1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * cfg80211 scan result handling 4 * 5 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2016 Intel Deutschland GmbH 8 * Copyright (C) 2018-2022 Intel Corporation 9 */ 10 #include <linux/kernel.h> 11 #include <linux/slab.h> 12 #include <linux/module.h> 13 #include <linux/netdevice.h> 14 #include <linux/wireless.h> 15 #include <linux/nl80211.h> 16 #include <linux/etherdevice.h> 17 #include <linux/crc32.h> 18 #include <linux/bitfield.h> 19 #include <net/arp.h> 20 #include <net/cfg80211.h> 21 #include <net/cfg80211-wext.h> 22 #include <net/iw_handler.h> 23 #include "core.h" 24 #include "nl80211.h" 25 #include "wext-compat.h" 26 #include "rdev-ops.h" 27 28 /** 29 * DOC: BSS tree/list structure 30 * 31 * At the top level, the BSS list is kept in both a list in each 32 * registered device (@bss_list) as well as an RB-tree for faster 33 * lookup. In the RB-tree, entries can be looked up using their 34 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID 35 * for other BSSes. 36 * 37 * Due to the possibility of hidden SSIDs, there's a second level 38 * structure, the "hidden_list" and "hidden_beacon_bss" pointer. 39 * The hidden_list connects all BSSes belonging to a single AP 40 * that has a hidden SSID, and connects beacon and probe response 41 * entries. For a probe response entry for a hidden SSID, the 42 * hidden_beacon_bss pointer points to the BSS struct holding the 43 * beacon's information. 44 * 45 * Reference counting is done for all these references except for 46 * the hidden_list, so that a beacon BSS struct that is otherwise 47 * not referenced has one reference for being on the bss_list and 48 * one for each probe response entry that points to it using the 49 * hidden_beacon_bss pointer. When a BSS struct that has such a 50 * pointer is get/put, the refcount update is also propagated to 51 * the referenced struct, this ensure that it cannot get removed 52 * while somebody is using the probe response version. 53 * 54 * Note that the hidden_beacon_bss pointer never changes, due to 55 * the reference counting. Therefore, no locking is needed for 56 * it. 57 * 58 * Also note that the hidden_beacon_bss pointer is only relevant 59 * if the driver uses something other than the IEs, e.g. private 60 * data stored in the BSS struct, since the beacon IEs are 61 * also linked into the probe response struct. 62 */ 63 64 /* 65 * Limit the number of BSS entries stored in mac80211. Each one is 66 * a bit over 4k at most, so this limits to roughly 4-5M of memory. 67 * If somebody wants to really attack this though, they'd likely 68 * use small beacons, and only one type of frame, limiting each of 69 * the entries to a much smaller size (in order to generate more 70 * entries in total, so overhead is bigger.) 71 */ 72 static int bss_entries_limit = 1000; 73 module_param(bss_entries_limit, int, 0644); 74 MODULE_PARM_DESC(bss_entries_limit, 75 "limit to number of scan BSS entries (per wiphy, default 1000)"); 76 77 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ) 78 79 /** 80 * struct cfg80211_colocated_ap - colocated AP information 81 * 82 * @list: linked list to all colocated aPS 83 * @bssid: BSSID of the reported AP 84 * @ssid: SSID of the reported AP 85 * @ssid_len: length of the ssid 86 * @center_freq: frequency the reported AP is on 87 * @unsolicited_probe: the reported AP is part of an ESS, where all the APs 88 * that operate in the same channel as the reported AP and that might be 89 * detected by a STA receiving this frame, are transmitting unsolicited 90 * Probe Response frames every 20 TUs 91 * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP 92 * @same_ssid: the reported AP has the same SSID as the reporting AP 93 * @multi_bss: the reported AP is part of a multiple BSSID set 94 * @transmitted_bssid: the reported AP is the transmitting BSSID 95 * @colocated_ess: all the APs that share the same ESS as the reported AP are 96 * colocated and can be discovered via legacy bands. 97 * @short_ssid_valid: short_ssid is valid and can be used 98 * @short_ssid: the short SSID for this SSID 99 */ 100 struct cfg80211_colocated_ap { 101 struct list_head list; 102 u8 bssid[ETH_ALEN]; 103 u8 ssid[IEEE80211_MAX_SSID_LEN]; 104 size_t ssid_len; 105 u32 short_ssid; 106 u32 center_freq; 107 u8 unsolicited_probe:1, 108 oct_recommended:1, 109 same_ssid:1, 110 multi_bss:1, 111 transmitted_bssid:1, 112 colocated_ess:1, 113 short_ssid_valid:1; 114 }; 115 116 static void bss_free(struct cfg80211_internal_bss *bss) 117 { 118 struct cfg80211_bss_ies *ies; 119 120 if (WARN_ON(atomic_read(&bss->hold))) 121 return; 122 123 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies); 124 if (ies && !bss->pub.hidden_beacon_bss) 125 kfree_rcu(ies, rcu_head); 126 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies); 127 if (ies) 128 kfree_rcu(ies, rcu_head); 129 130 /* 131 * This happens when the module is removed, it doesn't 132 * really matter any more save for completeness 133 */ 134 if (!list_empty(&bss->hidden_list)) 135 list_del(&bss->hidden_list); 136 137 kfree(bss); 138 } 139 140 static inline void bss_ref_get(struct cfg80211_registered_device *rdev, 141 struct cfg80211_internal_bss *bss) 142 { 143 lockdep_assert_held(&rdev->bss_lock); 144 145 bss->refcount++; 146 147 if (bss->pub.hidden_beacon_bss) 148 bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++; 149 150 if (bss->pub.transmitted_bss) 151 bss_from_pub(bss->pub.transmitted_bss)->refcount++; 152 } 153 154 static inline void bss_ref_put(struct cfg80211_registered_device *rdev, 155 struct cfg80211_internal_bss *bss) 156 { 157 lockdep_assert_held(&rdev->bss_lock); 158 159 if (bss->pub.hidden_beacon_bss) { 160 struct cfg80211_internal_bss *hbss; 161 162 hbss = bss_from_pub(bss->pub.hidden_beacon_bss); 163 hbss->refcount--; 164 if (hbss->refcount == 0) 165 bss_free(hbss); 166 } 167 168 if (bss->pub.transmitted_bss) { 169 struct cfg80211_internal_bss *tbss; 170 171 tbss = bss_from_pub(bss->pub.transmitted_bss); 172 tbss->refcount--; 173 if (tbss->refcount == 0) 174 bss_free(tbss); 175 } 176 177 bss->refcount--; 178 if (bss->refcount == 0) 179 bss_free(bss); 180 } 181 182 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev, 183 struct cfg80211_internal_bss *bss) 184 { 185 lockdep_assert_held(&rdev->bss_lock); 186 187 if (!list_empty(&bss->hidden_list)) { 188 /* 189 * don't remove the beacon entry if it has 190 * probe responses associated with it 191 */ 192 if (!bss->pub.hidden_beacon_bss) 193 return false; 194 /* 195 * if it's a probe response entry break its 196 * link to the other entries in the group 197 */ 198 list_del_init(&bss->hidden_list); 199 } 200 201 list_del_init(&bss->list); 202 list_del_init(&bss->pub.nontrans_list); 203 rb_erase(&bss->rbn, &rdev->bss_tree); 204 rdev->bss_entries--; 205 WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list), 206 "rdev bss entries[%d]/list[empty:%d] corruption\n", 207 rdev->bss_entries, list_empty(&rdev->bss_list)); 208 bss_ref_put(rdev, bss); 209 return true; 210 } 211 212 bool cfg80211_is_element_inherited(const struct element *elem, 213 const struct element *non_inherit_elem) 214 { 215 u8 id_len, ext_id_len, i, loop_len, id; 216 const u8 *list; 217 218 if (elem->id == WLAN_EID_MULTIPLE_BSSID) 219 return false; 220 221 if (!non_inherit_elem || non_inherit_elem->datalen < 2) 222 return true; 223 224 /* 225 * non inheritance element format is: 226 * ext ID (56) | IDs list len | list | extension IDs list len | list 227 * Both lists are optional. Both lengths are mandatory. 228 * This means valid length is: 229 * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths 230 */ 231 id_len = non_inherit_elem->data[1]; 232 if (non_inherit_elem->datalen < 3 + id_len) 233 return true; 234 235 ext_id_len = non_inherit_elem->data[2 + id_len]; 236 if (non_inherit_elem->datalen < 3 + id_len + ext_id_len) 237 return true; 238 239 if (elem->id == WLAN_EID_EXTENSION) { 240 if (!ext_id_len) 241 return true; 242 loop_len = ext_id_len; 243 list = &non_inherit_elem->data[3 + id_len]; 244 id = elem->data[0]; 245 } else { 246 if (!id_len) 247 return true; 248 loop_len = id_len; 249 list = &non_inherit_elem->data[2]; 250 id = elem->id; 251 } 252 253 for (i = 0; i < loop_len; i++) { 254 if (list[i] == id) 255 return false; 256 } 257 258 return true; 259 } 260 EXPORT_SYMBOL(cfg80211_is_element_inherited); 261 262 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, 263 const u8 *subelement, size_t subie_len, 264 u8 *new_ie, gfp_t gfp) 265 { 266 u8 *pos, *tmp; 267 const u8 *tmp_old, *tmp_new; 268 const struct element *non_inherit_elem; 269 u8 *sub_copy; 270 271 /* copy subelement as we need to change its content to 272 * mark an ie after it is processed. 273 */ 274 sub_copy = kmemdup(subelement, subie_len, gfp); 275 if (!sub_copy) 276 return 0; 277 278 pos = &new_ie[0]; 279 280 /* set new ssid */ 281 tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len); 282 if (tmp_new) { 283 memcpy(pos, tmp_new, tmp_new[1] + 2); 284 pos += (tmp_new[1] + 2); 285 } 286 287 /* get non inheritance list if exists */ 288 non_inherit_elem = 289 cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 290 sub_copy, subie_len); 291 292 /* go through IEs in ie (skip SSID) and subelement, 293 * merge them into new_ie 294 */ 295 tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); 296 tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie; 297 298 while (tmp_old + 2 - ie <= ielen && 299 tmp_old + tmp_old[1] + 2 - ie <= ielen) { 300 if (tmp_old[0] == 0) { 301 tmp_old++; 302 continue; 303 } 304 305 if (tmp_old[0] == WLAN_EID_EXTENSION) 306 tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy, 307 subie_len); 308 else 309 tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy, 310 subie_len); 311 312 if (!tmp) { 313 const struct element *old_elem = (void *)tmp_old; 314 315 /* ie in old ie but not in subelement */ 316 if (cfg80211_is_element_inherited(old_elem, 317 non_inherit_elem)) { 318 memcpy(pos, tmp_old, tmp_old[1] + 2); 319 pos += tmp_old[1] + 2; 320 } 321 } else { 322 /* ie in transmitting ie also in subelement, 323 * copy from subelement and flag the ie in subelement 324 * as copied (by setting eid field to WLAN_EID_SSID, 325 * which is skipped anyway). 326 * For vendor ie, compare OUI + type + subType to 327 * determine if they are the same ie. 328 */ 329 if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) { 330 if (tmp_old[1] >= 5 && tmp[1] >= 5 && 331 !memcmp(tmp_old + 2, tmp + 2, 5)) { 332 /* same vendor ie, copy from 333 * subelement 334 */ 335 memcpy(pos, tmp, tmp[1] + 2); 336 pos += tmp[1] + 2; 337 tmp[0] = WLAN_EID_SSID; 338 } else { 339 memcpy(pos, tmp_old, tmp_old[1] + 2); 340 pos += tmp_old[1] + 2; 341 } 342 } else { 343 /* copy ie from subelement into new ie */ 344 memcpy(pos, tmp, tmp[1] + 2); 345 pos += tmp[1] + 2; 346 tmp[0] = WLAN_EID_SSID; 347 } 348 } 349 350 if (tmp_old + tmp_old[1] + 2 - ie == ielen) 351 break; 352 353 tmp_old += tmp_old[1] + 2; 354 } 355 356 /* go through subelement again to check if there is any ie not 357 * copied to new ie, skip ssid, capability, bssid-index ie 358 */ 359 tmp_new = sub_copy; 360 while (tmp_new + 2 - sub_copy <= subie_len && 361 tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) { 362 if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP || 363 tmp_new[0] == WLAN_EID_SSID)) { 364 memcpy(pos, tmp_new, tmp_new[1] + 2); 365 pos += tmp_new[1] + 2; 366 } 367 if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len) 368 break; 369 tmp_new += tmp_new[1] + 2; 370 } 371 372 kfree(sub_copy); 373 return pos - new_ie; 374 } 375 376 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid, 377 const u8 *ssid, size_t ssid_len) 378 { 379 const struct cfg80211_bss_ies *ies; 380 const struct element *ssid_elem; 381 382 if (bssid && !ether_addr_equal(a->bssid, bssid)) 383 return false; 384 385 if (!ssid) 386 return true; 387 388 ies = rcu_access_pointer(a->ies); 389 if (!ies) 390 return false; 391 ssid_elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len); 392 if (!ssid_elem) 393 return false; 394 if (ssid_elem->datalen != ssid_len) 395 return false; 396 return memcmp(ssid_elem->data, ssid, ssid_len) == 0; 397 } 398 399 static int 400 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss, 401 struct cfg80211_bss *nontrans_bss) 402 { 403 const struct element *ssid_elem; 404 struct cfg80211_bss *bss = NULL; 405 406 rcu_read_lock(); 407 ssid_elem = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID); 408 if (!ssid_elem) { 409 rcu_read_unlock(); 410 return -EINVAL; 411 } 412 413 /* check if nontrans_bss is in the list */ 414 list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) { 415 if (is_bss(bss, nontrans_bss->bssid, ssid_elem->data, 416 ssid_elem->datalen)) { 417 rcu_read_unlock(); 418 return 0; 419 } 420 } 421 422 rcu_read_unlock(); 423 424 /* 425 * This is a bit weird - it's not on the list, but already on another 426 * one! The only way that could happen is if there's some BSSID/SSID 427 * shared by multiple APs in their multi-BSSID profiles, potentially 428 * with hidden SSID mixed in ... ignore it. 429 */ 430 if (!list_empty(&nontrans_bss->nontrans_list)) 431 return -EINVAL; 432 433 /* add to the list */ 434 list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); 435 return 0; 436 } 437 438 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev, 439 unsigned long expire_time) 440 { 441 struct cfg80211_internal_bss *bss, *tmp; 442 bool expired = false; 443 444 lockdep_assert_held(&rdev->bss_lock); 445 446 list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) { 447 if (atomic_read(&bss->hold)) 448 continue; 449 if (!time_after(expire_time, bss->ts)) 450 continue; 451 452 if (__cfg80211_unlink_bss(rdev, bss)) 453 expired = true; 454 } 455 456 if (expired) 457 rdev->bss_generation++; 458 } 459 460 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev) 461 { 462 struct cfg80211_internal_bss *bss, *oldest = NULL; 463 bool ret; 464 465 lockdep_assert_held(&rdev->bss_lock); 466 467 list_for_each_entry(bss, &rdev->bss_list, list) { 468 if (atomic_read(&bss->hold)) 469 continue; 470 471 if (!list_empty(&bss->hidden_list) && 472 !bss->pub.hidden_beacon_bss) 473 continue; 474 475 if (oldest && time_before(oldest->ts, bss->ts)) 476 continue; 477 oldest = bss; 478 } 479 480 if (WARN_ON(!oldest)) 481 return false; 482 483 /* 484 * The callers make sure to increase rdev->bss_generation if anything 485 * gets removed (and a new entry added), so there's no need to also do 486 * it here. 487 */ 488 489 ret = __cfg80211_unlink_bss(rdev, oldest); 490 WARN_ON(!ret); 491 return ret; 492 } 493 494 static u8 cfg80211_parse_bss_param(u8 data, 495 struct cfg80211_colocated_ap *coloc_ap) 496 { 497 coloc_ap->oct_recommended = 498 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED); 499 coloc_ap->same_ssid = 500 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID); 501 coloc_ap->multi_bss = 502 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID); 503 coloc_ap->transmitted_bssid = 504 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID); 505 coloc_ap->unsolicited_probe = 506 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE); 507 coloc_ap->colocated_ess = 508 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS); 509 510 return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP); 511 } 512 513 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies, 514 const struct element **elem, u32 *s_ssid) 515 { 516 517 *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len); 518 if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN) 519 return -EINVAL; 520 521 *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen); 522 return 0; 523 } 524 525 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list) 526 { 527 struct cfg80211_colocated_ap *ap, *tmp_ap; 528 529 list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) { 530 list_del(&ap->list); 531 kfree(ap); 532 } 533 } 534 535 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry, 536 const u8 *pos, u8 length, 537 const struct element *ssid_elem, 538 int s_ssid_tmp) 539 { 540 /* skip the TBTT offset */ 541 pos++; 542 543 memcpy(entry->bssid, pos, ETH_ALEN); 544 pos += ETH_ALEN; 545 546 if (length >= IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM) { 547 memcpy(&entry->short_ssid, pos, 548 sizeof(entry->short_ssid)); 549 entry->short_ssid_valid = true; 550 pos += 4; 551 } 552 553 /* skip non colocated APs */ 554 if (!cfg80211_parse_bss_param(*pos, entry)) 555 return -EINVAL; 556 pos++; 557 558 if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM) { 559 /* 560 * no information about the short ssid. Consider the entry valid 561 * for now. It would later be dropped in case there are explicit 562 * SSIDs that need to be matched 563 */ 564 if (!entry->same_ssid) 565 return 0; 566 } 567 568 if (entry->same_ssid) { 569 entry->short_ssid = s_ssid_tmp; 570 entry->short_ssid_valid = true; 571 572 /* 573 * This is safe because we validate datalen in 574 * cfg80211_parse_colocated_ap(), before calling this 575 * function. 576 */ 577 memcpy(&entry->ssid, &ssid_elem->data, 578 ssid_elem->datalen); 579 entry->ssid_len = ssid_elem->datalen; 580 } 581 return 0; 582 } 583 584 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies, 585 struct list_head *list) 586 { 587 struct ieee80211_neighbor_ap_info *ap_info; 588 const struct element *elem, *ssid_elem; 589 const u8 *pos, *end; 590 u32 s_ssid_tmp; 591 int n_coloc = 0, ret; 592 LIST_HEAD(ap_list); 593 594 elem = cfg80211_find_elem(WLAN_EID_REDUCED_NEIGHBOR_REPORT, ies->data, 595 ies->len); 596 if (!elem) 597 return 0; 598 599 pos = elem->data; 600 end = pos + elem->datalen; 601 602 ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp); 603 if (ret) 604 return ret; 605 606 /* RNR IE may contain more than one NEIGHBOR_AP_INFO */ 607 while (pos + sizeof(*ap_info) <= end) { 608 enum nl80211_band band; 609 int freq; 610 u8 length, i, count; 611 612 ap_info = (void *)pos; 613 count = u8_get_bits(ap_info->tbtt_info_hdr, 614 IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1; 615 length = ap_info->tbtt_info_len; 616 617 pos += sizeof(*ap_info); 618 619 if (!ieee80211_operating_class_to_band(ap_info->op_class, 620 &band)) 621 break; 622 623 freq = ieee80211_channel_to_frequency(ap_info->channel, band); 624 625 if (end - pos < count * length) 626 break; 627 628 /* 629 * TBTT info must include bss param + BSSID + 630 * (short SSID or same_ssid bit to be set). 631 * ignore other options, and move to the 632 * next AP info 633 */ 634 if (band != NL80211_BAND_6GHZ || 635 (length != IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM && 636 length < IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM)) { 637 pos += count * length; 638 continue; 639 } 640 641 for (i = 0; i < count; i++) { 642 struct cfg80211_colocated_ap *entry; 643 644 entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN, 645 GFP_ATOMIC); 646 647 if (!entry) 648 break; 649 650 entry->center_freq = freq; 651 652 if (!cfg80211_parse_ap_info(entry, pos, length, 653 ssid_elem, s_ssid_tmp)) { 654 n_coloc++; 655 list_add_tail(&entry->list, &ap_list); 656 } else { 657 kfree(entry); 658 } 659 660 pos += length; 661 } 662 } 663 664 if (pos != end) { 665 cfg80211_free_coloc_ap_list(&ap_list); 666 return 0; 667 } 668 669 list_splice_tail(&ap_list, list); 670 return n_coloc; 671 } 672 673 static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request, 674 struct ieee80211_channel *chan, 675 bool add_to_6ghz) 676 { 677 int i; 678 u32 n_channels = request->n_channels; 679 struct cfg80211_scan_6ghz_params *params = 680 &request->scan_6ghz_params[request->n_6ghz_params]; 681 682 for (i = 0; i < n_channels; i++) { 683 if (request->channels[i] == chan) { 684 if (add_to_6ghz) 685 params->channel_idx = i; 686 return; 687 } 688 } 689 690 request->channels[n_channels] = chan; 691 if (add_to_6ghz) 692 request->scan_6ghz_params[request->n_6ghz_params].channel_idx = 693 n_channels; 694 695 request->n_channels++; 696 } 697 698 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap, 699 struct cfg80211_scan_request *request) 700 { 701 int i; 702 u32 s_ssid; 703 704 for (i = 0; i < request->n_ssids; i++) { 705 /* wildcard ssid in the scan request */ 706 if (!request->ssids[i].ssid_len) { 707 if (ap->multi_bss && !ap->transmitted_bssid) 708 continue; 709 710 return true; 711 } 712 713 if (ap->ssid_len && 714 ap->ssid_len == request->ssids[i].ssid_len) { 715 if (!memcmp(request->ssids[i].ssid, ap->ssid, 716 ap->ssid_len)) 717 return true; 718 } else if (ap->short_ssid_valid) { 719 s_ssid = ~crc32_le(~0, request->ssids[i].ssid, 720 request->ssids[i].ssid_len); 721 722 if (ap->short_ssid == s_ssid) 723 return true; 724 } 725 } 726 727 return false; 728 } 729 730 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) 731 { 732 u8 i; 733 struct cfg80211_colocated_ap *ap; 734 int n_channels, count = 0, err; 735 struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req; 736 LIST_HEAD(coloc_ap_list); 737 bool need_scan_psc = true; 738 const struct ieee80211_sband_iftype_data *iftd; 739 740 rdev_req->scan_6ghz = true; 741 742 if (!rdev->wiphy.bands[NL80211_BAND_6GHZ]) 743 return -EOPNOTSUPP; 744 745 iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ], 746 rdev_req->wdev->iftype); 747 if (!iftd || !iftd->he_cap.has_he) 748 return -EOPNOTSUPP; 749 750 n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels; 751 752 if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) { 753 struct cfg80211_internal_bss *intbss; 754 755 spin_lock_bh(&rdev->bss_lock); 756 list_for_each_entry(intbss, &rdev->bss_list, list) { 757 struct cfg80211_bss *res = &intbss->pub; 758 const struct cfg80211_bss_ies *ies; 759 760 ies = rcu_access_pointer(res->ies); 761 count += cfg80211_parse_colocated_ap(ies, 762 &coloc_ap_list); 763 } 764 spin_unlock_bh(&rdev->bss_lock); 765 } 766 767 request = kzalloc(struct_size(request, channels, n_channels) + 768 sizeof(*request->scan_6ghz_params) * count + 769 sizeof(*request->ssids) * rdev_req->n_ssids, 770 GFP_KERNEL); 771 if (!request) { 772 cfg80211_free_coloc_ap_list(&coloc_ap_list); 773 return -ENOMEM; 774 } 775 776 *request = *rdev_req; 777 request->n_channels = 0; 778 request->scan_6ghz_params = 779 (void *)&request->channels[n_channels]; 780 781 /* 782 * PSC channels should not be scanned in case of direct scan with 1 SSID 783 * and at least one of the reported co-located APs with same SSID 784 * indicating that all APs in the same ESS are co-located 785 */ 786 if (count && request->n_ssids == 1 && request->ssids[0].ssid_len) { 787 list_for_each_entry(ap, &coloc_ap_list, list) { 788 if (ap->colocated_ess && 789 cfg80211_find_ssid_match(ap, request)) { 790 need_scan_psc = false; 791 break; 792 } 793 } 794 } 795 796 /* 797 * add to the scan request the channels that need to be scanned 798 * regardless of the collocated APs (PSC channels or all channels 799 * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set) 800 */ 801 for (i = 0; i < rdev_req->n_channels; i++) { 802 if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ && 803 ((need_scan_psc && 804 cfg80211_channel_is_psc(rdev_req->channels[i])) || 805 !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) { 806 cfg80211_scan_req_add_chan(request, 807 rdev_req->channels[i], 808 false); 809 } 810 } 811 812 if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ)) 813 goto skip; 814 815 list_for_each_entry(ap, &coloc_ap_list, list) { 816 bool found = false; 817 struct cfg80211_scan_6ghz_params *scan_6ghz_params = 818 &request->scan_6ghz_params[request->n_6ghz_params]; 819 struct ieee80211_channel *chan = 820 ieee80211_get_channel(&rdev->wiphy, ap->center_freq); 821 822 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 823 continue; 824 825 for (i = 0; i < rdev_req->n_channels; i++) { 826 if (rdev_req->channels[i] == chan) 827 found = true; 828 } 829 830 if (!found) 831 continue; 832 833 if (request->n_ssids > 0 && 834 !cfg80211_find_ssid_match(ap, request)) 835 continue; 836 837 if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid) 838 continue; 839 840 cfg80211_scan_req_add_chan(request, chan, true); 841 memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN); 842 scan_6ghz_params->short_ssid = ap->short_ssid; 843 scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid; 844 scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe; 845 846 /* 847 * If a PSC channel is added to the scan and 'need_scan_psc' is 848 * set to false, then all the APs that the scan logic is 849 * interested with on the channel are collocated and thus there 850 * is no need to perform the initial PSC channel listen. 851 */ 852 if (cfg80211_channel_is_psc(chan) && !need_scan_psc) 853 scan_6ghz_params->psc_no_listen = true; 854 855 request->n_6ghz_params++; 856 } 857 858 skip: 859 cfg80211_free_coloc_ap_list(&coloc_ap_list); 860 861 if (request->n_channels) { 862 struct cfg80211_scan_request *old = rdev->int_scan_req; 863 rdev->int_scan_req = request; 864 865 /* 866 * Add the ssids from the parent scan request to the new scan 867 * request, so the driver would be able to use them in its 868 * probe requests to discover hidden APs on PSC channels. 869 */ 870 request->ssids = (void *)&request->channels[request->n_channels]; 871 request->n_ssids = rdev_req->n_ssids; 872 memcpy(request->ssids, rdev_req->ssids, sizeof(*request->ssids) * 873 request->n_ssids); 874 875 /* 876 * If this scan follows a previous scan, save the scan start 877 * info from the first part of the scan 878 */ 879 if (old) 880 rdev->int_scan_req->info = old->info; 881 882 err = rdev_scan(rdev, request); 883 if (err) { 884 rdev->int_scan_req = old; 885 kfree(request); 886 } else { 887 kfree(old); 888 } 889 890 return err; 891 } 892 893 kfree(request); 894 return -EINVAL; 895 } 896 897 int cfg80211_scan(struct cfg80211_registered_device *rdev) 898 { 899 struct cfg80211_scan_request *request; 900 struct cfg80211_scan_request *rdev_req = rdev->scan_req; 901 u32 n_channels = 0, idx, i; 902 903 if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ)) 904 return rdev_scan(rdev, rdev_req); 905 906 for (i = 0; i < rdev_req->n_channels; i++) { 907 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ) 908 n_channels++; 909 } 910 911 if (!n_channels) 912 return cfg80211_scan_6ghz(rdev); 913 914 request = kzalloc(struct_size(request, channels, n_channels), 915 GFP_KERNEL); 916 if (!request) 917 return -ENOMEM; 918 919 *request = *rdev_req; 920 request->n_channels = n_channels; 921 922 for (i = idx = 0; i < rdev_req->n_channels; i++) { 923 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ) 924 request->channels[idx++] = rdev_req->channels[i]; 925 } 926 927 rdev_req->scan_6ghz = false; 928 rdev->int_scan_req = request; 929 return rdev_scan(rdev, request); 930 } 931 932 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, 933 bool send_message) 934 { 935 struct cfg80211_scan_request *request, *rdev_req; 936 struct wireless_dev *wdev; 937 struct sk_buff *msg; 938 #ifdef CONFIG_CFG80211_WEXT 939 union iwreq_data wrqu; 940 #endif 941 942 lockdep_assert_held(&rdev->wiphy.mtx); 943 944 if (rdev->scan_msg) { 945 nl80211_send_scan_msg(rdev, rdev->scan_msg); 946 rdev->scan_msg = NULL; 947 return; 948 } 949 950 rdev_req = rdev->scan_req; 951 if (!rdev_req) 952 return; 953 954 wdev = rdev_req->wdev; 955 request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req; 956 957 if (wdev_running(wdev) && 958 (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) && 959 !rdev_req->scan_6ghz && !request->info.aborted && 960 !cfg80211_scan_6ghz(rdev)) 961 return; 962 963 /* 964 * This must be before sending the other events! 965 * Otherwise, wpa_supplicant gets completely confused with 966 * wext events. 967 */ 968 if (wdev->netdev) 969 cfg80211_sme_scan_done(wdev->netdev); 970 971 if (!request->info.aborted && 972 request->flags & NL80211_SCAN_FLAG_FLUSH) { 973 /* flush entries from previous scans */ 974 spin_lock_bh(&rdev->bss_lock); 975 __cfg80211_bss_expire(rdev, request->scan_start); 976 spin_unlock_bh(&rdev->bss_lock); 977 } 978 979 msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted); 980 981 #ifdef CONFIG_CFG80211_WEXT 982 if (wdev->netdev && !request->info.aborted) { 983 memset(&wrqu, 0, sizeof(wrqu)); 984 985 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL); 986 } 987 #endif 988 989 dev_put(wdev->netdev); 990 991 kfree(rdev->int_scan_req); 992 rdev->int_scan_req = NULL; 993 994 kfree(rdev->scan_req); 995 rdev->scan_req = NULL; 996 997 if (!send_message) 998 rdev->scan_msg = msg; 999 else 1000 nl80211_send_scan_msg(rdev, msg); 1001 } 1002 1003 void __cfg80211_scan_done(struct work_struct *wk) 1004 { 1005 struct cfg80211_registered_device *rdev; 1006 1007 rdev = container_of(wk, struct cfg80211_registered_device, 1008 scan_done_wk); 1009 1010 wiphy_lock(&rdev->wiphy); 1011 ___cfg80211_scan_done(rdev, true); 1012 wiphy_unlock(&rdev->wiphy); 1013 } 1014 1015 void cfg80211_scan_done(struct cfg80211_scan_request *request, 1016 struct cfg80211_scan_info *info) 1017 { 1018 struct cfg80211_scan_info old_info = request->info; 1019 1020 trace_cfg80211_scan_done(request, info); 1021 WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req && 1022 request != wiphy_to_rdev(request->wiphy)->int_scan_req); 1023 1024 request->info = *info; 1025 1026 /* 1027 * In case the scan is split, the scan_start_tsf and tsf_bssid should 1028 * be of the first part. In such a case old_info.scan_start_tsf should 1029 * be non zero. 1030 */ 1031 if (request->scan_6ghz && old_info.scan_start_tsf) { 1032 request->info.scan_start_tsf = old_info.scan_start_tsf; 1033 memcpy(request->info.tsf_bssid, old_info.tsf_bssid, 1034 sizeof(request->info.tsf_bssid)); 1035 } 1036 1037 request->notified = true; 1038 queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk); 1039 } 1040 EXPORT_SYMBOL(cfg80211_scan_done); 1041 1042 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev, 1043 struct cfg80211_sched_scan_request *req) 1044 { 1045 lockdep_assert_held(&rdev->wiphy.mtx); 1046 1047 list_add_rcu(&req->list, &rdev->sched_scan_req_list); 1048 } 1049 1050 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev, 1051 struct cfg80211_sched_scan_request *req) 1052 { 1053 lockdep_assert_held(&rdev->wiphy.mtx); 1054 1055 list_del_rcu(&req->list); 1056 kfree_rcu(req, rcu_head); 1057 } 1058 1059 static struct cfg80211_sched_scan_request * 1060 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid) 1061 { 1062 struct cfg80211_sched_scan_request *pos; 1063 1064 list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list, 1065 lockdep_is_held(&rdev->wiphy.mtx)) { 1066 if (pos->reqid == reqid) 1067 return pos; 1068 } 1069 return NULL; 1070 } 1071 1072 /* 1073 * Determines if a scheduled scan request can be handled. When a legacy 1074 * scheduled scan is running no other scheduled scan is allowed regardless 1075 * whether the request is for legacy or multi-support scan. When a multi-support 1076 * scheduled scan is running a request for legacy scan is not allowed. In this 1077 * case a request for multi-support scan can be handled if resources are 1078 * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached. 1079 */ 1080 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev, 1081 bool want_multi) 1082 { 1083 struct cfg80211_sched_scan_request *pos; 1084 int i = 0; 1085 1086 list_for_each_entry(pos, &rdev->sched_scan_req_list, list) { 1087 /* request id zero means legacy in progress */ 1088 if (!i && !pos->reqid) 1089 return -EINPROGRESS; 1090 i++; 1091 } 1092 1093 if (i) { 1094 /* no legacy allowed when multi request(s) are active */ 1095 if (!want_multi) 1096 return -EINPROGRESS; 1097 1098 /* resource limit reached */ 1099 if (i == rdev->wiphy.max_sched_scan_reqs) 1100 return -ENOSPC; 1101 } 1102 return 0; 1103 } 1104 1105 void cfg80211_sched_scan_results_wk(struct work_struct *work) 1106 { 1107 struct cfg80211_registered_device *rdev; 1108 struct cfg80211_sched_scan_request *req, *tmp; 1109 1110 rdev = container_of(work, struct cfg80211_registered_device, 1111 sched_scan_res_wk); 1112 1113 wiphy_lock(&rdev->wiphy); 1114 list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) { 1115 if (req->report_results) { 1116 req->report_results = false; 1117 if (req->flags & NL80211_SCAN_FLAG_FLUSH) { 1118 /* flush entries from previous scans */ 1119 spin_lock_bh(&rdev->bss_lock); 1120 __cfg80211_bss_expire(rdev, req->scan_start); 1121 spin_unlock_bh(&rdev->bss_lock); 1122 req->scan_start = jiffies; 1123 } 1124 nl80211_send_sched_scan(req, 1125 NL80211_CMD_SCHED_SCAN_RESULTS); 1126 } 1127 } 1128 wiphy_unlock(&rdev->wiphy); 1129 } 1130 1131 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid) 1132 { 1133 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1134 struct cfg80211_sched_scan_request *request; 1135 1136 trace_cfg80211_sched_scan_results(wiphy, reqid); 1137 /* ignore if we're not scanning */ 1138 1139 rcu_read_lock(); 1140 request = cfg80211_find_sched_scan_req(rdev, reqid); 1141 if (request) { 1142 request->report_results = true; 1143 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk); 1144 } 1145 rcu_read_unlock(); 1146 } 1147 EXPORT_SYMBOL(cfg80211_sched_scan_results); 1148 1149 void cfg80211_sched_scan_stopped_locked(struct wiphy *wiphy, u64 reqid) 1150 { 1151 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1152 1153 lockdep_assert_held(&wiphy->mtx); 1154 1155 trace_cfg80211_sched_scan_stopped(wiphy, reqid); 1156 1157 __cfg80211_stop_sched_scan(rdev, reqid, true); 1158 } 1159 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_locked); 1160 1161 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid) 1162 { 1163 wiphy_lock(wiphy); 1164 cfg80211_sched_scan_stopped_locked(wiphy, reqid); 1165 wiphy_unlock(wiphy); 1166 } 1167 EXPORT_SYMBOL(cfg80211_sched_scan_stopped); 1168 1169 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev, 1170 struct cfg80211_sched_scan_request *req, 1171 bool driver_initiated) 1172 { 1173 lockdep_assert_held(&rdev->wiphy.mtx); 1174 1175 if (!driver_initiated) { 1176 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid); 1177 if (err) 1178 return err; 1179 } 1180 1181 nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED); 1182 1183 cfg80211_del_sched_scan_req(rdev, req); 1184 1185 return 0; 1186 } 1187 1188 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev, 1189 u64 reqid, bool driver_initiated) 1190 { 1191 struct cfg80211_sched_scan_request *sched_scan_req; 1192 1193 lockdep_assert_held(&rdev->wiphy.mtx); 1194 1195 sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid); 1196 if (!sched_scan_req) 1197 return -ENOENT; 1198 1199 return cfg80211_stop_sched_scan_req(rdev, sched_scan_req, 1200 driver_initiated); 1201 } 1202 1203 void cfg80211_bss_age(struct cfg80211_registered_device *rdev, 1204 unsigned long age_secs) 1205 { 1206 struct cfg80211_internal_bss *bss; 1207 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC); 1208 1209 spin_lock_bh(&rdev->bss_lock); 1210 list_for_each_entry(bss, &rdev->bss_list, list) 1211 bss->ts -= age_jiffies; 1212 spin_unlock_bh(&rdev->bss_lock); 1213 } 1214 1215 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev) 1216 { 1217 __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE); 1218 } 1219 1220 void cfg80211_bss_flush(struct wiphy *wiphy) 1221 { 1222 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1223 1224 spin_lock_bh(&rdev->bss_lock); 1225 __cfg80211_bss_expire(rdev, jiffies); 1226 spin_unlock_bh(&rdev->bss_lock); 1227 } 1228 EXPORT_SYMBOL(cfg80211_bss_flush); 1229 1230 const struct element * 1231 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len, 1232 const u8 *match, unsigned int match_len, 1233 unsigned int match_offset) 1234 { 1235 const struct element *elem; 1236 1237 for_each_element_id(elem, eid, ies, len) { 1238 if (elem->datalen >= match_offset + match_len && 1239 !memcmp(elem->data + match_offset, match, match_len)) 1240 return elem; 1241 } 1242 1243 return NULL; 1244 } 1245 EXPORT_SYMBOL(cfg80211_find_elem_match); 1246 1247 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type, 1248 const u8 *ies, 1249 unsigned int len) 1250 { 1251 const struct element *elem; 1252 u8 match[] = { oui >> 16, oui >> 8, oui, oui_type }; 1253 int match_len = (oui_type < 0) ? 3 : sizeof(match); 1254 1255 if (WARN_ON(oui_type > 0xff)) 1256 return NULL; 1257 1258 elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len, 1259 match, match_len, 0); 1260 1261 if (!elem || elem->datalen < 4) 1262 return NULL; 1263 1264 return elem; 1265 } 1266 EXPORT_SYMBOL(cfg80211_find_vendor_elem); 1267 1268 /** 1269 * enum bss_compare_mode - BSS compare mode 1270 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find) 1271 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode 1272 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode 1273 */ 1274 enum bss_compare_mode { 1275 BSS_CMP_REGULAR, 1276 BSS_CMP_HIDE_ZLEN, 1277 BSS_CMP_HIDE_NUL, 1278 }; 1279 1280 static int cmp_bss(struct cfg80211_bss *a, 1281 struct cfg80211_bss *b, 1282 enum bss_compare_mode mode) 1283 { 1284 const struct cfg80211_bss_ies *a_ies, *b_ies; 1285 const u8 *ie1 = NULL; 1286 const u8 *ie2 = NULL; 1287 int i, r; 1288 1289 if (a->channel != b->channel) 1290 return (b->channel->center_freq * 1000 + b->channel->freq_offset) - 1291 (a->channel->center_freq * 1000 + a->channel->freq_offset); 1292 1293 a_ies = rcu_access_pointer(a->ies); 1294 if (!a_ies) 1295 return -1; 1296 b_ies = rcu_access_pointer(b->ies); 1297 if (!b_ies) 1298 return 1; 1299 1300 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability)) 1301 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID, 1302 a_ies->data, a_ies->len); 1303 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability)) 1304 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID, 1305 b_ies->data, b_ies->len); 1306 if (ie1 && ie2) { 1307 int mesh_id_cmp; 1308 1309 if (ie1[1] == ie2[1]) 1310 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]); 1311 else 1312 mesh_id_cmp = ie2[1] - ie1[1]; 1313 1314 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, 1315 a_ies->data, a_ies->len); 1316 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, 1317 b_ies->data, b_ies->len); 1318 if (ie1 && ie2) { 1319 if (mesh_id_cmp) 1320 return mesh_id_cmp; 1321 if (ie1[1] != ie2[1]) 1322 return ie2[1] - ie1[1]; 1323 return memcmp(ie1 + 2, ie2 + 2, ie1[1]); 1324 } 1325 } 1326 1327 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid)); 1328 if (r) 1329 return r; 1330 1331 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len); 1332 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len); 1333 1334 if (!ie1 && !ie2) 1335 return 0; 1336 1337 /* 1338 * Note that with "hide_ssid", the function returns a match if 1339 * the already-present BSS ("b") is a hidden SSID beacon for 1340 * the new BSS ("a"). 1341 */ 1342 1343 /* sort missing IE before (left of) present IE */ 1344 if (!ie1) 1345 return -1; 1346 if (!ie2) 1347 return 1; 1348 1349 switch (mode) { 1350 case BSS_CMP_HIDE_ZLEN: 1351 /* 1352 * In ZLEN mode we assume the BSS entry we're 1353 * looking for has a zero-length SSID. So if 1354 * the one we're looking at right now has that, 1355 * return 0. Otherwise, return the difference 1356 * in length, but since we're looking for the 1357 * 0-length it's really equivalent to returning 1358 * the length of the one we're looking at. 1359 * 1360 * No content comparison is needed as we assume 1361 * the content length is zero. 1362 */ 1363 return ie2[1]; 1364 case BSS_CMP_REGULAR: 1365 default: 1366 /* sort by length first, then by contents */ 1367 if (ie1[1] != ie2[1]) 1368 return ie2[1] - ie1[1]; 1369 return memcmp(ie1 + 2, ie2 + 2, ie1[1]); 1370 case BSS_CMP_HIDE_NUL: 1371 if (ie1[1] != ie2[1]) 1372 return ie2[1] - ie1[1]; 1373 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */ 1374 for (i = 0; i < ie2[1]; i++) 1375 if (ie2[i + 2]) 1376 return -1; 1377 return 0; 1378 } 1379 } 1380 1381 static bool cfg80211_bss_type_match(u16 capability, 1382 enum nl80211_band band, 1383 enum ieee80211_bss_type bss_type) 1384 { 1385 bool ret = true; 1386 u16 mask, val; 1387 1388 if (bss_type == IEEE80211_BSS_TYPE_ANY) 1389 return ret; 1390 1391 if (band == NL80211_BAND_60GHZ) { 1392 mask = WLAN_CAPABILITY_DMG_TYPE_MASK; 1393 switch (bss_type) { 1394 case IEEE80211_BSS_TYPE_ESS: 1395 val = WLAN_CAPABILITY_DMG_TYPE_AP; 1396 break; 1397 case IEEE80211_BSS_TYPE_PBSS: 1398 val = WLAN_CAPABILITY_DMG_TYPE_PBSS; 1399 break; 1400 case IEEE80211_BSS_TYPE_IBSS: 1401 val = WLAN_CAPABILITY_DMG_TYPE_IBSS; 1402 break; 1403 default: 1404 return false; 1405 } 1406 } else { 1407 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS; 1408 switch (bss_type) { 1409 case IEEE80211_BSS_TYPE_ESS: 1410 val = WLAN_CAPABILITY_ESS; 1411 break; 1412 case IEEE80211_BSS_TYPE_IBSS: 1413 val = WLAN_CAPABILITY_IBSS; 1414 break; 1415 case IEEE80211_BSS_TYPE_MBSS: 1416 val = 0; 1417 break; 1418 default: 1419 return false; 1420 } 1421 } 1422 1423 ret = ((capability & mask) == val); 1424 return ret; 1425 } 1426 1427 /* Returned bss is reference counted and must be cleaned up appropriately. */ 1428 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy, 1429 struct ieee80211_channel *channel, 1430 const u8 *bssid, 1431 const u8 *ssid, size_t ssid_len, 1432 enum ieee80211_bss_type bss_type, 1433 enum ieee80211_privacy privacy) 1434 { 1435 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1436 struct cfg80211_internal_bss *bss, *res = NULL; 1437 unsigned long now = jiffies; 1438 int bss_privacy; 1439 1440 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type, 1441 privacy); 1442 1443 spin_lock_bh(&rdev->bss_lock); 1444 1445 list_for_each_entry(bss, &rdev->bss_list, list) { 1446 if (!cfg80211_bss_type_match(bss->pub.capability, 1447 bss->pub.channel->band, bss_type)) 1448 continue; 1449 1450 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY); 1451 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) || 1452 (privacy == IEEE80211_PRIVACY_OFF && bss_privacy)) 1453 continue; 1454 if (channel && bss->pub.channel != channel) 1455 continue; 1456 if (!is_valid_ether_addr(bss->pub.bssid)) 1457 continue; 1458 /* Don't get expired BSS structs */ 1459 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) && 1460 !atomic_read(&bss->hold)) 1461 continue; 1462 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) { 1463 res = bss; 1464 bss_ref_get(rdev, res); 1465 break; 1466 } 1467 } 1468 1469 spin_unlock_bh(&rdev->bss_lock); 1470 if (!res) 1471 return NULL; 1472 trace_cfg80211_return_bss(&res->pub); 1473 return &res->pub; 1474 } 1475 EXPORT_SYMBOL(cfg80211_get_bss); 1476 1477 static void rb_insert_bss(struct cfg80211_registered_device *rdev, 1478 struct cfg80211_internal_bss *bss) 1479 { 1480 struct rb_node **p = &rdev->bss_tree.rb_node; 1481 struct rb_node *parent = NULL; 1482 struct cfg80211_internal_bss *tbss; 1483 int cmp; 1484 1485 while (*p) { 1486 parent = *p; 1487 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn); 1488 1489 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR); 1490 1491 if (WARN_ON(!cmp)) { 1492 /* will sort of leak this BSS */ 1493 return; 1494 } 1495 1496 if (cmp < 0) 1497 p = &(*p)->rb_left; 1498 else 1499 p = &(*p)->rb_right; 1500 } 1501 1502 rb_link_node(&bss->rbn, parent, p); 1503 rb_insert_color(&bss->rbn, &rdev->bss_tree); 1504 } 1505 1506 static struct cfg80211_internal_bss * 1507 rb_find_bss(struct cfg80211_registered_device *rdev, 1508 struct cfg80211_internal_bss *res, 1509 enum bss_compare_mode mode) 1510 { 1511 struct rb_node *n = rdev->bss_tree.rb_node; 1512 struct cfg80211_internal_bss *bss; 1513 int r; 1514 1515 while (n) { 1516 bss = rb_entry(n, struct cfg80211_internal_bss, rbn); 1517 r = cmp_bss(&res->pub, &bss->pub, mode); 1518 1519 if (r == 0) 1520 return bss; 1521 else if (r < 0) 1522 n = n->rb_left; 1523 else 1524 n = n->rb_right; 1525 } 1526 1527 return NULL; 1528 } 1529 1530 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, 1531 struct cfg80211_internal_bss *new) 1532 { 1533 const struct cfg80211_bss_ies *ies; 1534 struct cfg80211_internal_bss *bss; 1535 const u8 *ie; 1536 int i, ssidlen; 1537 u8 fold = 0; 1538 u32 n_entries = 0; 1539 1540 ies = rcu_access_pointer(new->pub.beacon_ies); 1541 if (WARN_ON(!ies)) 1542 return false; 1543 1544 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); 1545 if (!ie) { 1546 /* nothing to do */ 1547 return true; 1548 } 1549 1550 ssidlen = ie[1]; 1551 for (i = 0; i < ssidlen; i++) 1552 fold |= ie[2 + i]; 1553 1554 if (fold) { 1555 /* not a hidden SSID */ 1556 return true; 1557 } 1558 1559 /* This is the bad part ... */ 1560 1561 list_for_each_entry(bss, &rdev->bss_list, list) { 1562 /* 1563 * we're iterating all the entries anyway, so take the 1564 * opportunity to validate the list length accounting 1565 */ 1566 n_entries++; 1567 1568 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid)) 1569 continue; 1570 if (bss->pub.channel != new->pub.channel) 1571 continue; 1572 if (bss->pub.scan_width != new->pub.scan_width) 1573 continue; 1574 if (rcu_access_pointer(bss->pub.beacon_ies)) 1575 continue; 1576 ies = rcu_access_pointer(bss->pub.ies); 1577 if (!ies) 1578 continue; 1579 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); 1580 if (!ie) 1581 continue; 1582 if (ssidlen && ie[1] != ssidlen) 1583 continue; 1584 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss)) 1585 continue; 1586 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list))) 1587 list_del(&bss->hidden_list); 1588 /* combine them */ 1589 list_add(&bss->hidden_list, &new->hidden_list); 1590 bss->pub.hidden_beacon_bss = &new->pub; 1591 new->refcount += bss->refcount; 1592 rcu_assign_pointer(bss->pub.beacon_ies, 1593 new->pub.beacon_ies); 1594 } 1595 1596 WARN_ONCE(n_entries != rdev->bss_entries, 1597 "rdev bss entries[%d]/list[len:%d] corruption\n", 1598 rdev->bss_entries, n_entries); 1599 1600 return true; 1601 } 1602 1603 struct cfg80211_non_tx_bss { 1604 struct cfg80211_bss *tx_bss; 1605 u8 max_bssid_indicator; 1606 u8 bssid_index; 1607 }; 1608 1609 static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known, 1610 const struct cfg80211_bss_ies *new_ies, 1611 const struct cfg80211_bss_ies *old_ies) 1612 { 1613 struct cfg80211_internal_bss *bss; 1614 1615 /* Assign beacon IEs to all sub entries */ 1616 list_for_each_entry(bss, &known->hidden_list, hidden_list) { 1617 const struct cfg80211_bss_ies *ies; 1618 1619 ies = rcu_access_pointer(bss->pub.beacon_ies); 1620 WARN_ON(ies != old_ies); 1621 1622 rcu_assign_pointer(bss->pub.beacon_ies, new_ies); 1623 } 1624 } 1625 1626 static bool 1627 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, 1628 struct cfg80211_internal_bss *known, 1629 struct cfg80211_internal_bss *new, 1630 bool signal_valid) 1631 { 1632 lockdep_assert_held(&rdev->bss_lock); 1633 1634 /* Update IEs */ 1635 if (rcu_access_pointer(new->pub.proberesp_ies)) { 1636 const struct cfg80211_bss_ies *old; 1637 1638 old = rcu_access_pointer(known->pub.proberesp_ies); 1639 1640 rcu_assign_pointer(known->pub.proberesp_ies, 1641 new->pub.proberesp_ies); 1642 /* Override possible earlier Beacon frame IEs */ 1643 rcu_assign_pointer(known->pub.ies, 1644 new->pub.proberesp_ies); 1645 if (old) 1646 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 1647 } else if (rcu_access_pointer(new->pub.beacon_ies)) { 1648 const struct cfg80211_bss_ies *old; 1649 1650 if (known->pub.hidden_beacon_bss && 1651 !list_empty(&known->hidden_list)) { 1652 const struct cfg80211_bss_ies *f; 1653 1654 /* The known BSS struct is one of the probe 1655 * response members of a group, but we're 1656 * receiving a beacon (beacon_ies in the new 1657 * bss is used). This can only mean that the 1658 * AP changed its beacon from not having an 1659 * SSID to showing it, which is confusing so 1660 * drop this information. 1661 */ 1662 1663 f = rcu_access_pointer(new->pub.beacon_ies); 1664 kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head); 1665 return false; 1666 } 1667 1668 old = rcu_access_pointer(known->pub.beacon_ies); 1669 1670 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies); 1671 1672 /* Override IEs if they were from a beacon before */ 1673 if (old == rcu_access_pointer(known->pub.ies)) 1674 rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies); 1675 1676 cfg80211_update_hidden_bsses(known, 1677 rcu_access_pointer(new->pub.beacon_ies), 1678 old); 1679 1680 if (old) 1681 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 1682 } 1683 1684 known->pub.beacon_interval = new->pub.beacon_interval; 1685 1686 /* don't update the signal if beacon was heard on 1687 * adjacent channel. 1688 */ 1689 if (signal_valid) 1690 known->pub.signal = new->pub.signal; 1691 known->pub.capability = new->pub.capability; 1692 known->ts = new->ts; 1693 known->ts_boottime = new->ts_boottime; 1694 known->parent_tsf = new->parent_tsf; 1695 known->pub.chains = new->pub.chains; 1696 memcpy(known->pub.chain_signal, new->pub.chain_signal, 1697 IEEE80211_MAX_CHAINS); 1698 ether_addr_copy(known->parent_bssid, new->parent_bssid); 1699 known->pub.max_bssid_indicator = new->pub.max_bssid_indicator; 1700 known->pub.bssid_index = new->pub.bssid_index; 1701 1702 return true; 1703 } 1704 1705 /* Returned bss is reference counted and must be cleaned up appropriately. */ 1706 struct cfg80211_internal_bss * 1707 cfg80211_bss_update(struct cfg80211_registered_device *rdev, 1708 struct cfg80211_internal_bss *tmp, 1709 bool signal_valid, unsigned long ts) 1710 { 1711 struct cfg80211_internal_bss *found = NULL; 1712 1713 if (WARN_ON(!tmp->pub.channel)) 1714 return NULL; 1715 1716 tmp->ts = ts; 1717 1718 spin_lock_bh(&rdev->bss_lock); 1719 1720 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) { 1721 spin_unlock_bh(&rdev->bss_lock); 1722 return NULL; 1723 } 1724 1725 found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR); 1726 1727 if (found) { 1728 if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid)) 1729 goto drop; 1730 } else { 1731 struct cfg80211_internal_bss *new; 1732 struct cfg80211_internal_bss *hidden; 1733 struct cfg80211_bss_ies *ies; 1734 1735 /* 1736 * create a copy -- the "res" variable that is passed in 1737 * is allocated on the stack since it's not needed in the 1738 * more common case of an update 1739 */ 1740 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size, 1741 GFP_ATOMIC); 1742 if (!new) { 1743 ies = (void *)rcu_dereference(tmp->pub.beacon_ies); 1744 if (ies) 1745 kfree_rcu(ies, rcu_head); 1746 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies); 1747 if (ies) 1748 kfree_rcu(ies, rcu_head); 1749 goto drop; 1750 } 1751 memcpy(new, tmp, sizeof(*new)); 1752 new->refcount = 1; 1753 INIT_LIST_HEAD(&new->hidden_list); 1754 INIT_LIST_HEAD(&new->pub.nontrans_list); 1755 /* we'll set this later if it was non-NULL */ 1756 new->pub.transmitted_bss = NULL; 1757 1758 if (rcu_access_pointer(tmp->pub.proberesp_ies)) { 1759 hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN); 1760 if (!hidden) 1761 hidden = rb_find_bss(rdev, tmp, 1762 BSS_CMP_HIDE_NUL); 1763 if (hidden) { 1764 new->pub.hidden_beacon_bss = &hidden->pub; 1765 list_add(&new->hidden_list, 1766 &hidden->hidden_list); 1767 hidden->refcount++; 1768 rcu_assign_pointer(new->pub.beacon_ies, 1769 hidden->pub.beacon_ies); 1770 } 1771 } else { 1772 /* 1773 * Ok so we found a beacon, and don't have an entry. If 1774 * it's a beacon with hidden SSID, we might be in for an 1775 * expensive search for any probe responses that should 1776 * be grouped with this beacon for updates ... 1777 */ 1778 if (!cfg80211_combine_bsses(rdev, new)) { 1779 bss_ref_put(rdev, new); 1780 goto drop; 1781 } 1782 } 1783 1784 if (rdev->bss_entries >= bss_entries_limit && 1785 !cfg80211_bss_expire_oldest(rdev)) { 1786 bss_ref_put(rdev, new); 1787 goto drop; 1788 } 1789 1790 /* This must be before the call to bss_ref_get */ 1791 if (tmp->pub.transmitted_bss) { 1792 new->pub.transmitted_bss = tmp->pub.transmitted_bss; 1793 bss_ref_get(rdev, bss_from_pub(tmp->pub.transmitted_bss)); 1794 } 1795 1796 list_add_tail(&new->list, &rdev->bss_list); 1797 rdev->bss_entries++; 1798 rb_insert_bss(rdev, new); 1799 found = new; 1800 } 1801 1802 rdev->bss_generation++; 1803 bss_ref_get(rdev, found); 1804 spin_unlock_bh(&rdev->bss_lock); 1805 1806 return found; 1807 drop: 1808 spin_unlock_bh(&rdev->bss_lock); 1809 return NULL; 1810 } 1811 1812 int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen, 1813 enum nl80211_band band) 1814 { 1815 const struct element *tmp; 1816 1817 if (band == NL80211_BAND_6GHZ) { 1818 struct ieee80211_he_operation *he_oper; 1819 1820 tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, 1821 ielen); 1822 if (tmp && tmp->datalen >= sizeof(*he_oper) && 1823 tmp->datalen >= ieee80211_he_oper_size(&tmp->data[1])) { 1824 const struct ieee80211_he_6ghz_oper *he_6ghz_oper; 1825 1826 he_oper = (void *)&tmp->data[1]; 1827 1828 he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper); 1829 if (!he_6ghz_oper) 1830 return -1; 1831 1832 return he_6ghz_oper->primary; 1833 } 1834 } else if (band == NL80211_BAND_S1GHZ) { 1835 tmp = cfg80211_find_elem(WLAN_EID_S1G_OPERATION, ie, ielen); 1836 if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) { 1837 struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data; 1838 1839 return s1gop->oper_ch; 1840 } 1841 } else { 1842 tmp = cfg80211_find_elem(WLAN_EID_DS_PARAMS, ie, ielen); 1843 if (tmp && tmp->datalen == 1) 1844 return tmp->data[0]; 1845 1846 tmp = cfg80211_find_elem(WLAN_EID_HT_OPERATION, ie, ielen); 1847 if (tmp && 1848 tmp->datalen >= sizeof(struct ieee80211_ht_operation)) { 1849 struct ieee80211_ht_operation *htop = (void *)tmp->data; 1850 1851 return htop->primary_chan; 1852 } 1853 } 1854 1855 return -1; 1856 } 1857 EXPORT_SYMBOL(cfg80211_get_ies_channel_number); 1858 1859 /* 1860 * Update RX channel information based on the available frame payload 1861 * information. This is mainly for the 2.4 GHz band where frames can be received 1862 * from neighboring channels and the Beacon frames use the DSSS Parameter Set 1863 * element to indicate the current (transmitting) channel, but this might also 1864 * be needed on other bands if RX frequency does not match with the actual 1865 * operating channel of a BSS, or if the AP reports a different primary channel. 1866 */ 1867 static struct ieee80211_channel * 1868 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen, 1869 struct ieee80211_channel *channel, 1870 enum nl80211_bss_scan_width scan_width) 1871 { 1872 u32 freq; 1873 int channel_number; 1874 struct ieee80211_channel *alt_channel; 1875 1876 channel_number = cfg80211_get_ies_channel_number(ie, ielen, 1877 channel->band); 1878 1879 if (channel_number < 0) { 1880 /* No channel information in frame payload */ 1881 return channel; 1882 } 1883 1884 freq = ieee80211_channel_to_freq_khz(channel_number, channel->band); 1885 1886 /* 1887 * Frame info (beacon/prob res) is the same as received channel, 1888 * no need for further processing. 1889 */ 1890 if (freq == ieee80211_channel_to_khz(channel)) 1891 return channel; 1892 1893 alt_channel = ieee80211_get_channel_khz(wiphy, freq); 1894 if (!alt_channel) { 1895 if (channel->band == NL80211_BAND_2GHZ || 1896 channel->band == NL80211_BAND_6GHZ) { 1897 /* 1898 * Better not allow unexpected channels when that could 1899 * be going beyond the 1-11 range (e.g., discovering 1900 * BSS on channel 12 when radio is configured for 1901 * channel 11) or beyond the 6 GHz channel range. 1902 */ 1903 return NULL; 1904 } 1905 1906 /* No match for the payload channel number - ignore it */ 1907 return channel; 1908 } 1909 1910 if (scan_width == NL80211_BSS_CHAN_WIDTH_10 || 1911 scan_width == NL80211_BSS_CHAN_WIDTH_5) { 1912 /* 1913 * Ignore channel number in 5 and 10 MHz channels where there 1914 * may not be an n:1 or 1:n mapping between frequencies and 1915 * channel numbers. 1916 */ 1917 return channel; 1918 } 1919 1920 /* 1921 * Use the channel determined through the payload channel number 1922 * instead of the RX channel reported by the driver. 1923 */ 1924 if (alt_channel->flags & IEEE80211_CHAN_DISABLED) 1925 return NULL; 1926 return alt_channel; 1927 } 1928 1929 /* Returned bss is reference counted and must be cleaned up appropriately. */ 1930 static struct cfg80211_bss * 1931 cfg80211_inform_single_bss_data(struct wiphy *wiphy, 1932 struct cfg80211_inform_bss *data, 1933 enum cfg80211_bss_frame_type ftype, 1934 const u8 *bssid, u64 tsf, u16 capability, 1935 u16 beacon_interval, const u8 *ie, size_t ielen, 1936 struct cfg80211_non_tx_bss *non_tx_data, 1937 gfp_t gfp) 1938 { 1939 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1940 struct cfg80211_bss_ies *ies; 1941 struct ieee80211_channel *channel; 1942 struct cfg80211_internal_bss tmp = {}, *res; 1943 int bss_type; 1944 bool signal_valid; 1945 unsigned long ts; 1946 1947 if (WARN_ON(!wiphy)) 1948 return NULL; 1949 1950 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC && 1951 (data->signal < 0 || data->signal > 100))) 1952 return NULL; 1953 1954 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan, 1955 data->scan_width); 1956 if (!channel) 1957 return NULL; 1958 1959 memcpy(tmp.pub.bssid, bssid, ETH_ALEN); 1960 tmp.pub.channel = channel; 1961 tmp.pub.scan_width = data->scan_width; 1962 tmp.pub.signal = data->signal; 1963 tmp.pub.beacon_interval = beacon_interval; 1964 tmp.pub.capability = capability; 1965 tmp.ts_boottime = data->boottime_ns; 1966 tmp.parent_tsf = data->parent_tsf; 1967 ether_addr_copy(tmp.parent_bssid, data->parent_bssid); 1968 1969 if (non_tx_data) { 1970 tmp.pub.transmitted_bss = non_tx_data->tx_bss; 1971 ts = bss_from_pub(non_tx_data->tx_bss)->ts; 1972 tmp.pub.bssid_index = non_tx_data->bssid_index; 1973 tmp.pub.max_bssid_indicator = non_tx_data->max_bssid_indicator; 1974 } else { 1975 ts = jiffies; 1976 } 1977 1978 /* 1979 * If we do not know here whether the IEs are from a Beacon or Probe 1980 * Response frame, we need to pick one of the options and only use it 1981 * with the driver that does not provide the full Beacon/Probe Response 1982 * frame. Use Beacon frame pointer to avoid indicating that this should 1983 * override the IEs pointer should we have received an earlier 1984 * indication of Probe Response data. 1985 */ 1986 ies = kzalloc(sizeof(*ies) + ielen, gfp); 1987 if (!ies) 1988 return NULL; 1989 ies->len = ielen; 1990 ies->tsf = tsf; 1991 ies->from_beacon = false; 1992 memcpy(ies->data, ie, ielen); 1993 1994 switch (ftype) { 1995 case CFG80211_BSS_FTYPE_BEACON: 1996 ies->from_beacon = true; 1997 fallthrough; 1998 case CFG80211_BSS_FTYPE_UNKNOWN: 1999 rcu_assign_pointer(tmp.pub.beacon_ies, ies); 2000 break; 2001 case CFG80211_BSS_FTYPE_PRESP: 2002 rcu_assign_pointer(tmp.pub.proberesp_ies, ies); 2003 break; 2004 } 2005 rcu_assign_pointer(tmp.pub.ies, ies); 2006 2007 signal_valid = data->chan == channel; 2008 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, ts); 2009 if (!res) 2010 return NULL; 2011 2012 if (channel->band == NL80211_BAND_60GHZ) { 2013 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK; 2014 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP || 2015 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS) 2016 regulatory_hint_found_beacon(wiphy, channel, gfp); 2017 } else { 2018 if (res->pub.capability & WLAN_CAPABILITY_ESS) 2019 regulatory_hint_found_beacon(wiphy, channel, gfp); 2020 } 2021 2022 if (non_tx_data) { 2023 /* this is a nontransmitting bss, we need to add it to 2024 * transmitting bss' list if it is not there 2025 */ 2026 spin_lock_bh(&rdev->bss_lock); 2027 if (cfg80211_add_nontrans_list(non_tx_data->tx_bss, 2028 &res->pub)) { 2029 if (__cfg80211_unlink_bss(rdev, res)) { 2030 rdev->bss_generation++; 2031 res = NULL; 2032 } 2033 } 2034 spin_unlock_bh(&rdev->bss_lock); 2035 2036 if (!res) 2037 return NULL; 2038 } 2039 2040 trace_cfg80211_return_bss(&res->pub); 2041 /* cfg80211_bss_update gives us a referenced result */ 2042 return &res->pub; 2043 } 2044 2045 static const struct element 2046 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen, 2047 const struct element *mbssid_elem, 2048 const struct element *sub_elem) 2049 { 2050 const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen; 2051 const struct element *next_mbssid; 2052 const struct element *next_sub; 2053 2054 next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, 2055 mbssid_end, 2056 ielen - (mbssid_end - ie)); 2057 2058 /* 2059 * If it is not the last subelement in current MBSSID IE or there isn't 2060 * a next MBSSID IE - profile is complete. 2061 */ 2062 if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) || 2063 !next_mbssid) 2064 return NULL; 2065 2066 /* For any length error, just return NULL */ 2067 2068 if (next_mbssid->datalen < 4) 2069 return NULL; 2070 2071 next_sub = (void *)&next_mbssid->data[1]; 2072 2073 if (next_mbssid->data + next_mbssid->datalen < 2074 next_sub->data + next_sub->datalen) 2075 return NULL; 2076 2077 if (next_sub->id != 0 || next_sub->datalen < 2) 2078 return NULL; 2079 2080 /* 2081 * Check if the first element in the next sub element is a start 2082 * of a new profile 2083 */ 2084 return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ? 2085 NULL : next_mbssid; 2086 } 2087 2088 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen, 2089 const struct element *mbssid_elem, 2090 const struct element *sub_elem, 2091 u8 *merged_ie, size_t max_copy_len) 2092 { 2093 size_t copied_len = sub_elem->datalen; 2094 const struct element *next_mbssid; 2095 2096 if (sub_elem->datalen > max_copy_len) 2097 return 0; 2098 2099 memcpy(merged_ie, sub_elem->data, sub_elem->datalen); 2100 2101 while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen, 2102 mbssid_elem, 2103 sub_elem))) { 2104 const struct element *next_sub = (void *)&next_mbssid->data[1]; 2105 2106 if (copied_len + next_sub->datalen > max_copy_len) 2107 break; 2108 memcpy(merged_ie + copied_len, next_sub->data, 2109 next_sub->datalen); 2110 copied_len += next_sub->datalen; 2111 } 2112 2113 return copied_len; 2114 } 2115 EXPORT_SYMBOL(cfg80211_merge_profile); 2116 2117 static void cfg80211_parse_mbssid_data(struct wiphy *wiphy, 2118 struct cfg80211_inform_bss *data, 2119 enum cfg80211_bss_frame_type ftype, 2120 const u8 *bssid, u64 tsf, 2121 u16 beacon_interval, const u8 *ie, 2122 size_t ielen, 2123 struct cfg80211_non_tx_bss *non_tx_data, 2124 gfp_t gfp) 2125 { 2126 const u8 *mbssid_index_ie; 2127 const struct element *elem, *sub; 2128 size_t new_ie_len; 2129 u8 new_bssid[ETH_ALEN]; 2130 u8 *new_ie, *profile; 2131 u64 seen_indices = 0; 2132 u16 capability; 2133 struct cfg80211_bss *bss; 2134 2135 if (!non_tx_data) 2136 return; 2137 if (!cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) 2138 return; 2139 if (!wiphy->support_mbssid) 2140 return; 2141 if (wiphy->support_only_he_mbssid && 2142 !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen)) 2143 return; 2144 2145 new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp); 2146 if (!new_ie) 2147 return; 2148 2149 profile = kmalloc(ielen, gfp); 2150 if (!profile) 2151 goto out; 2152 2153 for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) { 2154 if (elem->datalen < 4) 2155 continue; 2156 if (elem->data[0] < 1 || (int)elem->data[0] > 8) 2157 continue; 2158 for_each_element(sub, elem->data + 1, elem->datalen - 1) { 2159 u8 profile_len; 2160 2161 if (sub->id != 0 || sub->datalen < 4) { 2162 /* not a valid BSS profile */ 2163 continue; 2164 } 2165 2166 if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP || 2167 sub->data[1] != 2) { 2168 /* The first element within the Nontransmitted 2169 * BSSID Profile is not the Nontransmitted 2170 * BSSID Capability element. 2171 */ 2172 continue; 2173 } 2174 2175 memset(profile, 0, ielen); 2176 profile_len = cfg80211_merge_profile(ie, ielen, 2177 elem, 2178 sub, 2179 profile, 2180 ielen); 2181 2182 /* found a Nontransmitted BSSID Profile */ 2183 mbssid_index_ie = cfg80211_find_ie 2184 (WLAN_EID_MULTI_BSSID_IDX, 2185 profile, profile_len); 2186 if (!mbssid_index_ie || mbssid_index_ie[1] < 1 || 2187 mbssid_index_ie[2] == 0 || 2188 mbssid_index_ie[2] > 46) { 2189 /* No valid Multiple BSSID-Index element */ 2190 continue; 2191 } 2192 2193 if (seen_indices & BIT_ULL(mbssid_index_ie[2])) 2194 /* We don't support legacy split of a profile */ 2195 net_dbg_ratelimited("Partial info for BSSID index %d\n", 2196 mbssid_index_ie[2]); 2197 2198 seen_indices |= BIT_ULL(mbssid_index_ie[2]); 2199 2200 non_tx_data->bssid_index = mbssid_index_ie[2]; 2201 non_tx_data->max_bssid_indicator = elem->data[0]; 2202 2203 cfg80211_gen_new_bssid(bssid, 2204 non_tx_data->max_bssid_indicator, 2205 non_tx_data->bssid_index, 2206 new_bssid); 2207 memset(new_ie, 0, IEEE80211_MAX_DATA_LEN); 2208 new_ie_len = cfg80211_gen_new_ie(ie, ielen, 2209 profile, 2210 profile_len, new_ie, 2211 gfp); 2212 if (!new_ie_len) 2213 continue; 2214 2215 capability = get_unaligned_le16(profile + 2); 2216 bss = cfg80211_inform_single_bss_data(wiphy, data, 2217 ftype, 2218 new_bssid, tsf, 2219 capability, 2220 beacon_interval, 2221 new_ie, 2222 new_ie_len, 2223 non_tx_data, 2224 gfp); 2225 if (!bss) 2226 break; 2227 cfg80211_put_bss(wiphy, bss); 2228 } 2229 } 2230 2231 out: 2232 kfree(new_ie); 2233 kfree(profile); 2234 } 2235 2236 struct cfg80211_bss * 2237 cfg80211_inform_bss_data(struct wiphy *wiphy, 2238 struct cfg80211_inform_bss *data, 2239 enum cfg80211_bss_frame_type ftype, 2240 const u8 *bssid, u64 tsf, u16 capability, 2241 u16 beacon_interval, const u8 *ie, size_t ielen, 2242 gfp_t gfp) 2243 { 2244 struct cfg80211_bss *res; 2245 struct cfg80211_non_tx_bss non_tx_data; 2246 2247 res = cfg80211_inform_single_bss_data(wiphy, data, ftype, bssid, tsf, 2248 capability, beacon_interval, ie, 2249 ielen, NULL, gfp); 2250 if (!res) 2251 return NULL; 2252 non_tx_data.tx_bss = res; 2253 cfg80211_parse_mbssid_data(wiphy, data, ftype, bssid, tsf, 2254 beacon_interval, ie, ielen, &non_tx_data, 2255 gfp); 2256 return res; 2257 } 2258 EXPORT_SYMBOL(cfg80211_inform_bss_data); 2259 2260 static void 2261 cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy, 2262 struct cfg80211_inform_bss *data, 2263 struct ieee80211_mgmt *mgmt, size_t len, 2264 struct cfg80211_non_tx_bss *non_tx_data, 2265 gfp_t gfp) 2266 { 2267 enum cfg80211_bss_frame_type ftype; 2268 const u8 *ie = mgmt->u.probe_resp.variable; 2269 size_t ielen = len - offsetof(struct ieee80211_mgmt, 2270 u.probe_resp.variable); 2271 2272 ftype = ieee80211_is_beacon(mgmt->frame_control) ? 2273 CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP; 2274 2275 cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid, 2276 le64_to_cpu(mgmt->u.probe_resp.timestamp), 2277 le16_to_cpu(mgmt->u.probe_resp.beacon_int), 2278 ie, ielen, non_tx_data, gfp); 2279 } 2280 2281 static void 2282 cfg80211_update_notlisted_nontrans(struct wiphy *wiphy, 2283 struct cfg80211_bss *nontrans_bss, 2284 struct ieee80211_mgmt *mgmt, size_t len) 2285 { 2286 u8 *ie, *new_ie, *pos; 2287 const struct element *nontrans_ssid; 2288 const u8 *trans_ssid, *mbssid; 2289 size_t ielen = len - offsetof(struct ieee80211_mgmt, 2290 u.probe_resp.variable); 2291 size_t new_ie_len; 2292 struct cfg80211_bss_ies *new_ies; 2293 const struct cfg80211_bss_ies *old; 2294 size_t cpy_len; 2295 2296 lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock); 2297 2298 ie = mgmt->u.probe_resp.variable; 2299 2300 new_ie_len = ielen; 2301 trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); 2302 if (!trans_ssid) 2303 return; 2304 new_ie_len -= trans_ssid[1]; 2305 mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen); 2306 /* 2307 * It's not valid to have the MBSSID element before SSID 2308 * ignore if that happens - the code below assumes it is 2309 * after (while copying things inbetween). 2310 */ 2311 if (!mbssid || mbssid < trans_ssid) 2312 return; 2313 new_ie_len -= mbssid[1]; 2314 2315 nontrans_ssid = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID); 2316 if (!nontrans_ssid) 2317 return; 2318 2319 new_ie_len += nontrans_ssid->datalen; 2320 2321 /* generate new ie for nontrans BSS 2322 * 1. replace SSID with nontrans BSS' SSID 2323 * 2. skip MBSSID IE 2324 */ 2325 new_ie = kzalloc(new_ie_len, GFP_ATOMIC); 2326 if (!new_ie) 2327 return; 2328 2329 new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC); 2330 if (!new_ies) 2331 goto out_free; 2332 2333 pos = new_ie; 2334 2335 /* copy the nontransmitted SSID */ 2336 cpy_len = nontrans_ssid->datalen + 2; 2337 memcpy(pos, nontrans_ssid, cpy_len); 2338 pos += cpy_len; 2339 /* copy the IEs between SSID and MBSSID */ 2340 cpy_len = trans_ssid[1] + 2; 2341 memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len))); 2342 pos += (mbssid - (trans_ssid + cpy_len)); 2343 /* copy the IEs after MBSSID */ 2344 cpy_len = mbssid[1] + 2; 2345 memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len))); 2346 2347 /* update ie */ 2348 new_ies->len = new_ie_len; 2349 new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp); 2350 new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control); 2351 memcpy(new_ies->data, new_ie, new_ie_len); 2352 if (ieee80211_is_probe_resp(mgmt->frame_control)) { 2353 old = rcu_access_pointer(nontrans_bss->proberesp_ies); 2354 rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies); 2355 rcu_assign_pointer(nontrans_bss->ies, new_ies); 2356 if (old) 2357 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 2358 } else { 2359 old = rcu_access_pointer(nontrans_bss->beacon_ies); 2360 rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies); 2361 cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss), 2362 new_ies, old); 2363 rcu_assign_pointer(nontrans_bss->ies, new_ies); 2364 if (old) 2365 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 2366 } 2367 2368 out_free: 2369 kfree(new_ie); 2370 } 2371 2372 /* cfg80211_inform_bss_width_frame helper */ 2373 static struct cfg80211_bss * 2374 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy, 2375 struct cfg80211_inform_bss *data, 2376 struct ieee80211_mgmt *mgmt, size_t len, 2377 gfp_t gfp) 2378 { 2379 struct cfg80211_internal_bss tmp = {}, *res; 2380 struct cfg80211_bss_ies *ies; 2381 struct ieee80211_channel *channel; 2382 bool signal_valid; 2383 struct ieee80211_ext *ext = NULL; 2384 u8 *bssid, *variable; 2385 u16 capability, beacon_int; 2386 size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt, 2387 u.probe_resp.variable); 2388 int bss_type; 2389 2390 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) != 2391 offsetof(struct ieee80211_mgmt, u.beacon.variable)); 2392 2393 trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len); 2394 2395 if (WARN_ON(!mgmt)) 2396 return NULL; 2397 2398 if (WARN_ON(!wiphy)) 2399 return NULL; 2400 2401 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC && 2402 (data->signal < 0 || data->signal > 100))) 2403 return NULL; 2404 2405 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) { 2406 ext = (void *) mgmt; 2407 min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon); 2408 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control)) 2409 min_hdr_len = offsetof(struct ieee80211_ext, 2410 u.s1g_short_beacon.variable); 2411 } 2412 2413 if (WARN_ON(len < min_hdr_len)) 2414 return NULL; 2415 2416 ielen = len - min_hdr_len; 2417 variable = mgmt->u.probe_resp.variable; 2418 if (ext) { 2419 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control)) 2420 variable = ext->u.s1g_short_beacon.variable; 2421 else 2422 variable = ext->u.s1g_beacon.variable; 2423 } 2424 2425 channel = cfg80211_get_bss_channel(wiphy, variable, 2426 ielen, data->chan, data->scan_width); 2427 if (!channel) 2428 return NULL; 2429 2430 if (ext) { 2431 const struct ieee80211_s1g_bcn_compat_ie *compat; 2432 const struct element *elem; 2433 2434 elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT, 2435 variable, ielen); 2436 if (!elem) 2437 return NULL; 2438 if (elem->datalen < sizeof(*compat)) 2439 return NULL; 2440 compat = (void *)elem->data; 2441 bssid = ext->u.s1g_beacon.sa; 2442 capability = le16_to_cpu(compat->compat_info); 2443 beacon_int = le16_to_cpu(compat->beacon_int); 2444 } else { 2445 bssid = mgmt->bssid; 2446 beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int); 2447 capability = le16_to_cpu(mgmt->u.probe_resp.capab_info); 2448 } 2449 2450 ies = kzalloc(sizeof(*ies) + ielen, gfp); 2451 if (!ies) 2452 return NULL; 2453 ies->len = ielen; 2454 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp); 2455 ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) || 2456 ieee80211_is_s1g_beacon(mgmt->frame_control); 2457 memcpy(ies->data, variable, ielen); 2458 2459 if (ieee80211_is_probe_resp(mgmt->frame_control)) 2460 rcu_assign_pointer(tmp.pub.proberesp_ies, ies); 2461 else 2462 rcu_assign_pointer(tmp.pub.beacon_ies, ies); 2463 rcu_assign_pointer(tmp.pub.ies, ies); 2464 2465 memcpy(tmp.pub.bssid, bssid, ETH_ALEN); 2466 tmp.pub.beacon_interval = beacon_int; 2467 tmp.pub.capability = capability; 2468 tmp.pub.channel = channel; 2469 tmp.pub.scan_width = data->scan_width; 2470 tmp.pub.signal = data->signal; 2471 tmp.ts_boottime = data->boottime_ns; 2472 tmp.parent_tsf = data->parent_tsf; 2473 tmp.pub.chains = data->chains; 2474 memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS); 2475 ether_addr_copy(tmp.parent_bssid, data->parent_bssid); 2476 2477 signal_valid = data->chan == channel; 2478 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, 2479 jiffies); 2480 if (!res) 2481 return NULL; 2482 2483 if (channel->band == NL80211_BAND_60GHZ) { 2484 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK; 2485 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP || 2486 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS) 2487 regulatory_hint_found_beacon(wiphy, channel, gfp); 2488 } else { 2489 if (res->pub.capability & WLAN_CAPABILITY_ESS) 2490 regulatory_hint_found_beacon(wiphy, channel, gfp); 2491 } 2492 2493 trace_cfg80211_return_bss(&res->pub); 2494 /* cfg80211_bss_update gives us a referenced result */ 2495 return &res->pub; 2496 } 2497 2498 struct cfg80211_bss * 2499 cfg80211_inform_bss_frame_data(struct wiphy *wiphy, 2500 struct cfg80211_inform_bss *data, 2501 struct ieee80211_mgmt *mgmt, size_t len, 2502 gfp_t gfp) 2503 { 2504 struct cfg80211_bss *res, *tmp_bss; 2505 const u8 *ie = mgmt->u.probe_resp.variable; 2506 const struct cfg80211_bss_ies *ies1, *ies2; 2507 size_t ielen = len - offsetof(struct ieee80211_mgmt, 2508 u.probe_resp.variable); 2509 struct cfg80211_non_tx_bss non_tx_data = {}; 2510 2511 res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt, 2512 len, gfp); 2513 2514 /* don't do any further MBSSID handling for S1G */ 2515 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) 2516 return res; 2517 2518 if (!res || !wiphy->support_mbssid || 2519 !cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) 2520 return res; 2521 if (wiphy->support_only_he_mbssid && 2522 !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen)) 2523 return res; 2524 2525 non_tx_data.tx_bss = res; 2526 /* process each non-transmitting bss */ 2527 cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len, 2528 &non_tx_data, gfp); 2529 2530 spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock); 2531 2532 /* check if the res has other nontransmitting bss which is not 2533 * in MBSSID IE 2534 */ 2535 ies1 = rcu_access_pointer(res->ies); 2536 2537 /* go through nontrans_list, if the timestamp of the BSS is 2538 * earlier than the timestamp of the transmitting BSS then 2539 * update it 2540 */ 2541 list_for_each_entry(tmp_bss, &res->nontrans_list, 2542 nontrans_list) { 2543 ies2 = rcu_access_pointer(tmp_bss->ies); 2544 if (ies2->tsf < ies1->tsf) 2545 cfg80211_update_notlisted_nontrans(wiphy, tmp_bss, 2546 mgmt, len); 2547 } 2548 spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock); 2549 2550 return res; 2551 } 2552 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data); 2553 2554 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 2555 { 2556 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2557 2558 if (!pub) 2559 return; 2560 2561 spin_lock_bh(&rdev->bss_lock); 2562 bss_ref_get(rdev, bss_from_pub(pub)); 2563 spin_unlock_bh(&rdev->bss_lock); 2564 } 2565 EXPORT_SYMBOL(cfg80211_ref_bss); 2566 2567 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 2568 { 2569 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2570 2571 if (!pub) 2572 return; 2573 2574 spin_lock_bh(&rdev->bss_lock); 2575 bss_ref_put(rdev, bss_from_pub(pub)); 2576 spin_unlock_bh(&rdev->bss_lock); 2577 } 2578 EXPORT_SYMBOL(cfg80211_put_bss); 2579 2580 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 2581 { 2582 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2583 struct cfg80211_internal_bss *bss, *tmp1; 2584 struct cfg80211_bss *nontrans_bss, *tmp; 2585 2586 if (WARN_ON(!pub)) 2587 return; 2588 2589 bss = bss_from_pub(pub); 2590 2591 spin_lock_bh(&rdev->bss_lock); 2592 if (list_empty(&bss->list)) 2593 goto out; 2594 2595 list_for_each_entry_safe(nontrans_bss, tmp, 2596 &pub->nontrans_list, 2597 nontrans_list) { 2598 tmp1 = bss_from_pub(nontrans_bss); 2599 if (__cfg80211_unlink_bss(rdev, tmp1)) 2600 rdev->bss_generation++; 2601 } 2602 2603 if (__cfg80211_unlink_bss(rdev, bss)) 2604 rdev->bss_generation++; 2605 out: 2606 spin_unlock_bh(&rdev->bss_lock); 2607 } 2608 EXPORT_SYMBOL(cfg80211_unlink_bss); 2609 2610 void cfg80211_bss_iter(struct wiphy *wiphy, 2611 struct cfg80211_chan_def *chandef, 2612 void (*iter)(struct wiphy *wiphy, 2613 struct cfg80211_bss *bss, 2614 void *data), 2615 void *iter_data) 2616 { 2617 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2618 struct cfg80211_internal_bss *bss; 2619 2620 spin_lock_bh(&rdev->bss_lock); 2621 2622 list_for_each_entry(bss, &rdev->bss_list, list) { 2623 if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel, 2624 false)) 2625 iter(wiphy, &bss->pub, iter_data); 2626 } 2627 2628 spin_unlock_bh(&rdev->bss_lock); 2629 } 2630 EXPORT_SYMBOL(cfg80211_bss_iter); 2631 2632 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev, 2633 unsigned int link_id, 2634 struct ieee80211_channel *chan) 2635 { 2636 struct wiphy *wiphy = wdev->wiphy; 2637 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2638 struct cfg80211_internal_bss *cbss = wdev->links[link_id].client.current_bss; 2639 struct cfg80211_internal_bss *new = NULL; 2640 struct cfg80211_internal_bss *bss; 2641 struct cfg80211_bss *nontrans_bss; 2642 struct cfg80211_bss *tmp; 2643 2644 spin_lock_bh(&rdev->bss_lock); 2645 2646 /* 2647 * Some APs use CSA also for bandwidth changes, i.e., without actually 2648 * changing the control channel, so no need to update in such a case. 2649 */ 2650 if (cbss->pub.channel == chan) 2651 goto done; 2652 2653 /* use transmitting bss */ 2654 if (cbss->pub.transmitted_bss) 2655 cbss = bss_from_pub(cbss->pub.transmitted_bss); 2656 2657 cbss->pub.channel = chan; 2658 2659 list_for_each_entry(bss, &rdev->bss_list, list) { 2660 if (!cfg80211_bss_type_match(bss->pub.capability, 2661 bss->pub.channel->band, 2662 wdev->conn_bss_type)) 2663 continue; 2664 2665 if (bss == cbss) 2666 continue; 2667 2668 if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) { 2669 new = bss; 2670 break; 2671 } 2672 } 2673 2674 if (new) { 2675 /* to save time, update IEs for transmitting bss only */ 2676 if (cfg80211_update_known_bss(rdev, cbss, new, false)) { 2677 new->pub.proberesp_ies = NULL; 2678 new->pub.beacon_ies = NULL; 2679 } 2680 2681 list_for_each_entry_safe(nontrans_bss, tmp, 2682 &new->pub.nontrans_list, 2683 nontrans_list) { 2684 bss = bss_from_pub(nontrans_bss); 2685 if (__cfg80211_unlink_bss(rdev, bss)) 2686 rdev->bss_generation++; 2687 } 2688 2689 WARN_ON(atomic_read(&new->hold)); 2690 if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new))) 2691 rdev->bss_generation++; 2692 } 2693 2694 rb_erase(&cbss->rbn, &rdev->bss_tree); 2695 rb_insert_bss(rdev, cbss); 2696 rdev->bss_generation++; 2697 2698 list_for_each_entry_safe(nontrans_bss, tmp, 2699 &cbss->pub.nontrans_list, 2700 nontrans_list) { 2701 bss = bss_from_pub(nontrans_bss); 2702 bss->pub.channel = chan; 2703 rb_erase(&bss->rbn, &rdev->bss_tree); 2704 rb_insert_bss(rdev, bss); 2705 rdev->bss_generation++; 2706 } 2707 2708 done: 2709 spin_unlock_bh(&rdev->bss_lock); 2710 } 2711 2712 #ifdef CONFIG_CFG80211_WEXT 2713 static struct cfg80211_registered_device * 2714 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex) 2715 { 2716 struct cfg80211_registered_device *rdev; 2717 struct net_device *dev; 2718 2719 ASSERT_RTNL(); 2720 2721 dev = dev_get_by_index(net, ifindex); 2722 if (!dev) 2723 return ERR_PTR(-ENODEV); 2724 if (dev->ieee80211_ptr) 2725 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy); 2726 else 2727 rdev = ERR_PTR(-ENODEV); 2728 dev_put(dev); 2729 return rdev; 2730 } 2731 2732 int cfg80211_wext_siwscan(struct net_device *dev, 2733 struct iw_request_info *info, 2734 union iwreq_data *wrqu, char *extra) 2735 { 2736 struct cfg80211_registered_device *rdev; 2737 struct wiphy *wiphy; 2738 struct iw_scan_req *wreq = NULL; 2739 struct cfg80211_scan_request *creq; 2740 int i, err, n_channels = 0; 2741 enum nl80211_band band; 2742 2743 if (!netif_running(dev)) 2744 return -ENETDOWN; 2745 2746 if (wrqu->data.length == sizeof(struct iw_scan_req)) 2747 wreq = (struct iw_scan_req *)extra; 2748 2749 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex); 2750 2751 if (IS_ERR(rdev)) 2752 return PTR_ERR(rdev); 2753 2754 if (rdev->scan_req || rdev->scan_msg) 2755 return -EBUSY; 2756 2757 wiphy = &rdev->wiphy; 2758 2759 /* Determine number of channels, needed to allocate creq */ 2760 if (wreq && wreq->num_channels) 2761 n_channels = wreq->num_channels; 2762 else 2763 n_channels = ieee80211_get_num_supported_channels(wiphy); 2764 2765 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) + 2766 n_channels * sizeof(void *), 2767 GFP_ATOMIC); 2768 if (!creq) 2769 return -ENOMEM; 2770 2771 creq->wiphy = wiphy; 2772 creq->wdev = dev->ieee80211_ptr; 2773 /* SSIDs come after channels */ 2774 creq->ssids = (void *)&creq->channels[n_channels]; 2775 creq->n_channels = n_channels; 2776 creq->n_ssids = 1; 2777 creq->scan_start = jiffies; 2778 2779 /* translate "Scan on frequencies" request */ 2780 i = 0; 2781 for (band = 0; band < NUM_NL80211_BANDS; band++) { 2782 int j; 2783 2784 if (!wiphy->bands[band]) 2785 continue; 2786 2787 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 2788 /* ignore disabled channels */ 2789 if (wiphy->bands[band]->channels[j].flags & 2790 IEEE80211_CHAN_DISABLED) 2791 continue; 2792 2793 /* If we have a wireless request structure and the 2794 * wireless request specifies frequencies, then search 2795 * for the matching hardware channel. 2796 */ 2797 if (wreq && wreq->num_channels) { 2798 int k; 2799 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq; 2800 for (k = 0; k < wreq->num_channels; k++) { 2801 struct iw_freq *freq = 2802 &wreq->channel_list[k]; 2803 int wext_freq = 2804 cfg80211_wext_freq(freq); 2805 2806 if (wext_freq == wiphy_freq) 2807 goto wext_freq_found; 2808 } 2809 goto wext_freq_not_found; 2810 } 2811 2812 wext_freq_found: 2813 creq->channels[i] = &wiphy->bands[band]->channels[j]; 2814 i++; 2815 wext_freq_not_found: ; 2816 } 2817 } 2818 /* No channels found? */ 2819 if (!i) { 2820 err = -EINVAL; 2821 goto out; 2822 } 2823 2824 /* Set real number of channels specified in creq->channels[] */ 2825 creq->n_channels = i; 2826 2827 /* translate "Scan for SSID" request */ 2828 if (wreq) { 2829 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) { 2830 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) { 2831 err = -EINVAL; 2832 goto out; 2833 } 2834 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len); 2835 creq->ssids[0].ssid_len = wreq->essid_len; 2836 } 2837 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE) 2838 creq->n_ssids = 0; 2839 } 2840 2841 for (i = 0; i < NUM_NL80211_BANDS; i++) 2842 if (wiphy->bands[i]) 2843 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1; 2844 2845 eth_broadcast_addr(creq->bssid); 2846 2847 wiphy_lock(&rdev->wiphy); 2848 2849 rdev->scan_req = creq; 2850 err = rdev_scan(rdev, creq); 2851 if (err) { 2852 rdev->scan_req = NULL; 2853 /* creq will be freed below */ 2854 } else { 2855 nl80211_send_scan_start(rdev, dev->ieee80211_ptr); 2856 /* creq now owned by driver */ 2857 creq = NULL; 2858 dev_hold(dev); 2859 } 2860 wiphy_unlock(&rdev->wiphy); 2861 out: 2862 kfree(creq); 2863 return err; 2864 } 2865 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan); 2866 2867 static char *ieee80211_scan_add_ies(struct iw_request_info *info, 2868 const struct cfg80211_bss_ies *ies, 2869 char *current_ev, char *end_buf) 2870 { 2871 const u8 *pos, *end, *next; 2872 struct iw_event iwe; 2873 2874 if (!ies) 2875 return current_ev; 2876 2877 /* 2878 * If needed, fragment the IEs buffer (at IE boundaries) into short 2879 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages. 2880 */ 2881 pos = ies->data; 2882 end = pos + ies->len; 2883 2884 while (end - pos > IW_GENERIC_IE_MAX) { 2885 next = pos + 2 + pos[1]; 2886 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX) 2887 next = next + 2 + next[1]; 2888 2889 memset(&iwe, 0, sizeof(iwe)); 2890 iwe.cmd = IWEVGENIE; 2891 iwe.u.data.length = next - pos; 2892 current_ev = iwe_stream_add_point_check(info, current_ev, 2893 end_buf, &iwe, 2894 (void *)pos); 2895 if (IS_ERR(current_ev)) 2896 return current_ev; 2897 pos = next; 2898 } 2899 2900 if (end > pos) { 2901 memset(&iwe, 0, sizeof(iwe)); 2902 iwe.cmd = IWEVGENIE; 2903 iwe.u.data.length = end - pos; 2904 current_ev = iwe_stream_add_point_check(info, current_ev, 2905 end_buf, &iwe, 2906 (void *)pos); 2907 if (IS_ERR(current_ev)) 2908 return current_ev; 2909 } 2910 2911 return current_ev; 2912 } 2913 2914 static char * 2915 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info, 2916 struct cfg80211_internal_bss *bss, char *current_ev, 2917 char *end_buf) 2918 { 2919 const struct cfg80211_bss_ies *ies; 2920 struct iw_event iwe; 2921 const u8 *ie; 2922 u8 buf[50]; 2923 u8 *cfg, *p, *tmp; 2924 int rem, i, sig; 2925 bool ismesh = false; 2926 2927 memset(&iwe, 0, sizeof(iwe)); 2928 iwe.cmd = SIOCGIWAP; 2929 iwe.u.ap_addr.sa_family = ARPHRD_ETHER; 2930 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN); 2931 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 2932 IW_EV_ADDR_LEN); 2933 if (IS_ERR(current_ev)) 2934 return current_ev; 2935 2936 memset(&iwe, 0, sizeof(iwe)); 2937 iwe.cmd = SIOCGIWFREQ; 2938 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq); 2939 iwe.u.freq.e = 0; 2940 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 2941 IW_EV_FREQ_LEN); 2942 if (IS_ERR(current_ev)) 2943 return current_ev; 2944 2945 memset(&iwe, 0, sizeof(iwe)); 2946 iwe.cmd = SIOCGIWFREQ; 2947 iwe.u.freq.m = bss->pub.channel->center_freq; 2948 iwe.u.freq.e = 6; 2949 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 2950 IW_EV_FREQ_LEN); 2951 if (IS_ERR(current_ev)) 2952 return current_ev; 2953 2954 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) { 2955 memset(&iwe, 0, sizeof(iwe)); 2956 iwe.cmd = IWEVQUAL; 2957 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED | 2958 IW_QUAL_NOISE_INVALID | 2959 IW_QUAL_QUAL_UPDATED; 2960 switch (wiphy->signal_type) { 2961 case CFG80211_SIGNAL_TYPE_MBM: 2962 sig = bss->pub.signal / 100; 2963 iwe.u.qual.level = sig; 2964 iwe.u.qual.updated |= IW_QUAL_DBM; 2965 if (sig < -110) /* rather bad */ 2966 sig = -110; 2967 else if (sig > -40) /* perfect */ 2968 sig = -40; 2969 /* will give a range of 0 .. 70 */ 2970 iwe.u.qual.qual = sig + 110; 2971 break; 2972 case CFG80211_SIGNAL_TYPE_UNSPEC: 2973 iwe.u.qual.level = bss->pub.signal; 2974 /* will give range 0 .. 100 */ 2975 iwe.u.qual.qual = bss->pub.signal; 2976 break; 2977 default: 2978 /* not reached */ 2979 break; 2980 } 2981 current_ev = iwe_stream_add_event_check(info, current_ev, 2982 end_buf, &iwe, 2983 IW_EV_QUAL_LEN); 2984 if (IS_ERR(current_ev)) 2985 return current_ev; 2986 } 2987 2988 memset(&iwe, 0, sizeof(iwe)); 2989 iwe.cmd = SIOCGIWENCODE; 2990 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY) 2991 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; 2992 else 2993 iwe.u.data.flags = IW_ENCODE_DISABLED; 2994 iwe.u.data.length = 0; 2995 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf, 2996 &iwe, ""); 2997 if (IS_ERR(current_ev)) 2998 return current_ev; 2999 3000 rcu_read_lock(); 3001 ies = rcu_dereference(bss->pub.ies); 3002 rem = ies->len; 3003 ie = ies->data; 3004 3005 while (rem >= 2) { 3006 /* invalid data */ 3007 if (ie[1] > rem - 2) 3008 break; 3009 3010 switch (ie[0]) { 3011 case WLAN_EID_SSID: 3012 memset(&iwe, 0, sizeof(iwe)); 3013 iwe.cmd = SIOCGIWESSID; 3014 iwe.u.data.length = ie[1]; 3015 iwe.u.data.flags = 1; 3016 current_ev = iwe_stream_add_point_check(info, 3017 current_ev, 3018 end_buf, &iwe, 3019 (u8 *)ie + 2); 3020 if (IS_ERR(current_ev)) 3021 goto unlock; 3022 break; 3023 case WLAN_EID_MESH_ID: 3024 memset(&iwe, 0, sizeof(iwe)); 3025 iwe.cmd = SIOCGIWESSID; 3026 iwe.u.data.length = ie[1]; 3027 iwe.u.data.flags = 1; 3028 current_ev = iwe_stream_add_point_check(info, 3029 current_ev, 3030 end_buf, &iwe, 3031 (u8 *)ie + 2); 3032 if (IS_ERR(current_ev)) 3033 goto unlock; 3034 break; 3035 case WLAN_EID_MESH_CONFIG: 3036 ismesh = true; 3037 if (ie[1] != sizeof(struct ieee80211_meshconf_ie)) 3038 break; 3039 cfg = (u8 *)ie + 2; 3040 memset(&iwe, 0, sizeof(iwe)); 3041 iwe.cmd = IWEVCUSTOM; 3042 sprintf(buf, "Mesh Network Path Selection Protocol ID: " 3043 "0x%02X", cfg[0]); 3044 iwe.u.data.length = strlen(buf); 3045 current_ev = iwe_stream_add_point_check(info, 3046 current_ev, 3047 end_buf, 3048 &iwe, buf); 3049 if (IS_ERR(current_ev)) 3050 goto unlock; 3051 sprintf(buf, "Path Selection Metric ID: 0x%02X", 3052 cfg[1]); 3053 iwe.u.data.length = strlen(buf); 3054 current_ev = iwe_stream_add_point_check(info, 3055 current_ev, 3056 end_buf, 3057 &iwe, buf); 3058 if (IS_ERR(current_ev)) 3059 goto unlock; 3060 sprintf(buf, "Congestion Control Mode ID: 0x%02X", 3061 cfg[2]); 3062 iwe.u.data.length = strlen(buf); 3063 current_ev = iwe_stream_add_point_check(info, 3064 current_ev, 3065 end_buf, 3066 &iwe, buf); 3067 if (IS_ERR(current_ev)) 3068 goto unlock; 3069 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]); 3070 iwe.u.data.length = strlen(buf); 3071 current_ev = iwe_stream_add_point_check(info, 3072 current_ev, 3073 end_buf, 3074 &iwe, buf); 3075 if (IS_ERR(current_ev)) 3076 goto unlock; 3077 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]); 3078 iwe.u.data.length = strlen(buf); 3079 current_ev = iwe_stream_add_point_check(info, 3080 current_ev, 3081 end_buf, 3082 &iwe, buf); 3083 if (IS_ERR(current_ev)) 3084 goto unlock; 3085 sprintf(buf, "Formation Info: 0x%02X", cfg[5]); 3086 iwe.u.data.length = strlen(buf); 3087 current_ev = iwe_stream_add_point_check(info, 3088 current_ev, 3089 end_buf, 3090 &iwe, buf); 3091 if (IS_ERR(current_ev)) 3092 goto unlock; 3093 sprintf(buf, "Capabilities: 0x%02X", cfg[6]); 3094 iwe.u.data.length = strlen(buf); 3095 current_ev = iwe_stream_add_point_check(info, 3096 current_ev, 3097 end_buf, 3098 &iwe, buf); 3099 if (IS_ERR(current_ev)) 3100 goto unlock; 3101 break; 3102 case WLAN_EID_SUPP_RATES: 3103 case WLAN_EID_EXT_SUPP_RATES: 3104 /* display all supported rates in readable format */ 3105 p = current_ev + iwe_stream_lcp_len(info); 3106 3107 memset(&iwe, 0, sizeof(iwe)); 3108 iwe.cmd = SIOCGIWRATE; 3109 /* Those two flags are ignored... */ 3110 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0; 3111 3112 for (i = 0; i < ie[1]; i++) { 3113 iwe.u.bitrate.value = 3114 ((ie[i + 2] & 0x7f) * 500000); 3115 tmp = p; 3116 p = iwe_stream_add_value(info, current_ev, p, 3117 end_buf, &iwe, 3118 IW_EV_PARAM_LEN); 3119 if (p == tmp) { 3120 current_ev = ERR_PTR(-E2BIG); 3121 goto unlock; 3122 } 3123 } 3124 current_ev = p; 3125 break; 3126 } 3127 rem -= ie[1] + 2; 3128 ie += ie[1] + 2; 3129 } 3130 3131 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) || 3132 ismesh) { 3133 memset(&iwe, 0, sizeof(iwe)); 3134 iwe.cmd = SIOCGIWMODE; 3135 if (ismesh) 3136 iwe.u.mode = IW_MODE_MESH; 3137 else if (bss->pub.capability & WLAN_CAPABILITY_ESS) 3138 iwe.u.mode = IW_MODE_MASTER; 3139 else 3140 iwe.u.mode = IW_MODE_ADHOC; 3141 current_ev = iwe_stream_add_event_check(info, current_ev, 3142 end_buf, &iwe, 3143 IW_EV_UINT_LEN); 3144 if (IS_ERR(current_ev)) 3145 goto unlock; 3146 } 3147 3148 memset(&iwe, 0, sizeof(iwe)); 3149 iwe.cmd = IWEVCUSTOM; 3150 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf)); 3151 iwe.u.data.length = strlen(buf); 3152 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf, 3153 &iwe, buf); 3154 if (IS_ERR(current_ev)) 3155 goto unlock; 3156 memset(&iwe, 0, sizeof(iwe)); 3157 iwe.cmd = IWEVCUSTOM; 3158 sprintf(buf, " Last beacon: %ums ago", 3159 elapsed_jiffies_msecs(bss->ts)); 3160 iwe.u.data.length = strlen(buf); 3161 current_ev = iwe_stream_add_point_check(info, current_ev, 3162 end_buf, &iwe, buf); 3163 if (IS_ERR(current_ev)) 3164 goto unlock; 3165 3166 current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf); 3167 3168 unlock: 3169 rcu_read_unlock(); 3170 return current_ev; 3171 } 3172 3173 3174 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev, 3175 struct iw_request_info *info, 3176 char *buf, size_t len) 3177 { 3178 char *current_ev = buf; 3179 char *end_buf = buf + len; 3180 struct cfg80211_internal_bss *bss; 3181 int err = 0; 3182 3183 spin_lock_bh(&rdev->bss_lock); 3184 cfg80211_bss_expire(rdev); 3185 3186 list_for_each_entry(bss, &rdev->bss_list, list) { 3187 if (buf + len - current_ev <= IW_EV_ADDR_LEN) { 3188 err = -E2BIG; 3189 break; 3190 } 3191 current_ev = ieee80211_bss(&rdev->wiphy, info, bss, 3192 current_ev, end_buf); 3193 if (IS_ERR(current_ev)) { 3194 err = PTR_ERR(current_ev); 3195 break; 3196 } 3197 } 3198 spin_unlock_bh(&rdev->bss_lock); 3199 3200 if (err) 3201 return err; 3202 return current_ev - buf; 3203 } 3204 3205 3206 int cfg80211_wext_giwscan(struct net_device *dev, 3207 struct iw_request_info *info, 3208 union iwreq_data *wrqu, char *extra) 3209 { 3210 struct iw_point *data = &wrqu->data; 3211 struct cfg80211_registered_device *rdev; 3212 int res; 3213 3214 if (!netif_running(dev)) 3215 return -ENETDOWN; 3216 3217 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex); 3218 3219 if (IS_ERR(rdev)) 3220 return PTR_ERR(rdev); 3221 3222 if (rdev->scan_req || rdev->scan_msg) 3223 return -EAGAIN; 3224 3225 res = ieee80211_scan_results(rdev, info, extra, data->length); 3226 data->length = 0; 3227 if (res >= 0) { 3228 data->length = res; 3229 res = 0; 3230 } 3231 3232 return res; 3233 } 3234 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan); 3235 #endif 3236