scan.c 32.9 KB
Newer Older
1 2 3 4 5 6
/*
 * cfg80211 scan result handling
 *
 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
 */
#include <linux/kernel.h>
7
#include <linux/slab.h>
8 9 10 11 12 13 14
#include <linux/module.h>
#include <linux/netdevice.h>
#include <linux/wireless.h>
#include <linux/nl80211.h>
#include <linux/etherdevice.h>
#include <net/arp.h>
#include <net/cfg80211.h>
15
#include <net/cfg80211-wext.h>
16 17 18
#include <net/iw_handler.h>
#include "core.h"
#include "nl80211.h"
19
#include "wext-compat.h"
20
#include "rdev-ops.h"
21

22
#define IEEE80211_SCAN_RESULT_EXPIRE	(30 * HZ)
23

24 25
static void bss_release(struct kref *ref)
{
26
	struct cfg80211_bss_ies *ies;
27 28 29
	struct cfg80211_internal_bss *bss;

	bss = container_of(ref, struct cfg80211_internal_bss, ref);
30 31 32 33

	if (WARN_ON(atomic_read(&bss->hold)))
		return;

34 35 36 37 38 39
	ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
	if (ies)
		kfree_rcu(ies, rcu_head);
	ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
	if (ies)
		kfree_rcu(ies, rcu_head);
40 41 42 43 44 45 46 47 48 49 50 51 52

	kfree(bss);
}

/* must hold dev->bss_lock! */
static void __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
				  struct cfg80211_internal_bss *bss)
{
	list_del_init(&bss->list);
	rb_erase(&bss->rbn, &dev->bss_tree);
	kref_put(&bss->ref, bss_release);
}

53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73
/* must hold dev->bss_lock! */
static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
				  unsigned long expire_time)
{
	struct cfg80211_internal_bss *bss, *tmp;
	bool expired = false;

	list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
		if (atomic_read(&bss->hold))
			continue;
		if (!time_after(expire_time, bss->ts))
			continue;

		__cfg80211_unlink_bss(dev, bss);
		expired = true;
	}

	if (expired)
		dev->bss_generation++;
}

74
void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
75
{
J
Johannes Berg 已提交
76
	struct cfg80211_scan_request *request;
J
Johannes Berg 已提交
77
	struct wireless_dev *wdev;
J
Johannes Berg 已提交
78
#ifdef CONFIG_CFG80211_WEXT
79 80 81
	union iwreq_data wrqu;
#endif

82 83
	ASSERT_RDEV_LOCK(rdev);

J
Johannes Berg 已提交
84 85
	request = rdev->scan_req;

86 87 88
	if (!request)
		return;

J
Johannes Berg 已提交
89
	wdev = request->wdev;
90

91 92 93 94 95
	/*
	 * This must be before sending the other events!
	 * Otherwise, wpa_supplicant gets completely confused with
	 * wext events.
	 */
J
Johannes Berg 已提交
96 97
	if (wdev->netdev)
		cfg80211_sme_scan_done(wdev->netdev);
98

99
	if (request->aborted) {
J
Johannes Berg 已提交
100
		nl80211_send_scan_aborted(rdev, wdev);
101 102 103 104 105 106 107
	} else {
		if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
			/* flush entries from previous scans */
			spin_lock_bh(&rdev->bss_lock);
			__cfg80211_bss_expire(rdev, request->scan_start);
			spin_unlock_bh(&rdev->bss_lock);
		}
J
Johannes Berg 已提交
108
		nl80211_send_scan_done(rdev, wdev);
109
	}
110

J
Johannes Berg 已提交
111
#ifdef CONFIG_CFG80211_WEXT
J
Johannes Berg 已提交
112
	if (wdev->netdev && !request->aborted) {
113 114
		memset(&wrqu, 0, sizeof(wrqu));

J
Johannes Berg 已提交
115
		wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
116 117 118
	}
#endif

J
Johannes Berg 已提交
119 120
	if (wdev->netdev)
		dev_put(wdev->netdev);
121

122
	rdev->scan_req = NULL;
123 124 125 126 127 128 129 130 131 132 133

	/*
	 * OK. If this is invoked with "leak" then we can't
	 * free this ... but we've cleaned it up anyway. The
	 * driver failed to call the scan_done callback, so
	 * all bets are off, it might still be trying to use
	 * the scan request or not ... if it accesses the dev
	 * in there (it shouldn't anyway) then it may crash.
	 */
	if (!leak)
		kfree(request);
134
}
J
Johannes Berg 已提交
135

136 137 138 139 140 141 142 143
void __cfg80211_scan_done(struct work_struct *wk)
{
	struct cfg80211_registered_device *rdev;

	rdev = container_of(wk, struct cfg80211_registered_device,
			    scan_done_wk);

	cfg80211_lock_rdev(rdev);
144
	___cfg80211_scan_done(rdev, false);
145 146 147
	cfg80211_unlock_rdev(rdev);
}

J
Johannes Berg 已提交
148 149
void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
{
150
	trace_cfg80211_scan_done(request, aborted);
J
Johannes Berg 已提交
151 152 153
	WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);

	request->aborted = aborted;
154
	queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
J
Johannes Berg 已提交
155
}
156 157
EXPORT_SYMBOL(cfg80211_scan_done);

158 159 160
void __cfg80211_sched_scan_results(struct work_struct *wk)
{
	struct cfg80211_registered_device *rdev;
161
	struct cfg80211_sched_scan_request *request;
162 163 164 165

	rdev = container_of(wk, struct cfg80211_registered_device,
			    sched_scan_results_wk);

166 167
	request = rdev->sched_scan_req;

168
	mutex_lock(&rdev->sched_scan_mtx);
169 170

	/* we don't have sched_scan_req anymore if the scan is stopping */
171 172 173 174 175 176 177 178 179 180 181
	if (request) {
		if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
			/* flush entries from previous scans */
			spin_lock_bh(&rdev->bss_lock);
			__cfg80211_bss_expire(rdev, request->scan_start);
			spin_unlock_bh(&rdev->bss_lock);
			request->scan_start =
				jiffies + msecs_to_jiffies(request->interval);
		}
		nl80211_send_sched_scan_results(rdev, request->dev);
	}
182

183
	mutex_unlock(&rdev->sched_scan_mtx);
184 185 186 187
}

void cfg80211_sched_scan_results(struct wiphy *wiphy)
{
188
	trace_cfg80211_sched_scan_results(wiphy);
189 190 191 192 193 194 195
	/* ignore if we're not scanning */
	if (wiphy_to_dev(wiphy)->sched_scan_req)
		queue_work(cfg80211_wq,
			   &wiphy_to_dev(wiphy)->sched_scan_results_wk);
}
EXPORT_SYMBOL(cfg80211_sched_scan_results);

196
void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
197
{
198
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
199

200 201
	trace_cfg80211_sched_scan_stopped(wiphy);

202
	mutex_lock(&rdev->sched_scan_mtx);
203
	__cfg80211_stop_sched_scan(rdev, true);
204
	mutex_unlock(&rdev->sched_scan_mtx);
205 206 207 208 209 210 211 212
}
EXPORT_SYMBOL(cfg80211_sched_scan_stopped);

int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
			       bool driver_initiated)
{
	struct net_device *dev;

213
	lockdep_assert_held(&rdev->sched_scan_mtx);
214 215

	if (!rdev->sched_scan_req)
216
		return -ENOENT;
217 218 219

	dev = rdev->sched_scan_req->dev;

220
	if (!driver_initiated) {
221
		int err = rdev_sched_scan_stop(rdev, dev);
222 223 224
		if (err)
			return err;
	}
225 226 227 228 229 230

	nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);

	kfree(rdev->sched_scan_req);
	rdev->sched_scan_req = NULL;

231
	return 0;
232 233
}

234 235 236 237 238 239 240
/* must hold dev->bss_lock! */
void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                      unsigned long age_secs)
{
	struct cfg80211_internal_bss *bss;
	unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);

241
	list_for_each_entry(bss, &dev->bss_list, list)
242 243 244
		bss->ts -= age_jiffies;
}

245 246
void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
{
247
	__cfg80211_bss_expire(dev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
248 249
}

250
const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
251
{
252
	while (len > 2 && ies[0] != eid) {
253 254 255 256 257 258 259 260 261
		len -= ies[1] + 2;
		ies += ies[1] + 2;
	}
	if (len < 2)
		return NULL;
	if (len < 2 + ies[1])
		return NULL;
	return ies;
}
262
EXPORT_SYMBOL(cfg80211_find_ie);
263

264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
				  const u8 *ies, int len)
{
	struct ieee80211_vendor_ie *ie;
	const u8 *pos = ies, *end = ies + len;
	int ie_oui;

	while (pos < end) {
		pos = cfg80211_find_ie(WLAN_EID_VENDOR_SPECIFIC, pos,
				       end - pos);
		if (!pos)
			return NULL;

		if (end - pos < sizeof(*ie))
			return NULL;

		ie = (struct ieee80211_vendor_ie *)pos;
		ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
		if (ie_oui == oui && ie->oui_type == oui_type)
			return pos;

		pos += 2 + ie->len;
	}
	return NULL;
}
EXPORT_SYMBOL(cfg80211_find_vendor_ie);

291
static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
292 293
		   const u8 *ssid, size_t ssid_len)
{
294
	const struct cfg80211_bss_ies *ies;
295 296
	const u8 *ssidie;

297
	if (bssid && !ether_addr_equal(a->bssid, bssid))
298 299
		return false;

300 301 302
	if (!ssid)
		return true;

303 304 305 306
	ies = rcu_access_pointer(a->ies);
	if (!ies)
		return false;
	ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
307 308 309 310 311 312 313
	if (!ssidie)
		return false;
	if (ssidie[1] != ssid_len)
		return false;
	return memcmp(ssidie + 2, ssid, ssid_len) == 0;
}

314 315 316 317 318 319 320 321 322 323 324 325
/**
 * enum bss_compare_mode - BSS compare mode
 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
 */
enum bss_compare_mode {
	BSS_CMP_REGULAR,
	BSS_CMP_HIDE_ZLEN,
	BSS_CMP_HIDE_NUL,
};

326
static int cmp_bss(struct cfg80211_bss *a,
327
		   struct cfg80211_bss *b,
328
		   enum bss_compare_mode mode)
329
{
330
	const struct cfg80211_bss_ies *a_ies, *b_ies;
331 332
	const u8 *ie1 = NULL;
	const u8 *ie2 = NULL;
333
	int i, r;
334

335 336
	if (a->channel != b->channel)
		return b->channel->center_freq - a->channel->center_freq;
337

338 339 340 341 342 343 344
	a_ies = rcu_access_pointer(a->ies);
	if (!a_ies)
		return -1;
	b_ies = rcu_access_pointer(b->ies);
	if (!b_ies)
		return 1;

345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379
	if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
		ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
				       a_ies->data, a_ies->len);
	if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
		ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
				       b_ies->data, b_ies->len);
	if (ie1 && ie2) {
		int mesh_id_cmp;

		if (ie1[1] == ie2[1])
			mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
		else
			mesh_id_cmp = ie2[1] - ie1[1];

		ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
				       a_ies->data, a_ies->len);
		ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
				       b_ies->data, b_ies->len);
		if (ie1 && ie2) {
			if (mesh_id_cmp)
				return mesh_id_cmp;
			if (ie1[1] != ie2[1])
				return ie2[1] - ie1[1];
			return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
		}
	}

	/*
	 * we can't use compare_ether_addr here since we need a < > operator.
	 * The binary return value of compare_ether_addr isn't enough
	 */
	r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
	if (r)
		return r;

380 381
	ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
	ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
382

383 384 385
	if (!ie1 && !ie2)
		return 0;

J
Johannes Berg 已提交
386
	/*
387 388 389
	 * Note that with "hide_ssid", the function returns a match if
	 * the already-present BSS ("b") is a hidden SSID beacon for
	 * the new BSS ("a").
J
Johannes Berg 已提交
390
	 */
391 392 393 394 395 396 397

	/* sort missing IE before (left of) present IE */
	if (!ie1)
		return -1;
	if (!ie2)
		return 1;

398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417
	switch (mode) {
	case BSS_CMP_HIDE_ZLEN:
		/*
		 * In ZLEN mode we assume the BSS entry we're
		 * looking for has a zero-length SSID. So if
		 * the one we're looking at right now has that,
		 * return 0. Otherwise, return the difference
		 * in length, but since we're looking for the
		 * 0-length it's really equivalent to returning
		 * the length of the one we're looking at.
		 *
		 * No content comparison is needed as we assume
		 * the content length is zero.
		 */
		return ie2[1];
	case BSS_CMP_REGULAR:
	default:
		/* sort by length first, then by contents */
		if (ie1[1] != ie2[1])
			return ie2[1] - ie1[1];
418
		return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
419 420 421 422 423 424 425 426 427
	case BSS_CMP_HIDE_NUL:
		if (ie1[1] != ie2[1])
			return ie2[1] - ie1[1];
		/* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
		for (i = 0; i < ie2[1]; i++)
			if (ie2[i + 2])
				return -1;
		return 0;
	}
428 429
}

430 431 432
struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
				      struct ieee80211_channel *channel,
				      const u8 *bssid,
433 434
				      const u8 *ssid, size_t ssid_len,
				      u16 capa_mask, u16 capa_val)
435 436 437
{
	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
	struct cfg80211_internal_bss *bss, *res = NULL;
438
	unsigned long now = jiffies;
439

440 441 442
	trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, capa_mask,
			       capa_val);

443 444 445
	spin_lock_bh(&dev->bss_lock);

	list_for_each_entry(bss, &dev->bss_list, list) {
446 447
		if ((bss->pub.capability & capa_mask) != capa_val)
			continue;
448 449
		if (channel && bss->pub.channel != channel)
			continue;
450 451 452 453
		/* Don't get expired BSS structs */
		if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
		    !atomic_read(&bss->hold))
			continue;
454 455 456 457 458 459 460 461 462 463
		if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
			res = bss;
			kref_get(&res->ref);
			break;
		}
	}

	spin_unlock_bh(&dev->bss_lock);
	if (!res)
		return NULL;
464
	trace_cfg80211_return_bss(&res->pub);
465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480
	return &res->pub;
}
EXPORT_SYMBOL(cfg80211_get_bss);

static void rb_insert_bss(struct cfg80211_registered_device *dev,
			  struct cfg80211_internal_bss *bss)
{
	struct rb_node **p = &dev->bss_tree.rb_node;
	struct rb_node *parent = NULL;
	struct cfg80211_internal_bss *tbss;
	int cmp;

	while (*p) {
		parent = *p;
		tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);

481
		cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499

		if (WARN_ON(!cmp)) {
			/* will sort of leak this BSS */
			return;
		}

		if (cmp < 0)
			p = &(*p)->rb_left;
		else
			p = &(*p)->rb_right;
	}

	rb_link_node(&bss->rbn, parent, p);
	rb_insert_color(&bss->rbn, &dev->bss_tree);
}

static struct cfg80211_internal_bss *
rb_find_bss(struct cfg80211_registered_device *dev,
500
	    struct cfg80211_internal_bss *res,
501
	    enum bss_compare_mode mode)
502 503 504 505 506 507 508
{
	struct rb_node *n = dev->bss_tree.rb_node;
	struct cfg80211_internal_bss *bss;
	int r;

	while (n) {
		bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
509
		r = cmp_bss(&res->pub, &bss->pub, mode);
510 511 512 513 514 515 516 517 518 519 520 521 522 523

		if (r == 0)
			return bss;
		else if (r < 0)
			n = n->rb_left;
		else
			n = n->rb_right;
	}

	return NULL;
}

static void
copy_hidden_ies(struct cfg80211_internal_bss *res,
524
		struct cfg80211_internal_bss *hidden)
525
{
526 527 528
	const struct cfg80211_bss_ies *ies;

	if (rcu_access_pointer(res->pub.beacon_ies))
529 530
		return;

531 532
	ies = rcu_access_pointer(hidden->pub.beacon_ies);
	if (WARN_ON(!ies))
533 534
		return;

535 536 537 538
	ies = kmemdup(ies, sizeof(*ies) + ies->len, GFP_ATOMIC);
	if (unlikely(!ies))
		return;
	rcu_assign_pointer(res->pub.beacon_ies, ies);
539 540
}

541 542
static struct cfg80211_internal_bss *
cfg80211_bss_update(struct cfg80211_registered_device *dev,
543
		    struct cfg80211_internal_bss *tmp)
544 545 546
{
	struct cfg80211_internal_bss *found = NULL;

547
	if (WARN_ON(!tmp->pub.channel))
548 549
		return NULL;

550
	tmp->ts = jiffies;
551 552 553

	spin_lock_bh(&dev->bss_lock);

554 555 556 557 558
	if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
		spin_unlock_bh(&dev->bss_lock);
		return NULL;
	}

559
	found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
560

561
	if (found) {
562 563 564 565 566
		found->pub.beacon_interval = tmp->pub.beacon_interval;
		found->pub.tsf = tmp->pub.tsf;
		found->pub.signal = tmp->pub.signal;
		found->pub.capability = tmp->pub.capability;
		found->ts = tmp->ts;
567

568
		/* Update IEs */
569 570 571 572
		if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
			const struct cfg80211_bss_ies *old;

			old = rcu_access_pointer(found->pub.proberesp_ies);
573

574 575
			rcu_assign_pointer(found->pub.proberesp_ies,
					   tmp->pub.proberesp_ies);
576
			/* Override possible earlier Beacon frame IEs */
577 578 579 580 581 582 583
			rcu_assign_pointer(found->pub.ies,
					   tmp->pub.proberesp_ies);
			if (old)
				kfree_rcu((struct cfg80211_bss_ies *)old,
					  rcu_head);
		} else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
			const struct cfg80211_bss_ies *old, *ies;
584

585 586 587 588 589
			old = rcu_access_pointer(found->pub.beacon_ies);
			ies = rcu_access_pointer(found->pub.ies);

			rcu_assign_pointer(found->pub.beacon_ies,
					   tmp->pub.beacon_ies);
590 591

			/* Override IEs if they were from a beacon before */
592 593 594
			if (old == ies)
				rcu_assign_pointer(found->pub.ies,
						   tmp->pub.beacon_ies);
595

596 597 598 599
			if (old)
				kfree_rcu((struct cfg80211_bss_ies *)old,
					  rcu_head);
		}
600
	} else {
601
		struct cfg80211_internal_bss *new;
602
		struct cfg80211_internal_bss *hidden;
603
		struct cfg80211_bss_ies *ies;
604 605 606 607 608 609 610 611 612 613

		/* First check if the beacon is a probe response from
		 * a hidden bss. If so, copy beacon ies (with nullified
		 * ssid) into the probe response bss entry (with real ssid).
		 * It is required basically for PSM implementation
		 * (probe responses do not contain tim ie) */

		/* TODO: The code is not trying to update existing probe
		 * response bss entries when beacon ies are
		 * getting changed. */
614 615
		hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_ZLEN);
		if (hidden) {
616
			copy_hidden_ies(tmp, hidden);
617 618 619 620 621
		} else {
			hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_NUL);
			if (hidden)
				copy_hidden_ies(tmp, hidden);
		}
622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644

		/*
		 * create a copy -- the "res" variable that is passed in
		 * is allocated on the stack since it's not needed in the
		 * more common case of an update
		 */
		new = kzalloc(sizeof(*new) + dev->wiphy.bss_priv_size,
			      GFP_ATOMIC);
		if (!new) {
			ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
			if (ies)
				kfree_rcu(ies, rcu_head);
			ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
			if (ies)
				kfree_rcu(ies, rcu_head);
			spin_unlock_bh(&dev->bss_lock);
			return NULL;
		}
		memcpy(new, tmp, sizeof(*new));
		kref_init(&new->ref);
		list_add_tail(&new->list, &dev->bss_list);
		rb_insert_bss(dev, new);
		found = new;
645 646 647 648 649 650 651 652 653
	}

	dev->bss_generation++;
	spin_unlock_bh(&dev->bss_lock);

	kref_get(&found->ref);
	return found;
}

654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685
static struct ieee80211_channel *
cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
			 struct ieee80211_channel *channel)
{
	const u8 *tmp;
	u32 freq;
	int channel_number = -1;

	tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
	if (tmp && tmp[1] == 1) {
		channel_number = tmp[2];
	} else {
		tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
		if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
			struct ieee80211_ht_operation *htop = (void *)(tmp + 2);

			channel_number = htop->primary_chan;
		}
	}

	if (channel_number < 0)
		return channel;

	freq = ieee80211_channel_to_frequency(channel_number, channel->band);
	channel = ieee80211_get_channel(wiphy, freq);
	if (!channel)
		return NULL;
	if (channel->flags & IEEE80211_CHAN_DISABLED)
		return NULL;
	return channel;
}

686 687 688
struct cfg80211_bss*
cfg80211_inform_bss(struct wiphy *wiphy,
		    struct ieee80211_channel *channel,
689 690
		    const u8 *bssid, u64 tsf, u16 capability,
		    u16 beacon_interval, const u8 *ie, size_t ielen,
691 692
		    s32 signal, gfp_t gfp)
{
693 694
	struct cfg80211_bss_ies *ies;
	struct cfg80211_internal_bss tmp = {}, *res;
695 696 697 698

	if (WARN_ON(!wiphy))
		return NULL;

S
Sujith 已提交
699
	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
700 701 702
			(signal < 0 || signal > 100)))
		return NULL;

703 704 705 706
	channel = cfg80211_get_bss_channel(wiphy, ie, ielen, channel);
	if (!channel)
		return NULL;

707 708 709 710 711 712
	memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
	tmp.pub.channel = channel;
	tmp.pub.signal = signal;
	tmp.pub.tsf = tsf;
	tmp.pub.beacon_interval = beacon_interval;
	tmp.pub.capability = capability;
713 714 715 716 717
	/*
	 * Since we do not know here whether the IEs are from a Beacon or Probe
	 * Response frame, we need to pick one of the options and only use it
	 * with the driver that does not provide the full Beacon/Probe Response
	 * frame. Use Beacon frame pointer to avoid indicating that this should
718 719
	 * override the iies pointer should we have received an earlier
	 * indication of Probe Response data.
720 721 722 723
	 *
	 * The initial buffer for the IEs is allocated with the BSS entry and
	 * is located after the private area.
	 */
724 725 726 727 728
	ies = kmalloc(sizeof(*ies) + ielen, gfp);
	if (!ies)
		return NULL;
	ies->len = ielen;
	memcpy(ies->data, ie, ielen);
729

730 731
	rcu_assign_pointer(tmp.pub.beacon_ies, ies);
	rcu_assign_pointer(tmp.pub.ies, ies);
732

733
	res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
734 735 736 737 738 739
	if (!res)
		return NULL;

	if (res->pub.capability & WLAN_CAPABILITY_ESS)
		regulatory_hint_found_beacon(wiphy, channel, gfp);

740
	trace_cfg80211_return_bss(&res->pub);
741 742 743 744 745
	/* cfg80211_bss_update gives us a referenced result */
	return &res->pub;
}
EXPORT_SYMBOL(cfg80211_inform_bss);

746 747 748 749
struct cfg80211_bss *
cfg80211_inform_bss_frame(struct wiphy *wiphy,
			  struct ieee80211_channel *channel,
			  struct ieee80211_mgmt *mgmt, size_t len,
J
Johannes Berg 已提交
750
			  s32 signal, gfp_t gfp)
751
{
752 753
	struct cfg80211_internal_bss tmp = {}, *res;
	struct cfg80211_bss_ies *ies;
754 755
	size_t ielen = len - offsetof(struct ieee80211_mgmt,
				      u.probe_resp.variable);
756

757 758 759
	BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
			offsetof(struct ieee80211_mgmt, u.beacon.variable));

760 761
	trace_cfg80211_inform_bss_frame(wiphy, channel, mgmt, len, signal);

762 763 764 765 766
	if (WARN_ON(!mgmt))
		return NULL;

	if (WARN_ON(!wiphy))
		return NULL;
767

S
Sujith 已提交
768
	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
H
Hila Gonen 已提交
769
		    (signal < 0 || signal > 100)))
770 771
		return NULL;

772
	if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
773 774
		return NULL;

775 776 777 778 779
	channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
					   ielen, channel);
	if (!channel)
		return NULL;

780 781
	ies = kmalloc(sizeof(*ies) + ielen, gfp);
	if (!ies)
782
		return NULL;
783 784
	ies->len = ielen;
	memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
785

786 787 788 789 790 791 792 793 794 795 796 797 798 799
	if (ieee80211_is_probe_resp(mgmt->frame_control))
		rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
	else
		rcu_assign_pointer(tmp.pub.beacon_ies, ies);
	rcu_assign_pointer(tmp.pub.ies, ies);
	
	memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
	tmp.pub.channel = channel;
	tmp.pub.signal = signal;
	tmp.pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
	tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
	tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);

	res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
800 801 802
	if (!res)
		return NULL;

803 804 805
	if (res->pub.capability & WLAN_CAPABILITY_ESS)
		regulatory_hint_found_beacon(wiphy, channel, gfp);

806
	trace_cfg80211_return_bss(&res->pub);
807 808 809 810 811
	/* cfg80211_bss_update gives us a referenced result */
	return &res->pub;
}
EXPORT_SYMBOL(cfg80211_inform_bss_frame);

812 813 814 815 816 817 818 819 820 821 822 823
void cfg80211_ref_bss(struct cfg80211_bss *pub)
{
	struct cfg80211_internal_bss *bss;

	if (!pub)
		return;

	bss = container_of(pub, struct cfg80211_internal_bss, pub);
	kref_get(&bss->ref);
}
EXPORT_SYMBOL(cfg80211_ref_bss);

824 825 826 827 828 829 830 831 832 833 834 835
void cfg80211_put_bss(struct cfg80211_bss *pub)
{
	struct cfg80211_internal_bss *bss;

	if (!pub)
		return;

	bss = container_of(pub, struct cfg80211_internal_bss, pub);
	kref_put(&bss->ref, bss_release);
}
EXPORT_SYMBOL(cfg80211_put_bss);

836 837 838 839 840 841 842 843 844 845 846
void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
{
	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
	struct cfg80211_internal_bss *bss;

	if (WARN_ON(!pub))
		return;

	bss = container_of(pub, struct cfg80211_internal_bss, pub);

	spin_lock_bh(&dev->bss_lock);
J
Johannes Berg 已提交
847
	if (!list_empty(&bss->list)) {
848
		__cfg80211_unlink_bss(dev, bss);
J
Johannes Berg 已提交
849 850
		dev->bss_generation++;
	}
851 852 853 854
	spin_unlock_bh(&dev->bss_lock);
}
EXPORT_SYMBOL(cfg80211_unlink_bss);

J
Johannes Berg 已提交
855
#ifdef CONFIG_CFG80211_WEXT
856 857 858 859 860 861 862
int cfg80211_wext_siwscan(struct net_device *dev,
			  struct iw_request_info *info,
			  union iwreq_data *wrqu, char *extra)
{
	struct cfg80211_registered_device *rdev;
	struct wiphy *wiphy;
	struct iw_scan_req *wreq = NULL;
863
	struct cfg80211_scan_request *creq = NULL;
864 865 866 867 868 869
	int i, err, n_channels = 0;
	enum ieee80211_band band;

	if (!netif_running(dev))
		return -ENETDOWN;

870 871 872
	if (wrqu->data.length == sizeof(struct iw_scan_req))
		wreq = (struct iw_scan_req *)extra;

873
	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
874 875 876 877 878 879 880 881 882 883 884

	if (IS_ERR(rdev))
		return PTR_ERR(rdev);

	if (rdev->scan_req) {
		err = -EBUSY;
		goto out;
	}

	wiphy = &rdev->wiphy;

885 886 887 888 889 890 891 892
	/* Determine number of channels, needed to allocate creq */
	if (wreq && wreq->num_channels)
		n_channels = wreq->num_channels;
	else {
		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
			if (wiphy->bands[band])
				n_channels += wiphy->bands[band]->n_channels;
	}
893 894 895 896 897 898 899 900 901 902

	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
		       n_channels * sizeof(void *),
		       GFP_ATOMIC);
	if (!creq) {
		err = -ENOMEM;
		goto out;
	}

	creq->wiphy = wiphy;
J
Johannes Berg 已提交
903
	creq->wdev = dev->ieee80211_ptr;
904 905
	/* SSIDs come after channels */
	creq->ssids = (void *)&creq->channels[n_channels];
906 907
	creq->n_channels = n_channels;
	creq->n_ssids = 1;
908
	creq->scan_start = jiffies;
909

910
	/* translate "Scan on frequencies" request */
911 912 913
	i = 0;
	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
		int j;
J
Johannes Berg 已提交
914

915 916
		if (!wiphy->bands[band])
			continue;
J
Johannes Berg 已提交
917

918
		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
J
Johannes Berg 已提交
919 920 921 922
			/* ignore disabled channels */
			if (wiphy->bands[band]->channels[j].flags &
						IEEE80211_CHAN_DISABLED)
				continue;
923 924 925 926 927 928 929 930 931

			/* If we have a wireless request structure and the
			 * wireless request specifies frequencies, then search
			 * for the matching hardware channel.
			 */
			if (wreq && wreq->num_channels) {
				int k;
				int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
				for (k = 0; k < wreq->num_channels; k++) {
932
					int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
933 934 935 936 937 938 939
					if (wext_freq == wiphy_freq)
						goto wext_freq_found;
				}
				goto wext_freq_not_found;
			}

		wext_freq_found:
940 941
			creq->channels[i] = &wiphy->bands[band]->channels[j];
			i++;
942
		wext_freq_not_found: ;
943 944
		}
	}
945 946 947 948 949
	/* No channels found? */
	if (!i) {
		err = -EINVAL;
		goto out;
	}
950

951 952
	/* Set real number of channels specified in creq->channels[] */
	creq->n_channels = i;
953

954 955
	/* translate "Scan for SSID" request */
	if (wreq) {
956
		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
957 958 959 960
			if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
				err = -EINVAL;
				goto out;
			}
961 962 963 964 965 966 967
			memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
			creq->ssids[0].ssid_len = wreq->essid_len;
		}
		if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
			creq->n_ssids = 0;
	}

968
	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
969 970
		if (wiphy->bands[i])
			creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
971

972
	rdev->scan_req = creq;
973
	err = rdev_scan(rdev, creq);
974 975
	if (err) {
		rdev->scan_req = NULL;
976
		/* creq will be freed below */
977
	} else {
J
Johannes Berg 已提交
978
		nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
979 980
		/* creq now owned by driver */
		creq = NULL;
981 982
		dev_hold(dev);
	}
983
 out:
984
	kfree(creq);
985
	cfg80211_unlock_rdev(rdev);
986 987
	return err;
}
988
EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
989 990

static void ieee80211_scan_add_ies(struct iw_request_info *info,
991
				   const struct cfg80211_bss_ies *ies,
992 993
				   char **current_ev, char *end_buf)
{
994
	const u8 *pos, *end, *next;
995 996
	struct iw_event iwe;

997
	if (!ies)
998 999 1000 1001 1002 1003
		return;

	/*
	 * If needed, fragment the IEs buffer (at IE boundaries) into short
	 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
	 */
1004 1005
	pos = ies->data;
	end = pos + ies->len;
1006 1007 1008 1009 1010 1011 1012 1013 1014 1015

	while (end - pos > IW_GENERIC_IE_MAX) {
		next = pos + 2 + pos[1];
		while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
			next = next + 2 + next[1];

		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVGENIE;
		iwe.u.data.length = next - pos;
		*current_ev = iwe_stream_add_point(info, *current_ev,
1016 1017
						   end_buf, &iwe,
						   (void *)pos);
1018 1019 1020 1021 1022 1023 1024 1025 1026

		pos = next;
	}

	if (end > pos) {
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVGENIE;
		iwe.u.data.length = end - pos;
		*current_ev = iwe_stream_add_point(info, *current_ev,
1027 1028
						   end_buf, &iwe,
						   (void *)pos);
1029 1030 1031
	}
}

1032 1033 1034 1035 1036 1037 1038 1039 1040
static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
{
	unsigned long end = jiffies;

	if (end >= start)
		return jiffies_to_msecs(end - start);

	return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
}
1041 1042

static char *
J
Johannes Berg 已提交
1043 1044 1045
ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
	      struct cfg80211_internal_bss *bss, char *current_ev,
	      char *end_buf)
1046
{
1047
	const struct cfg80211_bss_ies *ies;
1048
	struct iw_event iwe;
1049
	const u8 *ie;
1050
	u8 *buf, *cfg, *p;
1051
	int rem, i, sig;
1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074
	bool ismesh = false;

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWAP;
	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
	memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
					  IW_EV_ADDR_LEN);

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWFREQ;
	iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
	iwe.u.freq.e = 0;
	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
					  IW_EV_FREQ_LEN);

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWFREQ;
	iwe.u.freq.m = bss->pub.channel->center_freq;
	iwe.u.freq.e = 6;
	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
					  IW_EV_FREQ_LEN);

J
Johannes Berg 已提交
1075
	if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
1076 1077 1078 1079
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVQUAL;
		iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
				     IW_QUAL_NOISE_INVALID |
1080
				     IW_QUAL_QUAL_UPDATED;
J
Johannes Berg 已提交
1081
		switch (wiphy->signal_type) {
1082
		case CFG80211_SIGNAL_TYPE_MBM:
1083 1084
			sig = bss->pub.signal / 100;
			iwe.u.qual.level = sig;
1085
			iwe.u.qual.updated |= IW_QUAL_DBM;
1086 1087 1088 1089 1090 1091
			if (sig < -110)		/* rather bad */
				sig = -110;
			else if (sig > -40)	/* perfect */
				sig = -40;
			/* will give a range of 0 .. 70 */
			iwe.u.qual.qual = sig + 110;
1092 1093 1094
			break;
		case CFG80211_SIGNAL_TYPE_UNSPEC:
			iwe.u.qual.level = bss->pub.signal;
1095 1096
			/* will give range 0 .. 100 */
			iwe.u.qual.qual = bss->pub.signal;
1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115
			break;
		default:
			/* not reached */
			break;
		}
		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
						  &iwe, IW_EV_QUAL_LEN);
	}

	memset(&iwe, 0, sizeof(iwe));
	iwe.cmd = SIOCGIWENCODE;
	if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
	else
		iwe.u.data.flags = IW_ENCODE_DISABLED;
	iwe.u.data.length = 0;
	current_ev = iwe_stream_add_point(info, current_ev, end_buf,
					  &iwe, "");

1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126
	rcu_read_lock();
	ies = rcu_dereference(bss->pub.ies);
	if (ies) {
		rem = ies->len;
		ie = ies->data;
	} else {
		rem = 0;
		ie = NULL;
	}

	while (ies && rem >= 2) {
1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137
		/* invalid data */
		if (ie[1] > rem - 2)
			break;

		switch (ie[0]) {
		case WLAN_EID_SSID:
			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = SIOCGIWESSID;
			iwe.u.data.length = ie[1];
			iwe.u.data.flags = 1;
			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1138
							  &iwe, (u8 *)ie + 2);
1139 1140 1141 1142 1143 1144 1145
			break;
		case WLAN_EID_MESH_ID:
			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = SIOCGIWESSID;
			iwe.u.data.length = ie[1];
			iwe.u.data.flags = 1;
			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1146
							  &iwe, (u8 *)ie + 2);
1147 1148 1149
			break;
		case WLAN_EID_MESH_CONFIG:
			ismesh = true;
1150
			if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1151 1152 1153 1154
				break;
			buf = kmalloc(50, GFP_ATOMIC);
			if (!buf)
				break;
1155
			cfg = (u8 *)ie + 2;
1156 1157
			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = IWEVCUSTOM;
1158 1159
			sprintf(buf, "Mesh Network Path Selection Protocol ID: "
				"0x%02X", cfg[0]);
1160 1161 1162 1163
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1164 1165
			sprintf(buf, "Path Selection Metric ID: 0x%02X",
				cfg[1]);
1166 1167 1168 1169
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1170 1171
			sprintf(buf, "Congestion Control Mode ID: 0x%02X",
				cfg[2]);
1172 1173 1174 1175
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1176
			sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1177 1178 1179 1180
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191
			sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
			sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
			sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220
			iwe.u.data.length = strlen(buf);
			current_ev = iwe_stream_add_point(info, current_ev,
							  end_buf,
							  &iwe, buf);
			kfree(buf);
			break;
		case WLAN_EID_SUPP_RATES:
		case WLAN_EID_EXT_SUPP_RATES:
			/* display all supported rates in readable format */
			p = current_ev + iwe_stream_lcp_len(info);

			memset(&iwe, 0, sizeof(iwe));
			iwe.cmd = SIOCGIWRATE;
			/* Those two flags are ignored... */
			iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;

			for (i = 0; i < ie[1]; i++) {
				iwe.u.bitrate.value =
					((ie[i + 2] & 0x7f) * 500000);
				p = iwe_stream_add_value(info, current_ev, p,
						end_buf, &iwe, IW_EV_PARAM_LEN);
			}
			current_ev = p;
			break;
		}
		rem -= ie[1] + 2;
		ie += ie[1] + 2;
	}

1221 1222
	if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
	    ismesh) {
1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = SIOCGIWMODE;
		if (ismesh)
			iwe.u.mode = IW_MODE_MESH;
		else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
			iwe.u.mode = IW_MODE_MASTER;
		else
			iwe.u.mode = IW_MODE_ADHOC;
		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
						  &iwe, IW_EV_UINT_LEN);
	}

	buf = kmalloc(30, GFP_ATOMIC);
	if (buf) {
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVCUSTOM;
		sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
		iwe.u.data.length = strlen(buf);
		current_ev = iwe_stream_add_point(info, current_ev, end_buf,
						  &iwe, buf);
		memset(&iwe, 0, sizeof(iwe));
		iwe.cmd = IWEVCUSTOM;
1245 1246
		sprintf(buf, " Last beacon: %ums ago",
			elapsed_jiffies_msecs(bss->ts));
1247 1248 1249 1250 1251 1252
		iwe.u.data.length = strlen(buf);
		current_ev = iwe_stream_add_point(info, current_ev,
						  end_buf, &iwe, buf);
		kfree(buf);
	}

1253 1254
	ieee80211_scan_add_ies(info, ies, &current_ev, end_buf);
	rcu_read_unlock();
1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275

	return current_ev;
}


static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
				  struct iw_request_info *info,
				  char *buf, size_t len)
{
	char *current_ev = buf;
	char *end_buf = buf + len;
	struct cfg80211_internal_bss *bss;

	spin_lock_bh(&dev->bss_lock);
	cfg80211_bss_expire(dev);

	list_for_each_entry(bss, &dev->bss_list, list) {
		if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
			spin_unlock_bh(&dev->bss_lock);
			return -E2BIG;
		}
J
Johannes Berg 已提交
1276 1277
		current_ev = ieee80211_bss(&dev->wiphy, info, bss,
					   current_ev, end_buf);
1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293
	}
	spin_unlock_bh(&dev->bss_lock);
	return current_ev - buf;
}


int cfg80211_wext_giwscan(struct net_device *dev,
			  struct iw_request_info *info,
			  struct iw_point *data, char *extra)
{
	struct cfg80211_registered_device *rdev;
	int res;

	if (!netif_running(dev))
		return -ENETDOWN;

1294
	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311

	if (IS_ERR(rdev))
		return PTR_ERR(rdev);

	if (rdev->scan_req) {
		res = -EAGAIN;
		goto out;
	}

	res = ieee80211_scan_results(rdev, info, extra, data->length);
	data->length = 0;
	if (res >= 0) {
		data->length = res;
		res = 0;
	}

 out:
1312
	cfg80211_unlock_rdev(rdev);
1313 1314
	return res;
}
1315
EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
1316
#endif