xref: /openbmc/linux/net/wireless/scan.c (revision 78c99ba1)
1 /*
2  * cfg80211 scan result handling
3  *
4  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
5  */
6 #include <linux/kernel.h>
7 #include <linux/module.h>
8 #include <linux/netdevice.h>
9 #include <linux/wireless.h>
10 #include <linux/nl80211.h>
11 #include <linux/etherdevice.h>
12 #include <net/arp.h>
13 #include <net/cfg80211.h>
14 #include <net/iw_handler.h>
15 #include "core.h"
16 #include "nl80211.h"
17 
18 #define IEEE80211_SCAN_RESULT_EXPIRE	(10 * HZ)
19 
20 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
21 {
22 	struct net_device *dev;
23 #ifdef CONFIG_WIRELESS_EXT
24 	union iwreq_data wrqu;
25 #endif
26 
27 	dev = dev_get_by_index(&init_net, request->ifidx);
28 	if (!dev)
29 		goto out;
30 
31 	WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
32 	wiphy_to_dev(request->wiphy)->scan_req = NULL;
33 
34 	if (aborted)
35 		nl80211_send_scan_aborted(wiphy_to_dev(request->wiphy), dev);
36 	else
37 		nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
38 
39 #ifdef CONFIG_WIRELESS_EXT
40 	if (!aborted) {
41 		memset(&wrqu, 0, sizeof(wrqu));
42 
43 		wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
44 	}
45 #endif
46 
47 	dev_put(dev);
48 
49  out:
50 	kfree(request);
51 }
52 EXPORT_SYMBOL(cfg80211_scan_done);
53 
54 static void bss_release(struct kref *ref)
55 {
56 	struct cfg80211_internal_bss *bss;
57 
58 	bss = container_of(ref, struct cfg80211_internal_bss, ref);
59 	if (bss->pub.free_priv)
60 		bss->pub.free_priv(&bss->pub);
61 
62 	if (bss->ies_allocated)
63 		kfree(bss->pub.information_elements);
64 
65 	kfree(bss);
66 }
67 
68 /* must hold dev->bss_lock! */
69 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
70                       unsigned long age_secs)
71 {
72 	struct cfg80211_internal_bss *bss;
73 	unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
74 
75 	list_for_each_entry(bss, &dev->bss_list, list) {
76 		bss->ts -= age_jiffies;
77 	}
78 }
79 
80 /* must hold dev->bss_lock! */
81 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
82 {
83 	struct cfg80211_internal_bss *bss, *tmp;
84 	bool expired = false;
85 
86 	list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
87 		if (bss->hold ||
88 		    !time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
89 			continue;
90 		list_del(&bss->list);
91 		rb_erase(&bss->rbn, &dev->bss_tree);
92 		kref_put(&bss->ref, bss_release);
93 		expired = true;
94 	}
95 
96 	if (expired)
97 		dev->bss_generation++;
98 }
99 
100 static u8 *find_ie(u8 num, u8 *ies, size_t len)
101 {
102 	while (len > 2 && ies[0] != num) {
103 		len -= ies[1] + 2;
104 		ies += ies[1] + 2;
105 	}
106 	if (len < 2)
107 		return NULL;
108 	if (len < 2 + ies[1])
109 		return NULL;
110 	return ies;
111 }
112 
113 static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
114 {
115 	const u8 *ie1 = find_ie(num, ies1, len1);
116 	const u8 *ie2 = find_ie(num, ies2, len2);
117 	int r;
118 
119 	if (!ie1 && !ie2)
120 		return 0;
121 	if (!ie1)
122 		return -1;
123 
124 	r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
125 	if (r == 0 && ie1[1] != ie2[1])
126 		return ie2[1] - ie1[1];
127 	return r;
128 }
129 
130 static bool is_bss(struct cfg80211_bss *a,
131 		   const u8 *bssid,
132 		   const u8 *ssid, size_t ssid_len)
133 {
134 	const u8 *ssidie;
135 
136 	if (bssid && compare_ether_addr(a->bssid, bssid))
137 		return false;
138 
139 	if (!ssid)
140 		return true;
141 
142 	ssidie = find_ie(WLAN_EID_SSID,
143 			 a->information_elements,
144 			 a->len_information_elements);
145 	if (!ssidie)
146 		return false;
147 	if (ssidie[1] != ssid_len)
148 		return false;
149 	return memcmp(ssidie + 2, ssid, ssid_len) == 0;
150 }
151 
152 static bool is_mesh(struct cfg80211_bss *a,
153 		    const u8 *meshid, size_t meshidlen,
154 		    const u8 *meshcfg)
155 {
156 	const u8 *ie;
157 
158 	if (!is_zero_ether_addr(a->bssid))
159 		return false;
160 
161 	ie = find_ie(WLAN_EID_MESH_ID,
162 		     a->information_elements,
163 		     a->len_information_elements);
164 	if (!ie)
165 		return false;
166 	if (ie[1] != meshidlen)
167 		return false;
168 	if (memcmp(ie + 2, meshid, meshidlen))
169 		return false;
170 
171 	ie = find_ie(WLAN_EID_MESH_CONFIG,
172 		     a->information_elements,
173 		     a->len_information_elements);
174 	if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
175 		return false;
176 
177 	/*
178 	 * Ignore mesh capability (last two bytes of the IE) when
179 	 * comparing since that may differ between stations taking
180 	 * part in the same mesh.
181 	 */
182 	return memcmp(ie + 2, meshcfg, IEEE80211_MESH_CONFIG_LEN - 2) == 0;
183 }
184 
185 static int cmp_bss(struct cfg80211_bss *a,
186 		   struct cfg80211_bss *b)
187 {
188 	int r;
189 
190 	if (a->channel != b->channel)
191 		return b->channel->center_freq - a->channel->center_freq;
192 
193 	r = memcmp(a->bssid, b->bssid, ETH_ALEN);
194 	if (r)
195 		return r;
196 
197 	if (is_zero_ether_addr(a->bssid)) {
198 		r = cmp_ies(WLAN_EID_MESH_ID,
199 			    a->information_elements,
200 			    a->len_information_elements,
201 			    b->information_elements,
202 			    b->len_information_elements);
203 		if (r)
204 			return r;
205 		return cmp_ies(WLAN_EID_MESH_CONFIG,
206 			       a->information_elements,
207 			       a->len_information_elements,
208 			       b->information_elements,
209 			       b->len_information_elements);
210 	}
211 
212 	return cmp_ies(WLAN_EID_SSID,
213 		       a->information_elements,
214 		       a->len_information_elements,
215 		       b->information_elements,
216 		       b->len_information_elements);
217 }
218 
219 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
220 				      struct ieee80211_channel *channel,
221 				      const u8 *bssid,
222 				      const u8 *ssid, size_t ssid_len,
223 				      u16 capa_mask, u16 capa_val)
224 {
225 	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
226 	struct cfg80211_internal_bss *bss, *res = NULL;
227 
228 	spin_lock_bh(&dev->bss_lock);
229 
230 	list_for_each_entry(bss, &dev->bss_list, list) {
231 		if ((bss->pub.capability & capa_mask) != capa_val)
232 			continue;
233 		if (channel && bss->pub.channel != channel)
234 			continue;
235 		if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
236 			res = bss;
237 			kref_get(&res->ref);
238 			break;
239 		}
240 	}
241 
242 	spin_unlock_bh(&dev->bss_lock);
243 	if (!res)
244 		return NULL;
245 	return &res->pub;
246 }
247 EXPORT_SYMBOL(cfg80211_get_bss);
248 
249 struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
250 				       struct ieee80211_channel *channel,
251 				       const u8 *meshid, size_t meshidlen,
252 				       const u8 *meshcfg)
253 {
254 	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
255 	struct cfg80211_internal_bss *bss, *res = NULL;
256 
257 	spin_lock_bh(&dev->bss_lock);
258 
259 	list_for_each_entry(bss, &dev->bss_list, list) {
260 		if (channel && bss->pub.channel != channel)
261 			continue;
262 		if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
263 			res = bss;
264 			kref_get(&res->ref);
265 			break;
266 		}
267 	}
268 
269 	spin_unlock_bh(&dev->bss_lock);
270 	if (!res)
271 		return NULL;
272 	return &res->pub;
273 }
274 EXPORT_SYMBOL(cfg80211_get_mesh);
275 
276 
277 static void rb_insert_bss(struct cfg80211_registered_device *dev,
278 			  struct cfg80211_internal_bss *bss)
279 {
280 	struct rb_node **p = &dev->bss_tree.rb_node;
281 	struct rb_node *parent = NULL;
282 	struct cfg80211_internal_bss *tbss;
283 	int cmp;
284 
285 	while (*p) {
286 		parent = *p;
287 		tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
288 
289 		cmp = cmp_bss(&bss->pub, &tbss->pub);
290 
291 		if (WARN_ON(!cmp)) {
292 			/* will sort of leak this BSS */
293 			return;
294 		}
295 
296 		if (cmp < 0)
297 			p = &(*p)->rb_left;
298 		else
299 			p = &(*p)->rb_right;
300 	}
301 
302 	rb_link_node(&bss->rbn, parent, p);
303 	rb_insert_color(&bss->rbn, &dev->bss_tree);
304 }
305 
306 static struct cfg80211_internal_bss *
307 rb_find_bss(struct cfg80211_registered_device *dev,
308 	    struct cfg80211_internal_bss *res)
309 {
310 	struct rb_node *n = dev->bss_tree.rb_node;
311 	struct cfg80211_internal_bss *bss;
312 	int r;
313 
314 	while (n) {
315 		bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
316 		r = cmp_bss(&res->pub, &bss->pub);
317 
318 		if (r == 0)
319 			return bss;
320 		else if (r < 0)
321 			n = n->rb_left;
322 		else
323 			n = n->rb_right;
324 	}
325 
326 	return NULL;
327 }
328 
329 static struct cfg80211_internal_bss *
330 cfg80211_bss_update(struct cfg80211_registered_device *dev,
331 		    struct cfg80211_internal_bss *res,
332 		    bool overwrite)
333 {
334 	struct cfg80211_internal_bss *found = NULL;
335 	const u8 *meshid, *meshcfg;
336 
337 	/*
338 	 * The reference to "res" is donated to this function.
339 	 */
340 
341 	if (WARN_ON(!res->pub.channel)) {
342 		kref_put(&res->ref, bss_release);
343 		return NULL;
344 	}
345 
346 	res->ts = jiffies;
347 
348 	if (is_zero_ether_addr(res->pub.bssid)) {
349 		/* must be mesh, verify */
350 		meshid = find_ie(WLAN_EID_MESH_ID, res->pub.information_elements,
351 				 res->pub.len_information_elements);
352 		meshcfg = find_ie(WLAN_EID_MESH_CONFIG,
353 				  res->pub.information_elements,
354 				  res->pub.len_information_elements);
355 		if (!meshid || !meshcfg ||
356 		    meshcfg[1] != IEEE80211_MESH_CONFIG_LEN) {
357 			/* bogus mesh */
358 			kref_put(&res->ref, bss_release);
359 			return NULL;
360 		}
361 	}
362 
363 	spin_lock_bh(&dev->bss_lock);
364 
365 	found = rb_find_bss(dev, res);
366 
367 	if (found) {
368 		kref_get(&found->ref);
369 		found->pub.beacon_interval = res->pub.beacon_interval;
370 		found->pub.tsf = res->pub.tsf;
371 		found->pub.signal = res->pub.signal;
372 		found->pub.capability = res->pub.capability;
373 		found->ts = res->ts;
374 
375 		/* overwrite IEs */
376 		if (overwrite) {
377 			size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
378 			size_t ielen = res->pub.len_information_elements;
379 
380 			if (ksize(found) >= used + ielen) {
381 				memcpy(found->pub.information_elements,
382 				       res->pub.information_elements, ielen);
383 				found->pub.len_information_elements = ielen;
384 			} else {
385 				u8 *ies = found->pub.information_elements;
386 
387 				if (found->ies_allocated) {
388 					if (ksize(ies) < ielen)
389 						ies = krealloc(ies, ielen,
390 							       GFP_ATOMIC);
391 				} else
392 					ies = kmalloc(ielen, GFP_ATOMIC);
393 
394 				if (ies) {
395 					memcpy(ies, res->pub.information_elements, ielen);
396 					found->ies_allocated = true;
397 					found->pub.information_elements = ies;
398 					found->pub.len_information_elements = ielen;
399 				}
400 			}
401 		}
402 
403 		kref_put(&res->ref, bss_release);
404 	} else {
405 		/* this "consumes" the reference */
406 		list_add_tail(&res->list, &dev->bss_list);
407 		rb_insert_bss(dev, res);
408 		found = res;
409 	}
410 
411 	dev->bss_generation++;
412 	spin_unlock_bh(&dev->bss_lock);
413 
414 	kref_get(&found->ref);
415 	return found;
416 }
417 
418 struct cfg80211_bss *
419 cfg80211_inform_bss_frame(struct wiphy *wiphy,
420 			  struct ieee80211_channel *channel,
421 			  struct ieee80211_mgmt *mgmt, size_t len,
422 			  s32 signal, gfp_t gfp)
423 {
424 	struct cfg80211_internal_bss *res;
425 	size_t ielen = len - offsetof(struct ieee80211_mgmt,
426 				      u.probe_resp.variable);
427 	bool overwrite;
428 	size_t privsz = wiphy->bss_priv_size;
429 
430 	if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
431 	            (signal < 0 || signal > 100)))
432 		return NULL;
433 
434 	if (WARN_ON(!mgmt || !wiphy ||
435 		    len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
436 		return NULL;
437 
438 	res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
439 	if (!res)
440 		return NULL;
441 
442 	memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
443 	res->pub.channel = channel;
444 	res->pub.signal = signal;
445 	res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
446 	res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
447 	res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
448 	/* point to after the private area */
449 	res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
450 	memcpy(res->pub.information_elements, mgmt->u.probe_resp.variable, ielen);
451 	res->pub.len_information_elements = ielen;
452 
453 	kref_init(&res->ref);
454 
455 	overwrite = ieee80211_is_probe_resp(mgmt->frame_control);
456 
457 	res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, overwrite);
458 	if (!res)
459 		return NULL;
460 
461 	if (res->pub.capability & WLAN_CAPABILITY_ESS)
462 		regulatory_hint_found_beacon(wiphy, channel, gfp);
463 
464 	/* cfg80211_bss_update gives us a referenced result */
465 	return &res->pub;
466 }
467 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
468 
469 void cfg80211_put_bss(struct cfg80211_bss *pub)
470 {
471 	struct cfg80211_internal_bss *bss;
472 
473 	if (!pub)
474 		return;
475 
476 	bss = container_of(pub, struct cfg80211_internal_bss, pub);
477 	kref_put(&bss->ref, bss_release);
478 }
479 EXPORT_SYMBOL(cfg80211_put_bss);
480 
481 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
482 {
483 	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
484 	struct cfg80211_internal_bss *bss;
485 
486 	if (WARN_ON(!pub))
487 		return;
488 
489 	bss = container_of(pub, struct cfg80211_internal_bss, pub);
490 
491 	spin_lock_bh(&dev->bss_lock);
492 
493 	list_del(&bss->list);
494 	rb_erase(&bss->rbn, &dev->bss_tree);
495 
496 	spin_unlock_bh(&dev->bss_lock);
497 
498 	kref_put(&bss->ref, bss_release);
499 }
500 EXPORT_SYMBOL(cfg80211_unlink_bss);
501 
502 void cfg80211_hold_bss(struct cfg80211_bss *pub)
503 {
504 	struct cfg80211_internal_bss *bss;
505 
506 	if (!pub)
507 		return;
508 
509 	bss = container_of(pub, struct cfg80211_internal_bss, pub);
510 	bss->hold = true;
511 }
512 EXPORT_SYMBOL(cfg80211_hold_bss);
513 
514 void cfg80211_unhold_bss(struct cfg80211_bss *pub)
515 {
516 	struct cfg80211_internal_bss *bss;
517 
518 	if (!pub)
519 		return;
520 
521 	bss = container_of(pub, struct cfg80211_internal_bss, pub);
522 	bss->hold = false;
523 }
524 EXPORT_SYMBOL(cfg80211_unhold_bss);
525 
526 #ifdef CONFIG_WIRELESS_EXT
527 int cfg80211_wext_siwscan(struct net_device *dev,
528 			  struct iw_request_info *info,
529 			  union iwreq_data *wrqu, char *extra)
530 {
531 	struct cfg80211_registered_device *rdev;
532 	struct wiphy *wiphy;
533 	struct iw_scan_req *wreq = NULL;
534 	struct cfg80211_scan_request *creq;
535 	int i, err, n_channels = 0;
536 	enum ieee80211_band band;
537 
538 	if (!netif_running(dev))
539 		return -ENETDOWN;
540 
541 	rdev = cfg80211_get_dev_from_ifindex(dev->ifindex);
542 
543 	if (IS_ERR(rdev))
544 		return PTR_ERR(rdev);
545 
546 	if (rdev->scan_req) {
547 		err = -EBUSY;
548 		goto out;
549 	}
550 
551 	wiphy = &rdev->wiphy;
552 
553 	for (band = 0; band < IEEE80211_NUM_BANDS; band++)
554 		if (wiphy->bands[band])
555 			n_channels += wiphy->bands[band]->n_channels;
556 
557 	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
558 		       n_channels * sizeof(void *),
559 		       GFP_ATOMIC);
560 	if (!creq) {
561 		err = -ENOMEM;
562 		goto out;
563 	}
564 
565 	creq->wiphy = wiphy;
566 	creq->ifidx = dev->ifindex;
567 	creq->ssids = (void *)(creq + 1);
568 	creq->channels = (void *)(creq->ssids + 1);
569 	creq->n_channels = n_channels;
570 	creq->n_ssids = 1;
571 
572 	/* all channels */
573 	i = 0;
574 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
575 		int j;
576 		if (!wiphy->bands[band])
577 			continue;
578 		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
579 			creq->channels[i] = &wiphy->bands[band]->channels[j];
580 			i++;
581 		}
582 	}
583 
584 	/* translate scan request */
585 	if (wrqu->data.length == sizeof(struct iw_scan_req)) {
586 		wreq = (struct iw_scan_req *)extra;
587 
588 		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
589 			if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
590 				return -EINVAL;
591 			memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
592 			creq->ssids[0].ssid_len = wreq->essid_len;
593 		}
594 		if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
595 			creq->n_ssids = 0;
596 	}
597 
598 	rdev->scan_req = creq;
599 	err = rdev->ops->scan(wiphy, dev, creq);
600 	if (err) {
601 		rdev->scan_req = NULL;
602 		kfree(creq);
603 	}
604  out:
605 	cfg80211_put_dev(rdev);
606 	return err;
607 }
608 EXPORT_SYMBOL(cfg80211_wext_siwscan);
609 
610 static void ieee80211_scan_add_ies(struct iw_request_info *info,
611 				   struct cfg80211_bss *bss,
612 				   char **current_ev, char *end_buf)
613 {
614 	u8 *pos, *end, *next;
615 	struct iw_event iwe;
616 
617 	if (!bss->information_elements ||
618 	    !bss->len_information_elements)
619 		return;
620 
621 	/*
622 	 * If needed, fragment the IEs buffer (at IE boundaries) into short
623 	 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
624 	 */
625 	pos = bss->information_elements;
626 	end = pos + bss->len_information_elements;
627 
628 	while (end - pos > IW_GENERIC_IE_MAX) {
629 		next = pos + 2 + pos[1];
630 		while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
631 			next = next + 2 + next[1];
632 
633 		memset(&iwe, 0, sizeof(iwe));
634 		iwe.cmd = IWEVGENIE;
635 		iwe.u.data.length = next - pos;
636 		*current_ev = iwe_stream_add_point(info, *current_ev,
637 						   end_buf, &iwe, pos);
638 
639 		pos = next;
640 	}
641 
642 	if (end > pos) {
643 		memset(&iwe, 0, sizeof(iwe));
644 		iwe.cmd = IWEVGENIE;
645 		iwe.u.data.length = end - pos;
646 		*current_ev = iwe_stream_add_point(info, *current_ev,
647 						   end_buf, &iwe, pos);
648 	}
649 }
650 
651 static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
652 {
653 	unsigned long end = jiffies;
654 
655 	if (end >= start)
656 		return jiffies_to_msecs(end - start);
657 
658 	return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
659 }
660 
661 static char *
662 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
663 	      struct cfg80211_internal_bss *bss, char *current_ev,
664 	      char *end_buf)
665 {
666 	struct iw_event iwe;
667 	u8 *buf, *cfg, *p;
668 	u8 *ie = bss->pub.information_elements;
669 	int rem = bss->pub.len_information_elements, i, sig;
670 	bool ismesh = false;
671 
672 	memset(&iwe, 0, sizeof(iwe));
673 	iwe.cmd = SIOCGIWAP;
674 	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
675 	memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
676 	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
677 					  IW_EV_ADDR_LEN);
678 
679 	memset(&iwe, 0, sizeof(iwe));
680 	iwe.cmd = SIOCGIWFREQ;
681 	iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
682 	iwe.u.freq.e = 0;
683 	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
684 					  IW_EV_FREQ_LEN);
685 
686 	memset(&iwe, 0, sizeof(iwe));
687 	iwe.cmd = SIOCGIWFREQ;
688 	iwe.u.freq.m = bss->pub.channel->center_freq;
689 	iwe.u.freq.e = 6;
690 	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
691 					  IW_EV_FREQ_LEN);
692 
693 	if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
694 		memset(&iwe, 0, sizeof(iwe));
695 		iwe.cmd = IWEVQUAL;
696 		iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
697 				     IW_QUAL_NOISE_INVALID |
698 				     IW_QUAL_QUAL_UPDATED;
699 		switch (wiphy->signal_type) {
700 		case CFG80211_SIGNAL_TYPE_MBM:
701 			sig = bss->pub.signal / 100;
702 			iwe.u.qual.level = sig;
703 			iwe.u.qual.updated |= IW_QUAL_DBM;
704 			if (sig < -110)		/* rather bad */
705 				sig = -110;
706 			else if (sig > -40)	/* perfect */
707 				sig = -40;
708 			/* will give a range of 0 .. 70 */
709 			iwe.u.qual.qual = sig + 110;
710 			break;
711 		case CFG80211_SIGNAL_TYPE_UNSPEC:
712 			iwe.u.qual.level = bss->pub.signal;
713 			/* will give range 0 .. 100 */
714 			iwe.u.qual.qual = bss->pub.signal;
715 			break;
716 		default:
717 			/* not reached */
718 			break;
719 		}
720 		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
721 						  &iwe, IW_EV_QUAL_LEN);
722 	}
723 
724 	memset(&iwe, 0, sizeof(iwe));
725 	iwe.cmd = SIOCGIWENCODE;
726 	if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
727 		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
728 	else
729 		iwe.u.data.flags = IW_ENCODE_DISABLED;
730 	iwe.u.data.length = 0;
731 	current_ev = iwe_stream_add_point(info, current_ev, end_buf,
732 					  &iwe, "");
733 
734 	while (rem >= 2) {
735 		/* invalid data */
736 		if (ie[1] > rem - 2)
737 			break;
738 
739 		switch (ie[0]) {
740 		case WLAN_EID_SSID:
741 			memset(&iwe, 0, sizeof(iwe));
742 			iwe.cmd = SIOCGIWESSID;
743 			iwe.u.data.length = ie[1];
744 			iwe.u.data.flags = 1;
745 			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
746 							  &iwe, ie + 2);
747 			break;
748 		case WLAN_EID_MESH_ID:
749 			memset(&iwe, 0, sizeof(iwe));
750 			iwe.cmd = SIOCGIWESSID;
751 			iwe.u.data.length = ie[1];
752 			iwe.u.data.flags = 1;
753 			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
754 							  &iwe, ie + 2);
755 			break;
756 		case WLAN_EID_MESH_CONFIG:
757 			ismesh = true;
758 			if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
759 				break;
760 			buf = kmalloc(50, GFP_ATOMIC);
761 			if (!buf)
762 				break;
763 			cfg = ie + 2;
764 			memset(&iwe, 0, sizeof(iwe));
765 			iwe.cmd = IWEVCUSTOM;
766 			sprintf(buf, "Mesh network (version %d)", cfg[0]);
767 			iwe.u.data.length = strlen(buf);
768 			current_ev = iwe_stream_add_point(info, current_ev,
769 							  end_buf,
770 							  &iwe, buf);
771 			sprintf(buf, "Path Selection Protocol ID: "
772 				"0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
773 							cfg[4]);
774 			iwe.u.data.length = strlen(buf);
775 			current_ev = iwe_stream_add_point(info, current_ev,
776 							  end_buf,
777 							  &iwe, buf);
778 			sprintf(buf, "Path Selection Metric ID: "
779 				"0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
780 							cfg[8]);
781 			iwe.u.data.length = strlen(buf);
782 			current_ev = iwe_stream_add_point(info, current_ev,
783 							  end_buf,
784 							  &iwe, buf);
785 			sprintf(buf, "Congestion Control Mode ID: "
786 				"0x%02X%02X%02X%02X", cfg[9], cfg[10],
787 							cfg[11], cfg[12]);
788 			iwe.u.data.length = strlen(buf);
789 			current_ev = iwe_stream_add_point(info, current_ev,
790 							  end_buf,
791 							  &iwe, buf);
792 			sprintf(buf, "Channel Precedence: "
793 				"0x%02X%02X%02X%02X", cfg[13], cfg[14],
794 							cfg[15], cfg[16]);
795 			iwe.u.data.length = strlen(buf);
796 			current_ev = iwe_stream_add_point(info, current_ev,
797 							  end_buf,
798 							  &iwe, buf);
799 			kfree(buf);
800 			break;
801 		case WLAN_EID_SUPP_RATES:
802 		case WLAN_EID_EXT_SUPP_RATES:
803 			/* display all supported rates in readable format */
804 			p = current_ev + iwe_stream_lcp_len(info);
805 
806 			memset(&iwe, 0, sizeof(iwe));
807 			iwe.cmd = SIOCGIWRATE;
808 			/* Those two flags are ignored... */
809 			iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
810 
811 			for (i = 0; i < ie[1]; i++) {
812 				iwe.u.bitrate.value =
813 					((ie[i + 2] & 0x7f) * 500000);
814 				p = iwe_stream_add_value(info, current_ev, p,
815 						end_buf, &iwe, IW_EV_PARAM_LEN);
816 			}
817 			current_ev = p;
818 			break;
819 		}
820 		rem -= ie[1] + 2;
821 		ie += ie[1] + 2;
822 	}
823 
824 	if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
825 	    || ismesh) {
826 		memset(&iwe, 0, sizeof(iwe));
827 		iwe.cmd = SIOCGIWMODE;
828 		if (ismesh)
829 			iwe.u.mode = IW_MODE_MESH;
830 		else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
831 			iwe.u.mode = IW_MODE_MASTER;
832 		else
833 			iwe.u.mode = IW_MODE_ADHOC;
834 		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
835 						  &iwe, IW_EV_UINT_LEN);
836 	}
837 
838 	buf = kmalloc(30, GFP_ATOMIC);
839 	if (buf) {
840 		memset(&iwe, 0, sizeof(iwe));
841 		iwe.cmd = IWEVCUSTOM;
842 		sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
843 		iwe.u.data.length = strlen(buf);
844 		current_ev = iwe_stream_add_point(info, current_ev, end_buf,
845 						  &iwe, buf);
846 		memset(&iwe, 0, sizeof(iwe));
847 		iwe.cmd = IWEVCUSTOM;
848 		sprintf(buf, " Last beacon: %ums ago",
849 			elapsed_jiffies_msecs(bss->ts));
850 		iwe.u.data.length = strlen(buf);
851 		current_ev = iwe_stream_add_point(info, current_ev,
852 						  end_buf, &iwe, buf);
853 		kfree(buf);
854 	}
855 
856 	ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
857 
858 	return current_ev;
859 }
860 
861 
862 static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
863 				  struct iw_request_info *info,
864 				  char *buf, size_t len)
865 {
866 	char *current_ev = buf;
867 	char *end_buf = buf + len;
868 	struct cfg80211_internal_bss *bss;
869 
870 	spin_lock_bh(&dev->bss_lock);
871 	cfg80211_bss_expire(dev);
872 
873 	list_for_each_entry(bss, &dev->bss_list, list) {
874 		if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
875 			spin_unlock_bh(&dev->bss_lock);
876 			return -E2BIG;
877 		}
878 		current_ev = ieee80211_bss(&dev->wiphy, info, bss,
879 					   current_ev, end_buf);
880 	}
881 	spin_unlock_bh(&dev->bss_lock);
882 	return current_ev - buf;
883 }
884 
885 
886 int cfg80211_wext_giwscan(struct net_device *dev,
887 			  struct iw_request_info *info,
888 			  struct iw_point *data, char *extra)
889 {
890 	struct cfg80211_registered_device *rdev;
891 	int res;
892 
893 	if (!netif_running(dev))
894 		return -ENETDOWN;
895 
896 	rdev = cfg80211_get_dev_from_ifindex(dev->ifindex);
897 
898 	if (IS_ERR(rdev))
899 		return PTR_ERR(rdev);
900 
901 	if (rdev->scan_req) {
902 		res = -EAGAIN;
903 		goto out;
904 	}
905 
906 	res = ieee80211_scan_results(rdev, info, extra, data->length);
907 	data->length = 0;
908 	if (res >= 0) {
909 		data->length = res;
910 		res = 0;
911 	}
912 
913  out:
914 	cfg80211_put_dev(rdev);
915 	return res;
916 }
917 EXPORT_SYMBOL(cfg80211_wext_giwscan);
918 #endif
919