scan.c revision c10841ca722a0bc960dc541c51582773f9a24f98 
1/*
2 * cfg80211 scan result handling
3 *
4 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
5 */
6#include <linux/kernel.h>
7#include <linux/slab.h>
8#include <linux/module.h>
9#include <linux/netdevice.h>
10#include <linux/wireless.h>
11#include <linux/nl80211.h>
12#include <linux/etherdevice.h>
13#include <net/arp.h>
14#include <net/cfg80211.h>
15#include <net/iw_handler.h>
16#include "core.h"
17#include "nl80211.h"
18#include "wext-compat.h"
19
20#define IEEE80211_SCAN_RESULT_EXPIRE	(15 * HZ)
21
22void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
23{
24	struct cfg80211_scan_request *request;
25	struct net_device *dev;
26#ifdef CONFIG_CFG80211_WEXT
27	union iwreq_data wrqu;
28#endif
29
30	ASSERT_RDEV_LOCK(rdev);
31
32	request = rdev->scan_req;
33
34	if (!request)
35		return;
36
37	dev = request->dev;
38
39	/*
40	 * This must be before sending the other events!
41	 * Otherwise, wpa_supplicant gets completely confused with
42	 * wext events.
43	 */
44	cfg80211_sme_scan_done(dev);
45
46	if (request->aborted)
47		nl80211_send_scan_aborted(rdev, dev);
48	else
49		nl80211_send_scan_done(rdev, dev);
50
51#ifdef CONFIG_CFG80211_WEXT
52	if (!request->aborted) {
53		memset(&wrqu, 0, sizeof(wrqu));
54
55		wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
56	}
57#endif
58
59	dev_put(dev);
60
61	rdev->scan_req = NULL;
62
63	/*
64	 * OK. If this is invoked with "leak" then we can't
65	 * free this ... but we've cleaned it up anyway. The
66	 * driver failed to call the scan_done callback, so
67	 * all bets are off, it might still be trying to use
68	 * the scan request or not ... if it accesses the dev
69	 * in there (it shouldn't anyway) then it may crash.
70	 */
71	if (!leak)
72		kfree(request);
73}
74
75void __cfg80211_scan_done(struct work_struct *wk)
76{
77	struct cfg80211_registered_device *rdev;
78
79	rdev = container_of(wk, struct cfg80211_registered_device,
80			    scan_done_wk);
81
82	cfg80211_lock_rdev(rdev);
83	___cfg80211_scan_done(rdev, false);
84	cfg80211_unlock_rdev(rdev);
85}
86
87void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
88{
89	WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
90
91	request->aborted = aborted;
92	queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
93}
94EXPORT_SYMBOL(cfg80211_scan_done);
95
96void __cfg80211_sched_scan_results(struct work_struct *wk)
97{
98	struct cfg80211_registered_device *rdev;
99
100	rdev = container_of(wk, struct cfg80211_registered_device,
101			    sched_scan_results_wk);
102
103	mutex_lock(&rdev->sched_scan_mtx);
104
105	/* we don't have sched_scan_req anymore if the scan is stopping */
106	if (rdev->sched_scan_req)
107		nl80211_send_sched_scan_results(rdev,
108						rdev->sched_scan_req->dev);
109
110	mutex_unlock(&rdev->sched_scan_mtx);
111}
112
113void cfg80211_sched_scan_results(struct wiphy *wiphy)
114{
115	/* ignore if we're not scanning */
116	if (wiphy_to_dev(wiphy)->sched_scan_req)
117		queue_work(cfg80211_wq,
118			   &wiphy_to_dev(wiphy)->sched_scan_results_wk);
119}
120EXPORT_SYMBOL(cfg80211_sched_scan_results);
121
122void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
123{
124	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
125
126	mutex_lock(&rdev->sched_scan_mtx);
127	__cfg80211_stop_sched_scan(rdev, true);
128	mutex_unlock(&rdev->sched_scan_mtx);
129}
130EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
131
132int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
133			       bool driver_initiated)
134{
135	int err;
136	struct net_device *dev;
137
138	lockdep_assert_held(&rdev->sched_scan_mtx);
139
140	if (!rdev->sched_scan_req)
141		return 0;
142
143	dev = rdev->sched_scan_req->dev;
144
145	if (!driver_initiated) {
146		err = rdev->ops->sched_scan_stop(&rdev->wiphy, dev);
147		if (err)
148			return err;
149	}
150
151	nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);
152
153	kfree(rdev->sched_scan_req);
154	rdev->sched_scan_req = NULL;
155
156	return err;
157}
158
159static void bss_release(struct kref *ref)
160{
161	struct cfg80211_internal_bss *bss;
162
163	bss = container_of(ref, struct cfg80211_internal_bss, ref);
164	if (bss->pub.free_priv)
165		bss->pub.free_priv(&bss->pub);
166
167	if (bss->beacon_ies_allocated)
168		kfree(bss->pub.beacon_ies);
169	if (bss->proberesp_ies_allocated)
170		kfree(bss->pub.proberesp_ies);
171
172	BUG_ON(atomic_read(&bss->hold));
173
174	kfree(bss);
175}
176
177/* must hold dev->bss_lock! */
178void cfg80211_bss_age(struct cfg80211_registered_device *dev,
179                      unsigned long age_secs)
180{
181	struct cfg80211_internal_bss *bss;
182	unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
183
184	list_for_each_entry(bss, &dev->bss_list, list) {
185		bss->ts -= age_jiffies;
186	}
187}
188
189/* must hold dev->bss_lock! */
190static void __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
191				  struct cfg80211_internal_bss *bss)
192{
193	list_del_init(&bss->list);
194	rb_erase(&bss->rbn, &dev->bss_tree);
195	kref_put(&bss->ref, bss_release);
196}
197
198/* must hold dev->bss_lock! */
199void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
200{
201	struct cfg80211_internal_bss *bss, *tmp;
202	bool expired = false;
203
204	list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
205		if (atomic_read(&bss->hold))
206			continue;
207		if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
208			continue;
209		__cfg80211_unlink_bss(dev, bss);
210		expired = true;
211	}
212
213	if (expired)
214		dev->bss_generation++;
215}
216
217const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
218{
219	while (len > 2 && ies[0] != eid) {
220		len -= ies[1] + 2;
221		ies += ies[1] + 2;
222	}
223	if (len < 2)
224		return NULL;
225	if (len < 2 + ies[1])
226		return NULL;
227	return ies;
228}
229EXPORT_SYMBOL(cfg80211_find_ie);
230
231static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
232{
233	const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
234	const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
235	int r;
236
237	if (!ie1 && !ie2)
238		return 0;
239	if (!ie1 || !ie2)
240		return -1;
241
242	r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
243	if (r == 0 && ie1[1] != ie2[1])
244		return ie2[1] - ie1[1];
245	return r;
246}
247
248static bool is_bss(struct cfg80211_bss *a,
249		   const u8 *bssid,
250		   const u8 *ssid, size_t ssid_len)
251{
252	const u8 *ssidie;
253
254	if (bssid && compare_ether_addr(a->bssid, bssid))
255		return false;
256
257	if (!ssid)
258		return true;
259
260	ssidie = cfg80211_find_ie(WLAN_EID_SSID,
261				  a->information_elements,
262				  a->len_information_elements);
263	if (!ssidie)
264		return false;
265	if (ssidie[1] != ssid_len)
266		return false;
267	return memcmp(ssidie + 2, ssid, ssid_len) == 0;
268}
269
270static bool is_mesh_bss(struct cfg80211_bss *a)
271{
272	const u8 *ie;
273
274	if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
275		return false;
276
277	ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
278			      a->information_elements,
279			      a->len_information_elements);
280	if (!ie)
281		return false;
282
283	ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
284			      a->information_elements,
285			      a->len_information_elements);
286	if (!ie)
287		return false;
288
289	return true;
290}
291
292static bool is_mesh(struct cfg80211_bss *a,
293		    const u8 *meshid, size_t meshidlen,
294		    const u8 *meshcfg)
295{
296	const u8 *ie;
297
298	if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
299		return false;
300
301	ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
302			      a->information_elements,
303			      a->len_information_elements);
304	if (!ie)
305		return false;
306	if (ie[1] != meshidlen)
307		return false;
308	if (memcmp(ie + 2, meshid, meshidlen))
309		return false;
310
311	ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
312			      a->information_elements,
313			      a->len_information_elements);
314	if (!ie)
315		return false;
316	if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
317		return false;
318
319	/*
320	 * Ignore mesh capability (last two bytes of the IE) when
321	 * comparing since that may differ between stations taking
322	 * part in the same mesh.
323	 */
324	return memcmp(ie + 2, meshcfg,
325	    sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
326}
327
328static int cmp_bss(struct cfg80211_bss *a,
329		   struct cfg80211_bss *b)
330{
331	int r;
332
333	if (a->channel != b->channel)
334		return b->channel->center_freq - a->channel->center_freq;
335
336	if (is_mesh_bss(a) && is_mesh_bss(b)) {
337		r = cmp_ies(WLAN_EID_MESH_ID,
338			    a->information_elements,
339			    a->len_information_elements,
340			    b->information_elements,
341			    b->len_information_elements);
342		if (r)
343			return r;
344		return cmp_ies(WLAN_EID_MESH_CONFIG,
345			       a->information_elements,
346			       a->len_information_elements,
347			       b->information_elements,
348			       b->len_information_elements);
349	}
350
351	r = memcmp(a->bssid, b->bssid, ETH_ALEN);
352	if (r)
353		return r;
354
355	return cmp_ies(WLAN_EID_SSID,
356		       a->information_elements,
357		       a->len_information_elements,
358		       b->information_elements,
359		       b->len_information_elements);
360}
361
362struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
363				      struct ieee80211_channel *channel,
364				      const u8 *bssid,
365				      const u8 *ssid, size_t ssid_len,
366				      u16 capa_mask, u16 capa_val)
367{
368	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
369	struct cfg80211_internal_bss *bss, *res = NULL;
370	unsigned long now = jiffies;
371
372	spin_lock_bh(&dev->bss_lock);
373
374	list_for_each_entry(bss, &dev->bss_list, list) {
375		if ((bss->pub.capability & capa_mask) != capa_val)
376			continue;
377		if (channel && bss->pub.channel != channel)
378			continue;
379		/* Don't get expired BSS structs */
380		if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
381		    !atomic_read(&bss->hold))
382			continue;
383		if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
384			res = bss;
385			kref_get(&res->ref);
386			break;
387		}
388	}
389
390	spin_unlock_bh(&dev->bss_lock);
391	if (!res)
392		return NULL;
393	return &res->pub;
394}
395EXPORT_SYMBOL(cfg80211_get_bss);
396
397struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
398				       struct ieee80211_channel *channel,
399				       const u8 *meshid, size_t meshidlen,
400				       const u8 *meshcfg)
401{
402	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
403	struct cfg80211_internal_bss *bss, *res = NULL;
404
405	spin_lock_bh(&dev->bss_lock);
406
407	list_for_each_entry(bss, &dev->bss_list, list) {
408		if (channel && bss->pub.channel != channel)
409			continue;
410		if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
411			res = bss;
412			kref_get(&res->ref);
413			break;
414		}
415	}
416
417	spin_unlock_bh(&dev->bss_lock);
418	if (!res)
419		return NULL;
420	return &res->pub;
421}
422EXPORT_SYMBOL(cfg80211_get_mesh);
423
424
425static void rb_insert_bss(struct cfg80211_registered_device *dev,
426			  struct cfg80211_internal_bss *bss)
427{
428	struct rb_node **p = &dev->bss_tree.rb_node;
429	struct rb_node *parent = NULL;
430	struct cfg80211_internal_bss *tbss;
431	int cmp;
432
433	while (*p) {
434		parent = *p;
435		tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
436
437		cmp = cmp_bss(&bss->pub, &tbss->pub);
438
439		if (WARN_ON(!cmp)) {
440			/* will sort of leak this BSS */
441			return;
442		}
443
444		if (cmp < 0)
445			p = &(*p)->rb_left;
446		else
447			p = &(*p)->rb_right;
448	}
449
450	rb_link_node(&bss->rbn, parent, p);
451	rb_insert_color(&bss->rbn, &dev->bss_tree);
452}
453
454static struct cfg80211_internal_bss *
455rb_find_bss(struct cfg80211_registered_device *dev,
456	    struct cfg80211_internal_bss *res)
457{
458	struct rb_node *n = dev->bss_tree.rb_node;
459	struct cfg80211_internal_bss *bss;
460	int r;
461
462	while (n) {
463		bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
464		r = cmp_bss(&res->pub, &bss->pub);
465
466		if (r == 0)
467			return bss;
468		else if (r < 0)
469			n = n->rb_left;
470		else
471			n = n->rb_right;
472	}
473
474	return NULL;
475}
476
477static struct cfg80211_internal_bss *
478cfg80211_bss_update(struct cfg80211_registered_device *dev,
479		    struct cfg80211_internal_bss *res)
480{
481	struct cfg80211_internal_bss *found = NULL;
482
483	/*
484	 * The reference to "res" is donated to this function.
485	 */
486
487	if (WARN_ON(!res->pub.channel)) {
488		kref_put(&res->ref, bss_release);
489		return NULL;
490	}
491
492	res->ts = jiffies;
493
494	spin_lock_bh(&dev->bss_lock);
495
496	found = rb_find_bss(dev, res);
497
498	if (found) {
499		found->pub.beacon_interval = res->pub.beacon_interval;
500		found->pub.tsf = res->pub.tsf;
501		found->pub.signal = res->pub.signal;
502		found->pub.capability = res->pub.capability;
503		found->ts = res->ts;
504
505		/* Update IEs */
506		if (res->pub.proberesp_ies) {
507			size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
508			size_t ielen = res->pub.len_proberesp_ies;
509
510			if (found->pub.proberesp_ies &&
511			    !found->proberesp_ies_allocated &&
512			    ksize(found) >= used + ielen) {
513				memcpy(found->pub.proberesp_ies,
514				       res->pub.proberesp_ies, ielen);
515				found->pub.len_proberesp_ies = ielen;
516			} else {
517				u8 *ies = found->pub.proberesp_ies;
518
519				if (found->proberesp_ies_allocated)
520					ies = krealloc(ies, ielen, GFP_ATOMIC);
521				else
522					ies = kmalloc(ielen, GFP_ATOMIC);
523
524				if (ies) {
525					memcpy(ies, res->pub.proberesp_ies,
526					       ielen);
527					found->proberesp_ies_allocated = true;
528					found->pub.proberesp_ies = ies;
529					found->pub.len_proberesp_ies = ielen;
530				}
531			}
532
533			/* Override possible earlier Beacon frame IEs */
534			found->pub.information_elements =
535				found->pub.proberesp_ies;
536			found->pub.len_information_elements =
537				found->pub.len_proberesp_ies;
538		}
539		if (res->pub.beacon_ies) {
540			size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
541			size_t ielen = res->pub.len_beacon_ies;
542			bool information_elements_is_beacon_ies =
543				(found->pub.information_elements ==
544				 found->pub.beacon_ies);
545
546			if (found->pub.beacon_ies &&
547			    !found->beacon_ies_allocated &&
548			    ksize(found) >= used + ielen) {
549				memcpy(found->pub.beacon_ies,
550				       res->pub.beacon_ies, ielen);
551				found->pub.len_beacon_ies = ielen;
552			} else {
553				u8 *ies = found->pub.beacon_ies;
554
555				if (found->beacon_ies_allocated)
556					ies = krealloc(ies, ielen, GFP_ATOMIC);
557				else
558					ies = kmalloc(ielen, GFP_ATOMIC);
559
560				if (ies) {
561					memcpy(ies, res->pub.beacon_ies,
562					       ielen);
563					found->beacon_ies_allocated = true;
564					found->pub.beacon_ies = ies;
565					found->pub.len_beacon_ies = ielen;
566				}
567			}
568
569			/* Override IEs if they were from a beacon before */
570			if (information_elements_is_beacon_ies) {
571				found->pub.information_elements =
572					found->pub.beacon_ies;
573				found->pub.len_information_elements =
574					found->pub.len_beacon_ies;
575			}
576		}
577
578		kref_put(&res->ref, bss_release);
579	} else {
580		/* this "consumes" the reference */
581		list_add_tail(&res->list, &dev->bss_list);
582		rb_insert_bss(dev, res);
583		found = res;
584	}
585
586	dev->bss_generation++;
587	spin_unlock_bh(&dev->bss_lock);
588
589	kref_get(&found->ref);
590	return found;
591}
592
593struct cfg80211_bss*
594cfg80211_inform_bss(struct wiphy *wiphy,
595		    struct ieee80211_channel *channel,
596		    const u8 *bssid,
597		    u64 timestamp, u16 capability, u16 beacon_interval,
598		    const u8 *ie, size_t ielen,
599		    s32 signal, gfp_t gfp)
600{
601	struct cfg80211_internal_bss *res;
602	size_t privsz;
603
604	if (WARN_ON(!wiphy))
605		return NULL;
606
607	privsz = wiphy->bss_priv_size;
608
609	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
610			(signal < 0 || signal > 100)))
611		return NULL;
612
613	res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
614	if (!res)
615		return NULL;
616
617	memcpy(res->pub.bssid, bssid, ETH_ALEN);
618	res->pub.channel = channel;
619	res->pub.signal = signal;
620	res->pub.tsf = timestamp;
621	res->pub.beacon_interval = beacon_interval;
622	res->pub.capability = capability;
623	/*
624	 * Since we do not know here whether the IEs are from a Beacon or Probe
625	 * Response frame, we need to pick one of the options and only use it
626	 * with the driver that does not provide the full Beacon/Probe Response
627	 * frame. Use Beacon frame pointer to avoid indicating that this should
628	 * override the information_elements pointer should we have received an
629	 * earlier indication of Probe Response data.
630	 *
631	 * The initial buffer for the IEs is allocated with the BSS entry and
632	 * is located after the private area.
633	 */
634	res->pub.beacon_ies = (u8 *)res + sizeof(*res) + privsz;
635	memcpy(res->pub.beacon_ies, ie, ielen);
636	res->pub.len_beacon_ies = ielen;
637	res->pub.information_elements = res->pub.beacon_ies;
638	res->pub.len_information_elements = res->pub.len_beacon_ies;
639
640	kref_init(&res->ref);
641
642	res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
643	if (!res)
644		return NULL;
645
646	if (res->pub.capability & WLAN_CAPABILITY_ESS)
647		regulatory_hint_found_beacon(wiphy, channel, gfp);
648
649	/* cfg80211_bss_update gives us a referenced result */
650	return &res->pub;
651}
652EXPORT_SYMBOL(cfg80211_inform_bss);
653
654struct cfg80211_bss *
655cfg80211_inform_bss_frame(struct wiphy *wiphy,
656			  struct ieee80211_channel *channel,
657			  struct ieee80211_mgmt *mgmt, size_t len,
658			  s32 signal, gfp_t gfp)
659{
660	struct cfg80211_internal_bss *res;
661	size_t ielen = len - offsetof(struct ieee80211_mgmt,
662				      u.probe_resp.variable);
663	size_t privsz;
664
665	if (WARN_ON(!mgmt))
666		return NULL;
667
668	if (WARN_ON(!wiphy))
669		return NULL;
670
671	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
672	            (signal < 0 || signal > 100)))
673		return NULL;
674
675	if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
676		return NULL;
677
678	privsz = wiphy->bss_priv_size;
679
680	res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
681	if (!res)
682		return NULL;
683
684	memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
685	res->pub.channel = channel;
686	res->pub.signal = signal;
687	res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
688	res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
689	res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
690	/*
691	 * The initial buffer for the IEs is allocated with the BSS entry and
692	 * is located after the private area.
693	 */
694	if (ieee80211_is_probe_resp(mgmt->frame_control)) {
695		res->pub.proberesp_ies = (u8 *) res + sizeof(*res) + privsz;
696		memcpy(res->pub.proberesp_ies, mgmt->u.probe_resp.variable,
697		       ielen);
698		res->pub.len_proberesp_ies = ielen;
699		res->pub.information_elements = res->pub.proberesp_ies;
700		res->pub.len_information_elements = res->pub.len_proberesp_ies;
701	} else {
702		res->pub.beacon_ies = (u8 *) res + sizeof(*res) + privsz;
703		memcpy(res->pub.beacon_ies, mgmt->u.beacon.variable, ielen);
704		res->pub.len_beacon_ies = ielen;
705		res->pub.information_elements = res->pub.beacon_ies;
706		res->pub.len_information_elements = res->pub.len_beacon_ies;
707	}
708
709	kref_init(&res->ref);
710
711	res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
712	if (!res)
713		return NULL;
714
715	if (res->pub.capability & WLAN_CAPABILITY_ESS)
716		regulatory_hint_found_beacon(wiphy, channel, gfp);
717
718	/* cfg80211_bss_update gives us a referenced result */
719	return &res->pub;
720}
721EXPORT_SYMBOL(cfg80211_inform_bss_frame);
722
723void cfg80211_put_bss(struct cfg80211_bss *pub)
724{
725	struct cfg80211_internal_bss *bss;
726
727	if (!pub)
728		return;
729
730	bss = container_of(pub, struct cfg80211_internal_bss, pub);
731	kref_put(&bss->ref, bss_release);
732}
733EXPORT_SYMBOL(cfg80211_put_bss);
734
735void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
736{
737	struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
738	struct cfg80211_internal_bss *bss;
739
740	if (WARN_ON(!pub))
741		return;
742
743	bss = container_of(pub, struct cfg80211_internal_bss, pub);
744
745	spin_lock_bh(&dev->bss_lock);
746	if (!list_empty(&bss->list)) {
747		__cfg80211_unlink_bss(dev, bss);
748		dev->bss_generation++;
749	}
750	spin_unlock_bh(&dev->bss_lock);
751}
752EXPORT_SYMBOL(cfg80211_unlink_bss);
753
754#ifdef CONFIG_CFG80211_WEXT
755int cfg80211_wext_siwscan(struct net_device *dev,
756			  struct iw_request_info *info,
757			  union iwreq_data *wrqu, char *extra)
758{
759	struct cfg80211_registered_device *rdev;
760	struct wiphy *wiphy;
761	struct iw_scan_req *wreq = NULL;
762	struct cfg80211_scan_request *creq = NULL;
763	int i, err, n_channels = 0;
764	enum ieee80211_band band;
765
766	if (!netif_running(dev))
767		return -ENETDOWN;
768
769	if (wrqu->data.length == sizeof(struct iw_scan_req))
770		wreq = (struct iw_scan_req *)extra;
771
772	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
773
774	if (IS_ERR(rdev))
775		return PTR_ERR(rdev);
776
777	if (rdev->scan_req) {
778		err = -EBUSY;
779		goto out;
780	}
781
782	wiphy = &rdev->wiphy;
783
784	/* Determine number of channels, needed to allocate creq */
785	if (wreq && wreq->num_channels)
786		n_channels = wreq->num_channels;
787	else {
788		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
789			if (wiphy->bands[band])
790				n_channels += wiphy->bands[band]->n_channels;
791	}
792
793	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
794		       n_channels * sizeof(void *),
795		       GFP_ATOMIC);
796	if (!creq) {
797		err = -ENOMEM;
798		goto out;
799	}
800
801	creq->wiphy = wiphy;
802	creq->dev = dev;
803	/* SSIDs come after channels */
804	creq->ssids = (void *)&creq->channels[n_channels];
805	creq->n_channels = n_channels;
806	creq->n_ssids = 1;
807
808	/* translate "Scan on frequencies" request */
809	i = 0;
810	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
811		int j;
812
813		if (!wiphy->bands[band])
814			continue;
815
816		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
817			/* ignore disabled channels */
818			if (wiphy->bands[band]->channels[j].flags &
819						IEEE80211_CHAN_DISABLED)
820				continue;
821
822			/* If we have a wireless request structure and the
823			 * wireless request specifies frequencies, then search
824			 * for the matching hardware channel.
825			 */
826			if (wreq && wreq->num_channels) {
827				int k;
828				int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
829				for (k = 0; k < wreq->num_channels; k++) {
830					int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
831					if (wext_freq == wiphy_freq)
832						goto wext_freq_found;
833				}
834				goto wext_freq_not_found;
835			}
836
837		wext_freq_found:
838			creq->channels[i] = &wiphy->bands[band]->channels[j];
839			i++;
840		wext_freq_not_found: ;
841		}
842	}
843	/* No channels found? */
844	if (!i) {
845		err = -EINVAL;
846		goto out;
847	}
848
849	/* Set real number of channels specified in creq->channels[] */
850	creq->n_channels = i;
851
852	/* translate "Scan for SSID" request */
853	if (wreq) {
854		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
855			if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
856				err = -EINVAL;
857				goto out;
858			}
859			memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
860			creq->ssids[0].ssid_len = wreq->essid_len;
861		}
862		if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
863			creq->n_ssids = 0;
864	}
865
866	rdev->scan_req = creq;
867	err = rdev->ops->scan(wiphy, dev, creq);
868	if (err) {
869		rdev->scan_req = NULL;
870		/* creq will be freed below */
871	} else {
872		nl80211_send_scan_start(rdev, dev);
873		/* creq now owned by driver */
874		creq = NULL;
875		dev_hold(dev);
876	}
877 out:
878	kfree(creq);
879	cfg80211_unlock_rdev(rdev);
880	return err;
881}
882EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
883
884static void ieee80211_scan_add_ies(struct iw_request_info *info,
885				   struct cfg80211_bss *bss,
886				   char **current_ev, char *end_buf)
887{
888	u8 *pos, *end, *next;
889	struct iw_event iwe;
890
891	if (!bss->information_elements ||
892	    !bss->len_information_elements)
893		return;
894
895	/*
896	 * If needed, fragment the IEs buffer (at IE boundaries) into short
897	 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
898	 */
899	pos = bss->information_elements;
900	end = pos + bss->len_information_elements;
901
902	while (end - pos > IW_GENERIC_IE_MAX) {
903		next = pos + 2 + pos[1];
904		while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
905			next = next + 2 + next[1];
906
907		memset(&iwe, 0, sizeof(iwe));
908		iwe.cmd = IWEVGENIE;
909		iwe.u.data.length = next - pos;
910		*current_ev = iwe_stream_add_point(info, *current_ev,
911						   end_buf, &iwe, pos);
912
913		pos = next;
914	}
915
916	if (end > pos) {
917		memset(&iwe, 0, sizeof(iwe));
918		iwe.cmd = IWEVGENIE;
919		iwe.u.data.length = end - pos;
920		*current_ev = iwe_stream_add_point(info, *current_ev,
921						   end_buf, &iwe, pos);
922	}
923}
924
925static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
926{
927	unsigned long end = jiffies;
928
929	if (end >= start)
930		return jiffies_to_msecs(end - start);
931
932	return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
933}
934
935static char *
936ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
937	      struct cfg80211_internal_bss *bss, char *current_ev,
938	      char *end_buf)
939{
940	struct iw_event iwe;
941	u8 *buf, *cfg, *p;
942	u8 *ie = bss->pub.information_elements;
943	int rem = bss->pub.len_information_elements, i, sig;
944	bool ismesh = false;
945
946	memset(&iwe, 0, sizeof(iwe));
947	iwe.cmd = SIOCGIWAP;
948	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
949	memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
950	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
951					  IW_EV_ADDR_LEN);
952
953	memset(&iwe, 0, sizeof(iwe));
954	iwe.cmd = SIOCGIWFREQ;
955	iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
956	iwe.u.freq.e = 0;
957	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
958					  IW_EV_FREQ_LEN);
959
960	memset(&iwe, 0, sizeof(iwe));
961	iwe.cmd = SIOCGIWFREQ;
962	iwe.u.freq.m = bss->pub.channel->center_freq;
963	iwe.u.freq.e = 6;
964	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
965					  IW_EV_FREQ_LEN);
966
967	if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
968		memset(&iwe, 0, sizeof(iwe));
969		iwe.cmd = IWEVQUAL;
970		iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
971				     IW_QUAL_NOISE_INVALID |
972				     IW_QUAL_QUAL_UPDATED;
973		switch (wiphy->signal_type) {
974		case CFG80211_SIGNAL_TYPE_MBM:
975			sig = bss->pub.signal / 100;
976			iwe.u.qual.level = sig;
977			iwe.u.qual.updated |= IW_QUAL_DBM;
978			if (sig < -110)		/* rather bad */
979				sig = -110;
980			else if (sig > -40)	/* perfect */
981				sig = -40;
982			/* will give a range of 0 .. 70 */
983			iwe.u.qual.qual = sig + 110;
984			break;
985		case CFG80211_SIGNAL_TYPE_UNSPEC:
986			iwe.u.qual.level = bss->pub.signal;
987			/* will give range 0 .. 100 */
988			iwe.u.qual.qual = bss->pub.signal;
989			break;
990		default:
991			/* not reached */
992			break;
993		}
994		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
995						  &iwe, IW_EV_QUAL_LEN);
996	}
997
998	memset(&iwe, 0, sizeof(iwe));
999	iwe.cmd = SIOCGIWENCODE;
1000	if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
1001		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
1002	else
1003		iwe.u.data.flags = IW_ENCODE_DISABLED;
1004	iwe.u.data.length = 0;
1005	current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1006					  &iwe, "");
1007
1008	while (rem >= 2) {
1009		/* invalid data */
1010		if (ie[1] > rem - 2)
1011			break;
1012
1013		switch (ie[0]) {
1014		case WLAN_EID_SSID:
1015			memset(&iwe, 0, sizeof(iwe));
1016			iwe.cmd = SIOCGIWESSID;
1017			iwe.u.data.length = ie[1];
1018			iwe.u.data.flags = 1;
1019			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1020							  &iwe, ie + 2);
1021			break;
1022		case WLAN_EID_MESH_ID:
1023			memset(&iwe, 0, sizeof(iwe));
1024			iwe.cmd = SIOCGIWESSID;
1025			iwe.u.data.length = ie[1];
1026			iwe.u.data.flags = 1;
1027			current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1028							  &iwe, ie + 2);
1029			break;
1030		case WLAN_EID_MESH_CONFIG:
1031			ismesh = true;
1032			if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1033				break;
1034			buf = kmalloc(50, GFP_ATOMIC);
1035			if (!buf)
1036				break;
1037			cfg = ie + 2;
1038			memset(&iwe, 0, sizeof(iwe));
1039			iwe.cmd = IWEVCUSTOM;
1040			sprintf(buf, "Mesh Network Path Selection Protocol ID: "
1041				"0x%02X", cfg[0]);
1042			iwe.u.data.length = strlen(buf);
1043			current_ev = iwe_stream_add_point(info, current_ev,
1044							  end_buf,
1045							  &iwe, buf);
1046			sprintf(buf, "Path Selection Metric ID: 0x%02X",
1047				cfg[1]);
1048			iwe.u.data.length = strlen(buf);
1049			current_ev = iwe_stream_add_point(info, current_ev,
1050							  end_buf,
1051							  &iwe, buf);
1052			sprintf(buf, "Congestion Control Mode ID: 0x%02X",
1053				cfg[2]);
1054			iwe.u.data.length = strlen(buf);
1055			current_ev = iwe_stream_add_point(info, current_ev,
1056							  end_buf,
1057							  &iwe, buf);
1058			sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1059			iwe.u.data.length = strlen(buf);
1060			current_ev = iwe_stream_add_point(info, current_ev,
1061							  end_buf,
1062							  &iwe, buf);
1063			sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
1064			iwe.u.data.length = strlen(buf);
1065			current_ev = iwe_stream_add_point(info, current_ev,
1066							  end_buf,
1067							  &iwe, buf);
1068			sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
1069			iwe.u.data.length = strlen(buf);
1070			current_ev = iwe_stream_add_point(info, current_ev,
1071							  end_buf,
1072							  &iwe, buf);
1073			sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1074			iwe.u.data.length = strlen(buf);
1075			current_ev = iwe_stream_add_point(info, current_ev,
1076							  end_buf,
1077							  &iwe, buf);
1078			kfree(buf);
1079			break;
1080		case WLAN_EID_SUPP_RATES:
1081		case WLAN_EID_EXT_SUPP_RATES:
1082			/* display all supported rates in readable format */
1083			p = current_ev + iwe_stream_lcp_len(info);
1084
1085			memset(&iwe, 0, sizeof(iwe));
1086			iwe.cmd = SIOCGIWRATE;
1087			/* Those two flags are ignored... */
1088			iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
1089
1090			for (i = 0; i < ie[1]; i++) {
1091				iwe.u.bitrate.value =
1092					((ie[i + 2] & 0x7f) * 500000);
1093				p = iwe_stream_add_value(info, current_ev, p,
1094						end_buf, &iwe, IW_EV_PARAM_LEN);
1095			}
1096			current_ev = p;
1097			break;
1098		}
1099		rem -= ie[1] + 2;
1100		ie += ie[1] + 2;
1101	}
1102
1103	if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
1104	    ismesh) {
1105		memset(&iwe, 0, sizeof(iwe));
1106		iwe.cmd = SIOCGIWMODE;
1107		if (ismesh)
1108			iwe.u.mode = IW_MODE_MESH;
1109		else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
1110			iwe.u.mode = IW_MODE_MASTER;
1111		else
1112			iwe.u.mode = IW_MODE_ADHOC;
1113		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
1114						  &iwe, IW_EV_UINT_LEN);
1115	}
1116
1117	buf = kmalloc(30, GFP_ATOMIC);
1118	if (buf) {
1119		memset(&iwe, 0, sizeof(iwe));
1120		iwe.cmd = IWEVCUSTOM;
1121		sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
1122		iwe.u.data.length = strlen(buf);
1123		current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1124						  &iwe, buf);
1125		memset(&iwe, 0, sizeof(iwe));
1126		iwe.cmd = IWEVCUSTOM;
1127		sprintf(buf, " Last beacon: %ums ago",
1128			elapsed_jiffies_msecs(bss->ts));
1129		iwe.u.data.length = strlen(buf);
1130		current_ev = iwe_stream_add_point(info, current_ev,
1131						  end_buf, &iwe, buf);
1132		kfree(buf);
1133	}
1134
1135	ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
1136
1137	return current_ev;
1138}
1139
1140
1141static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
1142				  struct iw_request_info *info,
1143				  char *buf, size_t len)
1144{
1145	char *current_ev = buf;
1146	char *end_buf = buf + len;
1147	struct cfg80211_internal_bss *bss;
1148
1149	spin_lock_bh(&dev->bss_lock);
1150	cfg80211_bss_expire(dev);
1151
1152	list_for_each_entry(bss, &dev->bss_list, list) {
1153		if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
1154			spin_unlock_bh(&dev->bss_lock);
1155			return -E2BIG;
1156		}
1157		current_ev = ieee80211_bss(&dev->wiphy, info, bss,
1158					   current_ev, end_buf);
1159	}
1160	spin_unlock_bh(&dev->bss_lock);
1161	return current_ev - buf;
1162}
1163
1164
1165int cfg80211_wext_giwscan(struct net_device *dev,
1166			  struct iw_request_info *info,
1167			  struct iw_point *data, char *extra)
1168{
1169	struct cfg80211_registered_device *rdev;
1170	int res;
1171
1172	if (!netif_running(dev))
1173		return -ENETDOWN;
1174
1175	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1176
1177	if (IS_ERR(rdev))
1178		return PTR_ERR(rdev);
1179
1180	if (rdev->scan_req) {
1181		res = -EAGAIN;
1182		goto out;
1183	}
1184
1185	res = ieee80211_scan_results(rdev, info, extra, data->length);
1186	data->length = 0;
1187	if (res >= 0) {
1188		data->length = res;
1189		res = 0;
1190	}
1191
1192 out:
1193	cfg80211_unlock_rdev(rdev);
1194	return res;
1195}
1196EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
1197#endif
1198