1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * cfg80211 scan result handling 4 * 5 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2016 Intel Deutschland GmbH 8 */ 9 #include <linux/kernel.h> 10 #include <linux/slab.h> 11 #include <linux/module.h> 12 #include <linux/netdevice.h> 13 #include <linux/wireless.h> 14 #include <linux/nl80211.h> 15 #include <linux/etherdevice.h> 16 #include <net/arp.h> 17 #include <net/cfg80211.h> 18 #include <net/cfg80211-wext.h> 19 #include <net/iw_handler.h> 20 #include "core.h" 21 #include "nl80211.h" 22 #include "wext-compat.h" 23 #include "rdev-ops.h" 24 25 /** 26 * DOC: BSS tree/list structure 27 * 28 * At the top level, the BSS list is kept in both a list in each 29 * registered device (@bss_list) as well as an RB-tree for faster 30 * lookup. In the RB-tree, entries can be looked up using their 31 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID 32 * for other BSSes. 33 * 34 * Due to the possibility of hidden SSIDs, there's a second level 35 * structure, the "hidden_list" and "hidden_beacon_bss" pointer. 36 * The hidden_list connects all BSSes belonging to a single AP 37 * that has a hidden SSID, and connects beacon and probe response 38 * entries. For a probe response entry for a hidden SSID, the 39 * hidden_beacon_bss pointer points to the BSS struct holding the 40 * beacon's information. 41 * 42 * Reference counting is done for all these references except for 43 * the hidden_list, so that a beacon BSS struct that is otherwise 44 * not referenced has one reference for being on the bss_list and 45 * one for each probe response entry that points to it using the 46 * hidden_beacon_bss pointer. When a BSS struct that has such a 47 * pointer is get/put, the refcount update is also propagated to 48 * the referenced struct, this ensure that it cannot get removed 49 * while somebody is using the probe response version. 50 * 51 * Note that the hidden_beacon_bss pointer never changes, due to 52 * the reference counting. Therefore, no locking is needed for 53 * it. 54 * 55 * Also note that the hidden_beacon_bss pointer is only relevant 56 * if the driver uses something other than the IEs, e.g. private 57 * data stored stored in the BSS struct, since the beacon IEs are 58 * also linked into the probe response struct. 59 */ 60 61 /* 62 * Limit the number of BSS entries stored in mac80211. Each one is 63 * a bit over 4k at most, so this limits to roughly 4-5M of memory. 64 * If somebody wants to really attack this though, they'd likely 65 * use small beacons, and only one type of frame, limiting each of 66 * the entries to a much smaller size (in order to generate more 67 * entries in total, so overhead is bigger.) 68 */ 69 static int bss_entries_limit = 1000; 70 module_param(bss_entries_limit, int, 0644); 71 MODULE_PARM_DESC(bss_entries_limit, 72 "limit to number of scan BSS entries (per wiphy, default 1000)"); 73 74 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ) 75 76 static void bss_free(struct cfg80211_internal_bss *bss) 77 { 78 struct cfg80211_bss_ies *ies; 79 80 if (WARN_ON(atomic_read(&bss->hold))) 81 return; 82 83 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies); 84 if (ies && !bss->pub.hidden_beacon_bss) 85 kfree_rcu(ies, rcu_head); 86 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies); 87 if (ies) 88 kfree_rcu(ies, rcu_head); 89 90 /* 91 * This happens when the module is removed, it doesn't 92 * really matter any more save for completeness 93 */ 94 if (!list_empty(&bss->hidden_list)) 95 list_del(&bss->hidden_list); 96 97 kfree(bss); 98 } 99 100 static inline void bss_ref_get(struct cfg80211_registered_device *rdev, 101 struct cfg80211_internal_bss *bss) 102 { 103 lockdep_assert_held(&rdev->bss_lock); 104 105 bss->refcount++; 106 if (bss->pub.hidden_beacon_bss) { 107 bss = container_of(bss->pub.hidden_beacon_bss, 108 struct cfg80211_internal_bss, 109 pub); 110 bss->refcount++; 111 } 112 } 113 114 static inline void bss_ref_put(struct cfg80211_registered_device *rdev, 115 struct cfg80211_internal_bss *bss) 116 { 117 lockdep_assert_held(&rdev->bss_lock); 118 119 if (bss->pub.hidden_beacon_bss) { 120 struct cfg80211_internal_bss *hbss; 121 hbss = container_of(bss->pub.hidden_beacon_bss, 122 struct cfg80211_internal_bss, 123 pub); 124 hbss->refcount--; 125 if (hbss->refcount == 0) 126 bss_free(hbss); 127 } 128 bss->refcount--; 129 if (bss->refcount == 0) 130 bss_free(bss); 131 } 132 133 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev, 134 struct cfg80211_internal_bss *bss) 135 { 136 lockdep_assert_held(&rdev->bss_lock); 137 138 if (!list_empty(&bss->hidden_list)) { 139 /* 140 * don't remove the beacon entry if it has 141 * probe responses associated with it 142 */ 143 if (!bss->pub.hidden_beacon_bss) 144 return false; 145 /* 146 * if it's a probe response entry break its 147 * link to the other entries in the group 148 */ 149 list_del_init(&bss->hidden_list); 150 } 151 152 list_del_init(&bss->list); 153 rb_erase(&bss->rbn, &rdev->bss_tree); 154 rdev->bss_entries--; 155 WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list), 156 "rdev bss entries[%d]/list[empty:%d] corruption\n", 157 rdev->bss_entries, list_empty(&rdev->bss_list)); 158 bss_ref_put(rdev, bss); 159 return true; 160 } 161 162 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev, 163 unsigned long expire_time) 164 { 165 struct cfg80211_internal_bss *bss, *tmp; 166 bool expired = false; 167 168 lockdep_assert_held(&rdev->bss_lock); 169 170 list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) { 171 if (atomic_read(&bss->hold)) 172 continue; 173 if (!time_after(expire_time, bss->ts)) 174 continue; 175 176 if (__cfg80211_unlink_bss(rdev, bss)) 177 expired = true; 178 } 179 180 if (expired) 181 rdev->bss_generation++; 182 } 183 184 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev) 185 { 186 struct cfg80211_internal_bss *bss, *oldest = NULL; 187 bool ret; 188 189 lockdep_assert_held(&rdev->bss_lock); 190 191 list_for_each_entry(bss, &rdev->bss_list, list) { 192 if (atomic_read(&bss->hold)) 193 continue; 194 195 if (!list_empty(&bss->hidden_list) && 196 !bss->pub.hidden_beacon_bss) 197 continue; 198 199 if (oldest && time_before(oldest->ts, bss->ts)) 200 continue; 201 oldest = bss; 202 } 203 204 if (WARN_ON(!oldest)) 205 return false; 206 207 /* 208 * The callers make sure to increase rdev->bss_generation if anything 209 * gets removed (and a new entry added), so there's no need to also do 210 * it here. 211 */ 212 213 ret = __cfg80211_unlink_bss(rdev, oldest); 214 WARN_ON(!ret); 215 return ret; 216 } 217 218 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, 219 bool send_message) 220 { 221 struct cfg80211_scan_request *request; 222 struct wireless_dev *wdev; 223 struct sk_buff *msg; 224 #ifdef CONFIG_CFG80211_WEXT 225 union iwreq_data wrqu; 226 #endif 227 228 ASSERT_RTNL(); 229 230 if (rdev->scan_msg) { 231 nl80211_send_scan_msg(rdev, rdev->scan_msg); 232 rdev->scan_msg = NULL; 233 return; 234 } 235 236 request = rdev->scan_req; 237 if (!request) 238 return; 239 240 wdev = request->wdev; 241 242 /* 243 * This must be before sending the other events! 244 * Otherwise, wpa_supplicant gets completely confused with 245 * wext events. 246 */ 247 if (wdev->netdev) 248 cfg80211_sme_scan_done(wdev->netdev); 249 250 if (!request->info.aborted && 251 request->flags & NL80211_SCAN_FLAG_FLUSH) { 252 /* flush entries from previous scans */ 253 spin_lock_bh(&rdev->bss_lock); 254 __cfg80211_bss_expire(rdev, request->scan_start); 255 spin_unlock_bh(&rdev->bss_lock); 256 } 257 258 msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted); 259 260 #ifdef CONFIG_CFG80211_WEXT 261 if (wdev->netdev && !request->info.aborted) { 262 memset(&wrqu, 0, sizeof(wrqu)); 263 264 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL); 265 } 266 #endif 267 268 if (wdev->netdev) 269 dev_put(wdev->netdev); 270 271 rdev->scan_req = NULL; 272 kfree(request); 273 274 if (!send_message) 275 rdev->scan_msg = msg; 276 else 277 nl80211_send_scan_msg(rdev, msg); 278 } 279 280 void __cfg80211_scan_done(struct work_struct *wk) 281 { 282 struct cfg80211_registered_device *rdev; 283 284 rdev = container_of(wk, struct cfg80211_registered_device, 285 scan_done_wk); 286 287 rtnl_lock(); 288 ___cfg80211_scan_done(rdev, true); 289 rtnl_unlock(); 290 } 291 292 void cfg80211_scan_done(struct cfg80211_scan_request *request, 293 struct cfg80211_scan_info *info) 294 { 295 trace_cfg80211_scan_done(request, info); 296 WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req); 297 298 request->info = *info; 299 request->notified = true; 300 queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk); 301 } 302 EXPORT_SYMBOL(cfg80211_scan_done); 303 304 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev, 305 struct cfg80211_sched_scan_request *req) 306 { 307 ASSERT_RTNL(); 308 309 list_add_rcu(&req->list, &rdev->sched_scan_req_list); 310 } 311 312 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev, 313 struct cfg80211_sched_scan_request *req) 314 { 315 ASSERT_RTNL(); 316 317 list_del_rcu(&req->list); 318 kfree_rcu(req, rcu_head); 319 } 320 321 static struct cfg80211_sched_scan_request * 322 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid) 323 { 324 struct cfg80211_sched_scan_request *pos; 325 326 WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held()); 327 328 list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list) { 329 if (pos->reqid == reqid) 330 return pos; 331 } 332 return NULL; 333 } 334 335 /* 336 * Determines if a scheduled scan request can be handled. When a legacy 337 * scheduled scan is running no other scheduled scan is allowed regardless 338 * whether the request is for legacy or multi-support scan. When a multi-support 339 * scheduled scan is running a request for legacy scan is not allowed. In this 340 * case a request for multi-support scan can be handled if resources are 341 * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached. 342 */ 343 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev, 344 bool want_multi) 345 { 346 struct cfg80211_sched_scan_request *pos; 347 int i = 0; 348 349 list_for_each_entry(pos, &rdev->sched_scan_req_list, list) { 350 /* request id zero means legacy in progress */ 351 if (!i && !pos->reqid) 352 return -EINPROGRESS; 353 i++; 354 } 355 356 if (i) { 357 /* no legacy allowed when multi request(s) are active */ 358 if (!want_multi) 359 return -EINPROGRESS; 360 361 /* resource limit reached */ 362 if (i == rdev->wiphy.max_sched_scan_reqs) 363 return -ENOSPC; 364 } 365 return 0; 366 } 367 368 void cfg80211_sched_scan_results_wk(struct work_struct *work) 369 { 370 struct cfg80211_registered_device *rdev; 371 struct cfg80211_sched_scan_request *req, *tmp; 372 373 rdev = container_of(work, struct cfg80211_registered_device, 374 sched_scan_res_wk); 375 376 rtnl_lock(); 377 list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) { 378 if (req->report_results) { 379 req->report_results = false; 380 if (req->flags & NL80211_SCAN_FLAG_FLUSH) { 381 /* flush entries from previous scans */ 382 spin_lock_bh(&rdev->bss_lock); 383 __cfg80211_bss_expire(rdev, req->scan_start); 384 spin_unlock_bh(&rdev->bss_lock); 385 req->scan_start = jiffies; 386 } 387 nl80211_send_sched_scan(req, 388 NL80211_CMD_SCHED_SCAN_RESULTS); 389 } 390 } 391 rtnl_unlock(); 392 } 393 394 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid) 395 { 396 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 397 struct cfg80211_sched_scan_request *request; 398 399 trace_cfg80211_sched_scan_results(wiphy, reqid); 400 /* ignore if we're not scanning */ 401 402 rcu_read_lock(); 403 request = cfg80211_find_sched_scan_req(rdev, reqid); 404 if (request) { 405 request->report_results = true; 406 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk); 407 } 408 rcu_read_unlock(); 409 } 410 EXPORT_SYMBOL(cfg80211_sched_scan_results); 411 412 void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy, u64 reqid) 413 { 414 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 415 416 ASSERT_RTNL(); 417 418 trace_cfg80211_sched_scan_stopped(wiphy, reqid); 419 420 __cfg80211_stop_sched_scan(rdev, reqid, true); 421 } 422 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl); 423 424 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid) 425 { 426 rtnl_lock(); 427 cfg80211_sched_scan_stopped_rtnl(wiphy, reqid); 428 rtnl_unlock(); 429 } 430 EXPORT_SYMBOL(cfg80211_sched_scan_stopped); 431 432 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev, 433 struct cfg80211_sched_scan_request *req, 434 bool driver_initiated) 435 { 436 ASSERT_RTNL(); 437 438 if (!driver_initiated) { 439 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid); 440 if (err) 441 return err; 442 } 443 444 nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED); 445 446 cfg80211_del_sched_scan_req(rdev, req); 447 448 return 0; 449 } 450 451 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev, 452 u64 reqid, bool driver_initiated) 453 { 454 struct cfg80211_sched_scan_request *sched_scan_req; 455 456 ASSERT_RTNL(); 457 458 sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid); 459 if (!sched_scan_req) 460 return -ENOENT; 461 462 return cfg80211_stop_sched_scan_req(rdev, sched_scan_req, 463 driver_initiated); 464 } 465 466 void cfg80211_bss_age(struct cfg80211_registered_device *rdev, 467 unsigned long age_secs) 468 { 469 struct cfg80211_internal_bss *bss; 470 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC); 471 472 spin_lock_bh(&rdev->bss_lock); 473 list_for_each_entry(bss, &rdev->bss_list, list) 474 bss->ts -= age_jiffies; 475 spin_unlock_bh(&rdev->bss_lock); 476 } 477 478 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev) 479 { 480 __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE); 481 } 482 483 const u8 *cfg80211_find_ie_match(u8 eid, const u8 *ies, int len, 484 const u8 *match, int match_len, 485 int match_offset) 486 { 487 /* match_offset can't be smaller than 2, unless match_len is 488 * zero, in which case match_offset must be zero as well. 489 */ 490 if (WARN_ON((match_len && match_offset < 2) || 491 (!match_len && match_offset))) 492 return NULL; 493 494 while (len >= 2 && len >= ies[1] + 2) { 495 if ((ies[0] == eid) && 496 (ies[1] + 2 >= match_offset + match_len) && 497 !memcmp(ies + match_offset, match, match_len)) 498 return ies; 499 500 len -= ies[1] + 2; 501 ies += ies[1] + 2; 502 } 503 504 return NULL; 505 } 506 EXPORT_SYMBOL(cfg80211_find_ie_match); 507 508 const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type, 509 const u8 *ies, int len) 510 { 511 const u8 *ie; 512 u8 match[] = { oui >> 16, oui >> 8, oui, oui_type }; 513 int match_len = (oui_type < 0) ? 3 : sizeof(match); 514 515 if (WARN_ON(oui_type > 0xff)) 516 return NULL; 517 518 ie = cfg80211_find_ie_match(WLAN_EID_VENDOR_SPECIFIC, ies, len, 519 match, match_len, 2); 520 521 if (ie && (ie[1] < 4)) 522 return NULL; 523 524 return ie; 525 } 526 EXPORT_SYMBOL(cfg80211_find_vendor_ie); 527 528 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid, 529 const u8 *ssid, size_t ssid_len) 530 { 531 const struct cfg80211_bss_ies *ies; 532 const u8 *ssidie; 533 534 if (bssid && !ether_addr_equal(a->bssid, bssid)) 535 return false; 536 537 if (!ssid) 538 return true; 539 540 ies = rcu_access_pointer(a->ies); 541 if (!ies) 542 return false; 543 ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); 544 if (!ssidie) 545 return false; 546 if (ssidie[1] != ssid_len) 547 return false; 548 return memcmp(ssidie + 2, ssid, ssid_len) == 0; 549 } 550 551 /** 552 * enum bss_compare_mode - BSS compare mode 553 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find) 554 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode 555 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode 556 */ 557 enum bss_compare_mode { 558 BSS_CMP_REGULAR, 559 BSS_CMP_HIDE_ZLEN, 560 BSS_CMP_HIDE_NUL, 561 }; 562 563 static int cmp_bss(struct cfg80211_bss *a, 564 struct cfg80211_bss *b, 565 enum bss_compare_mode mode) 566 { 567 const struct cfg80211_bss_ies *a_ies, *b_ies; 568 const u8 *ie1 = NULL; 569 const u8 *ie2 = NULL; 570 int i, r; 571 572 if (a->channel != b->channel) 573 return b->channel->center_freq - a->channel->center_freq; 574 575 a_ies = rcu_access_pointer(a->ies); 576 if (!a_ies) 577 return -1; 578 b_ies = rcu_access_pointer(b->ies); 579 if (!b_ies) 580 return 1; 581 582 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability)) 583 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID, 584 a_ies->data, a_ies->len); 585 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability)) 586 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID, 587 b_ies->data, b_ies->len); 588 if (ie1 && ie2) { 589 int mesh_id_cmp; 590 591 if (ie1[1] == ie2[1]) 592 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]); 593 else 594 mesh_id_cmp = ie2[1] - ie1[1]; 595 596 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, 597 a_ies->data, a_ies->len); 598 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, 599 b_ies->data, b_ies->len); 600 if (ie1 && ie2) { 601 if (mesh_id_cmp) 602 return mesh_id_cmp; 603 if (ie1[1] != ie2[1]) 604 return ie2[1] - ie1[1]; 605 return memcmp(ie1 + 2, ie2 + 2, ie1[1]); 606 } 607 } 608 609 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid)); 610 if (r) 611 return r; 612 613 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len); 614 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len); 615 616 if (!ie1 && !ie2) 617 return 0; 618 619 /* 620 * Note that with "hide_ssid", the function returns a match if 621 * the already-present BSS ("b") is a hidden SSID beacon for 622 * the new BSS ("a"). 623 */ 624 625 /* sort missing IE before (left of) present IE */ 626 if (!ie1) 627 return -1; 628 if (!ie2) 629 return 1; 630 631 switch (mode) { 632 case BSS_CMP_HIDE_ZLEN: 633 /* 634 * In ZLEN mode we assume the BSS entry we're 635 * looking for has a zero-length SSID. So if 636 * the one we're looking at right now has that, 637 * return 0. Otherwise, return the difference 638 * in length, but since we're looking for the 639 * 0-length it's really equivalent to returning 640 * the length of the one we're looking at. 641 * 642 * No content comparison is needed as we assume 643 * the content length is zero. 644 */ 645 return ie2[1]; 646 case BSS_CMP_REGULAR: 647 default: 648 /* sort by length first, then by contents */ 649 if (ie1[1] != ie2[1]) 650 return ie2[1] - ie1[1]; 651 return memcmp(ie1 + 2, ie2 + 2, ie1[1]); 652 case BSS_CMP_HIDE_NUL: 653 if (ie1[1] != ie2[1]) 654 return ie2[1] - ie1[1]; 655 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */ 656 for (i = 0; i < ie2[1]; i++) 657 if (ie2[i + 2]) 658 return -1; 659 return 0; 660 } 661 } 662 663 static bool cfg80211_bss_type_match(u16 capability, 664 enum nl80211_band band, 665 enum ieee80211_bss_type bss_type) 666 { 667 bool ret = true; 668 u16 mask, val; 669 670 if (bss_type == IEEE80211_BSS_TYPE_ANY) 671 return ret; 672 673 if (band == NL80211_BAND_60GHZ) { 674 mask = WLAN_CAPABILITY_DMG_TYPE_MASK; 675 switch (bss_type) { 676 case IEEE80211_BSS_TYPE_ESS: 677 val = WLAN_CAPABILITY_DMG_TYPE_AP; 678 break; 679 case IEEE80211_BSS_TYPE_PBSS: 680 val = WLAN_CAPABILITY_DMG_TYPE_PBSS; 681 break; 682 case IEEE80211_BSS_TYPE_IBSS: 683 val = WLAN_CAPABILITY_DMG_TYPE_IBSS; 684 break; 685 default: 686 return false; 687 } 688 } else { 689 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS; 690 switch (bss_type) { 691 case IEEE80211_BSS_TYPE_ESS: 692 val = WLAN_CAPABILITY_ESS; 693 break; 694 case IEEE80211_BSS_TYPE_IBSS: 695 val = WLAN_CAPABILITY_IBSS; 696 break; 697 case IEEE80211_BSS_TYPE_MBSS: 698 val = 0; 699 break; 700 default: 701 return false; 702 } 703 } 704 705 ret = ((capability & mask) == val); 706 return ret; 707 } 708 709 /* Returned bss is reference counted and must be cleaned up appropriately. */ 710 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy, 711 struct ieee80211_channel *channel, 712 const u8 *bssid, 713 const u8 *ssid, size_t ssid_len, 714 enum ieee80211_bss_type bss_type, 715 enum ieee80211_privacy privacy) 716 { 717 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 718 struct cfg80211_internal_bss *bss, *res = NULL; 719 unsigned long now = jiffies; 720 int bss_privacy; 721 722 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type, 723 privacy); 724 725 spin_lock_bh(&rdev->bss_lock); 726 727 list_for_each_entry(bss, &rdev->bss_list, list) { 728 if (!cfg80211_bss_type_match(bss->pub.capability, 729 bss->pub.channel->band, bss_type)) 730 continue; 731 732 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY); 733 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) || 734 (privacy == IEEE80211_PRIVACY_OFF && bss_privacy)) 735 continue; 736 if (channel && bss->pub.channel != channel) 737 continue; 738 if (!is_valid_ether_addr(bss->pub.bssid)) 739 continue; 740 /* Don't get expired BSS structs */ 741 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) && 742 !atomic_read(&bss->hold)) 743 continue; 744 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) { 745 res = bss; 746 bss_ref_get(rdev, res); 747 break; 748 } 749 } 750 751 spin_unlock_bh(&rdev->bss_lock); 752 if (!res) 753 return NULL; 754 trace_cfg80211_return_bss(&res->pub); 755 return &res->pub; 756 } 757 EXPORT_SYMBOL(cfg80211_get_bss); 758 759 static void rb_insert_bss(struct cfg80211_registered_device *rdev, 760 struct cfg80211_internal_bss *bss) 761 { 762 struct rb_node **p = &rdev->bss_tree.rb_node; 763 struct rb_node *parent = NULL; 764 struct cfg80211_internal_bss *tbss; 765 int cmp; 766 767 while (*p) { 768 parent = *p; 769 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn); 770 771 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR); 772 773 if (WARN_ON(!cmp)) { 774 /* will sort of leak this BSS */ 775 return; 776 } 777 778 if (cmp < 0) 779 p = &(*p)->rb_left; 780 else 781 p = &(*p)->rb_right; 782 } 783 784 rb_link_node(&bss->rbn, parent, p); 785 rb_insert_color(&bss->rbn, &rdev->bss_tree); 786 } 787 788 static struct cfg80211_internal_bss * 789 rb_find_bss(struct cfg80211_registered_device *rdev, 790 struct cfg80211_internal_bss *res, 791 enum bss_compare_mode mode) 792 { 793 struct rb_node *n = rdev->bss_tree.rb_node; 794 struct cfg80211_internal_bss *bss; 795 int r; 796 797 while (n) { 798 bss = rb_entry(n, struct cfg80211_internal_bss, rbn); 799 r = cmp_bss(&res->pub, &bss->pub, mode); 800 801 if (r == 0) 802 return bss; 803 else if (r < 0) 804 n = n->rb_left; 805 else 806 n = n->rb_right; 807 } 808 809 return NULL; 810 } 811 812 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, 813 struct cfg80211_internal_bss *new) 814 { 815 const struct cfg80211_bss_ies *ies; 816 struct cfg80211_internal_bss *bss; 817 const u8 *ie; 818 int i, ssidlen; 819 u8 fold = 0; 820 u32 n_entries = 0; 821 822 ies = rcu_access_pointer(new->pub.beacon_ies); 823 if (WARN_ON(!ies)) 824 return false; 825 826 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); 827 if (!ie) { 828 /* nothing to do */ 829 return true; 830 } 831 832 ssidlen = ie[1]; 833 for (i = 0; i < ssidlen; i++) 834 fold |= ie[2 + i]; 835 836 if (fold) { 837 /* not a hidden SSID */ 838 return true; 839 } 840 841 /* This is the bad part ... */ 842 843 list_for_each_entry(bss, &rdev->bss_list, list) { 844 /* 845 * we're iterating all the entries anyway, so take the 846 * opportunity to validate the list length accounting 847 */ 848 n_entries++; 849 850 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid)) 851 continue; 852 if (bss->pub.channel != new->pub.channel) 853 continue; 854 if (bss->pub.scan_width != new->pub.scan_width) 855 continue; 856 if (rcu_access_pointer(bss->pub.beacon_ies)) 857 continue; 858 ies = rcu_access_pointer(bss->pub.ies); 859 if (!ies) 860 continue; 861 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); 862 if (!ie) 863 continue; 864 if (ssidlen && ie[1] != ssidlen) 865 continue; 866 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss)) 867 continue; 868 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list))) 869 list_del(&bss->hidden_list); 870 /* combine them */ 871 list_add(&bss->hidden_list, &new->hidden_list); 872 bss->pub.hidden_beacon_bss = &new->pub; 873 new->refcount += bss->refcount; 874 rcu_assign_pointer(bss->pub.beacon_ies, 875 new->pub.beacon_ies); 876 } 877 878 WARN_ONCE(n_entries != rdev->bss_entries, 879 "rdev bss entries[%d]/list[len:%d] corruption\n", 880 rdev->bss_entries, n_entries); 881 882 return true; 883 } 884 885 /* Returned bss is reference counted and must be cleaned up appropriately. */ 886 static struct cfg80211_internal_bss * 887 cfg80211_bss_update(struct cfg80211_registered_device *rdev, 888 struct cfg80211_internal_bss *tmp, 889 bool signal_valid) 890 { 891 struct cfg80211_internal_bss *found = NULL; 892 893 if (WARN_ON(!tmp->pub.channel)) 894 return NULL; 895 896 tmp->ts = jiffies; 897 898 spin_lock_bh(&rdev->bss_lock); 899 900 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) { 901 spin_unlock_bh(&rdev->bss_lock); 902 return NULL; 903 } 904 905 found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR); 906 907 if (found) { 908 /* Update IEs */ 909 if (rcu_access_pointer(tmp->pub.proberesp_ies)) { 910 const struct cfg80211_bss_ies *old; 911 912 old = rcu_access_pointer(found->pub.proberesp_ies); 913 914 rcu_assign_pointer(found->pub.proberesp_ies, 915 tmp->pub.proberesp_ies); 916 /* Override possible earlier Beacon frame IEs */ 917 rcu_assign_pointer(found->pub.ies, 918 tmp->pub.proberesp_ies); 919 if (old) 920 kfree_rcu((struct cfg80211_bss_ies *)old, 921 rcu_head); 922 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) { 923 const struct cfg80211_bss_ies *old; 924 struct cfg80211_internal_bss *bss; 925 926 if (found->pub.hidden_beacon_bss && 927 !list_empty(&found->hidden_list)) { 928 const struct cfg80211_bss_ies *f; 929 930 /* 931 * The found BSS struct is one of the probe 932 * response members of a group, but we're 933 * receiving a beacon (beacon_ies in the tmp 934 * bss is used). This can only mean that the 935 * AP changed its beacon from not having an 936 * SSID to showing it, which is confusing so 937 * drop this information. 938 */ 939 940 f = rcu_access_pointer(tmp->pub.beacon_ies); 941 kfree_rcu((struct cfg80211_bss_ies *)f, 942 rcu_head); 943 goto drop; 944 } 945 946 old = rcu_access_pointer(found->pub.beacon_ies); 947 948 rcu_assign_pointer(found->pub.beacon_ies, 949 tmp->pub.beacon_ies); 950 951 /* Override IEs if they were from a beacon before */ 952 if (old == rcu_access_pointer(found->pub.ies)) 953 rcu_assign_pointer(found->pub.ies, 954 tmp->pub.beacon_ies); 955 956 /* Assign beacon IEs to all sub entries */ 957 list_for_each_entry(bss, &found->hidden_list, 958 hidden_list) { 959 const struct cfg80211_bss_ies *ies; 960 961 ies = rcu_access_pointer(bss->pub.beacon_ies); 962 WARN_ON(ies != old); 963 964 rcu_assign_pointer(bss->pub.beacon_ies, 965 tmp->pub.beacon_ies); 966 } 967 968 if (old) 969 kfree_rcu((struct cfg80211_bss_ies *)old, 970 rcu_head); 971 } 972 973 found->pub.beacon_interval = tmp->pub.beacon_interval; 974 /* 975 * don't update the signal if beacon was heard on 976 * adjacent channel. 977 */ 978 if (signal_valid) 979 found->pub.signal = tmp->pub.signal; 980 found->pub.capability = tmp->pub.capability; 981 found->ts = tmp->ts; 982 found->ts_boottime = tmp->ts_boottime; 983 found->parent_tsf = tmp->parent_tsf; 984 ether_addr_copy(found->parent_bssid, tmp->parent_bssid); 985 } else { 986 struct cfg80211_internal_bss *new; 987 struct cfg80211_internal_bss *hidden; 988 struct cfg80211_bss_ies *ies; 989 990 /* 991 * create a copy -- the "res" variable that is passed in 992 * is allocated on the stack since it's not needed in the 993 * more common case of an update 994 */ 995 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size, 996 GFP_ATOMIC); 997 if (!new) { 998 ies = (void *)rcu_dereference(tmp->pub.beacon_ies); 999 if (ies) 1000 kfree_rcu(ies, rcu_head); 1001 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies); 1002 if (ies) 1003 kfree_rcu(ies, rcu_head); 1004 goto drop; 1005 } 1006 memcpy(new, tmp, sizeof(*new)); 1007 new->refcount = 1; 1008 INIT_LIST_HEAD(&new->hidden_list); 1009 1010 if (rcu_access_pointer(tmp->pub.proberesp_ies)) { 1011 hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN); 1012 if (!hidden) 1013 hidden = rb_find_bss(rdev, tmp, 1014 BSS_CMP_HIDE_NUL); 1015 if (hidden) { 1016 new->pub.hidden_beacon_bss = &hidden->pub; 1017 list_add(&new->hidden_list, 1018 &hidden->hidden_list); 1019 hidden->refcount++; 1020 rcu_assign_pointer(new->pub.beacon_ies, 1021 hidden->pub.beacon_ies); 1022 } 1023 } else { 1024 /* 1025 * Ok so we found a beacon, and don't have an entry. If 1026 * it's a beacon with hidden SSID, we might be in for an 1027 * expensive search for any probe responses that should 1028 * be grouped with this beacon for updates ... 1029 */ 1030 if (!cfg80211_combine_bsses(rdev, new)) { 1031 kfree(new); 1032 goto drop; 1033 } 1034 } 1035 1036 if (rdev->bss_entries >= bss_entries_limit && 1037 !cfg80211_bss_expire_oldest(rdev)) { 1038 kfree(new); 1039 goto drop; 1040 } 1041 1042 list_add_tail(&new->list, &rdev->bss_list); 1043 rdev->bss_entries++; 1044 rb_insert_bss(rdev, new); 1045 found = new; 1046 } 1047 1048 rdev->bss_generation++; 1049 bss_ref_get(rdev, found); 1050 spin_unlock_bh(&rdev->bss_lock); 1051 1052 return found; 1053 drop: 1054 spin_unlock_bh(&rdev->bss_lock); 1055 return NULL; 1056 } 1057 1058 static struct ieee80211_channel * 1059 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen, 1060 struct ieee80211_channel *channel) 1061 { 1062 const u8 *tmp; 1063 u32 freq; 1064 int channel_number = -1; 1065 1066 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen); 1067 if (tmp && tmp[1] == 1) { 1068 channel_number = tmp[2]; 1069 } else { 1070 tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen); 1071 if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) { 1072 struct ieee80211_ht_operation *htop = (void *)(tmp + 2); 1073 1074 channel_number = htop->primary_chan; 1075 } 1076 } 1077 1078 if (channel_number < 0) 1079 return channel; 1080 1081 freq = ieee80211_channel_to_frequency(channel_number, channel->band); 1082 channel = ieee80211_get_channel(wiphy, freq); 1083 if (!channel) 1084 return NULL; 1085 if (channel->flags & IEEE80211_CHAN_DISABLED) 1086 return NULL; 1087 return channel; 1088 } 1089 1090 /* Returned bss is reference counted and must be cleaned up appropriately. */ 1091 struct cfg80211_bss * 1092 cfg80211_inform_bss_data(struct wiphy *wiphy, 1093 struct cfg80211_inform_bss *data, 1094 enum cfg80211_bss_frame_type ftype, 1095 const u8 *bssid, u64 tsf, u16 capability, 1096 u16 beacon_interval, const u8 *ie, size_t ielen, 1097 gfp_t gfp) 1098 { 1099 struct cfg80211_bss_ies *ies; 1100 struct ieee80211_channel *channel; 1101 struct cfg80211_internal_bss tmp = {}, *res; 1102 int bss_type; 1103 bool signal_valid; 1104 1105 if (WARN_ON(!wiphy)) 1106 return NULL; 1107 1108 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC && 1109 (data->signal < 0 || data->signal > 100))) 1110 return NULL; 1111 1112 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan); 1113 if (!channel) 1114 return NULL; 1115 1116 memcpy(tmp.pub.bssid, bssid, ETH_ALEN); 1117 tmp.pub.channel = channel; 1118 tmp.pub.scan_width = data->scan_width; 1119 tmp.pub.signal = data->signal; 1120 tmp.pub.beacon_interval = beacon_interval; 1121 tmp.pub.capability = capability; 1122 tmp.ts_boottime = data->boottime_ns; 1123 1124 /* 1125 * If we do not know here whether the IEs are from a Beacon or Probe 1126 * Response frame, we need to pick one of the options and only use it 1127 * with the driver that does not provide the full Beacon/Probe Response 1128 * frame. Use Beacon frame pointer to avoid indicating that this should 1129 * override the IEs pointer should we have received an earlier 1130 * indication of Probe Response data. 1131 */ 1132 ies = kzalloc(sizeof(*ies) + ielen, gfp); 1133 if (!ies) 1134 return NULL; 1135 ies->len = ielen; 1136 ies->tsf = tsf; 1137 ies->from_beacon = false; 1138 memcpy(ies->data, ie, ielen); 1139 1140 switch (ftype) { 1141 case CFG80211_BSS_FTYPE_BEACON: 1142 ies->from_beacon = true; 1143 /* fall through to assign */ 1144 case CFG80211_BSS_FTYPE_UNKNOWN: 1145 rcu_assign_pointer(tmp.pub.beacon_ies, ies); 1146 break; 1147 case CFG80211_BSS_FTYPE_PRESP: 1148 rcu_assign_pointer(tmp.pub.proberesp_ies, ies); 1149 break; 1150 } 1151 rcu_assign_pointer(tmp.pub.ies, ies); 1152 1153 signal_valid = abs(data->chan->center_freq - channel->center_freq) <= 1154 wiphy->max_adj_channel_rssi_comp; 1155 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid); 1156 if (!res) 1157 return NULL; 1158 1159 if (channel->band == NL80211_BAND_60GHZ) { 1160 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK; 1161 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP || 1162 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS) 1163 regulatory_hint_found_beacon(wiphy, channel, gfp); 1164 } else { 1165 if (res->pub.capability & WLAN_CAPABILITY_ESS) 1166 regulatory_hint_found_beacon(wiphy, channel, gfp); 1167 } 1168 1169 trace_cfg80211_return_bss(&res->pub); 1170 /* cfg80211_bss_update gives us a referenced result */ 1171 return &res->pub; 1172 } 1173 EXPORT_SYMBOL(cfg80211_inform_bss_data); 1174 1175 /* cfg80211_inform_bss_width_frame helper */ 1176 struct cfg80211_bss * 1177 cfg80211_inform_bss_frame_data(struct wiphy *wiphy, 1178 struct cfg80211_inform_bss *data, 1179 struct ieee80211_mgmt *mgmt, size_t len, 1180 gfp_t gfp) 1181 1182 { 1183 struct cfg80211_internal_bss tmp = {}, *res; 1184 struct cfg80211_bss_ies *ies; 1185 struct ieee80211_channel *channel; 1186 bool signal_valid; 1187 size_t ielen = len - offsetof(struct ieee80211_mgmt, 1188 u.probe_resp.variable); 1189 int bss_type; 1190 1191 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) != 1192 offsetof(struct ieee80211_mgmt, u.beacon.variable)); 1193 1194 trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len); 1195 1196 if (WARN_ON(!mgmt)) 1197 return NULL; 1198 1199 if (WARN_ON(!wiphy)) 1200 return NULL; 1201 1202 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC && 1203 (data->signal < 0 || data->signal > 100))) 1204 return NULL; 1205 1206 if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable))) 1207 return NULL; 1208 1209 channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable, 1210 ielen, data->chan); 1211 if (!channel) 1212 return NULL; 1213 1214 ies = kzalloc(sizeof(*ies) + ielen, gfp); 1215 if (!ies) 1216 return NULL; 1217 ies->len = ielen; 1218 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp); 1219 ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control); 1220 memcpy(ies->data, mgmt->u.probe_resp.variable, ielen); 1221 1222 if (ieee80211_is_probe_resp(mgmt->frame_control)) 1223 rcu_assign_pointer(tmp.pub.proberesp_ies, ies); 1224 else 1225 rcu_assign_pointer(tmp.pub.beacon_ies, ies); 1226 rcu_assign_pointer(tmp.pub.ies, ies); 1227 1228 memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN); 1229 tmp.pub.channel = channel; 1230 tmp.pub.scan_width = data->scan_width; 1231 tmp.pub.signal = data->signal; 1232 tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int); 1233 tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info); 1234 tmp.ts_boottime = data->boottime_ns; 1235 tmp.parent_tsf = data->parent_tsf; 1236 ether_addr_copy(tmp.parent_bssid, data->parent_bssid); 1237 1238 signal_valid = abs(data->chan->center_freq - channel->center_freq) <= 1239 wiphy->max_adj_channel_rssi_comp; 1240 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid); 1241 if (!res) 1242 return NULL; 1243 1244 if (channel->band == NL80211_BAND_60GHZ) { 1245 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK; 1246 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP || 1247 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS) 1248 regulatory_hint_found_beacon(wiphy, channel, gfp); 1249 } else { 1250 if (res->pub.capability & WLAN_CAPABILITY_ESS) 1251 regulatory_hint_found_beacon(wiphy, channel, gfp); 1252 } 1253 1254 trace_cfg80211_return_bss(&res->pub); 1255 /* cfg80211_bss_update gives us a referenced result */ 1256 return &res->pub; 1257 } 1258 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data); 1259 1260 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 1261 { 1262 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1263 struct cfg80211_internal_bss *bss; 1264 1265 if (!pub) 1266 return; 1267 1268 bss = container_of(pub, struct cfg80211_internal_bss, pub); 1269 1270 spin_lock_bh(&rdev->bss_lock); 1271 bss_ref_get(rdev, bss); 1272 spin_unlock_bh(&rdev->bss_lock); 1273 } 1274 EXPORT_SYMBOL(cfg80211_ref_bss); 1275 1276 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 1277 { 1278 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1279 struct cfg80211_internal_bss *bss; 1280 1281 if (!pub) 1282 return; 1283 1284 bss = container_of(pub, struct cfg80211_internal_bss, pub); 1285 1286 spin_lock_bh(&rdev->bss_lock); 1287 bss_ref_put(rdev, bss); 1288 spin_unlock_bh(&rdev->bss_lock); 1289 } 1290 EXPORT_SYMBOL(cfg80211_put_bss); 1291 1292 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 1293 { 1294 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1295 struct cfg80211_internal_bss *bss; 1296 1297 if (WARN_ON(!pub)) 1298 return; 1299 1300 bss = container_of(pub, struct cfg80211_internal_bss, pub); 1301 1302 spin_lock_bh(&rdev->bss_lock); 1303 if (!list_empty(&bss->list)) { 1304 if (__cfg80211_unlink_bss(rdev, bss)) 1305 rdev->bss_generation++; 1306 } 1307 spin_unlock_bh(&rdev->bss_lock); 1308 } 1309 EXPORT_SYMBOL(cfg80211_unlink_bss); 1310 1311 #ifdef CONFIG_CFG80211_WEXT 1312 static struct cfg80211_registered_device * 1313 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex) 1314 { 1315 struct cfg80211_registered_device *rdev; 1316 struct net_device *dev; 1317 1318 ASSERT_RTNL(); 1319 1320 dev = dev_get_by_index(net, ifindex); 1321 if (!dev) 1322 return ERR_PTR(-ENODEV); 1323 if (dev->ieee80211_ptr) 1324 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy); 1325 else 1326 rdev = ERR_PTR(-ENODEV); 1327 dev_put(dev); 1328 return rdev; 1329 } 1330 1331 int cfg80211_wext_siwscan(struct net_device *dev, 1332 struct iw_request_info *info, 1333 union iwreq_data *wrqu, char *extra) 1334 { 1335 struct cfg80211_registered_device *rdev; 1336 struct wiphy *wiphy; 1337 struct iw_scan_req *wreq = NULL; 1338 struct cfg80211_scan_request *creq = NULL; 1339 int i, err, n_channels = 0; 1340 enum nl80211_band band; 1341 1342 if (!netif_running(dev)) 1343 return -ENETDOWN; 1344 1345 if (wrqu->data.length == sizeof(struct iw_scan_req)) 1346 wreq = (struct iw_scan_req *)extra; 1347 1348 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex); 1349 1350 if (IS_ERR(rdev)) 1351 return PTR_ERR(rdev); 1352 1353 if (rdev->scan_req || rdev->scan_msg) { 1354 err = -EBUSY; 1355 goto out; 1356 } 1357 1358 wiphy = &rdev->wiphy; 1359 1360 /* Determine number of channels, needed to allocate creq */ 1361 if (wreq && wreq->num_channels) 1362 n_channels = wreq->num_channels; 1363 else 1364 n_channels = ieee80211_get_num_supported_channels(wiphy); 1365 1366 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) + 1367 n_channels * sizeof(void *), 1368 GFP_ATOMIC); 1369 if (!creq) { 1370 err = -ENOMEM; 1371 goto out; 1372 } 1373 1374 creq->wiphy = wiphy; 1375 creq->wdev = dev->ieee80211_ptr; 1376 /* SSIDs come after channels */ 1377 creq->ssids = (void *)&creq->channels[n_channels]; 1378 creq->n_channels = n_channels; 1379 creq->n_ssids = 1; 1380 creq->scan_start = jiffies; 1381 1382 /* translate "Scan on frequencies" request */ 1383 i = 0; 1384 for (band = 0; band < NUM_NL80211_BANDS; band++) { 1385 int j; 1386 1387 if (!wiphy->bands[band]) 1388 continue; 1389 1390 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 1391 /* ignore disabled channels */ 1392 if (wiphy->bands[band]->channels[j].flags & 1393 IEEE80211_CHAN_DISABLED) 1394 continue; 1395 1396 /* If we have a wireless request structure and the 1397 * wireless request specifies frequencies, then search 1398 * for the matching hardware channel. 1399 */ 1400 if (wreq && wreq->num_channels) { 1401 int k; 1402 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq; 1403 for (k = 0; k < wreq->num_channels; k++) { 1404 struct iw_freq *freq = 1405 &wreq->channel_list[k]; 1406 int wext_freq = 1407 cfg80211_wext_freq(freq); 1408 1409 if (wext_freq == wiphy_freq) 1410 goto wext_freq_found; 1411 } 1412 goto wext_freq_not_found; 1413 } 1414 1415 wext_freq_found: 1416 creq->channels[i] = &wiphy->bands[band]->channels[j]; 1417 i++; 1418 wext_freq_not_found: ; 1419 } 1420 } 1421 /* No channels found? */ 1422 if (!i) { 1423 err = -EINVAL; 1424 goto out; 1425 } 1426 1427 /* Set real number of channels specified in creq->channels[] */ 1428 creq->n_channels = i; 1429 1430 /* translate "Scan for SSID" request */ 1431 if (wreq) { 1432 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) { 1433 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) { 1434 err = -EINVAL; 1435 goto out; 1436 } 1437 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len); 1438 creq->ssids[0].ssid_len = wreq->essid_len; 1439 } 1440 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE) 1441 creq->n_ssids = 0; 1442 } 1443 1444 for (i = 0; i < NUM_NL80211_BANDS; i++) 1445 if (wiphy->bands[i]) 1446 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1; 1447 1448 eth_broadcast_addr(creq->bssid); 1449 1450 rdev->scan_req = creq; 1451 err = rdev_scan(rdev, creq); 1452 if (err) { 1453 rdev->scan_req = NULL; 1454 /* creq will be freed below */ 1455 } else { 1456 nl80211_send_scan_start(rdev, dev->ieee80211_ptr); 1457 /* creq now owned by driver */ 1458 creq = NULL; 1459 dev_hold(dev); 1460 } 1461 out: 1462 kfree(creq); 1463 return err; 1464 } 1465 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan); 1466 1467 static char *ieee80211_scan_add_ies(struct iw_request_info *info, 1468 const struct cfg80211_bss_ies *ies, 1469 char *current_ev, char *end_buf) 1470 { 1471 const u8 *pos, *end, *next; 1472 struct iw_event iwe; 1473 1474 if (!ies) 1475 return current_ev; 1476 1477 /* 1478 * If needed, fragment the IEs buffer (at IE boundaries) into short 1479 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages. 1480 */ 1481 pos = ies->data; 1482 end = pos + ies->len; 1483 1484 while (end - pos > IW_GENERIC_IE_MAX) { 1485 next = pos + 2 + pos[1]; 1486 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX) 1487 next = next + 2 + next[1]; 1488 1489 memset(&iwe, 0, sizeof(iwe)); 1490 iwe.cmd = IWEVGENIE; 1491 iwe.u.data.length = next - pos; 1492 current_ev = iwe_stream_add_point_check(info, current_ev, 1493 end_buf, &iwe, 1494 (void *)pos); 1495 if (IS_ERR(current_ev)) 1496 return current_ev; 1497 pos = next; 1498 } 1499 1500 if (end > pos) { 1501 memset(&iwe, 0, sizeof(iwe)); 1502 iwe.cmd = IWEVGENIE; 1503 iwe.u.data.length = end - pos; 1504 current_ev = iwe_stream_add_point_check(info, current_ev, 1505 end_buf, &iwe, 1506 (void *)pos); 1507 if (IS_ERR(current_ev)) 1508 return current_ev; 1509 } 1510 1511 return current_ev; 1512 } 1513 1514 static char * 1515 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info, 1516 struct cfg80211_internal_bss *bss, char *current_ev, 1517 char *end_buf) 1518 { 1519 const struct cfg80211_bss_ies *ies; 1520 struct iw_event iwe; 1521 const u8 *ie; 1522 u8 buf[50]; 1523 u8 *cfg, *p, *tmp; 1524 int rem, i, sig; 1525 bool ismesh = false; 1526 1527 memset(&iwe, 0, sizeof(iwe)); 1528 iwe.cmd = SIOCGIWAP; 1529 iwe.u.ap_addr.sa_family = ARPHRD_ETHER; 1530 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN); 1531 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 1532 IW_EV_ADDR_LEN); 1533 if (IS_ERR(current_ev)) 1534 return current_ev; 1535 1536 memset(&iwe, 0, sizeof(iwe)); 1537 iwe.cmd = SIOCGIWFREQ; 1538 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq); 1539 iwe.u.freq.e = 0; 1540 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 1541 IW_EV_FREQ_LEN); 1542 if (IS_ERR(current_ev)) 1543 return current_ev; 1544 1545 memset(&iwe, 0, sizeof(iwe)); 1546 iwe.cmd = SIOCGIWFREQ; 1547 iwe.u.freq.m = bss->pub.channel->center_freq; 1548 iwe.u.freq.e = 6; 1549 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 1550 IW_EV_FREQ_LEN); 1551 if (IS_ERR(current_ev)) 1552 return current_ev; 1553 1554 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) { 1555 memset(&iwe, 0, sizeof(iwe)); 1556 iwe.cmd = IWEVQUAL; 1557 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED | 1558 IW_QUAL_NOISE_INVALID | 1559 IW_QUAL_QUAL_UPDATED; 1560 switch (wiphy->signal_type) { 1561 case CFG80211_SIGNAL_TYPE_MBM: 1562 sig = bss->pub.signal / 100; 1563 iwe.u.qual.level = sig; 1564 iwe.u.qual.updated |= IW_QUAL_DBM; 1565 if (sig < -110) /* rather bad */ 1566 sig = -110; 1567 else if (sig > -40) /* perfect */ 1568 sig = -40; 1569 /* will give a range of 0 .. 70 */ 1570 iwe.u.qual.qual = sig + 110; 1571 break; 1572 case CFG80211_SIGNAL_TYPE_UNSPEC: 1573 iwe.u.qual.level = bss->pub.signal; 1574 /* will give range 0 .. 100 */ 1575 iwe.u.qual.qual = bss->pub.signal; 1576 break; 1577 default: 1578 /* not reached */ 1579 break; 1580 } 1581 current_ev = iwe_stream_add_event_check(info, current_ev, 1582 end_buf, &iwe, 1583 IW_EV_QUAL_LEN); 1584 if (IS_ERR(current_ev)) 1585 return current_ev; 1586 } 1587 1588 memset(&iwe, 0, sizeof(iwe)); 1589 iwe.cmd = SIOCGIWENCODE; 1590 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY) 1591 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; 1592 else 1593 iwe.u.data.flags = IW_ENCODE_DISABLED; 1594 iwe.u.data.length = 0; 1595 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf, 1596 &iwe, ""); 1597 if (IS_ERR(current_ev)) 1598 return current_ev; 1599 1600 rcu_read_lock(); 1601 ies = rcu_dereference(bss->pub.ies); 1602 rem = ies->len; 1603 ie = ies->data; 1604 1605 while (rem >= 2) { 1606 /* invalid data */ 1607 if (ie[1] > rem - 2) 1608 break; 1609 1610 switch (ie[0]) { 1611 case WLAN_EID_SSID: 1612 memset(&iwe, 0, sizeof(iwe)); 1613 iwe.cmd = SIOCGIWESSID; 1614 iwe.u.data.length = ie[1]; 1615 iwe.u.data.flags = 1; 1616 current_ev = iwe_stream_add_point_check(info, 1617 current_ev, 1618 end_buf, &iwe, 1619 (u8 *)ie + 2); 1620 if (IS_ERR(current_ev)) 1621 goto unlock; 1622 break; 1623 case WLAN_EID_MESH_ID: 1624 memset(&iwe, 0, sizeof(iwe)); 1625 iwe.cmd = SIOCGIWESSID; 1626 iwe.u.data.length = ie[1]; 1627 iwe.u.data.flags = 1; 1628 current_ev = iwe_stream_add_point_check(info, 1629 current_ev, 1630 end_buf, &iwe, 1631 (u8 *)ie + 2); 1632 if (IS_ERR(current_ev)) 1633 goto unlock; 1634 break; 1635 case WLAN_EID_MESH_CONFIG: 1636 ismesh = true; 1637 if (ie[1] != sizeof(struct ieee80211_meshconf_ie)) 1638 break; 1639 cfg = (u8 *)ie + 2; 1640 memset(&iwe, 0, sizeof(iwe)); 1641 iwe.cmd = IWEVCUSTOM; 1642 sprintf(buf, "Mesh Network Path Selection Protocol ID: " 1643 "0x%02X", cfg[0]); 1644 iwe.u.data.length = strlen(buf); 1645 current_ev = iwe_stream_add_point_check(info, 1646 current_ev, 1647 end_buf, 1648 &iwe, buf); 1649 if (IS_ERR(current_ev)) 1650 goto unlock; 1651 sprintf(buf, "Path Selection Metric ID: 0x%02X", 1652 cfg[1]); 1653 iwe.u.data.length = strlen(buf); 1654 current_ev = iwe_stream_add_point_check(info, 1655 current_ev, 1656 end_buf, 1657 &iwe, buf); 1658 if (IS_ERR(current_ev)) 1659 goto unlock; 1660 sprintf(buf, "Congestion Control Mode ID: 0x%02X", 1661 cfg[2]); 1662 iwe.u.data.length = strlen(buf); 1663 current_ev = iwe_stream_add_point_check(info, 1664 current_ev, 1665 end_buf, 1666 &iwe, buf); 1667 if (IS_ERR(current_ev)) 1668 goto unlock; 1669 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]); 1670 iwe.u.data.length = strlen(buf); 1671 current_ev = iwe_stream_add_point_check(info, 1672 current_ev, 1673 end_buf, 1674 &iwe, buf); 1675 if (IS_ERR(current_ev)) 1676 goto unlock; 1677 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]); 1678 iwe.u.data.length = strlen(buf); 1679 current_ev = iwe_stream_add_point_check(info, 1680 current_ev, 1681 end_buf, 1682 &iwe, buf); 1683 if (IS_ERR(current_ev)) 1684 goto unlock; 1685 sprintf(buf, "Formation Info: 0x%02X", cfg[5]); 1686 iwe.u.data.length = strlen(buf); 1687 current_ev = iwe_stream_add_point_check(info, 1688 current_ev, 1689 end_buf, 1690 &iwe, buf); 1691 if (IS_ERR(current_ev)) 1692 goto unlock; 1693 sprintf(buf, "Capabilities: 0x%02X", cfg[6]); 1694 iwe.u.data.length = strlen(buf); 1695 current_ev = iwe_stream_add_point_check(info, 1696 current_ev, 1697 end_buf, 1698 &iwe, buf); 1699 if (IS_ERR(current_ev)) 1700 goto unlock; 1701 break; 1702 case WLAN_EID_SUPP_RATES: 1703 case WLAN_EID_EXT_SUPP_RATES: 1704 /* display all supported rates in readable format */ 1705 p = current_ev + iwe_stream_lcp_len(info); 1706 1707 memset(&iwe, 0, sizeof(iwe)); 1708 iwe.cmd = SIOCGIWRATE; 1709 /* Those two flags are ignored... */ 1710 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0; 1711 1712 for (i = 0; i < ie[1]; i++) { 1713 iwe.u.bitrate.value = 1714 ((ie[i + 2] & 0x7f) * 500000); 1715 tmp = p; 1716 p = iwe_stream_add_value(info, current_ev, p, 1717 end_buf, &iwe, 1718 IW_EV_PARAM_LEN); 1719 if (p == tmp) { 1720 current_ev = ERR_PTR(-E2BIG); 1721 goto unlock; 1722 } 1723 } 1724 current_ev = p; 1725 break; 1726 } 1727 rem -= ie[1] + 2; 1728 ie += ie[1] + 2; 1729 } 1730 1731 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) || 1732 ismesh) { 1733 memset(&iwe, 0, sizeof(iwe)); 1734 iwe.cmd = SIOCGIWMODE; 1735 if (ismesh) 1736 iwe.u.mode = IW_MODE_MESH; 1737 else if (bss->pub.capability & WLAN_CAPABILITY_ESS) 1738 iwe.u.mode = IW_MODE_MASTER; 1739 else 1740 iwe.u.mode = IW_MODE_ADHOC; 1741 current_ev = iwe_stream_add_event_check(info, current_ev, 1742 end_buf, &iwe, 1743 IW_EV_UINT_LEN); 1744 if (IS_ERR(current_ev)) 1745 goto unlock; 1746 } 1747 1748 memset(&iwe, 0, sizeof(iwe)); 1749 iwe.cmd = IWEVCUSTOM; 1750 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf)); 1751 iwe.u.data.length = strlen(buf); 1752 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf, 1753 &iwe, buf); 1754 if (IS_ERR(current_ev)) 1755 goto unlock; 1756 memset(&iwe, 0, sizeof(iwe)); 1757 iwe.cmd = IWEVCUSTOM; 1758 sprintf(buf, " Last beacon: %ums ago", 1759 elapsed_jiffies_msecs(bss->ts)); 1760 iwe.u.data.length = strlen(buf); 1761 current_ev = iwe_stream_add_point_check(info, current_ev, 1762 end_buf, &iwe, buf); 1763 if (IS_ERR(current_ev)) 1764 goto unlock; 1765 1766 current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf); 1767 1768 unlock: 1769 rcu_read_unlock(); 1770 return current_ev; 1771 } 1772 1773 1774 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev, 1775 struct iw_request_info *info, 1776 char *buf, size_t len) 1777 { 1778 char *current_ev = buf; 1779 char *end_buf = buf + len; 1780 struct cfg80211_internal_bss *bss; 1781 int err = 0; 1782 1783 spin_lock_bh(&rdev->bss_lock); 1784 cfg80211_bss_expire(rdev); 1785 1786 list_for_each_entry(bss, &rdev->bss_list, list) { 1787 if (buf + len - current_ev <= IW_EV_ADDR_LEN) { 1788 err = -E2BIG; 1789 break; 1790 } 1791 current_ev = ieee80211_bss(&rdev->wiphy, info, bss, 1792 current_ev, end_buf); 1793 if (IS_ERR(current_ev)) { 1794 err = PTR_ERR(current_ev); 1795 break; 1796 } 1797 } 1798 spin_unlock_bh(&rdev->bss_lock); 1799 1800 if (err) 1801 return err; 1802 return current_ev - buf; 1803 } 1804 1805 1806 int cfg80211_wext_giwscan(struct net_device *dev, 1807 struct iw_request_info *info, 1808 struct iw_point *data, char *extra) 1809 { 1810 struct cfg80211_registered_device *rdev; 1811 int res; 1812 1813 if (!netif_running(dev)) 1814 return -ENETDOWN; 1815 1816 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex); 1817 1818 if (IS_ERR(rdev)) 1819 return PTR_ERR(rdev); 1820 1821 if (rdev->scan_req || rdev->scan_msg) 1822 return -EAGAIN; 1823 1824 res = ieee80211_scan_results(rdev, info, extra, data->length); 1825 data->length = 0; 1826 if (res >= 0) { 1827 data->length = res; 1828 res = 0; 1829 } 1830 1831 return res; 1832 } 1833 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan); 1834 #endif 1835