEs buffer (at IE boundaries) into short
	 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
	 */
1252 1253
	pos = ies->data;
	end = pos + ies->len;
1254 1255 1256 1257 1258 1259 1260 1261 1262 1263

	while (end - pos > IW_GENERIC_IE_MAX) {
		next = pos + 2 + pos[1];
		while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
			next = next + 2 + next[1];

		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVGENIE;
		iwe.u.data.length = next - pos;
		*current_ev = iwe_stream_add_point(info, *current_ev,
1264 1265
						   end_buf, &iwe,
						   (void *)pos);
1266 1267 1268 1269 1270 1271 1272 1273 1274

		pos = next;
	}

	if (end > pos) {
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVGENIE;
		iwe.u.data.length = end - pos;
		*current_ev = iwe_stream_add_point(info, *current_ev,
1275 1276
						   end_buf, &iwe,
						   (void *)pos);
1277 1278 1279 1280
	}
}

static char *
J
Johannes Berg 已提交
1281 1282 1283
ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
	      struct cfg80211_internal_bss *bss, char *current_ev,
	      char *end_buf)
1284
{
1285
	const struct cfg80211_bss_ies *ies;
1286
	struct iw_event iwe;
1287
	const u8 *ie;
1288
	u8 *buf, *cfg, *p;
1289
	int rem, i, sig;
1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312
	bool ismesh = false;

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWAP;
	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
	memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
					  IW_EV_ADDR_LEN);

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWFREQ;
	iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
	iwe.u.freq.e = 0;
	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
					  IW_EV_FREQ_LEN);

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWFREQ;
	iwe.u.freq.m = bss->pub.channel->center_freq;
	iwe.u.freq.e = 6;
	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
					  IW_EV_FREQ_LEN);

J
Johannes Berg 已提交
1313
	if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
1314 1315 1316 1317
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVQUAL;
		iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
				     IW_QUAL_NOISE_INVALID |
1318
				     IW_QUAL_QUAL_UPDATED;
J
Johannes Berg 已提交
1319
		switch (wiphy->signal_type) {
1320
		case CFG80211_SIGNAL_TYPE_MBM:
1321 1322
			sig = bss->pub.signal / 100;
			iwe.u.qual.level = sig;
1323
			iwe.u.qual.updated |= IW_QUAL_DBM;
1324 1325 1326 1327 1328 1329
			if (sig < -110)		/* rather bad */
				sig = -110;
			else if (sig > -40)	/* perfect */
				sig = -40;
			/* will give a range of 0 .. 70 */
			iwe.u.qual.qual = sig + 110;
1330 1331 1332
			break;
		case CFG80211_SIGNAL_TYPE_UNSPEC:
			iwe.u.qual.level = bss->pub.signal;
1333 1334
			/* will give range 0 .. 100 */
			iwe.u.qual.qual = bss->pub.signal;
1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353
			break;
		default:
			/* not reached */
			break;
		}
		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
						  &iwe, IW_EV_QUAL_LEN);
	}

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWENCODE;
	if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
	else
		iwe.u.data.flags = IW_ENCODE_DISABLED;
	iwe.u.data.length = 0;
	current_ev = iwe_stream_add_point(info, current_ev, end_buf,
					  &iwe, "");

1354 1355
	rcu_read_lock();
	ies = rcu_dereference(bss->pub.ies);
1356 1357
	rem = ies->len;
	ie = ies->data;
1358

1359
	while (rem >= 2) {
1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370
		/* invalid data */
		if (ie[1] > rem - 2)
			break;

		switch (ie[0]) {
		case WLAN_EID_SSID:
			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = SIOCGIWESSID;
			iwe.u.data.length = ie[1];
			iwe.u.data.flags = 1;
			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1371
							  &iwe, (u8 *)ie + 2);
1372 1373 1374 1375 1376 1377 1378
			break;
		case WLAN_EID_MESH_ID:
			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = SIOCGIWESSID;
			iwe.u.data.length = ie[1];
			iwe.u.data.flags = 1;
			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1379
							  &iwe, (u8 *)ie + 2);
1380 1381 1382
			break;
		case WLAN_EID_MESH_CONFIG:
			ismesh = true;
1383
			if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1384 1385 1386 1387
				break;
			buf = kmalloc(50, GFP_ATOMIC);
			if (!buf)
				break;
1388
			cfg = (u8 *)ie + 2;
1389 1390
			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = IWEVCUSTOM;
1391 1392
			sprintf(buf, "Mesh Network Path Selection Protocol ID: "
				"0x%02X", cfg[0]);
1393 1394 1395 1396
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1397 1398
			sprintf(buf, "Path Selection Metric ID: 0x%02X",
				cfg[1]);
1399 1400 1401 1402
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1403 1404
			sprintf(buf, "Congestion Control Mode ID: 0x%02X",
				cfg[2]);
1405 1406 1407 1408
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1409
			sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1410 1411 1412 1413
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424
			sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
			sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
			sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
			kfree(buf);
			break;
		case WLAN_EID_SUPP_RATES:
		case WLAN_EID_EXT_SUPP_RATES:
			/* display all supported rates in readable format */
			p = current_ev + iwe_stream_lcp_len(info);

			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = SIOCGIWRATE;
			/* Those two flags are ignored... */
			iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;

			for (i = 0; i < ie[1]; i++) {
				iwe.u.bitrate.value =
					((ie[i + 2] & 0x7f) * 500000);
				p = iwe_stream_add_value(info, current_ev, p,
						end_buf, &iwe, IW_EV_PARAM_LEN);
			}
			current_ev = p;
			break;
		}
		rem -= ie[1] + 2;
		ie += ie[1] + 2;
	}

1454 1455
	if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
	    ismesh) {
1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = SIOCGIWMODE;
		if (ismesh)
			iwe.u.mode = IW_MODE_MESH;
		else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
			iwe.u.mode = IW_MODE_MASTER;
		else
			iwe.u.mode = IW_MODE_ADHOC;
		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
						  &iwe, IW_EV_UINT_LEN);
	}

1468
	buf = kmalloc(31, GFP_ATOMIC);
1469 1470 1471
	if (buf) {
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVCUSTOM;
J
Johannes Berg 已提交
1472
		sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
1473 1474 1475 1476 1477
		iwe.u.data.length = strlen(buf);
		current_ev = iwe_stream_add_point(info, current_ev, end_buf,
						  &iwe, buf);
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVCUSTOM;
1478 1479
		sprintf(buf, " Last beacon: %ums ago",
			elapsed_jiffies_msecs(bss->ts));
1480 1481 1482 1483 1484 1485
		iwe.u.data.length = strlen(buf);
		current_ev = iwe_stream_add_point(info, current_ev,
						  end_buf, &iwe, buf);
		kfree(buf);
	}

1486 1487
	ieee80211_scan_add_ies(info, ies, &current_ev, end_buf);
	rcu_read_unlock();
1488 1489 1490 1491 1492

	return current_ev;
}


1493
static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
1494 1495 1496 1497 1498 1499 1500
				  struct iw_request_info *info,
				  char *buf, size_t len)
{
	char *current_ev = buf;
	char *end_buf = buf + len;
	struct cfg80211_internal_bss *bss;

1501 1502
	spin_lock_bh(&rdev->bss_lock);
	cfg80211_bss_expire(rdev);
1503

1504
	list_for_each_entry(bss, &rdev->bss_list, list) {
1505
		if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
1506
			spin_unlock_bh(&rdev->bss_lock);
1507 1508
			return -E2BIG;
		}
1509
		current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
J
Johannes Berg 已提交
1510
					   current_ev, end_buf);
1511
	}
1512
	spin_unlock_bh(&rdev->bss_lock);
1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526
	return current_ev - buf;
}


int cfg80211_wext_giwscan(struct net_device *dev,
			  struct iw_request_info *info,
			  struct iw_point *data, char *extra)
{
	struct cfg80211_registered_device *rdev;
	int res;

	if (!netif_running(dev))
		return -ENETDOWN;

1527
	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1528 1529 1530 1531

	if (IS_ERR(rdev))
		return PTR_ERR(rdev);

1532
	if (rdev->scan_req || rdev->scan_msg)
1533
		return -EAGAIN;
1534 1535 1536 1537 1538 1539 1540 1541 1542 1543

	res = ieee80211_scan_results(rdev, info, extra, data->length);
	data->length = 0;
	if (res >= 0) {
		data->length = res;
		res = 0;
	}

	return res;
}
1544
EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
1545
#endif