1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * cfg80211 scan result handling 4 * 5 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2016 Intel Deutschland GmbH 8 * Copyright (C) 2018-2022 Intel Corporation 9 */ 10 #include <linux/kernel.h> 11 #include <linux/slab.h> 12 #include <linux/module.h> 13 #include <linux/netdevice.h> 14 #include <linux/wireless.h> 15 #include <linux/nl80211.h> 16 #include <linux/etherdevice.h> 17 #include <linux/crc32.h> 18 #include <linux/bitfield.h> 19 #include <net/arp.h> 20 #include <net/cfg80211.h> 21 #include <net/cfg80211-wext.h> 22 #include <net/iw_handler.h> 23 #include "core.h" 24 #include "nl80211.h" 25 #include "wext-compat.h" 26 #include "rdev-ops.h" 27 28 /** 29 * DOC: BSS tree/list structure 30 * 31 * At the top level, the BSS list is kept in both a list in each 32 * registered device (@bss_list) as well as an RB-tree for faster 33 * lookup. In the RB-tree, entries can be looked up using their 34 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID 35 * for other BSSes. 36 * 37 * Due to the possibility of hidden SSIDs, there's a second level 38 * structure, the "hidden_list" and "hidden_beacon_bss" pointer. 39 * The hidden_list connects all BSSes belonging to a single AP 40 * that has a hidden SSID, and connects beacon and probe response 41 * entries. For a probe response entry for a hidden SSID, the 42 * hidden_beacon_bss pointer points to the BSS struct holding the 43 * beacon's information. 44 * 45 * Reference counting is done for all these references except for 46 * the hidden_list, so that a beacon BSS struct that is otherwise 47 * not referenced has one reference for being on the bss_list and 48 * one for each probe response entry that points to it using the 49 * hidden_beacon_bss pointer. When a BSS struct that has such a 50 * pointer is get/put, the refcount update is also propagated to 51 * the referenced struct, this ensure that it cannot get removed 52 * while somebody is using the probe response version. 53 * 54 * Note that the hidden_beacon_bss pointer never changes, due to 55 * the reference counting. Therefore, no locking is needed for 56 * it. 57 * 58 * Also note that the hidden_beacon_bss pointer is only relevant 59 * if the driver uses something other than the IEs, e.g. private 60 * data stored in the BSS struct, since the beacon IEs are 61 * also linked into the probe response struct. 62 */ 63 64 /* 65 * Limit the number of BSS entries stored in mac80211. Each one is 66 * a bit over 4k at most, so this limits to roughly 4-5M of memory. 67 * If somebody wants to really attack this though, they'd likely 68 * use small beacons, and only one type of frame, limiting each of 69 * the entries to a much smaller size (in order to generate more 70 * entries in total, so overhead is bigger.) 71 */ 72 static int bss_entries_limit = 1000; 73 module_param(bss_entries_limit, int, 0644); 74 MODULE_PARM_DESC(bss_entries_limit, 75 "limit to number of scan BSS entries (per wiphy, default 1000)"); 76 77 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ) 78 79 /** 80 * struct cfg80211_colocated_ap - colocated AP information 81 * 82 * @list: linked list to all colocated aPS 83 * @bssid: BSSID of the reported AP 84 * @ssid: SSID of the reported AP 85 * @ssid_len: length of the ssid 86 * @center_freq: frequency the reported AP is on 87 * @unsolicited_probe: the reported AP is part of an ESS, where all the APs 88 * that operate in the same channel as the reported AP and that might be 89 * detected by a STA receiving this frame, are transmitting unsolicited 90 * Probe Response frames every 20 TUs 91 * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP 92 * @same_ssid: the reported AP has the same SSID as the reporting AP 93 * @multi_bss: the reported AP is part of a multiple BSSID set 94 * @transmitted_bssid: the reported AP is the transmitting BSSID 95 * @colocated_ess: all the APs that share the same ESS as the reported AP are 96 * colocated and can be discovered via legacy bands. 97 * @short_ssid_valid: short_ssid is valid and can be used 98 * @short_ssid: the short SSID for this SSID 99 */ 100 struct cfg80211_colocated_ap { 101 struct list_head list; 102 u8 bssid[ETH_ALEN]; 103 u8 ssid[IEEE80211_MAX_SSID_LEN]; 104 size_t ssid_len; 105 u32 short_ssid; 106 u32 center_freq; 107 u8 unsolicited_probe:1, 108 oct_recommended:1, 109 same_ssid:1, 110 multi_bss:1, 111 transmitted_bssid:1, 112 colocated_ess:1, 113 short_ssid_valid:1; 114 }; 115 116 static void bss_free(struct cfg80211_internal_bss *bss) 117 { 118 struct cfg80211_bss_ies *ies; 119 120 if (WARN_ON(atomic_read(&bss->hold))) 121 return; 122 123 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies); 124 if (ies && !bss->pub.hidden_beacon_bss) 125 kfree_rcu(ies, rcu_head); 126 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies); 127 if (ies) 128 kfree_rcu(ies, rcu_head); 129 130 /* 131 * This happens when the module is removed, it doesn't 132 * really matter any more save for completeness 133 */ 134 if (!list_empty(&bss->hidden_list)) 135 list_del(&bss->hidden_list); 136 137 kfree(bss); 138 } 139 140 static inline void bss_ref_get(struct cfg80211_registered_device *rdev, 141 struct cfg80211_internal_bss *bss) 142 { 143 lockdep_assert_held(&rdev->bss_lock); 144 145 bss->refcount++; 146 147 if (bss->pub.hidden_beacon_bss) 148 bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++; 149 150 if (bss->pub.transmitted_bss) 151 bss_from_pub(bss->pub.transmitted_bss)->refcount++; 152 } 153 154 static inline void bss_ref_put(struct cfg80211_registered_device *rdev, 155 struct cfg80211_internal_bss *bss) 156 { 157 lockdep_assert_held(&rdev->bss_lock); 158 159 if (bss->pub.hidden_beacon_bss) { 160 struct cfg80211_internal_bss *hbss; 161 162 hbss = bss_from_pub(bss->pub.hidden_beacon_bss); 163 hbss->refcount--; 164 if (hbss->refcount == 0) 165 bss_free(hbss); 166 } 167 168 if (bss->pub.transmitted_bss) { 169 struct cfg80211_internal_bss *tbss; 170 171 tbss = bss_from_pub(bss->pub.transmitted_bss); 172 tbss->refcount--; 173 if (tbss->refcount == 0) 174 bss_free(tbss); 175 } 176 177 bss->refcount--; 178 if (bss->refcount == 0) 179 bss_free(bss); 180 } 181 182 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev, 183 struct cfg80211_internal_bss *bss) 184 { 185 lockdep_assert_held(&rdev->bss_lock); 186 187 if (!list_empty(&bss->hidden_list)) { 188 /* 189 * don't remove the beacon entry if it has 190 * probe responses associated with it 191 */ 192 if (!bss->pub.hidden_beacon_bss) 193 return false; 194 /* 195 * if it's a probe response entry break its 196 * link to the other entries in the group 197 */ 198 list_del_init(&bss->hidden_list); 199 } 200 201 list_del_init(&bss->list); 202 list_del_init(&bss->pub.nontrans_list); 203 rb_erase(&bss->rbn, &rdev->bss_tree); 204 rdev->bss_entries--; 205 WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list), 206 "rdev bss entries[%d]/list[empty:%d] corruption\n", 207 rdev->bss_entries, list_empty(&rdev->bss_list)); 208 bss_ref_put(rdev, bss); 209 return true; 210 } 211 212 bool cfg80211_is_element_inherited(const struct element *elem, 213 const struct element *non_inherit_elem) 214 { 215 u8 id_len, ext_id_len, i, loop_len, id; 216 const u8 *list; 217 218 if (elem->id == WLAN_EID_MULTIPLE_BSSID) 219 return false; 220 221 if (!non_inherit_elem || non_inherit_elem->datalen < 2) 222 return true; 223 224 /* 225 * non inheritance element format is: 226 * ext ID (56) | IDs list len | list | extension IDs list len | list 227 * Both lists are optional. Both lengths are mandatory. 228 * This means valid length is: 229 * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths 230 */ 231 id_len = non_inherit_elem->data[1]; 232 if (non_inherit_elem->datalen < 3 + id_len) 233 return true; 234 235 ext_id_len = non_inherit_elem->data[2 + id_len]; 236 if (non_inherit_elem->datalen < 3 + id_len + ext_id_len) 237 return true; 238 239 if (elem->id == WLAN_EID_EXTENSION) { 240 if (!ext_id_len) 241 return true; 242 loop_len = ext_id_len; 243 list = &non_inherit_elem->data[3 + id_len]; 244 id = elem->data[0]; 245 } else { 246 if (!id_len) 247 return true; 248 loop_len = id_len; 249 list = &non_inherit_elem->data[2]; 250 id = elem->id; 251 } 252 253 for (i = 0; i < loop_len; i++) { 254 if (list[i] == id) 255 return false; 256 } 257 258 return true; 259 } 260 EXPORT_SYMBOL(cfg80211_is_element_inherited); 261 262 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, 263 const u8 *subelement, size_t subie_len, 264 u8 *new_ie, gfp_t gfp) 265 { 266 u8 *pos, *tmp; 267 const u8 *tmp_old, *tmp_new; 268 const struct element *non_inherit_elem; 269 u8 *sub_copy; 270 271 /* copy subelement as we need to change its content to 272 * mark an ie after it is processed. 273 */ 274 sub_copy = kmemdup(subelement, subie_len, gfp); 275 if (!sub_copy) 276 return 0; 277 278 pos = &new_ie[0]; 279 280 /* set new ssid */ 281 tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len); 282 if (tmp_new) { 283 memcpy(pos, tmp_new, tmp_new[1] + 2); 284 pos += (tmp_new[1] + 2); 285 } 286 287 /* get non inheritance list if exists */ 288 non_inherit_elem = 289 cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 290 sub_copy, subie_len); 291 292 /* go through IEs in ie (skip SSID) and subelement, 293 * merge them into new_ie 294 */ 295 tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); 296 tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie; 297 298 while (tmp_old + 2 - ie <= ielen && 299 tmp_old + tmp_old[1] + 2 - ie <= ielen) { 300 if (tmp_old[0] == 0) { 301 tmp_old++; 302 continue; 303 } 304 305 if (tmp_old[0] == WLAN_EID_EXTENSION) 306 tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy, 307 subie_len); 308 else 309 tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy, 310 subie_len); 311 312 if (!tmp) { 313 const struct element *old_elem = (void *)tmp_old; 314 315 /* ie in old ie but not in subelement */ 316 if (cfg80211_is_element_inherited(old_elem, 317 non_inherit_elem)) { 318 memcpy(pos, tmp_old, tmp_old[1] + 2); 319 pos += tmp_old[1] + 2; 320 } 321 } else { 322 /* ie in transmitting ie also in subelement, 323 * copy from subelement and flag the ie in subelement 324 * as copied (by setting eid field to WLAN_EID_SSID, 325 * which is skipped anyway). 326 * For vendor ie, compare OUI + type + subType to 327 * determine if they are the same ie. 328 */ 329 if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) { 330 if (tmp_old[1] >= 5 && tmp[1] >= 5 && 331 !memcmp(tmp_old + 2, tmp + 2, 5)) { 332 /* same vendor ie, copy from 333 * subelement 334 */ 335 memcpy(pos, tmp, tmp[1] + 2); 336 pos += tmp[1] + 2; 337 tmp[0] = WLAN_EID_SSID; 338 } else { 339 memcpy(pos, tmp_old, tmp_old[1] + 2); 340 pos += tmp_old[1] + 2; 341 } 342 } else { 343 /* copy ie from subelement into new ie */ 344 memcpy(pos, tmp, tmp[1] + 2); 345 pos += tmp[1] + 2; 346 tmp[0] = WLAN_EID_SSID; 347 } 348 } 349 350 if (tmp_old + tmp_old[1] + 2 - ie == ielen) 351 break; 352 353 tmp_old += tmp_old[1] + 2; 354 } 355 356 /* go through subelement again to check if there is any ie not 357 * copied to new ie, skip ssid, capability, bssid-index ie 358 */ 359 tmp_new = sub_copy; 360 while (tmp_new + 2 - sub_copy <= subie_len && 361 tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) { 362 if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP || 363 tmp_new[0] == WLAN_EID_SSID)) { 364 memcpy(pos, tmp_new, tmp_new[1] + 2); 365 pos += tmp_new[1] + 2; 366 } 367 if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len) 368 break; 369 tmp_new += tmp_new[1] + 2; 370 } 371 372 kfree(sub_copy); 373 return pos - new_ie; 374 } 375 376 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid, 377 const u8 *ssid, size_t ssid_len) 378 { 379 const struct cfg80211_bss_ies *ies; 380 const struct element *ssid_elem; 381 382 if (bssid && !ether_addr_equal(a->bssid, bssid)) 383 return false; 384 385 if (!ssid) 386 return true; 387 388 ies = rcu_access_pointer(a->ies); 389 if (!ies) 390 return false; 391 ssid_elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len); 392 if (!ssid_elem) 393 return false; 394 if (ssid_elem->datalen != ssid_len) 395 return false; 396 return memcmp(ssid_elem->data, ssid, ssid_len) == 0; 397 } 398 399 static int 400 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss, 401 struct cfg80211_bss *nontrans_bss) 402 { 403 const struct element *ssid_elem; 404 struct cfg80211_bss *bss = NULL; 405 406 rcu_read_lock(); 407 ssid_elem = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID); 408 if (!ssid_elem) { 409 rcu_read_unlock(); 410 return -EINVAL; 411 } 412 413 /* check if nontrans_bss is in the list */ 414 list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) { 415 if (is_bss(bss, nontrans_bss->bssid, ssid_elem->data, 416 ssid_elem->datalen)) { 417 rcu_read_unlock(); 418 return 0; 419 } 420 } 421 422 rcu_read_unlock(); 423 424 /* 425 * This is a bit weird - it's not on the list, but already on another 426 * one! The only way that could happen is if there's some BSSID/SSID 427 * shared by multiple APs in their multi-BSSID profiles, potentially 428 * with hidden SSID mixed in ... ignore it. 429 */ 430 if (!list_empty(&nontrans_bss->nontrans_list)) 431 return -EINVAL; 432 433 /* add to the list */ 434 list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); 435 return 0; 436 } 437 438 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev, 439 unsigned long expire_time) 440 { 441 struct cfg80211_internal_bss *bss, *tmp; 442 bool expired = false; 443 444 lockdep_assert_held(&rdev->bss_lock); 445 446 list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) { 447 if (atomic_read(&bss->hold)) 448 continue; 449 if (!time_after(expire_time, bss->ts)) 450 continue; 451 452 if (__cfg80211_unlink_bss(rdev, bss)) 453 expired = true; 454 } 455 456 if (expired) 457 rdev->bss_generation++; 458 } 459 460 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev) 461 { 462 struct cfg80211_internal_bss *bss, *oldest = NULL; 463 bool ret; 464 465 lockdep_assert_held(&rdev->bss_lock); 466 467 list_for_each_entry(bss, &rdev->bss_list, list) { 468 if (atomic_read(&bss->hold)) 469 continue; 470 471 if (!list_empty(&bss->hidden_list) && 472 !bss->pub.hidden_beacon_bss) 473 continue; 474 475 if (oldest && time_before(oldest->ts, bss->ts)) 476 continue; 477 oldest = bss; 478 } 479 480 if (WARN_ON(!oldest)) 481 return false; 482 483 /* 484 * The callers make sure to increase rdev->bss_generation if anything 485 * gets removed (and a new entry added), so there's no need to also do 486 * it here. 487 */ 488 489 ret = __cfg80211_unlink_bss(rdev, oldest); 490 WARN_ON(!ret); 491 return ret; 492 } 493 494 static u8 cfg80211_parse_bss_param(u8 data, 495 struct cfg80211_colocated_ap *coloc_ap) 496 { 497 coloc_ap->oct_recommended = 498 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED); 499 coloc_ap->same_ssid = 500 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID); 501 coloc_ap->multi_bss = 502 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID); 503 coloc_ap->transmitted_bssid = 504 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID); 505 coloc_ap->unsolicited_probe = 506 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE); 507 coloc_ap->colocated_ess = 508 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS); 509 510 return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP); 511 } 512 513 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies, 514 const struct element **elem, u32 *s_ssid) 515 { 516 517 *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len); 518 if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN) 519 return -EINVAL; 520 521 *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen); 522 return 0; 523 } 524 525 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list) 526 { 527 struct cfg80211_colocated_ap *ap, *tmp_ap; 528 529 list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) { 530 list_del(&ap->list); 531 kfree(ap); 532 } 533 } 534 535 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry, 536 const u8 *pos, u8 length, 537 const struct element *ssid_elem, 538 int s_ssid_tmp) 539 { 540 /* skip the TBTT offset */ 541 pos++; 542 543 memcpy(entry->bssid, pos, ETH_ALEN); 544 pos += ETH_ALEN; 545 546 if (length >= IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM) { 547 memcpy(&entry->short_ssid, pos, 548 sizeof(entry->short_ssid)); 549 entry->short_ssid_valid = true; 550 pos += 4; 551 } 552 553 /* skip non colocated APs */ 554 if (!cfg80211_parse_bss_param(*pos, entry)) 555 return -EINVAL; 556 pos++; 557 558 if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM) { 559 /* 560 * no information about the short ssid. Consider the entry valid 561 * for now. It would later be dropped in case there are explicit 562 * SSIDs that need to be matched 563 */ 564 if (!entry->same_ssid) 565 return 0; 566 } 567 568 if (entry->same_ssid) { 569 entry->short_ssid = s_ssid_tmp; 570 entry->short_ssid_valid = true; 571 572 /* 573 * This is safe because we validate datalen in 574 * cfg80211_parse_colocated_ap(), before calling this 575 * function. 576 */ 577 memcpy(&entry->ssid, &ssid_elem->data, 578 ssid_elem->datalen); 579 entry->ssid_len = ssid_elem->datalen; 580 } 581 return 0; 582 } 583 584 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies, 585 struct list_head *list) 586 { 587 struct ieee80211_neighbor_ap_info *ap_info; 588 const struct element *elem, *ssid_elem; 589 const u8 *pos, *end; 590 u32 s_ssid_tmp; 591 int n_coloc = 0, ret; 592 LIST_HEAD(ap_list); 593 594 elem = cfg80211_find_elem(WLAN_EID_REDUCED_NEIGHBOR_REPORT, ies->data, 595 ies->len); 596 if (!elem) 597 return 0; 598 599 pos = elem->data; 600 end = pos + elem->datalen; 601 602 ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp); 603 if (ret) 604 return ret; 605 606 /* RNR IE may contain more than one NEIGHBOR_AP_INFO */ 607 while (pos + sizeof(*ap_info) <= end) { 608 enum nl80211_band band; 609 int freq; 610 u8 length, i, count; 611 612 ap_info = (void *)pos; 613 count = u8_get_bits(ap_info->tbtt_info_hdr, 614 IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1; 615 length = ap_info->tbtt_info_len; 616 617 pos += sizeof(*ap_info); 618 619 if (!ieee80211_operating_class_to_band(ap_info->op_class, 620 &band)) 621 break; 622 623 freq = ieee80211_channel_to_frequency(ap_info->channel, band); 624 625 if (end - pos < count * length) 626 break; 627 628 /* 629 * TBTT info must include bss param + BSSID + 630 * (short SSID or same_ssid bit to be set). 631 * ignore other options, and move to the 632 * next AP info 633 */ 634 if (band != NL80211_BAND_6GHZ || 635 (length != IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM && 636 length < IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM)) { 637 pos += count * length; 638 continue; 639 } 640 641 for (i = 0; i < count; i++) { 642 struct cfg80211_colocated_ap *entry; 643 644 entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN, 645 GFP_ATOMIC); 646 647 if (!entry) 648 break; 649 650 entry->center_freq = freq; 651 652 if (!cfg80211_parse_ap_info(entry, pos, length, 653 ssid_elem, s_ssid_tmp)) { 654 n_coloc++; 655 list_add_tail(&entry->list, &ap_list); 656 } else { 657 kfree(entry); 658 } 659 660 pos += length; 661 } 662 } 663 664 if (pos != end) { 665 cfg80211_free_coloc_ap_list(&ap_list); 666 return 0; 667 } 668 669 list_splice_tail(&ap_list, list); 670 return n_coloc; 671 } 672 673 static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request, 674 struct ieee80211_channel *chan, 675 bool add_to_6ghz) 676 { 677 int i; 678 u32 n_channels = request->n_channels; 679 struct cfg80211_scan_6ghz_params *params = 680 &request->scan_6ghz_params[request->n_6ghz_params]; 681 682 for (i = 0; i < n_channels; i++) { 683 if (request->channels[i] == chan) { 684 if (add_to_6ghz) 685 params->channel_idx = i; 686 return; 687 } 688 } 689 690 request->channels[n_channels] = chan; 691 if (add_to_6ghz) 692 request->scan_6ghz_params[request->n_6ghz_params].channel_idx = 693 n_channels; 694 695 request->n_channels++; 696 } 697 698 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap, 699 struct cfg80211_scan_request *request) 700 { 701 int i; 702 u32 s_ssid; 703 704 for (i = 0; i < request->n_ssids; i++) { 705 /* wildcard ssid in the scan request */ 706 if (!request->ssids[i].ssid_len) { 707 if (ap->multi_bss && !ap->transmitted_bssid) 708 continue; 709 710 return true; 711 } 712 713 if (ap->ssid_len && 714 ap->ssid_len == request->ssids[i].ssid_len) { 715 if (!memcmp(request->ssids[i].ssid, ap->ssid, 716 ap->ssid_len)) 717 return true; 718 } else if (ap->short_ssid_valid) { 719 s_ssid = ~crc32_le(~0, request->ssids[i].ssid, 720 request->ssids[i].ssid_len); 721 722 if (ap->short_ssid == s_ssid) 723 return true; 724 } 725 } 726 727 return false; 728 } 729 730 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) 731 { 732 u8 i; 733 struct cfg80211_colocated_ap *ap; 734 int n_channels, count = 0, err; 735 struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req; 736 LIST_HEAD(coloc_ap_list); 737 bool need_scan_psc = true; 738 const struct ieee80211_sband_iftype_data *iftd; 739 740 rdev_req->scan_6ghz = true; 741 742 if (!rdev->wiphy.bands[NL80211_BAND_6GHZ]) 743 return -EOPNOTSUPP; 744 745 iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ], 746 rdev_req->wdev->iftype); 747 if (!iftd || !iftd->he_cap.has_he) 748 return -EOPNOTSUPP; 749 750 n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels; 751 752 if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) { 753 struct cfg80211_internal_bss *intbss; 754 755 spin_lock_bh(&rdev->bss_lock); 756 list_for_each_entry(intbss, &rdev->bss_list, list) { 757 struct cfg80211_bss *res = &intbss->pub; 758 const struct cfg80211_bss_ies *ies; 759 760 ies = rcu_access_pointer(res->ies); 761 count += cfg80211_parse_colocated_ap(ies, 762 &coloc_ap_list); 763 } 764 spin_unlock_bh(&rdev->bss_lock); 765 } 766 767 request = kzalloc(struct_size(request, channels, n_channels) + 768 sizeof(*request->scan_6ghz_params) * count + 769 sizeof(*request->ssids) * rdev_req->n_ssids, 770 GFP_KERNEL); 771 if (!request) { 772 cfg80211_free_coloc_ap_list(&coloc_ap_list); 773 return -ENOMEM; 774 } 775 776 *request = *rdev_req; 777 request->n_channels = 0; 778 request->scan_6ghz_params = 779 (void *)&request->channels[n_channels]; 780 781 /* 782 * PSC channels should not be scanned in case of direct scan with 1 SSID 783 * and at least one of the reported co-located APs with same SSID 784 * indicating that all APs in the same ESS are co-located 785 */ 786 if (count && request->n_ssids == 1 && request->ssids[0].ssid_len) { 787 list_for_each_entry(ap, &coloc_ap_list, list) { 788 if (ap->colocated_ess && 789 cfg80211_find_ssid_match(ap, request)) { 790 need_scan_psc = false; 791 break; 792 } 793 } 794 } 795 796 /* 797 * add to the scan request the channels that need to be scanned 798 * regardless of the collocated APs (PSC channels or all channels 799 * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set) 800 */ 801 for (i = 0; i < rdev_req->n_channels; i++) { 802 if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ && 803 ((need_scan_psc && 804 cfg80211_channel_is_psc(rdev_req->channels[i])) || 805 !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) { 806 cfg80211_scan_req_add_chan(request, 807 rdev_req->channels[i], 808 false); 809 } 810 } 811 812 if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ)) 813 goto skip; 814 815 list_for_each_entry(ap, &coloc_ap_list, list) { 816 bool found = false; 817 struct cfg80211_scan_6ghz_params *scan_6ghz_params = 818 &request->scan_6ghz_params[request->n_6ghz_params]; 819 struct ieee80211_channel *chan = 820 ieee80211_get_channel(&rdev->wiphy, ap->center_freq); 821 822 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 823 continue; 824 825 for (i = 0; i < rdev_req->n_channels; i++) { 826 if (rdev_req->channels[i] == chan) 827 found = true; 828 } 829 830 if (!found) 831 continue; 832 833 if (request->n_ssids > 0 && 834 !cfg80211_find_ssid_match(ap, request)) 835 continue; 836 837 if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid) 838 continue; 839 840 cfg80211_scan_req_add_chan(request, chan, true); 841 memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN); 842 scan_6ghz_params->short_ssid = ap->short_ssid; 843 scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid; 844 scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe; 845 846 /* 847 * If a PSC channel is added to the scan and 'need_scan_psc' is 848 * set to false, then all the APs that the scan logic is 849 * interested with on the channel are collocated and thus there 850 * is no need to perform the initial PSC channel listen. 851 */ 852 if (cfg80211_channel_is_psc(chan) && !need_scan_psc) 853 scan_6ghz_params->psc_no_listen = true; 854 855 request->n_6ghz_params++; 856 } 857 858 skip: 859 cfg80211_free_coloc_ap_list(&coloc_ap_list); 860 861 if (request->n_channels) { 862 struct cfg80211_scan_request *old = rdev->int_scan_req; 863 rdev->int_scan_req = request; 864 865 /* 866 * Add the ssids from the parent scan request to the new scan 867 * request, so the driver would be able to use them in its 868 * probe requests to discover hidden APs on PSC channels. 869 */ 870 request->ssids = (void *)&request->channels[request->n_channels]; 871 request->n_ssids = rdev_req->n_ssids; 872 memcpy(request->ssids, rdev_req->ssids, sizeof(*request->ssids) * 873 request->n_ssids); 874 875 /* 876 * If this scan follows a previous scan, save the scan start 877 * info from the first part of the scan 878 */ 879 if (old) 880 rdev->int_scan_req->info = old->info; 881 882 err = rdev_scan(rdev, request); 883 if (err) { 884 rdev->int_scan_req = old; 885 kfree(request); 886 } else { 887 kfree(old); 888 } 889 890 return err; 891 } 892 893 kfree(request); 894 return -EINVAL; 895 } 896 897 int cfg80211_scan(struct cfg80211_registered_device *rdev) 898 { 899 struct cfg80211_scan_request *request; 900 struct cfg80211_scan_request *rdev_req = rdev->scan_req; 901 u32 n_channels = 0, idx, i; 902 903 if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ)) 904 return rdev_scan(rdev, rdev_req); 905 906 for (i = 0; i < rdev_req->n_channels; i++) { 907 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ) 908 n_channels++; 909 } 910 911 if (!n_channels) 912 return cfg80211_scan_6ghz(rdev); 913 914 request = kzalloc(struct_size(request, channels, n_channels), 915 GFP_KERNEL); 916 if (!request) 917 return -ENOMEM; 918 919 *request = *rdev_req; 920 request->n_channels = n_channels; 921 922 for (i = idx = 0; i < rdev_req->n_channels; i++) { 923 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ) 924 request->channels[idx++] = rdev_req->channels[i]; 925 } 926 927 rdev_req->scan_6ghz = false; 928 rdev->int_scan_req = request; 929 return rdev_scan(rdev, request); 930 } 931 932 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, 933 bool send_message) 934 { 935 struct cfg80211_scan_request *request, *rdev_req; 936 struct wireless_dev *wdev; 937 struct sk_buff *msg; 938 #ifdef CONFIG_CFG80211_WEXT 939 union iwreq_data wrqu; 940 #endif 941 942 lockdep_assert_held(&rdev->wiphy.mtx); 943 944 if (rdev->scan_msg) { 945 nl80211_send_scan_msg(rdev, rdev->scan_msg); 946 rdev->scan_msg = NULL; 947 return; 948 } 949 950 rdev_req = rdev->scan_req; 951 if (!rdev_req) 952 return; 953 954 wdev = rdev_req->wdev; 955 request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req; 956 957 if (wdev_running(wdev) && 958 (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) && 959 !rdev_req->scan_6ghz && !request->info.aborted && 960 !cfg80211_scan_6ghz(rdev)) 961 return; 962 963 /* 964 * This must be before sending the other events! 965 * Otherwise, wpa_supplicant gets completely confused with 966 * wext events. 967 */ 968 if (wdev->netdev) 969 cfg80211_sme_scan_done(wdev->netdev); 970 971 if (!request->info.aborted && 972 request->flags & NL80211_SCAN_FLAG_FLUSH) { 973 /* flush entries from previous scans */ 974 spin_lock_bh(&rdev->bss_lock); 975 __cfg80211_bss_expire(rdev, request->scan_start); 976 spin_unlock_bh(&rdev->bss_lock); 977 } 978 979 msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted); 980 981 #ifdef CONFIG_CFG80211_WEXT 982 if (wdev->netdev && !request->info.aborted) { 983 memset(&wrqu, 0, sizeof(wrqu)); 984 985 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL); 986 } 987 #endif 988 989 dev_put(wdev->netdev); 990 991 kfree(rdev->int_scan_req); 992 rdev->int_scan_req = NULL; 993 994 kfree(rdev->scan_req); 995 rdev->scan_req = NULL; 996 997 if (!send_message) 998 rdev->scan_msg = msg; 999 else 1000 nl80211_send_scan_msg(rdev, msg); 1001 } 1002 1003 void __cfg80211_scan_done(struct work_struct *wk) 1004 { 1005 struct cfg80211_registered_device *rdev; 1006 1007 rdev = container_of(wk, struct cfg80211_registered_device, 1008 scan_done_wk); 1009 1010 wiphy_lock(&rdev->wiphy); 1011 ___cfg80211_scan_done(rdev, true); 1012 wiphy_unlock(&rdev->wiphy); 1013 } 1014 1015 void cfg80211_scan_done(struct cfg80211_scan_request *request, 1016 struct cfg80211_scan_info *info) 1017 { 1018 struct cfg80211_scan_info old_info = request->info; 1019 1020 trace_cfg80211_scan_done(request, info); 1021 WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req && 1022 request != wiphy_to_rdev(request->wiphy)->int_scan_req); 1023 1024 request->info = *info; 1025 1026 /* 1027 * In case the scan is split, the scan_start_tsf and tsf_bssid should 1028 * be of the first part. In such a case old_info.scan_start_tsf should 1029 * be non zero. 1030 */ 1031 if (request->scan_6ghz && old_info.scan_start_tsf) { 1032 request->info.scan_start_tsf = old_info.scan_start_tsf; 1033 memcpy(request->info.tsf_bssid, old_info.tsf_bssid, 1034 sizeof(request->info.tsf_bssid)); 1035 } 1036 1037 request->notified = true; 1038 queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk); 1039 } 1040 EXPORT_SYMBOL(cfg80211_scan_done); 1041 1042 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev, 1043 struct cfg80211_sched_scan_request *req) 1044 { 1045 lockdep_assert_held(&rdev->wiphy.mtx); 1046 1047 list_add_rcu(&req->list, &rdev->sched_scan_req_list); 1048 } 1049 1050 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev, 1051 struct cfg80211_sched_scan_request *req) 1052 { 1053 lockdep_assert_held(&rdev->wiphy.mtx); 1054 1055 list_del_rcu(&req->list); 1056 kfree_rcu(req, rcu_head); 1057 } 1058 1059 static struct cfg80211_sched_scan_request * 1060 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid) 1061 { 1062 struct cfg80211_sched_scan_request *pos; 1063 1064 list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list, 1065 lockdep_is_held(&rdev->wiphy.mtx)) { 1066 if (pos->reqid == reqid) 1067 return pos; 1068 } 1069 return NULL; 1070 } 1071 1072 /* 1073 * Determines if a scheduled scan request can be handled. When a legacy 1074 * scheduled scan is running no other scheduled scan is allowed regardless 1075 * whether the request is for legacy or multi-support scan. When a multi-support 1076 * scheduled scan is running a request for legacy scan is not allowed. In this 1077 * case a request for multi-support scan can be handled if resources are 1078 * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached. 1079 */ 1080 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev, 1081 bool want_multi) 1082 { 1083 struct cfg80211_sched_scan_request *pos; 1084 int i = 0; 1085 1086 list_for_each_entry(pos, &rdev->sched_scan_req_list, list) { 1087 /* request id zero means legacy in progress */ 1088 if (!i && !pos->reqid) 1089 return -EINPROGRESS; 1090 i++; 1091 } 1092 1093 if (i) { 1094 /* no legacy allowed when multi request(s) are active */ 1095 if (!want_multi) 1096 return -EINPROGRESS; 1097 1098 /* resource limit reached */ 1099 if (i == rdev->wiphy.max_sched_scan_reqs) 1100 return -ENOSPC; 1101 } 1102 return 0; 1103 } 1104 1105 void cfg80211_sched_scan_results_wk(struct work_struct *work) 1106 { 1107 struct cfg80211_registered_device *rdev; 1108 struct cfg80211_sched_scan_request *req, *tmp; 1109 1110 rdev = container_of(work, struct cfg80211_registered_device, 1111 sched_scan_res_wk); 1112 1113 wiphy_lock(&rdev->wiphy); 1114 list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) { 1115 if (req->report_results) { 1116 req->report_results = false; 1117 if (req->flags & NL80211_SCAN_FLAG_FLUSH) { 1118 /* flush entries from previous scans */ 1119 spin_lock_bh(&rdev->bss_lock); 1120 __cfg80211_bss_expire(rdev, req->scan_start); 1121 spin_unlock_bh(&rdev->bss_lock); 1122 req->scan_start = jiffies; 1123 } 1124 nl80211_send_sched_scan(req, 1125 NL80211_CMD_SCHED_SCAN_RESULTS); 1126 } 1127 } 1128 wiphy_unlock(&rdev->wiphy); 1129 } 1130 1131 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid) 1132 { 1133 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1134 struct cfg80211_sched_scan_request *request; 1135 1136 trace_cfg80211_sched_scan_results(wiphy, reqid); 1137 /* ignore if we're not scanning */ 1138 1139 rcu_read_lock(); 1140 request = cfg80211_find_sched_scan_req(rdev, reqid); 1141 if (request) { 1142 request->report_results = true; 1143 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk); 1144 } 1145 rcu_read_unlock(); 1146 } 1147 EXPORT_SYMBOL(cfg80211_sched_scan_results); 1148 1149 void cfg80211_sched_scan_stopped_locked(struct wiphy *wiphy, u64 reqid) 1150 { 1151 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1152 1153 lockdep_assert_held(&wiphy->mtx); 1154 1155 trace_cfg80211_sched_scan_stopped(wiphy, reqid); 1156 1157 __cfg80211_stop_sched_scan(rdev, reqid, true); 1158 } 1159 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_locked); 1160 1161 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid) 1162 { 1163 wiphy_lock(wiphy); 1164 cfg80211_sched_scan_stopped_locked(wiphy, reqid); 1165 wiphy_unlock(wiphy); 1166 } 1167 EXPORT_SYMBOL(cfg80211_sched_scan_stopped); 1168 1169 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev, 1170 struct cfg80211_sched_scan_request *req, 1171 bool driver_initiated) 1172 { 1173 lockdep_assert_held(&rdev->wiphy.mtx); 1174 1175 if (!driver_initiated) { 1176 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid); 1177 if (err) 1178 return err; 1179 } 1180 1181 nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED); 1182 1183 cfg80211_del_sched_scan_req(rdev, req); 1184 1185 return 0; 1186 } 1187 1188 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev, 1189 u64 reqid, bool driver_initiated) 1190 { 1191 struct cfg80211_sched_scan_request *sched_scan_req; 1192 1193 lockdep_assert_held(&rdev->wiphy.mtx); 1194 1195 sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid); 1196 if (!sched_scan_req) 1197 return -ENOENT; 1198 1199 return cfg80211_stop_sched_scan_req(rdev, sched_scan_req, 1200 driver_initiated); 1201 } 1202 1203 void cfg80211_bss_age(struct cfg80211_registered_device *rdev, 1204 unsigned long age_secs) 1205 { 1206 struct cfg80211_internal_bss *bss; 1207 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC); 1208 1209 spin_lock_bh(&rdev->bss_lock); 1210 list_for_each_entry(bss, &rdev->bss_list, list) 1211 bss->ts -= age_jiffies; 1212 spin_unlock_bh(&rdev->bss_lock); 1213 } 1214 1215 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev) 1216 { 1217 __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE); 1218 } 1219 1220 void cfg80211_bss_flush(struct wiphy *wiphy) 1221 { 1222 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1223 1224 spin_lock_bh(&rdev->bss_lock); 1225 __cfg80211_bss_expire(rdev, jiffies); 1226 spin_unlock_bh(&rdev->bss_lock); 1227 } 1228 EXPORT_SYMBOL(cfg80211_bss_flush); 1229 1230 const struct element * 1231 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len, 1232 const u8 *match, unsigned int match_len, 1233 unsigned int match_offset) 1234 { 1235 const struct element *elem; 1236 1237 for_each_element_id(elem, eid, ies, len) { 1238 if (elem->datalen >= match_offset + match_len && 1239 !memcmp(elem->data + match_offset, match, match_len)) 1240 return elem; 1241 } 1242 1243 return NULL; 1244 } 1245 EXPORT_SYMBOL(cfg80211_find_elem_match); 1246 1247 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type, 1248 const u8 *ies, 1249 unsigned int len) 1250 { 1251 const struct element *elem; 1252 u8 match[] = { oui >> 16, oui >> 8, oui, oui_type }; 1253 int match_len = (oui_type < 0) ? 3 : sizeof(match); 1254 1255 if (WARN_ON(oui_type > 0xff)) 1256 return NULL; 1257 1258 elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len, 1259 match, match_len, 0); 1260 1261 if (!elem || elem->datalen < 4) 1262 return NULL; 1263 1264 return elem; 1265 } 1266 EXPORT_SYMBOL(cfg80211_find_vendor_elem); 1267 1268 /** 1269 * enum bss_compare_mode - BSS compare mode 1270 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find) 1271 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode 1272 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode 1273 */ 1274 enum bss_compare_mode { 1275 BSS_CMP_REGULAR, 1276 BSS_CMP_HIDE_ZLEN, 1277 BSS_CMP_HIDE_NUL, 1278 }; 1279 1280 static int cmp_bss(struct cfg80211_bss *a, 1281 struct cfg80211_bss *b, 1282 enum bss_compare_mode mode) 1283 { 1284 const struct cfg80211_bss_ies *a_ies, *b_ies; 1285 const u8 *ie1 = NULL; 1286 const u8 *ie2 = NULL; 1287 int i, r; 1288 1289 if (a->channel != b->channel) 1290 return (b->channel->center_freq * 1000 + b->channel->freq_offset) - 1291 (a->channel->center_freq * 1000 + a->channel->freq_offset); 1292 1293 a_ies = rcu_access_pointer(a->ies); 1294 if (!a_ies) 1295 return -1; 1296 b_ies = rcu_access_pointer(b->ies); 1297 if (!b_ies) 1298 return 1; 1299 1300 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability)) 1301 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID, 1302 a_ies->data, a_ies->len); 1303 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability)) 1304 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID, 1305 b_ies->data, b_ies->len); 1306 if (ie1 && ie2) { 1307 int mesh_id_cmp; 1308 1309 if (ie1[1] == ie2[1]) 1310 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]); 1311 else 1312 mesh_id_cmp = ie2[1] - ie1[1]; 1313 1314 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, 1315 a_ies->data, a_ies->len); 1316 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, 1317 b_ies->data, b_ies->len); 1318 if (ie1 && ie2) { 1319 if (mesh_id_cmp) 1320 return mesh_id_cmp; 1321 if (ie1[1] != ie2[1]) 1322 return ie2[1] - ie1[1]; 1323 return memcmp(ie1 + 2, ie2 + 2, ie1[1]); 1324 } 1325 } 1326 1327 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid)); 1328 if (r) 1329 return r; 1330 1331 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len); 1332 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len); 1333 1334 if (!ie1 && !ie2) 1335 return 0; 1336 1337 /* 1338 * Note that with "hide_ssid", the function returns a match if 1339 * the already-present BSS ("b") is a hidden SSID beacon for 1340 * the new BSS ("a"). 1341 */ 1342 1343 /* sort missing IE before (left of) present IE */ 1344 if (!ie1) 1345 return -1; 1346 if (!ie2) 1347 return 1; 1348 1349 switch (mode) { 1350 case BSS_CMP_HIDE_ZLEN: 1351 /* 1352 * In ZLEN mode we assume the BSS entry we're 1353 * looking for has a zero-length SSID. So if 1354 * the one we're looking at right now has that, 1355 * return 0. Otherwise, return the difference 1356 * in length, but since we're looking for the 1357 * 0-length it's really equivalent to returning 1358 * the length of the one we're looking at. 1359 * 1360 * No content comparison is needed as we assume 1361 * the content length is zero. 1362 */ 1363 return ie2[1]; 1364 case BSS_CMP_REGULAR: 1365 default: 1366 /* sort by length first, then by contents */ 1367 if (ie1[1] != ie2[1]) 1368 return ie2[1] - ie1[1]; 1369 return memcmp(ie1 + 2, ie2 + 2, ie1[1]); 1370 case BSS_CMP_HIDE_NUL: 1371 if (ie1[1] != ie2[1]) 1372 return ie2[1] - ie1[1]; 1373 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */ 1374 for (i = 0; i < ie2[1]; i++) 1375 if (ie2[i + 2]) 1376 return -1; 1377 return 0; 1378 } 1379 } 1380 1381 static bool cfg80211_bss_type_match(u16 capability, 1382 enum nl80211_band band, 1383 enum ieee80211_bss_type bss_type) 1384 { 1385 bool ret = true; 1386 u16 mask, val; 1387 1388 if (bss_type == IEEE80211_BSS_TYPE_ANY) 1389 return ret; 1390 1391 if (band == NL80211_BAND_60GHZ) { 1392 mask = WLAN_CAPABILITY_DMG_TYPE_MASK; 1393 switch (bss_type) { 1394 case IEEE80211_BSS_TYPE_ESS: 1395 val = WLAN_CAPABILITY_DMG_TYPE_AP; 1396 break; 1397 case IEEE80211_BSS_TYPE_PBSS: 1398 val = WLAN_CAPABILITY_DMG_TYPE_PBSS; 1399 break; 1400 case IEEE80211_BSS_TYPE_IBSS: 1401 val = WLAN_CAPABILITY_DMG_TYPE_IBSS; 1402 break; 1403 default: 1404 return false; 1405 } 1406 } else { 1407 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS; 1408 switch (bss_type) { 1409 case IEEE80211_BSS_TYPE_ESS: 1410 val = WLAN_CAPABILITY_ESS; 1411 break; 1412 case IEEE80211_BSS_TYPE_IBSS: 1413 val = WLAN_CAPABILITY_IBSS; 1414 break; 1415 case IEEE80211_BSS_TYPE_MBSS: 1416 val = 0; 1417 break; 1418 default: 1419 return false; 1420 } 1421 } 1422 1423 ret = ((capability & mask) == val); 1424 return ret; 1425 } 1426 1427 /* Returned bss is reference counted and must be cleaned up appropriately. */ 1428 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy, 1429 struct ieee80211_channel *channel, 1430 const u8 *bssid, 1431 const u8 *ssid, size_t ssid_len, 1432 enum ieee80211_bss_type bss_type, 1433 enum ieee80211_privacy privacy) 1434 { 1435 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1436 struct cfg80211_internal_bss *bss, *res = NULL; 1437 unsigned long now = jiffies; 1438 int bss_privacy; 1439 1440 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type, 1441 privacy); 1442 1443 spin_lock_bh(&rdev->bss_lock); 1444 1445 list_for_each_entry(bss, &rdev->bss_list, list) { 1446 if (!cfg80211_bss_type_match(bss->pub.capability, 1447 bss->pub.channel->band, bss_type)) 1448 continue; 1449 1450 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY); 1451 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) || 1452 (privacy == IEEE80211_PRIVACY_OFF && bss_privacy)) 1453 continue; 1454 if (channel && bss->pub.channel != channel) 1455 continue; 1456 if (!is_valid_ether_addr(bss->pub.bssid)) 1457 continue; 1458 /* Don't get expired BSS structs */ 1459 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) && 1460 !atomic_read(&bss->hold)) 1461 continue; 1462 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) { 1463 res = bss; 1464 bss_ref_get(rdev, res); 1465 break; 1466 } 1467 } 1468 1469 spin_unlock_bh(&rdev->bss_lock); 1470 if (!res) 1471 return NULL; 1472 trace_cfg80211_return_bss(&res->pub); 1473 return &res->pub; 1474 } 1475 EXPORT_SYMBOL(cfg80211_get_bss); 1476 1477 static void rb_insert_bss(struct cfg80211_registered_device *rdev, 1478 struct cfg80211_internal_bss *bss) 1479 { 1480 struct rb_node **p = &rdev->bss_tree.rb_node; 1481 struct rb_node *parent = NULL; 1482 struct cfg80211_internal_bss *tbss; 1483 int cmp; 1484 1485 while (*p) { 1486 parent = *p; 1487 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn); 1488 1489 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR); 1490 1491 if (WARN_ON(!cmp)) { 1492 /* will sort of leak this BSS */ 1493 return; 1494 } 1495 1496 if (cmp < 0) 1497 p = &(*p)->rb_left; 1498 else 1499 p = &(*p)->rb_right; 1500 } 1501 1502 rb_link_node(&bss->rbn, parent, p); 1503 rb_insert_color(&bss->rbn, &rdev->bss_tree); 1504 } 1505 1506 static struct cfg80211_internal_bss * 1507 rb_find_bss(struct cfg80211_registered_device *rdev, 1508 struct cfg80211_internal_bss *res, 1509 enum bss_compare_mode mode) 1510 { 1511 struct rb_node *n = rdev->bss_tree.rb_node; 1512 struct cfg80211_internal_bss *bss; 1513 int r; 1514 1515 while (n) { 1516 bss = rb_entry(n, struct cfg80211_internal_bss, rbn); 1517 r = cmp_bss(&res->pub, &bss->pub, mode); 1518 1519 if (r == 0) 1520 return bss; 1521 else if (r < 0) 1522 n = n->rb_left; 1523 else 1524 n = n->rb_right; 1525 } 1526 1527 return NULL; 1528 } 1529 1530 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, 1531 struct cfg80211_internal_bss *new) 1532 { 1533 const struct cfg80211_bss_ies *ies; 1534 struct cfg80211_internal_bss *bss; 1535 const u8 *ie; 1536 int i, ssidlen; 1537 u8 fold = 0; 1538 u32 n_entries = 0; 1539 1540 ies = rcu_access_pointer(new->pub.beacon_ies); 1541 if (WARN_ON(!ies)) 1542 return false; 1543 1544 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); 1545 if (!ie) { 1546 /* nothing to do */ 1547 return true; 1548 } 1549 1550 ssidlen = ie[1]; 1551 for (i = 0; i < ssidlen; i++) 1552 fold |= ie[2 + i]; 1553 1554 if (fold) { 1555 /* not a hidden SSID */ 1556 return true; 1557 } 1558 1559 /* This is the bad part ... */ 1560 1561 list_for_each_entry(bss, &rdev->bss_list, list) { 1562 /* 1563 * we're iterating all the entries anyway, so take the 1564 * opportunity to validate the list length accounting 1565 */ 1566 n_entries++; 1567 1568 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid)) 1569 continue; 1570 if (bss->pub.channel != new->pub.channel) 1571 continue; 1572 if (bss->pub.scan_width != new->pub.scan_width) 1573 continue; 1574 if (rcu_access_pointer(bss->pub.beacon_ies)) 1575 continue; 1576 ies = rcu_access_pointer(bss->pub.ies); 1577 if (!ies) 1578 continue; 1579 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); 1580 if (!ie) 1581 continue; 1582 if (ssidlen && ie[1] != ssidlen) 1583 continue; 1584 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss)) 1585 continue; 1586 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list))) 1587 list_del(&bss->hidden_list); 1588 /* combine them */ 1589 list_add(&bss->hidden_list, &new->hidden_list); 1590 bss->pub.hidden_beacon_bss = &new->pub; 1591 new->refcount += bss->refcount; 1592 rcu_assign_pointer(bss->pub.beacon_ies, 1593 new->pub.beacon_ies); 1594 } 1595 1596 WARN_ONCE(n_entries != rdev->bss_entries, 1597 "rdev bss entries[%d]/list[len:%d] corruption\n", 1598 rdev->bss_entries, n_entries); 1599 1600 return true; 1601 } 1602 1603 struct cfg80211_non_tx_bss { 1604 struct cfg80211_bss *tx_bss; 1605 u8 max_bssid_indicator; 1606 u8 bssid_index; 1607 }; 1608 1609 static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known, 1610 const struct cfg80211_bss_ies *new_ies, 1611 const struct cfg80211_bss_ies *old_ies) 1612 { 1613 struct cfg80211_internal_bss *bss; 1614 1615 /* Assign beacon IEs to all sub entries */ 1616 list_for_each_entry(bss, &known->hidden_list, hidden_list) { 1617 const struct cfg80211_bss_ies *ies; 1618 1619 ies = rcu_access_pointer(bss->pub.beacon_ies); 1620 WARN_ON(ies != old_ies); 1621 1622 rcu_assign_pointer(bss->pub.beacon_ies, new_ies); 1623 } 1624 } 1625 1626 static bool 1627 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, 1628 struct cfg80211_internal_bss *known, 1629 struct cfg80211_internal_bss *new, 1630 bool signal_valid) 1631 { 1632 lockdep_assert_held(&rdev->bss_lock); 1633 1634 /* Update IEs */ 1635 if (rcu_access_pointer(new->pub.proberesp_ies)) { 1636 const struct cfg80211_bss_ies *old; 1637 1638 old = rcu_access_pointer(known->pub.proberesp_ies); 1639 1640 rcu_assign_pointer(known->pub.proberesp_ies, 1641 new->pub.proberesp_ies); 1642 /* Override possible earlier Beacon frame IEs */ 1643 rcu_assign_pointer(known->pub.ies, 1644 new->pub.proberesp_ies); 1645 if (old) 1646 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 1647 } else if (rcu_access_pointer(new->pub.beacon_ies)) { 1648 const struct cfg80211_bss_ies *old; 1649 1650 if (known->pub.hidden_beacon_bss && 1651 !list_empty(&known->hidden_list)) { 1652 const struct cfg80211_bss_ies *f; 1653 1654 /* The known BSS struct is one of the probe 1655 * response members of a group, but we're 1656 * receiving a beacon (beacon_ies in the new 1657 * bss is used). This can only mean that the 1658 * AP changed its beacon from not having an 1659 * SSID to showing it, which is confusing so 1660 * drop this information. 1661 */ 1662 1663 f = rcu_access_pointer(new->pub.beacon_ies); 1664 kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head); 1665 return false; 1666 } 1667 1668 old = rcu_access_pointer(known->pub.beacon_ies); 1669 1670 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies); 1671 1672 /* Override IEs if they were from a beacon before */ 1673 if (old == rcu_access_pointer(known->pub.ies)) 1674 rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies); 1675 1676 cfg80211_update_hidden_bsses(known, 1677 rcu_access_pointer(new->pub.beacon_ies), 1678 old); 1679 1680 if (old) 1681 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 1682 } 1683 1684 known->pub.beacon_interval = new->pub.beacon_interval; 1685 1686 /* don't update the signal if beacon was heard on 1687 * adjacent channel. 1688 */ 1689 if (signal_valid) 1690 known->pub.signal = new->pub.signal; 1691 known->pub.capability = new->pub.capability; 1692 known->ts = new->ts; 1693 known->ts_boottime = new->ts_boottime; 1694 known->parent_tsf = new->parent_tsf; 1695 known->pub.chains = new->pub.chains; 1696 memcpy(known->pub.chain_signal, new->pub.chain_signal, 1697 IEEE80211_MAX_CHAINS); 1698 ether_addr_copy(known->parent_bssid, new->parent_bssid); 1699 known->pub.max_bssid_indicator = new->pub.max_bssid_indicator; 1700 known->pub.bssid_index = new->pub.bssid_index; 1701 1702 return true; 1703 } 1704 1705 /* Returned bss is reference counted and must be cleaned up appropriately. */ 1706 struct cfg80211_internal_bss * 1707 cfg80211_bss_update(struct cfg80211_registered_device *rdev, 1708 struct cfg80211_internal_bss *tmp, 1709 bool signal_valid, unsigned long ts) 1710 { 1711 struct cfg80211_internal_bss *found = NULL; 1712 1713 if (WARN_ON(!tmp->pub.channel)) 1714 return NULL; 1715 1716 tmp->ts = ts; 1717 1718 spin_lock_bh(&rdev->bss_lock); 1719 1720 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) { 1721 spin_unlock_bh(&rdev->bss_lock); 1722 return NULL; 1723 } 1724 1725 found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR); 1726 1727 if (found) { 1728 if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid)) 1729 goto drop; 1730 } else { 1731 struct cfg80211_internal_bss *new; 1732 struct cfg80211_internal_bss *hidden; 1733 struct cfg80211_bss_ies *ies; 1734 1735 /* 1736 * create a copy -- the "res" variable that is passed in 1737 * is allocated on the stack since it's not needed in the 1738 * more common case of an update 1739 */ 1740 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size, 1741 GFP_ATOMIC); 1742 if (!new) { 1743 ies = (void *)rcu_dereference(tmp->pub.beacon_ies); 1744 if (ies) 1745 kfree_rcu(ies, rcu_head); 1746 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies); 1747 if (ies) 1748 kfree_rcu(ies, rcu_head); 1749 goto drop; 1750 } 1751 memcpy(new, tmp, sizeof(*new)); 1752 new->refcount = 1; 1753 INIT_LIST_HEAD(&new->hidden_list); 1754 INIT_LIST_HEAD(&new->pub.nontrans_list); 1755 /* we'll set this later if it was non-NULL */ 1756 new->pub.transmitted_bss = NULL; 1757 1758 if (rcu_access_pointer(tmp->pub.proberesp_ies)) { 1759 hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN); 1760 if (!hidden) 1761 hidden = rb_find_bss(rdev, tmp, 1762 BSS_CMP_HIDE_NUL); 1763 if (hidden) { 1764 new->pub.hidden_beacon_bss = &hidden->pub; 1765 list_add(&new->hidden_list, 1766 &hidden->hidden_list); 1767 hidden->refcount++; 1768 rcu_assign_pointer(new->pub.beacon_ies, 1769 hidden->pub.beacon_ies); 1770 } 1771 } else { 1772 /* 1773 * Ok so we found a beacon, and don't have an entry. If 1774 * it's a beacon with hidden SSID, we might be in for an 1775 * expensive search for any probe responses that should 1776 * be grouped with this beacon for updates ... 1777 */ 1778 if (!cfg80211_combine_bsses(rdev, new)) { 1779 bss_ref_put(rdev, new); 1780 goto drop; 1781 } 1782 } 1783 1784 if (rdev->bss_entries >= bss_entries_limit && 1785 !cfg80211_bss_expire_oldest(rdev)) { 1786 bss_ref_put(rdev, new); 1787 goto drop; 1788 } 1789 1790 /* This must be before the call to bss_ref_get */ 1791 if (tmp->pub.transmitted_bss) { 1792 new->pub.transmitted_bss = tmp->pub.transmitted_bss; 1793 bss_ref_get(rdev, bss_from_pub(tmp->pub.transmitted_bss)); 1794 } 1795 1796 list_add_tail(&new->list, &rdev->bss_list); 1797 rdev->bss_entries++; 1798 rb_insert_bss(rdev, new); 1799 found = new; 1800 } 1801 1802 rdev->bss_generation++; 1803 bss_ref_get(rdev, found); 1804 spin_unlock_bh(&rdev->bss_lock); 1805 1806 return found; 1807 drop: 1808 spin_unlock_bh(&rdev->bss_lock); 1809 return NULL; 1810 } 1811 1812 int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen, 1813 enum nl80211_band band, 1814 enum cfg80211_bss_frame_type ftype) 1815 { 1816 const struct element *tmp; 1817 1818 if (band == NL80211_BAND_6GHZ) { 1819 struct ieee80211_he_operation *he_oper; 1820 1821 tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, 1822 ielen); 1823 if (tmp && tmp->datalen >= sizeof(*he_oper) && 1824 tmp->datalen >= ieee80211_he_oper_size(&tmp->data[1])) { 1825 const struct ieee80211_he_6ghz_oper *he_6ghz_oper; 1826 1827 he_oper = (void *)&tmp->data[1]; 1828 1829 he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper); 1830 if (!he_6ghz_oper) 1831 return -1; 1832 1833 if (ftype != CFG80211_BSS_FTYPE_BEACON || 1834 he_6ghz_oper->control & IEEE80211_HE_6GHZ_OPER_CTRL_DUP_BEACON) 1835 return he_6ghz_oper->primary; 1836 } 1837 } else if (band == NL80211_BAND_S1GHZ) { 1838 tmp = cfg80211_find_elem(WLAN_EID_S1G_OPERATION, ie, ielen); 1839 if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) { 1840 struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data; 1841 1842 return s1gop->oper_ch; 1843 } 1844 } else { 1845 tmp = cfg80211_find_elem(WLAN_EID_DS_PARAMS, ie, ielen); 1846 if (tmp && tmp->datalen == 1) 1847 return tmp->data[0]; 1848 1849 tmp = cfg80211_find_elem(WLAN_EID_HT_OPERATION, ie, ielen); 1850 if (tmp && 1851 tmp->datalen >= sizeof(struct ieee80211_ht_operation)) { 1852 struct ieee80211_ht_operation *htop = (void *)tmp->data; 1853 1854 return htop->primary_chan; 1855 } 1856 } 1857 1858 return -1; 1859 } 1860 EXPORT_SYMBOL(cfg80211_get_ies_channel_number); 1861 1862 /* 1863 * Update RX channel information based on the available frame payload 1864 * information. This is mainly for the 2.4 GHz band where frames can be received 1865 * from neighboring channels and the Beacon frames use the DSSS Parameter Set 1866 * element to indicate the current (transmitting) channel, but this might also 1867 * be needed on other bands if RX frequency does not match with the actual 1868 * operating channel of a BSS, or if the AP reports a different primary channel. 1869 */ 1870 static struct ieee80211_channel * 1871 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen, 1872 struct ieee80211_channel *channel, 1873 enum nl80211_bss_scan_width scan_width, 1874 enum cfg80211_bss_frame_type ftype) 1875 { 1876 u32 freq; 1877 int channel_number; 1878 struct ieee80211_channel *alt_channel; 1879 1880 channel_number = cfg80211_get_ies_channel_number(ie, ielen, 1881 channel->band, ftype); 1882 1883 if (channel_number < 0) { 1884 /* No channel information in frame payload */ 1885 return channel; 1886 } 1887 1888 freq = ieee80211_channel_to_freq_khz(channel_number, channel->band); 1889 1890 /* 1891 * In 6GHz, duplicated beacon indication is relevant for 1892 * beacons only. 1893 */ 1894 if (channel->band == NL80211_BAND_6GHZ && 1895 (freq == channel->center_freq || 1896 abs(freq - channel->center_freq) > 80)) 1897 return channel; 1898 1899 alt_channel = ieee80211_get_channel_khz(wiphy, freq); 1900 if (!alt_channel) { 1901 if (channel->band == NL80211_BAND_2GHZ) { 1902 /* 1903 * Better not allow unexpected channels when that could 1904 * be going beyond the 1-11 range (e.g., discovering 1905 * BSS on channel 12 when radio is configured for 1906 * channel 11. 1907 */ 1908 return NULL; 1909 } 1910 1911 /* No match for the payload channel number - ignore it */ 1912 return channel; 1913 } 1914 1915 if (scan_width == NL80211_BSS_CHAN_WIDTH_10 || 1916 scan_width == NL80211_BSS_CHAN_WIDTH_5) { 1917 /* 1918 * Ignore channel number in 5 and 10 MHz channels where there 1919 * may not be an n:1 or 1:n mapping between frequencies and 1920 * channel numbers. 1921 */ 1922 return channel; 1923 } 1924 1925 /* 1926 * Use the channel determined through the payload channel number 1927 * instead of the RX channel reported by the driver. 1928 */ 1929 if (alt_channel->flags & IEEE80211_CHAN_DISABLED) 1930 return NULL; 1931 return alt_channel; 1932 } 1933 1934 /* Returned bss is reference counted and must be cleaned up appropriately. */ 1935 static struct cfg80211_bss * 1936 cfg80211_inform_single_bss_data(struct wiphy *wiphy, 1937 struct cfg80211_inform_bss *data, 1938 enum cfg80211_bss_frame_type ftype, 1939 const u8 *bssid, u64 tsf, u16 capability, 1940 u16 beacon_interval, const u8 *ie, size_t ielen, 1941 struct cfg80211_non_tx_bss *non_tx_data, 1942 gfp_t gfp) 1943 { 1944 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1945 struct cfg80211_bss_ies *ies; 1946 struct ieee80211_channel *channel; 1947 struct cfg80211_internal_bss tmp = {}, *res; 1948 int bss_type; 1949 bool signal_valid; 1950 unsigned long ts; 1951 1952 if (WARN_ON(!wiphy)) 1953 return NULL; 1954 1955 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC && 1956 (data->signal < 0 || data->signal > 100))) 1957 return NULL; 1958 1959 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan, 1960 data->scan_width, ftype); 1961 if (!channel) 1962 return NULL; 1963 1964 memcpy(tmp.pub.bssid, bssid, ETH_ALEN); 1965 tmp.pub.channel = channel; 1966 tmp.pub.scan_width = data->scan_width; 1967 tmp.pub.signal = data->signal; 1968 tmp.pub.beacon_interval = beacon_interval; 1969 tmp.pub.capability = capability; 1970 tmp.ts_boottime = data->boottime_ns; 1971 tmp.parent_tsf = data->parent_tsf; 1972 ether_addr_copy(tmp.parent_bssid, data->parent_bssid); 1973 1974 if (non_tx_data) { 1975 tmp.pub.transmitted_bss = non_tx_data->tx_bss; 1976 ts = bss_from_pub(non_tx_data->tx_bss)->ts; 1977 tmp.pub.bssid_index = non_tx_data->bssid_index; 1978 tmp.pub.max_bssid_indicator = non_tx_data->max_bssid_indicator; 1979 } else { 1980 ts = jiffies; 1981 } 1982 1983 /* 1984 * If we do not know here whether the IEs are from a Beacon or Probe 1985 * Response frame, we need to pick one of the options and only use it 1986 * with the driver that does not provide the full Beacon/Probe Response 1987 * frame. Use Beacon frame pointer to avoid indicating that this should 1988 * override the IEs pointer should we have received an earlier 1989 * indication of Probe Response data. 1990 */ 1991 ies = kzalloc(sizeof(*ies) + ielen, gfp); 1992 if (!ies) 1993 return NULL; 1994 ies->len = ielen; 1995 ies->tsf = tsf; 1996 ies->from_beacon = false; 1997 memcpy(ies->data, ie, ielen); 1998 1999 switch (ftype) { 2000 case CFG80211_BSS_FTYPE_BEACON: 2001 ies->from_beacon = true; 2002 fallthrough; 2003 case CFG80211_BSS_FTYPE_UNKNOWN: 2004 rcu_assign_pointer(tmp.pub.beacon_ies, ies); 2005 break; 2006 case CFG80211_BSS_FTYPE_PRESP: 2007 rcu_assign_pointer(tmp.pub.proberesp_ies, ies); 2008 break; 2009 } 2010 rcu_assign_pointer(tmp.pub.ies, ies); 2011 2012 signal_valid = data->chan == channel; 2013 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, ts); 2014 if (!res) 2015 return NULL; 2016 2017 if (channel->band == NL80211_BAND_60GHZ) { 2018 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK; 2019 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP || 2020 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS) 2021 regulatory_hint_found_beacon(wiphy, channel, gfp); 2022 } else { 2023 if (res->pub.capability & WLAN_CAPABILITY_ESS) 2024 regulatory_hint_found_beacon(wiphy, channel, gfp); 2025 } 2026 2027 if (non_tx_data) { 2028 /* this is a nontransmitting bss, we need to add it to 2029 * transmitting bss' list if it is not there 2030 */ 2031 spin_lock_bh(&rdev->bss_lock); 2032 if (cfg80211_add_nontrans_list(non_tx_data->tx_bss, 2033 &res->pub)) { 2034 if (__cfg80211_unlink_bss(rdev, res)) { 2035 rdev->bss_generation++; 2036 res = NULL; 2037 } 2038 } 2039 spin_unlock_bh(&rdev->bss_lock); 2040 2041 if (!res) 2042 return NULL; 2043 } 2044 2045 trace_cfg80211_return_bss(&res->pub); 2046 /* cfg80211_bss_update gives us a referenced result */ 2047 return &res->pub; 2048 } 2049 2050 static const struct element 2051 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen, 2052 const struct element *mbssid_elem, 2053 const struct element *sub_elem) 2054 { 2055 const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen; 2056 const struct element *next_mbssid; 2057 const struct element *next_sub; 2058 2059 next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, 2060 mbssid_end, 2061 ielen - (mbssid_end - ie)); 2062 2063 /* 2064 * If it is not the last subelement in current MBSSID IE or there isn't 2065 * a next MBSSID IE - profile is complete. 2066 */ 2067 if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) || 2068 !next_mbssid) 2069 return NULL; 2070 2071 /* For any length error, just return NULL */ 2072 2073 if (next_mbssid->datalen < 4) 2074 return NULL; 2075 2076 next_sub = (void *)&next_mbssid->data[1]; 2077 2078 if (next_mbssid->data + next_mbssid->datalen < 2079 next_sub->data + next_sub->datalen) 2080 return NULL; 2081 2082 if (next_sub->id != 0 || next_sub->datalen < 2) 2083 return NULL; 2084 2085 /* 2086 * Check if the first element in the next sub element is a start 2087 * of a new profile 2088 */ 2089 return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ? 2090 NULL : next_mbssid; 2091 } 2092 2093 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen, 2094 const struct element *mbssid_elem, 2095 const struct element *sub_elem, 2096 u8 *merged_ie, size_t max_copy_len) 2097 { 2098 size_t copied_len = sub_elem->datalen; 2099 const struct element *next_mbssid; 2100 2101 if (sub_elem->datalen > max_copy_len) 2102 return 0; 2103 2104 memcpy(merged_ie, sub_elem->data, sub_elem->datalen); 2105 2106 while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen, 2107 mbssid_elem, 2108 sub_elem))) { 2109 const struct element *next_sub = (void *)&next_mbssid->data[1]; 2110 2111 if (copied_len + next_sub->datalen > max_copy_len) 2112 break; 2113 memcpy(merged_ie + copied_len, next_sub->data, 2114 next_sub->datalen); 2115 copied_len += next_sub->datalen; 2116 } 2117 2118 return copied_len; 2119 } 2120 EXPORT_SYMBOL(cfg80211_merge_profile); 2121 2122 static void cfg80211_parse_mbssid_data(struct wiphy *wiphy, 2123 struct cfg80211_inform_bss *data, 2124 enum cfg80211_bss_frame_type ftype, 2125 const u8 *bssid, u64 tsf, 2126 u16 beacon_interval, const u8 *ie, 2127 size_t ielen, 2128 struct cfg80211_non_tx_bss *non_tx_data, 2129 gfp_t gfp) 2130 { 2131 const u8 *mbssid_index_ie; 2132 const struct element *elem, *sub; 2133 size_t new_ie_len; 2134 u8 new_bssid[ETH_ALEN]; 2135 u8 *new_ie, *profile; 2136 u64 seen_indices = 0; 2137 u16 capability; 2138 struct cfg80211_bss *bss; 2139 2140 if (!non_tx_data) 2141 return; 2142 if (!cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) 2143 return; 2144 if (!wiphy->support_mbssid) 2145 return; 2146 if (wiphy->support_only_he_mbssid && 2147 !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen)) 2148 return; 2149 2150 new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp); 2151 if (!new_ie) 2152 return; 2153 2154 profile = kmalloc(ielen, gfp); 2155 if (!profile) 2156 goto out; 2157 2158 for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) { 2159 if (elem->datalen < 4) 2160 continue; 2161 if (elem->data[0] < 1 || (int)elem->data[0] > 8) 2162 continue; 2163 for_each_element(sub, elem->data + 1, elem->datalen - 1) { 2164 u8 profile_len; 2165 2166 if (sub->id != 0 || sub->datalen < 4) { 2167 /* not a valid BSS profile */ 2168 continue; 2169 } 2170 2171 if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP || 2172 sub->data[1] != 2) { 2173 /* The first element within the Nontransmitted 2174 * BSSID Profile is not the Nontransmitted 2175 * BSSID Capability element. 2176 */ 2177 continue; 2178 } 2179 2180 memset(profile, 0, ielen); 2181 profile_len = cfg80211_merge_profile(ie, ielen, 2182 elem, 2183 sub, 2184 profile, 2185 ielen); 2186 2187 /* found a Nontransmitted BSSID Profile */ 2188 mbssid_index_ie = cfg80211_find_ie 2189 (WLAN_EID_MULTI_BSSID_IDX, 2190 profile, profile_len); 2191 if (!mbssid_index_ie || mbssid_index_ie[1] < 1 || 2192 mbssid_index_ie[2] == 0 || 2193 mbssid_index_ie[2] > 46) { 2194 /* No valid Multiple BSSID-Index element */ 2195 continue; 2196 } 2197 2198 if (seen_indices & BIT_ULL(mbssid_index_ie[2])) 2199 /* We don't support legacy split of a profile */ 2200 net_dbg_ratelimited("Partial info for BSSID index %d\n", 2201 mbssid_index_ie[2]); 2202 2203 seen_indices |= BIT_ULL(mbssid_index_ie[2]); 2204 2205 non_tx_data->bssid_index = mbssid_index_ie[2]; 2206 non_tx_data->max_bssid_indicator = elem->data[0]; 2207 2208 cfg80211_gen_new_bssid(bssid, 2209 non_tx_data->max_bssid_indicator, 2210 non_tx_data->bssid_index, 2211 new_bssid); 2212 memset(new_ie, 0, IEEE80211_MAX_DATA_LEN); 2213 new_ie_len = cfg80211_gen_new_ie(ie, ielen, 2214 profile, 2215 profile_len, new_ie, 2216 gfp); 2217 if (!new_ie_len) 2218 continue; 2219 2220 capability = get_unaligned_le16(profile + 2); 2221 bss = cfg80211_inform_single_bss_data(wiphy, data, 2222 ftype, 2223 new_bssid, tsf, 2224 capability, 2225 beacon_interval, 2226 new_ie, 2227 new_ie_len, 2228 non_tx_data, 2229 gfp); 2230 if (!bss) 2231 break; 2232 cfg80211_put_bss(wiphy, bss); 2233 } 2234 } 2235 2236 out: 2237 kfree(new_ie); 2238 kfree(profile); 2239 } 2240 2241 struct cfg80211_bss * 2242 cfg80211_inform_bss_data(struct wiphy *wiphy, 2243 struct cfg80211_inform_bss *data, 2244 enum cfg80211_bss_frame_type ftype, 2245 const u8 *bssid, u64 tsf, u16 capability, 2246 u16 beacon_interval, const u8 *ie, size_t ielen, 2247 gfp_t gfp) 2248 { 2249 struct cfg80211_bss *res; 2250 struct cfg80211_non_tx_bss non_tx_data; 2251 2252 res = cfg80211_inform_single_bss_data(wiphy, data, ftype, bssid, tsf, 2253 capability, beacon_interval, ie, 2254 ielen, NULL, gfp); 2255 if (!res) 2256 return NULL; 2257 non_tx_data.tx_bss = res; 2258 cfg80211_parse_mbssid_data(wiphy, data, ftype, bssid, tsf, 2259 beacon_interval, ie, ielen, &non_tx_data, 2260 gfp); 2261 return res; 2262 } 2263 EXPORT_SYMBOL(cfg80211_inform_bss_data); 2264 2265 static void 2266 cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy, 2267 struct cfg80211_inform_bss *data, 2268 struct ieee80211_mgmt *mgmt, size_t len, 2269 struct cfg80211_non_tx_bss *non_tx_data, 2270 gfp_t gfp) 2271 { 2272 enum cfg80211_bss_frame_type ftype; 2273 const u8 *ie = mgmt->u.probe_resp.variable; 2274 size_t ielen = len - offsetof(struct ieee80211_mgmt, 2275 u.probe_resp.variable); 2276 2277 ftype = ieee80211_is_beacon(mgmt->frame_control) ? 2278 CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP; 2279 2280 cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid, 2281 le64_to_cpu(mgmt->u.probe_resp.timestamp), 2282 le16_to_cpu(mgmt->u.probe_resp.beacon_int), 2283 ie, ielen, non_tx_data, gfp); 2284 } 2285 2286 static void 2287 cfg80211_update_notlisted_nontrans(struct wiphy *wiphy, 2288 struct cfg80211_bss *nontrans_bss, 2289 struct ieee80211_mgmt *mgmt, size_t len) 2290 { 2291 u8 *ie, *new_ie, *pos; 2292 const struct element *nontrans_ssid; 2293 const u8 *trans_ssid, *mbssid; 2294 size_t ielen = len - offsetof(struct ieee80211_mgmt, 2295 u.probe_resp.variable); 2296 size_t new_ie_len; 2297 struct cfg80211_bss_ies *new_ies; 2298 const struct cfg80211_bss_ies *old; 2299 size_t cpy_len; 2300 2301 lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock); 2302 2303 ie = mgmt->u.probe_resp.variable; 2304 2305 new_ie_len = ielen; 2306 trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); 2307 if (!trans_ssid) 2308 return; 2309 new_ie_len -= trans_ssid[1]; 2310 mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen); 2311 /* 2312 * It's not valid to have the MBSSID element before SSID 2313 * ignore if that happens - the code below assumes it is 2314 * after (while copying things inbetween). 2315 */ 2316 if (!mbssid || mbssid < trans_ssid) 2317 return; 2318 new_ie_len -= mbssid[1]; 2319 2320 nontrans_ssid = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID); 2321 if (!nontrans_ssid) 2322 return; 2323 2324 new_ie_len += nontrans_ssid->datalen; 2325 2326 /* generate new ie for nontrans BSS 2327 * 1. replace SSID with nontrans BSS' SSID 2328 * 2. skip MBSSID IE 2329 */ 2330 new_ie = kzalloc(new_ie_len, GFP_ATOMIC); 2331 if (!new_ie) 2332 return; 2333 2334 new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC); 2335 if (!new_ies) 2336 goto out_free; 2337 2338 pos = new_ie; 2339 2340 /* copy the nontransmitted SSID */ 2341 cpy_len = nontrans_ssid->datalen + 2; 2342 memcpy(pos, nontrans_ssid, cpy_len); 2343 pos += cpy_len; 2344 /* copy the IEs between SSID and MBSSID */ 2345 cpy_len = trans_ssid[1] + 2; 2346 memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len))); 2347 pos += (mbssid - (trans_ssid + cpy_len)); 2348 /* copy the IEs after MBSSID */ 2349 cpy_len = mbssid[1] + 2; 2350 memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len))); 2351 2352 /* update ie */ 2353 new_ies->len = new_ie_len; 2354 new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp); 2355 new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control); 2356 memcpy(new_ies->data, new_ie, new_ie_len); 2357 if (ieee80211_is_probe_resp(mgmt->frame_control)) { 2358 old = rcu_access_pointer(nontrans_bss->proberesp_ies); 2359 rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies); 2360 rcu_assign_pointer(nontrans_bss->ies, new_ies); 2361 if (old) 2362 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 2363 } else { 2364 old = rcu_access_pointer(nontrans_bss->beacon_ies); 2365 rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies); 2366 cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss), 2367 new_ies, old); 2368 rcu_assign_pointer(nontrans_bss->ies, new_ies); 2369 if (old) 2370 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); 2371 } 2372 2373 out_free: 2374 kfree(new_ie); 2375 } 2376 2377 /* cfg80211_inform_bss_width_frame helper */ 2378 static struct cfg80211_bss * 2379 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy, 2380 struct cfg80211_inform_bss *data, 2381 struct ieee80211_mgmt *mgmt, size_t len, 2382 gfp_t gfp) 2383 { 2384 struct cfg80211_internal_bss tmp = {}, *res; 2385 struct cfg80211_bss_ies *ies; 2386 struct ieee80211_channel *channel; 2387 bool signal_valid; 2388 struct ieee80211_ext *ext = NULL; 2389 u8 *bssid, *variable; 2390 u16 capability, beacon_int; 2391 size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt, 2392 u.probe_resp.variable); 2393 int bss_type; 2394 enum cfg80211_bss_frame_type ftype; 2395 2396 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) != 2397 offsetof(struct ieee80211_mgmt, u.beacon.variable)); 2398 2399 trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len); 2400 2401 if (WARN_ON(!mgmt)) 2402 return NULL; 2403 2404 if (WARN_ON(!wiphy)) 2405 return NULL; 2406 2407 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC && 2408 (data->signal < 0 || data->signal > 100))) 2409 return NULL; 2410 2411 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) { 2412 ext = (void *) mgmt; 2413 min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon); 2414 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control)) 2415 min_hdr_len = offsetof(struct ieee80211_ext, 2416 u.s1g_short_beacon.variable); 2417 } 2418 2419 if (WARN_ON(len < min_hdr_len)) 2420 return NULL; 2421 2422 ielen = len - min_hdr_len; 2423 variable = mgmt->u.probe_resp.variable; 2424 if (ext) { 2425 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control)) 2426 variable = ext->u.s1g_short_beacon.variable; 2427 else 2428 variable = ext->u.s1g_beacon.variable; 2429 } 2430 2431 if (ieee80211_is_beacon(mgmt->frame_control)) 2432 ftype = CFG80211_BSS_FTYPE_BEACON; 2433 else if (ieee80211_is_probe_resp(mgmt->frame_control)) 2434 ftype = CFG80211_BSS_FTYPE_PRESP; 2435 else 2436 ftype = CFG80211_BSS_FTYPE_UNKNOWN; 2437 2438 channel = cfg80211_get_bss_channel(wiphy, variable, 2439 ielen, data->chan, data->scan_width, 2440 ftype); 2441 if (!channel) 2442 return NULL; 2443 2444 if (ext) { 2445 const struct ieee80211_s1g_bcn_compat_ie *compat; 2446 const struct element *elem; 2447 2448 elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT, 2449 variable, ielen); 2450 if (!elem) 2451 return NULL; 2452 if (elem->datalen < sizeof(*compat)) 2453 return NULL; 2454 compat = (void *)elem->data; 2455 bssid = ext->u.s1g_beacon.sa; 2456 capability = le16_to_cpu(compat->compat_info); 2457 beacon_int = le16_to_cpu(compat->beacon_int); 2458 } else { 2459 bssid = mgmt->bssid; 2460 beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int); 2461 capability = le16_to_cpu(mgmt->u.probe_resp.capab_info); 2462 } 2463 2464 ies = kzalloc(sizeof(*ies) + ielen, gfp); 2465 if (!ies) 2466 return NULL; 2467 ies->len = ielen; 2468 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp); 2469 ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) || 2470 ieee80211_is_s1g_beacon(mgmt->frame_control); 2471 memcpy(ies->data, variable, ielen); 2472 2473 if (ieee80211_is_probe_resp(mgmt->frame_control)) 2474 rcu_assign_pointer(tmp.pub.proberesp_ies, ies); 2475 else 2476 rcu_assign_pointer(tmp.pub.beacon_ies, ies); 2477 rcu_assign_pointer(tmp.pub.ies, ies); 2478 2479 memcpy(tmp.pub.bssid, bssid, ETH_ALEN); 2480 tmp.pub.beacon_interval = beacon_int; 2481 tmp.pub.capability = capability; 2482 tmp.pub.channel = channel; 2483 tmp.pub.scan_width = data->scan_width; 2484 tmp.pub.signal = data->signal; 2485 tmp.ts_boottime = data->boottime_ns; 2486 tmp.parent_tsf = data->parent_tsf; 2487 tmp.pub.chains = data->chains; 2488 memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS); 2489 ether_addr_copy(tmp.parent_bssid, data->parent_bssid); 2490 2491 signal_valid = data->chan == channel; 2492 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, 2493 jiffies); 2494 if (!res) 2495 return NULL; 2496 2497 if (channel->band == NL80211_BAND_60GHZ) { 2498 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK; 2499 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP || 2500 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS) 2501 regulatory_hint_found_beacon(wiphy, channel, gfp); 2502 } else { 2503 if (res->pub.capability & WLAN_CAPABILITY_ESS) 2504 regulatory_hint_found_beacon(wiphy, channel, gfp); 2505 } 2506 2507 trace_cfg80211_return_bss(&res->pub); 2508 /* cfg80211_bss_update gives us a referenced result */ 2509 return &res->pub; 2510 } 2511 2512 struct cfg80211_bss * 2513 cfg80211_inform_bss_frame_data(struct wiphy *wiphy, 2514 struct cfg80211_inform_bss *data, 2515 struct ieee80211_mgmt *mgmt, size_t len, 2516 gfp_t gfp) 2517 { 2518 struct cfg80211_bss *res, *tmp_bss; 2519 const u8 *ie = mgmt->u.probe_resp.variable; 2520 const struct cfg80211_bss_ies *ies1, *ies2; 2521 size_t ielen = len - offsetof(struct ieee80211_mgmt, 2522 u.probe_resp.variable); 2523 struct cfg80211_non_tx_bss non_tx_data = {}; 2524 2525 res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt, 2526 len, gfp); 2527 2528 /* don't do any further MBSSID handling for S1G */ 2529 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) 2530 return res; 2531 2532 if (!res || !wiphy->support_mbssid || 2533 !cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) 2534 return res; 2535 if (wiphy->support_only_he_mbssid && 2536 !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen)) 2537 return res; 2538 2539 non_tx_data.tx_bss = res; 2540 /* process each non-transmitting bss */ 2541 cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len, 2542 &non_tx_data, gfp); 2543 2544 spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock); 2545 2546 /* check if the res has other nontransmitting bss which is not 2547 * in MBSSID IE 2548 */ 2549 ies1 = rcu_access_pointer(res->ies); 2550 2551 /* go through nontrans_list, if the timestamp of the BSS is 2552 * earlier than the timestamp of the transmitting BSS then 2553 * update it 2554 */ 2555 list_for_each_entry(tmp_bss, &res->nontrans_list, 2556 nontrans_list) { 2557 ies2 = rcu_access_pointer(tmp_bss->ies); 2558 if (ies2->tsf < ies1->tsf) 2559 cfg80211_update_notlisted_nontrans(wiphy, tmp_bss, 2560 mgmt, len); 2561 } 2562 spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock); 2563 2564 return res; 2565 } 2566 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data); 2567 2568 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 2569 { 2570 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2571 2572 if (!pub) 2573 return; 2574 2575 spin_lock_bh(&rdev->bss_lock); 2576 bss_ref_get(rdev, bss_from_pub(pub)); 2577 spin_unlock_bh(&rdev->bss_lock); 2578 } 2579 EXPORT_SYMBOL(cfg80211_ref_bss); 2580 2581 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 2582 { 2583 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2584 2585 if (!pub) 2586 return; 2587 2588 spin_lock_bh(&rdev->bss_lock); 2589 bss_ref_put(rdev, bss_from_pub(pub)); 2590 spin_unlock_bh(&rdev->bss_lock); 2591 } 2592 EXPORT_SYMBOL(cfg80211_put_bss); 2593 2594 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub) 2595 { 2596 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2597 struct cfg80211_internal_bss *bss, *tmp1; 2598 struct cfg80211_bss *nontrans_bss, *tmp; 2599 2600 if (WARN_ON(!pub)) 2601 return; 2602 2603 bss = bss_from_pub(pub); 2604 2605 spin_lock_bh(&rdev->bss_lock); 2606 if (list_empty(&bss->list)) 2607 goto out; 2608 2609 list_for_each_entry_safe(nontrans_bss, tmp, 2610 &pub->nontrans_list, 2611 nontrans_list) { 2612 tmp1 = bss_from_pub(nontrans_bss); 2613 if (__cfg80211_unlink_bss(rdev, tmp1)) 2614 rdev->bss_generation++; 2615 } 2616 2617 if (__cfg80211_unlink_bss(rdev, bss)) 2618 rdev->bss_generation++; 2619 out: 2620 spin_unlock_bh(&rdev->bss_lock); 2621 } 2622 EXPORT_SYMBOL(cfg80211_unlink_bss); 2623 2624 void cfg80211_bss_iter(struct wiphy *wiphy, 2625 struct cfg80211_chan_def *chandef, 2626 void (*iter)(struct wiphy *wiphy, 2627 struct cfg80211_bss *bss, 2628 void *data), 2629 void *iter_data) 2630 { 2631 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2632 struct cfg80211_internal_bss *bss; 2633 2634 spin_lock_bh(&rdev->bss_lock); 2635 2636 list_for_each_entry(bss, &rdev->bss_list, list) { 2637 if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel, 2638 false)) 2639 iter(wiphy, &bss->pub, iter_data); 2640 } 2641 2642 spin_unlock_bh(&rdev->bss_lock); 2643 } 2644 EXPORT_SYMBOL(cfg80211_bss_iter); 2645 2646 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev, 2647 unsigned int link_id, 2648 struct ieee80211_channel *chan) 2649 { 2650 struct wiphy *wiphy = wdev->wiphy; 2651 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 2652 struct cfg80211_internal_bss *cbss = wdev->links[link_id].client.current_bss; 2653 struct cfg80211_internal_bss *new = NULL; 2654 struct cfg80211_internal_bss *bss; 2655 struct cfg80211_bss *nontrans_bss; 2656 struct cfg80211_bss *tmp; 2657 2658 spin_lock_bh(&rdev->bss_lock); 2659 2660 /* 2661 * Some APs use CSA also for bandwidth changes, i.e., without actually 2662 * changing the control channel, so no need to update in such a case. 2663 */ 2664 if (cbss->pub.channel == chan) 2665 goto done; 2666 2667 /* use transmitting bss */ 2668 if (cbss->pub.transmitted_bss) 2669 cbss = bss_from_pub(cbss->pub.transmitted_bss); 2670 2671 cbss->pub.channel = chan; 2672 2673 list_for_each_entry(bss, &rdev->bss_list, list) { 2674 if (!cfg80211_bss_type_match(bss->pub.capability, 2675 bss->pub.channel->band, 2676 wdev->conn_bss_type)) 2677 continue; 2678 2679 if (bss == cbss) 2680 continue; 2681 2682 if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) { 2683 new = bss; 2684 break; 2685 } 2686 } 2687 2688 if (new) { 2689 /* to save time, update IEs for transmitting bss only */ 2690 if (cfg80211_update_known_bss(rdev, cbss, new, false)) { 2691 new->pub.proberesp_ies = NULL; 2692 new->pub.beacon_ies = NULL; 2693 } 2694 2695 list_for_each_entry_safe(nontrans_bss, tmp, 2696 &new->pub.nontrans_list, 2697 nontrans_list) { 2698 bss = bss_from_pub(nontrans_bss); 2699 if (__cfg80211_unlink_bss(rdev, bss)) 2700 rdev->bss_generation++; 2701 } 2702 2703 WARN_ON(atomic_read(&new->hold)); 2704 if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new))) 2705 rdev->bss_generation++; 2706 } 2707 2708 rb_erase(&cbss->rbn, &rdev->bss_tree); 2709 rb_insert_bss(rdev, cbss); 2710 rdev->bss_generation++; 2711 2712 list_for_each_entry_safe(nontrans_bss, tmp, 2713 &cbss->pub.nontrans_list, 2714 nontrans_list) { 2715 bss = bss_from_pub(nontrans_bss); 2716 bss->pub.channel = chan; 2717 rb_erase(&bss->rbn, &rdev->bss_tree); 2718 rb_insert_bss(rdev, bss); 2719 rdev->bss_generation++; 2720 } 2721 2722 done: 2723 spin_unlock_bh(&rdev->bss_lock); 2724 } 2725 2726 #ifdef CONFIG_CFG80211_WEXT 2727 static struct cfg80211_registered_device * 2728 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex) 2729 { 2730 struct cfg80211_registered_device *rdev; 2731 struct net_device *dev; 2732 2733 ASSERT_RTNL(); 2734 2735 dev = dev_get_by_index(net, ifindex); 2736 if (!dev) 2737 return ERR_PTR(-ENODEV); 2738 if (dev->ieee80211_ptr) 2739 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy); 2740 else 2741 rdev = ERR_PTR(-ENODEV); 2742 dev_put(dev); 2743 return rdev; 2744 } 2745 2746 int cfg80211_wext_siwscan(struct net_device *dev, 2747 struct iw_request_info *info, 2748 union iwreq_data *wrqu, char *extra) 2749 { 2750 struct cfg80211_registered_device *rdev; 2751 struct wiphy *wiphy; 2752 struct iw_scan_req *wreq = NULL; 2753 struct cfg80211_scan_request *creq; 2754 int i, err, n_channels = 0; 2755 enum nl80211_band band; 2756 2757 if (!netif_running(dev)) 2758 return -ENETDOWN; 2759 2760 if (wrqu->data.length == sizeof(struct iw_scan_req)) 2761 wreq = (struct iw_scan_req *)extra; 2762 2763 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex); 2764 2765 if (IS_ERR(rdev)) 2766 return PTR_ERR(rdev); 2767 2768 if (rdev->scan_req || rdev->scan_msg) 2769 return -EBUSY; 2770 2771 wiphy = &rdev->wiphy; 2772 2773 /* Determine number of channels, needed to allocate creq */ 2774 if (wreq && wreq->num_channels) 2775 n_channels = wreq->num_channels; 2776 else 2777 n_channels = ieee80211_get_num_supported_channels(wiphy); 2778 2779 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) + 2780 n_channels * sizeof(void *), 2781 GFP_ATOMIC); 2782 if (!creq) 2783 return -ENOMEM; 2784 2785 creq->wiphy = wiphy; 2786 creq->wdev = dev->ieee80211_ptr; 2787 /* SSIDs come after channels */ 2788 creq->ssids = (void *)&creq->channels[n_channels]; 2789 creq->n_channels = n_channels; 2790 creq->n_ssids = 1; 2791 creq->scan_start = jiffies; 2792 2793 /* translate "Scan on frequencies" request */ 2794 i = 0; 2795 for (band = 0; band < NUM_NL80211_BANDS; band++) { 2796 int j; 2797 2798 if (!wiphy->bands[band]) 2799 continue; 2800 2801 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 2802 /* ignore disabled channels */ 2803 if (wiphy->bands[band]->channels[j].flags & 2804 IEEE80211_CHAN_DISABLED) 2805 continue; 2806 2807 /* If we have a wireless request structure and the 2808 * wireless request specifies frequencies, then search 2809 * for the matching hardware channel. 2810 */ 2811 if (wreq && wreq->num_channels) { 2812 int k; 2813 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq; 2814 for (k = 0; k < wreq->num_channels; k++) { 2815 struct iw_freq *freq = 2816 &wreq->channel_list[k]; 2817 int wext_freq = 2818 cfg80211_wext_freq(freq); 2819 2820 if (wext_freq == wiphy_freq) 2821 goto wext_freq_found; 2822 } 2823 goto wext_freq_not_found; 2824 } 2825 2826 wext_freq_found: 2827 creq->channels[i] = &wiphy->bands[band]->channels[j]; 2828 i++; 2829 wext_freq_not_found: ; 2830 } 2831 } 2832 /* No channels found? */ 2833 if (!i) { 2834 err = -EINVAL; 2835 goto out; 2836 } 2837 2838 /* Set real number of channels specified in creq->channels[] */ 2839 creq->n_channels = i; 2840 2841 /* translate "Scan for SSID" request */ 2842 if (wreq) { 2843 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) { 2844 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) { 2845 err = -EINVAL; 2846 goto out; 2847 } 2848 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len); 2849 creq->ssids[0].ssid_len = wreq->essid_len; 2850 } 2851 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE) 2852 creq->n_ssids = 0; 2853 } 2854 2855 for (i = 0; i < NUM_NL80211_BANDS; i++) 2856 if (wiphy->bands[i]) 2857 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1; 2858 2859 eth_broadcast_addr(creq->bssid); 2860 2861 wiphy_lock(&rdev->wiphy); 2862 2863 rdev->scan_req = creq; 2864 err = rdev_scan(rdev, creq); 2865 if (err) { 2866 rdev->scan_req = NULL; 2867 /* creq will be freed below */ 2868 } else { 2869 nl80211_send_scan_start(rdev, dev->ieee80211_ptr); 2870 /* creq now owned by driver */ 2871 creq = NULL; 2872 dev_hold(dev); 2873 } 2874 wiphy_unlock(&rdev->wiphy); 2875 out: 2876 kfree(creq); 2877 return err; 2878 } 2879 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan); 2880 2881 static char *ieee80211_scan_add_ies(struct iw_request_info *info, 2882 const struct cfg80211_bss_ies *ies, 2883 char *current_ev, char *end_buf) 2884 { 2885 const u8 *pos, *end, *next; 2886 struct iw_event iwe; 2887 2888 if (!ies) 2889 return current_ev; 2890 2891 /* 2892 * If needed, fragment the IEs buffer (at IE boundaries) into short 2893 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages. 2894 */ 2895 pos = ies->data; 2896 end = pos + ies->len; 2897 2898 while (end - pos > IW_GENERIC_IE_MAX) { 2899 next = pos + 2 + pos[1]; 2900 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX) 2901 next = next + 2 + next[1]; 2902 2903 memset(&iwe, 0, sizeof(iwe)); 2904 iwe.cmd = IWEVGENIE; 2905 iwe.u.data.length = next - pos; 2906 current_ev = iwe_stream_add_point_check(info, current_ev, 2907 end_buf, &iwe, 2908 (void *)pos); 2909 if (IS_ERR(current_ev)) 2910 return current_ev; 2911 pos = next; 2912 } 2913 2914 if (end > pos) { 2915 memset(&iwe, 0, sizeof(iwe)); 2916 iwe.cmd = IWEVGENIE; 2917 iwe.u.data.length = end - pos; 2918 current_ev = iwe_stream_add_point_check(info, current_ev, 2919 end_buf, &iwe, 2920 (void *)pos); 2921 if (IS_ERR(current_ev)) 2922 return current_ev; 2923 } 2924 2925 return current_ev; 2926 } 2927 2928 static char * 2929 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info, 2930 struct cfg80211_internal_bss *bss, char *current_ev, 2931 char *end_buf) 2932 { 2933 const struct cfg80211_bss_ies *ies; 2934 struct iw_event iwe; 2935 const u8 *ie; 2936 u8 buf[50]; 2937 u8 *cfg, *p, *tmp; 2938 int rem, i, sig; 2939 bool ismesh = false; 2940 2941 memset(&iwe, 0, sizeof(iwe)); 2942 iwe.cmd = SIOCGIWAP; 2943 iwe.u.ap_addr.sa_family = ARPHRD_ETHER; 2944 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN); 2945 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 2946 IW_EV_ADDR_LEN); 2947 if (IS_ERR(current_ev)) 2948 return current_ev; 2949 2950 memset(&iwe, 0, sizeof(iwe)); 2951 iwe.cmd = SIOCGIWFREQ; 2952 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq); 2953 iwe.u.freq.e = 0; 2954 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 2955 IW_EV_FREQ_LEN); 2956 if (IS_ERR(current_ev)) 2957 return current_ev; 2958 2959 memset(&iwe, 0, sizeof(iwe)); 2960 iwe.cmd = SIOCGIWFREQ; 2961 iwe.u.freq.m = bss->pub.channel->center_freq; 2962 iwe.u.freq.e = 6; 2963 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe, 2964 IW_EV_FREQ_LEN); 2965 if (IS_ERR(current_ev)) 2966 return current_ev; 2967 2968 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) { 2969 memset(&iwe, 0, sizeof(iwe)); 2970 iwe.cmd = IWEVQUAL; 2971 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED | 2972 IW_QUAL_NOISE_INVALID | 2973 IW_QUAL_QUAL_UPDATED; 2974 switch (wiphy->signal_type) { 2975 case CFG80211_SIGNAL_TYPE_MBM: 2976 sig = bss->pub.signal / 100; 2977 iwe.u.qual.level = sig; 2978 iwe.u.qual.updated |= IW_QUAL_DBM; 2979 if (sig < -110) /* rather bad */ 2980 sig = -110; 2981 else if (sig > -40) /* perfect */ 2982 sig = -40; 2983 /* will give a range of 0 .. 70 */ 2984 iwe.u.qual.qual = sig + 110; 2985 break; 2986 case CFG80211_SIGNAL_TYPE_UNSPEC: 2987 iwe.u.qual.level = bss->pub.signal; 2988 /* will give range 0 .. 100 */ 2989 iwe.u.qual.qual = bss->pub.signal; 2990 break; 2991 default: 2992 /* not reached */ 2993 break; 2994 } 2995 current_ev = iwe_stream_add_event_check(info, current_ev, 2996 end_buf, &iwe, 2997 IW_EV_QUAL_LEN); 2998 if (IS_ERR(current_ev)) 2999 return current_ev; 3000 } 3001 3002 memset(&iwe, 0, sizeof(iwe)); 3003 iwe.cmd = SIOCGIWENCODE; 3004 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY) 3005 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; 3006 else 3007 iwe.u.data.flags = IW_ENCODE_DISABLED; 3008 iwe.u.data.length = 0; 3009 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf, 3010 &iwe, ""); 3011 if (IS_ERR(current_ev)) 3012 return current_ev; 3013 3014 rcu_read_lock(); 3015 ies = rcu_dereference(bss->pub.ies); 3016 rem = ies->len; 3017 ie = ies->data; 3018 3019 while (rem >= 2) { 3020 /* invalid data */ 3021 if (ie[1] > rem - 2) 3022 break; 3023 3024 switch (ie[0]) { 3025 case WLAN_EID_SSID: 3026 memset(&iwe, 0, sizeof(iwe)); 3027 iwe.cmd = SIOCGIWESSID; 3028 iwe.u.data.length = ie[1]; 3029 iwe.u.data.flags = 1; 3030 current_ev = iwe_stream_add_point_check(info, 3031 current_ev, 3032 end_buf, &iwe, 3033 (u8 *)ie + 2); 3034 if (IS_ERR(current_ev)) 3035 goto unlock; 3036 break; 3037 case WLAN_EID_MESH_ID: 3038 memset(&iwe, 0, sizeof(iwe)); 3039 iwe.cmd = SIOCGIWESSID; 3040 iwe.u.data.length = ie[1]; 3041 iwe.u.data.flags = 1; 3042 current_ev = iwe_stream_add_point_check(info, 3043 current_ev, 3044 end_buf, &iwe, 3045 (u8 *)ie + 2); 3046 if (IS_ERR(current_ev)) 3047 goto unlock; 3048 break; 3049 case WLAN_EID_MESH_CONFIG: 3050 ismesh = true; 3051 if (ie[1] != sizeof(struct ieee80211_meshconf_ie)) 3052 break; 3053 cfg = (u8 *)ie + 2; 3054 memset(&iwe, 0, sizeof(iwe)); 3055 iwe.cmd = IWEVCUSTOM; 3056 sprintf(buf, "Mesh Network Path Selection Protocol ID: " 3057 "0x%02X", cfg[0]); 3058 iwe.u.data.length = strlen(buf); 3059 current_ev = iwe_stream_add_point_check(info, 3060 current_ev, 3061 end_buf, 3062 &iwe, buf); 3063 if (IS_ERR(current_ev)) 3064 goto unlock; 3065 sprintf(buf, "Path Selection Metric ID: 0x%02X", 3066 cfg[1]); 3067 iwe.u.data.length = strlen(buf); 3068 current_ev = iwe_stream_add_point_check(info, 3069 current_ev, 3070 end_buf, 3071 &iwe, buf); 3072 if (IS_ERR(current_ev)) 3073 goto unlock; 3074 sprintf(buf, "Congestion Control Mode ID: 0x%02X", 3075 cfg[2]); 3076 iwe.u.data.length = strlen(buf); 3077 current_ev = iwe_stream_add_point_check(info, 3078 current_ev, 3079 end_buf, 3080 &iwe, buf); 3081 if (IS_ERR(current_ev)) 3082 goto unlock; 3083 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]); 3084 iwe.u.data.length = strlen(buf); 3085 current_ev = iwe_stream_add_point_check(info, 3086 current_ev, 3087 end_buf, 3088 &iwe, buf); 3089 if (IS_ERR(current_ev)) 3090 goto unlock; 3091 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]); 3092 iwe.u.data.length = strlen(buf); 3093 current_ev = iwe_stream_add_point_check(info, 3094 current_ev, 3095 end_buf, 3096 &iwe, buf); 3097 if (IS_ERR(current_ev)) 3098 goto unlock; 3099 sprintf(buf, "Formation Info: 0x%02X", cfg[5]); 3100 iwe.u.data.length = strlen(buf); 3101 current_ev = iwe_stream_add_point_check(info, 3102 current_ev, 3103 end_buf, 3104 &iwe, buf); 3105 if (IS_ERR(current_ev)) 3106 goto unlock; 3107 sprintf(buf, "Capabilities: 0x%02X", cfg[6]); 3108 iwe.u.data.length = strlen(buf); 3109 current_ev = iwe_stream_add_point_check(info, 3110 current_ev, 3111 end_buf, 3112 &iwe, buf); 3113 if (IS_ERR(current_ev)) 3114 goto unlock; 3115 break; 3116 case WLAN_EID_SUPP_RATES: 3117 case WLAN_EID_EXT_SUPP_RATES: 3118 /* display all supported rates in readable format */ 3119 p = current_ev + iwe_stream_lcp_len(info); 3120 3121 memset(&iwe, 0, sizeof(iwe)); 3122 iwe.cmd = SIOCGIWRATE; 3123 /* Those two flags are ignored... */ 3124 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0; 3125 3126 for (i = 0; i < ie[1]; i++) { 3127 iwe.u.bitrate.value = 3128 ((ie[i + 2] & 0x7f) * 500000); 3129 tmp = p; 3130 p = iwe_stream_add_value(info, current_ev, p, 3131 end_buf, &iwe, 3132 IW_EV_PARAM_LEN); 3133 if (p == tmp) { 3134 current_ev = ERR_PTR(-E2BIG); 3135 goto unlock; 3136 } 3137 } 3138 current_ev = p; 3139 break; 3140 } 3141 rem -= ie[1] + 2; 3142 ie += ie[1] + 2; 3143 } 3144 3145 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) || 3146 ismesh) { 3147 memset(&iwe, 0, sizeof(iwe)); 3148 iwe.cmd = SIOCGIWMODE; 3149 if (ismesh) 3150 iwe.u.mode = IW_MODE_MESH; 3151 else if (bss->pub.capability & WLAN_CAPABILITY_ESS) 3152 iwe.u.mode = IW_MODE_MASTER; 3153 else 3154 iwe.u.mode = IW_MODE_ADHOC; 3155 current_ev = iwe_stream_add_event_check(info, current_ev, 3156 end_buf, &iwe, 3157 IW_EV_UINT_LEN); 3158 if (IS_ERR(current_ev)) 3159 goto unlock; 3160 } 3161 3162 memset(&iwe, 0, sizeof(iwe)); 3163 iwe.cmd = IWEVCUSTOM; 3164 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf)); 3165 iwe.u.data.length = strlen(buf); 3166 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf, 3167 &iwe, buf); 3168 if (IS_ERR(current_ev)) 3169 goto unlock; 3170 memset(&iwe, 0, sizeof(iwe)); 3171 iwe.cmd = IWEVCUSTOM; 3172 sprintf(buf, " Last beacon: %ums ago", 3173 elapsed_jiffies_msecs(bss->ts)); 3174 iwe.u.data.length = strlen(buf); 3175 current_ev = iwe_stream_add_point_check(info, current_ev, 3176 end_buf, &iwe, buf); 3177 if (IS_ERR(current_ev)) 3178 goto unlock; 3179 3180 current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf); 3181 3182 unlock: 3183 rcu_read_unlock(); 3184 return current_ev; 3185 } 3186 3187 3188 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev, 3189 struct iw_request_info *info, 3190 char *buf, size_t len) 3191 { 3192 char *current_ev = buf; 3193 char *end_buf = buf + len; 3194 struct cfg80211_internal_bss *bss; 3195 int err = 0; 3196 3197 spin_lock_bh(&rdev->bss_lock); 3198 cfg80211_bss_expire(rdev); 3199 3200 list_for_each_entry(bss, &rdev->bss_list, list) { 3201 if (buf + len - current_ev <= IW_EV_ADDR_LEN) { 3202 err = -E2BIG; 3203 break; 3204 } 3205 current_ev = ieee80211_bss(&rdev->wiphy, info, bss, 3206 current_ev, end_buf); 3207 if (IS_ERR(current_ev)) { 3208 err = PTR_ERR(current_ev); 3209 break; 3210 } 3211 } 3212 spin_unlock_bh(&rdev->bss_lock); 3213 3214 if (err) 3215 return err; 3216 return current_ev - buf; 3217 } 3218 3219 3220 int cfg80211_wext_giwscan(struct net_device *dev, 3221 struct iw_request_info *info, 3222 union iwreq_data *wrqu, char *extra) 3223 { 3224 struct iw_point *data = &wrqu->data; 3225 struct cfg80211_registered_device *rdev; 3226 int res; 3227 3228 if (!netif_running(dev)) 3229 return -ENETDOWN; 3230 3231 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex); 3232 3233 if (IS_ERR(rdev)) 3234 return PTR_ERR(rdev); 3235 3236 if (rdev->scan_req || rdev->scan_msg) 3237 return -EAGAIN; 3238 3239 res = ieee80211_scan_results(rdev, info, extra, data->length); 3240 data->length = 0; 3241 if (res >= 0) { 3242 data->length = res; 3243 res = 0; 3244 } 3245 3246 return res; 3247 } 3248 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan); 3249 #endif 3250