scan.c 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101
  1. /*
  2. * cfg80211 scan result handling
  3. *
  4. * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
  5. */
  6. #include <linux/kernel.h>
  7. #include <linux/module.h>
  8. #include <linux/netdevice.h>
  9. #include <linux/wireless.h>
  10. #include <linux/nl80211.h>
  11. #include <linux/etherdevice.h>
  12. #include <net/arp.h>
  13. #include <net/cfg80211.h>
  14. #include <net/iw_handler.h>
  15. #include "core.h"
  16. #include "nl80211.h"
  17. #include "wext-compat.h"
  18. #define IEEE80211_SCAN_RESULT_EXPIRE (15 * HZ)
  19. void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
  20. {
  21. struct cfg80211_scan_request *request;
  22. struct net_device *dev;
  23. #ifdef CONFIG_CFG80211_WEXT
  24. union iwreq_data wrqu;
  25. #endif
  26. ASSERT_RDEV_LOCK(rdev);
  27. request = rdev->scan_req;
  28. if (!request)
  29. return;
  30. dev = request->dev;
  31. /*
  32. * This must be before sending the other events!
  33. * Otherwise, wpa_supplicant gets completely confused with
  34. * wext events.
  35. */
  36. cfg80211_sme_scan_done(dev);
  37. if (request->aborted)
  38. nl80211_send_scan_aborted(rdev, dev);
  39. else
  40. nl80211_send_scan_done(rdev, dev);
  41. #ifdef CONFIG_CFG80211_WEXT
  42. if (!request->aborted) {
  43. memset(&wrqu, 0, sizeof(wrqu));
  44. wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
  45. }
  46. #endif
  47. dev_put(dev);
  48. rdev->scan_req = NULL;
  49. /*
  50. * OK. If this is invoked with "leak" then we can't
  51. * free this ... but we've cleaned it up anyway. The
  52. * driver failed to call the scan_done callback, so
  53. * all bets are off, it might still be trying to use
  54. * the scan request or not ... if it accesses the dev
  55. * in there (it shouldn't anyway) then it may crash.
  56. */
  57. if (!leak)
  58. kfree(request);
  59. }
  60. void __cfg80211_scan_done(struct work_struct *wk)
  61. {
  62. struct cfg80211_registered_device *rdev;
  63. rdev = container_of(wk, struct cfg80211_registered_device,
  64. scan_done_wk);
  65. cfg80211_lock_rdev(rdev);
  66. ___cfg80211_scan_done(rdev, false);
  67. cfg80211_unlock_rdev(rdev);
  68. }
  69. void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
  70. {
  71. WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
  72. request->aborted = aborted;
  73. queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
  74. }
  75. EXPORT_SYMBOL(cfg80211_scan_done);
  76. static void bss_release(struct kref *ref)
  77. {
  78. struct cfg80211_internal_bss *bss;
  79. bss = container_of(ref, struct cfg80211_internal_bss, ref);
  80. if (bss->pub.free_priv)
  81. bss->pub.free_priv(&bss->pub);
  82. if (bss->beacon_ies_allocated)
  83. kfree(bss->pub.beacon_ies);
  84. if (bss->proberesp_ies_allocated)
  85. kfree(bss->pub.proberesp_ies);
  86. BUG_ON(atomic_read(&bss->hold));
  87. kfree(bss);
  88. }
  89. /* must hold dev->bss_lock! */
  90. void cfg80211_bss_age(struct cfg80211_registered_device *dev,
  91. unsigned long age_secs)
  92. {
  93. struct cfg80211_internal_bss *bss;
  94. unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
  95. list_for_each_entry(bss, &dev->bss_list, list) {
  96. bss->ts -= age_jiffies;
  97. }
  98. }
  99. /* must hold dev->bss_lock! */
  100. void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
  101. {
  102. struct cfg80211_internal_bss *bss, *tmp;
  103. bool expired = false;
  104. list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
  105. if (atomic_read(&bss->hold))
  106. continue;
  107. if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
  108. continue;
  109. list_del(&bss->list);
  110. rb_erase(&bss->rbn, &dev->bss_tree);
  111. kref_put(&bss->ref, bss_release);
  112. expired = true;
  113. }
  114. if (expired)
  115. dev->bss_generation++;
  116. }
  117. const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
  118. {
  119. while (len > 2 && ies[0] != eid) {
  120. len -= ies[1] + 2;
  121. ies += ies[1] + 2;
  122. }
  123. if (len < 2)
  124. return NULL;
  125. if (len < 2 + ies[1])
  126. return NULL;
  127. return ies;
  128. }
  129. EXPORT_SYMBOL(cfg80211_find_ie);
  130. static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
  131. {
  132. const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
  133. const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
  134. int r;
  135. if (!ie1 && !ie2)
  136. return 0;
  137. if (!ie1 || !ie2)
  138. return -1;
  139. r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
  140. if (r == 0 && ie1[1] != ie2[1])
  141. return ie2[1] - ie1[1];
  142. return r;
  143. }
  144. static bool is_bss(struct cfg80211_bss *a,
  145. const u8 *bssid,
  146. const u8 *ssid, size_t ssid_len)
  147. {
  148. const u8 *ssidie;
  149. if (bssid && compare_ether_addr(a->bssid, bssid))
  150. return false;
  151. if (!ssid)
  152. return true;
  153. ssidie = cfg80211_find_ie(WLAN_EID_SSID,
  154. a->information_elements,
  155. a->len_information_elements);
  156. if (!ssidie)
  157. return false;
  158. if (ssidie[1] != ssid_len)
  159. return false;
  160. return memcmp(ssidie + 2, ssid, ssid_len) == 0;
  161. }
  162. static bool is_mesh(struct cfg80211_bss *a,
  163. const u8 *meshid, size_t meshidlen,
  164. const u8 *meshcfg)
  165. {
  166. const u8 *ie;
  167. if (!is_zero_ether_addr(a->bssid))
  168. return false;
  169. ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
  170. a->information_elements,
  171. a->len_information_elements);
  172. if (!ie)
  173. return false;
  174. if (ie[1] != meshidlen)
  175. return false;
  176. if (memcmp(ie + 2, meshid, meshidlen))
  177. return false;
  178. ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
  179. a->information_elements,
  180. a->len_information_elements);
  181. if (!ie)
  182. return false;
  183. if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
  184. return false;
  185. /*
  186. * Ignore mesh capability (last two bytes of the IE) when
  187. * comparing since that may differ between stations taking
  188. * part in the same mesh.
  189. */
  190. return memcmp(ie + 2, meshcfg,
  191. sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
  192. }
  193. static int cmp_bss(struct cfg80211_bss *a,
  194. struct cfg80211_bss *b)
  195. {
  196. int r;
  197. if (a->channel != b->channel)
  198. return b->channel->center_freq - a->channel->center_freq;
  199. r = memcmp(a->bssid, b->bssid, ETH_ALEN);
  200. if (r)
  201. return r;
  202. if (is_zero_ether_addr(a->bssid)) {
  203. r = cmp_ies(WLAN_EID_MESH_ID,
  204. a->information_elements,
  205. a->len_information_elements,
  206. b->information_elements,
  207. b->len_information_elements);
  208. if (r)
  209. return r;
  210. return cmp_ies(WLAN_EID_MESH_CONFIG,
  211. a->information_elements,
  212. a->len_information_elements,
  213. b->information_elements,
  214. b->len_information_elements);
  215. }
  216. return cmp_ies(WLAN_EID_SSID,
  217. a->information_elements,
  218. a->len_information_elements,
  219. b->information_elements,
  220. b->len_information_elements);
  221. }
  222. struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
  223. struct ieee80211_channel *channel,
  224. const u8 *bssid,
  225. const u8 *ssid, size_t ssid_len,
  226. u16 capa_mask, u16 capa_val)
  227. {
  228. struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
  229. struct cfg80211_internal_bss *bss, *res = NULL;
  230. spin_lock_bh(&dev->bss_lock);
  231. list_for_each_entry(bss, &dev->bss_list, list) {
  232. if ((bss->pub.capability & capa_mask) != capa_val)
  233. continue;
  234. if (channel && bss->pub.channel != channel)
  235. continue;
  236. if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
  237. res = bss;
  238. kref_get(&res->ref);
  239. break;
  240. }
  241. }
  242. spin_unlock_bh(&dev->bss_lock);
  243. if (!res)
  244. return NULL;
  245. return &res->pub;
  246. }
  247. EXPORT_SYMBOL(cfg80211_get_bss);
  248. struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
  249. struct ieee80211_channel *channel,
  250. const u8 *meshid, size_t meshidlen,
  251. const u8 *meshcfg)
  252. {
  253. struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
  254. struct cfg80211_internal_bss *bss, *res = NULL;
  255. spin_lock_bh(&dev->bss_lock);
  256. list_for_each_entry(bss, &dev->bss_list, list) {
  257. if (channel && bss->pub.channel != channel)
  258. continue;
  259. if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
  260. res = bss;
  261. kref_get(&res->ref);
  262. break;
  263. }
  264. }
  265. spin_unlock_bh(&dev->bss_lock);
  266. if (!res)
  267. return NULL;
  268. return &res->pub;
  269. }
  270. EXPORT_SYMBOL(cfg80211_get_mesh);
  271. static void rb_insert_bss(struct cfg80211_registered_device *dev,
  272. struct cfg80211_internal_bss *bss)
  273. {
  274. struct rb_node **p = &dev->bss_tree.rb_node;
  275. struct rb_node *parent = NULL;
  276. struct cfg80211_internal_bss *tbss;
  277. int cmp;
  278. while (*p) {
  279. parent = *p;
  280. tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
  281. cmp = cmp_bss(&bss->pub, &tbss->pub);
  282. if (WARN_ON(!cmp)) {
  283. /* will sort of leak this BSS */
  284. return;
  285. }
  286. if (cmp < 0)
  287. p = &(*p)->rb_left;
  288. else
  289. p = &(*p)->rb_right;
  290. }
  291. rb_link_node(&bss->rbn, parent, p);
  292. rb_insert_color(&bss->rbn, &dev->bss_tree);
  293. }
  294. static struct cfg80211_internal_bss *
  295. rb_find_bss(struct cfg80211_registered_device *dev,
  296. struct cfg80211_internal_bss *res)
  297. {
  298. struct rb_node *n = dev->bss_tree.rb_node;
  299. struct cfg80211_internal_bss *bss;
  300. int r;
  301. while (n) {
  302. bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
  303. r = cmp_bss(&res->pub, &bss->pub);
  304. if (r == 0)
  305. return bss;
  306. else if (r < 0)
  307. n = n->rb_left;
  308. else
  309. n = n->rb_right;
  310. }
  311. return NULL;
  312. }
  313. static struct cfg80211_internal_bss *
  314. cfg80211_bss_update(struct cfg80211_registered_device *dev,
  315. struct cfg80211_internal_bss *res)
  316. {
  317. struct cfg80211_internal_bss *found = NULL;
  318. const u8 *meshid, *meshcfg;
  319. /*
  320. * The reference to "res" is donated to this function.
  321. */
  322. if (WARN_ON(!res->pub.channel)) {
  323. kref_put(&res->ref, bss_release);
  324. return NULL;
  325. }
  326. res->ts = jiffies;
  327. if (is_zero_ether_addr(res->pub.bssid)) {
  328. /* must be mesh, verify */
  329. meshid = cfg80211_find_ie(WLAN_EID_MESH_ID,
  330. res->pub.information_elements,
  331. res->pub.len_information_elements);
  332. meshcfg = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
  333. res->pub.information_elements,
  334. res->pub.len_information_elements);
  335. if (!meshid || !meshcfg ||
  336. meshcfg[1] != sizeof(struct ieee80211_meshconf_ie)) {
  337. /* bogus mesh */
  338. kref_put(&res->ref, bss_release);
  339. return NULL;
  340. }
  341. }
  342. spin_lock_bh(&dev->bss_lock);
  343. found = rb_find_bss(dev, res);
  344. if (found) {
  345. found->pub.beacon_interval = res->pub.beacon_interval;
  346. found->pub.tsf = res->pub.tsf;
  347. found->pub.signal = res->pub.signal;
  348. found->pub.capability = res->pub.capability;
  349. found->ts = res->ts;
  350. /* Update IEs */
  351. if (res->pub.proberesp_ies) {
  352. size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
  353. size_t ielen = res->pub.len_proberesp_ies;
  354. if (found->pub.proberesp_ies &&
  355. !found->proberesp_ies_allocated &&
  356. ksize(found) >= used + ielen) {
  357. memcpy(found->pub.proberesp_ies,
  358. res->pub.proberesp_ies, ielen);
  359. found->pub.len_proberesp_ies = ielen;
  360. } else {
  361. u8 *ies = found->pub.proberesp_ies;
  362. if (found->proberesp_ies_allocated)
  363. ies = krealloc(ies, ielen, GFP_ATOMIC);
  364. else
  365. ies = kmalloc(ielen, GFP_ATOMIC);
  366. if (ies) {
  367. memcpy(ies, res->pub.proberesp_ies,
  368. ielen);
  369. found->proberesp_ies_allocated = true;
  370. found->pub.proberesp_ies = ies;
  371. found->pub.len_proberesp_ies = ielen;
  372. }
  373. }
  374. /* Override possible earlier Beacon frame IEs */
  375. found->pub.information_elements =
  376. found->pub.proberesp_ies;
  377. found->pub.len_information_elements =
  378. found->pub.len_proberesp_ies;
  379. }
  380. if (res->pub.beacon_ies) {
  381. size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
  382. size_t ielen = res->pub.len_beacon_ies;
  383. if (found->pub.beacon_ies &&
  384. !found->beacon_ies_allocated &&
  385. ksize(found) >= used + ielen) {
  386. memcpy(found->pub.beacon_ies,
  387. res->pub.beacon_ies, ielen);
  388. found->pub.len_beacon_ies = ielen;
  389. } else {
  390. u8 *ies = found->pub.beacon_ies;
  391. if (found->beacon_ies_allocated)
  392. ies = krealloc(ies, ielen, GFP_ATOMIC);
  393. else
  394. ies = kmalloc(ielen, GFP_ATOMIC);
  395. if (ies) {
  396. memcpy(ies, res->pub.beacon_ies,
  397. ielen);
  398. found->beacon_ies_allocated = true;
  399. found->pub.beacon_ies = ies;
  400. found->pub.len_beacon_ies = ielen;
  401. }
  402. }
  403. }
  404. kref_put(&res->ref, bss_release);
  405. } else {
  406. /* this "consumes" the reference */
  407. list_add_tail(&res->list, &dev->bss_list);
  408. rb_insert_bss(dev, res);
  409. found = res;
  410. }
  411. dev->bss_generation++;
  412. spin_unlock_bh(&dev->bss_lock);
  413. kref_get(&found->ref);
  414. return found;
  415. }
  416. struct cfg80211_bss*
  417. cfg80211_inform_bss(struct wiphy *wiphy,
  418. struct ieee80211_channel *channel,
  419. const u8 *bssid,
  420. u64 timestamp, u16 capability, u16 beacon_interval,
  421. const u8 *ie, size_t ielen,
  422. s32 signal, gfp_t gfp)
  423. {
  424. struct cfg80211_internal_bss *res;
  425. size_t privsz;
  426. if (WARN_ON(!wiphy))
  427. return NULL;
  428. privsz = wiphy->bss_priv_size;
  429. if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
  430. (signal < 0 || signal > 100)))
  431. return NULL;
  432. res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
  433. if (!res)
  434. return NULL;
  435. memcpy(res->pub.bssid, bssid, ETH_ALEN);
  436. res->pub.channel = channel;
  437. res->pub.signal = signal;
  438. res->pub.tsf = timestamp;
  439. res->pub.beacon_interval = beacon_interval;
  440. res->pub.capability = capability;
  441. /*
  442. * Since we do not know here whether the IEs are from a Beacon or Probe
  443. * Response frame, we need to pick one of the options and only use it
  444. * with the driver that does not provide the full Beacon/Probe Response
  445. * frame. Use Beacon frame pointer to avoid indicating that this should
  446. * override the information_elements pointer should we have received an
  447. * earlier indication of Probe Response data.
  448. *
  449. * The initial buffer for the IEs is allocated with the BSS entry and
  450. * is located after the private area.
  451. */
  452. res->pub.beacon_ies = (u8 *)res + sizeof(*res) + privsz;
  453. memcpy(res->pub.beacon_ies, ie, ielen);
  454. res->pub.len_beacon_ies = ielen;
  455. res->pub.information_elements = res->pub.beacon_ies;
  456. res->pub.len_information_elements = res->pub.len_beacon_ies;
  457. kref_init(&res->ref);
  458. res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
  459. if (!res)
  460. return NULL;
  461. if (res->pub.capability & WLAN_CAPABILITY_ESS)
  462. regulatory_hint_found_beacon(wiphy, channel, gfp);
  463. /* cfg80211_bss_update gives us a referenced result */
  464. return &res->pub;
  465. }
  466. EXPORT_SYMBOL(cfg80211_inform_bss);
  467. struct cfg80211_bss *
  468. cfg80211_inform_bss_frame(struct wiphy *wiphy,
  469. struct ieee80211_channel *channel,
  470. struct ieee80211_mgmt *mgmt, size_t len,
  471. s32 signal, gfp_t gfp)
  472. {
  473. struct cfg80211_internal_bss *res;
  474. size_t ielen = len - offsetof(struct ieee80211_mgmt,
  475. u.probe_resp.variable);
  476. size_t privsz = wiphy->bss_priv_size;
  477. if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
  478. (signal < 0 || signal > 100)))
  479. return NULL;
  480. if (WARN_ON(!mgmt || !wiphy ||
  481. len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
  482. return NULL;
  483. res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
  484. if (!res)
  485. return NULL;
  486. memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
  487. res->pub.channel = channel;
  488. res->pub.signal = signal;
  489. res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
  490. res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
  491. res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
  492. /*
  493. * The initial buffer for the IEs is allocated with the BSS entry and
  494. * is located after the private area.
  495. */
  496. if (ieee80211_is_probe_resp(mgmt->frame_control)) {
  497. res->pub.proberesp_ies = (u8 *) res + sizeof(*res) + privsz;
  498. memcpy(res->pub.proberesp_ies, mgmt->u.probe_resp.variable,
  499. ielen);
  500. res->pub.len_proberesp_ies = ielen;
  501. res->pub.information_elements = res->pub.proberesp_ies;
  502. res->pub.len_information_elements = res->pub.len_proberesp_ies;
  503. } else {
  504. res->pub.beacon_ies = (u8 *) res + sizeof(*res) + privsz;
  505. memcpy(res->pub.beacon_ies, mgmt->u.beacon.variable, ielen);
  506. res->pub.len_beacon_ies = ielen;
  507. res->pub.information_elements = res->pub.beacon_ies;
  508. res->pub.len_information_elements = res->pub.len_beacon_ies;
  509. }
  510. kref_init(&res->ref);
  511. res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
  512. if (!res)
  513. return NULL;
  514. if (res->pub.capability & WLAN_CAPABILITY_ESS)
  515. regulatory_hint_found_beacon(wiphy, channel, gfp);
  516. /* cfg80211_bss_update gives us a referenced result */
  517. return &res->pub;
  518. }
  519. EXPORT_SYMBOL(cfg80211_inform_bss_frame);
  520. void cfg80211_put_bss(struct cfg80211_bss *pub)
  521. {
  522. struct cfg80211_internal_bss *bss;
  523. if (!pub)
  524. return;
  525. bss = container_of(pub, struct cfg80211_internal_bss, pub);
  526. kref_put(&bss->ref, bss_release);
  527. }
  528. EXPORT_SYMBOL(cfg80211_put_bss);
  529. void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
  530. {
  531. struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
  532. struct cfg80211_internal_bss *bss;
  533. if (WARN_ON(!pub))
  534. return;
  535. bss = container_of(pub, struct cfg80211_internal_bss, pub);
  536. spin_lock_bh(&dev->bss_lock);
  537. list_del(&bss->list);
  538. dev->bss_generation++;
  539. rb_erase(&bss->rbn, &dev->bss_tree);
  540. spin_unlock_bh(&dev->bss_lock);
  541. kref_put(&bss->ref, bss_release);
  542. }
  543. EXPORT_SYMBOL(cfg80211_unlink_bss);
  544. #ifdef CONFIG_CFG80211_WEXT
  545. int cfg80211_wext_siwscan(struct net_device *dev,
  546. struct iw_request_info *info,
  547. union iwreq_data *wrqu, char *extra)
  548. {
  549. struct cfg80211_registered_device *rdev;
  550. struct wiphy *wiphy;
  551. struct iw_scan_req *wreq = NULL;
  552. struct cfg80211_scan_request *creq = NULL;
  553. int i, err, n_channels = 0;
  554. enum ieee80211_band band;
  555. if (!netif_running(dev))
  556. return -ENETDOWN;
  557. if (wrqu->data.length == sizeof(struct iw_scan_req))
  558. wreq = (struct iw_scan_req *)extra;
  559. rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
  560. if (IS_ERR(rdev))
  561. return PTR_ERR(rdev);
  562. if (rdev->scan_req) {
  563. err = -EBUSY;
  564. goto out;
  565. }
  566. wiphy = &rdev->wiphy;
  567. /* Determine number of channels, needed to allocate creq */
  568. if (wreq && wreq->num_channels)
  569. n_channels = wreq->num_channels;
  570. else {
  571. for (band = 0; band < IEEE80211_NUM_BANDS; band++)
  572. if (wiphy->bands[band])
  573. n_channels += wiphy->bands[band]->n_channels;
  574. }
  575. creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
  576. n_channels * sizeof(void *),
  577. GFP_ATOMIC);
  578. if (!creq) {
  579. err = -ENOMEM;
  580. goto out;
  581. }
  582. creq->wiphy = wiphy;
  583. creq->dev = dev;
  584. /* SSIDs come after channels */
  585. creq->ssids = (void *)&creq->channels[n_channels];
  586. creq->n_channels = n_channels;
  587. creq->n_ssids = 1;
  588. /* translate "Scan on frequencies" request */
  589. i = 0;
  590. for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
  591. int j;
  592. if (!wiphy->bands[band])
  593. continue;
  594. for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
  595. /* ignore disabled channels */
  596. if (wiphy->bands[band]->channels[j].flags &
  597. IEEE80211_CHAN_DISABLED)
  598. continue;
  599. /* If we have a wireless request structure and the
  600. * wireless request specifies frequencies, then search
  601. * for the matching hardware channel.
  602. */
  603. if (wreq && wreq->num_channels) {
  604. int k;
  605. int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
  606. for (k = 0; k < wreq->num_channels; k++) {
  607. int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
  608. if (wext_freq == wiphy_freq)
  609. goto wext_freq_found;
  610. }
  611. goto wext_freq_not_found;
  612. }
  613. wext_freq_found:
  614. creq->channels[i] = &wiphy->bands[band]->channels[j];
  615. i++;
  616. wext_freq_not_found: ;
  617. }
  618. }
  619. /* No channels found? */
  620. if (!i) {
  621. err = -EINVAL;
  622. goto out;
  623. }
  624. /* Set real number of channels specified in creq->channels[] */
  625. creq->n_channels = i;
  626. /* translate "Scan for SSID" request */
  627. if (wreq) {
  628. if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
  629. if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
  630. err = -EINVAL;
  631. goto out;
  632. }
  633. memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
  634. creq->ssids[0].ssid_len = wreq->essid_len;
  635. }
  636. if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
  637. creq->n_ssids = 0;
  638. }
  639. rdev->scan_req = creq;
  640. err = rdev->ops->scan(wiphy, dev, creq);
  641. if (err) {
  642. rdev->scan_req = NULL;
  643. /* creq will be freed below */
  644. } else {
  645. nl80211_send_scan_start(rdev, dev);
  646. /* creq now owned by driver */
  647. creq = NULL;
  648. dev_hold(dev);
  649. }
  650. out:
  651. kfree(creq);
  652. cfg80211_unlock_rdev(rdev);
  653. return err;
  654. }
  655. EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
  656. static void ieee80211_scan_add_ies(struct iw_request_info *info,
  657. struct cfg80211_bss *bss,
  658. char **current_ev, char *end_buf)
  659. {
  660. u8 *pos, *end, *next;
  661. struct iw_event iwe;
  662. if (!bss->information_elements ||
  663. !bss->len_information_elements)
  664. return;
  665. /*
  666. * If needed, fragment the IEs buffer (at IE boundaries) into short
  667. * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
  668. */
  669. pos = bss->information_elements;
  670. end = pos + bss->len_information_elements;
  671. while (end - pos > IW_GENERIC_IE_MAX) {
  672. next = pos + 2 + pos[1];
  673. while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
  674. next = next + 2 + next[1];
  675. memset(&iwe, 0, sizeof(iwe));
  676. iwe.cmd = IWEVGENIE;
  677. iwe.u.data.length = next - pos;
  678. *current_ev = iwe_stream_add_point(info, *current_ev,
  679. end_buf, &iwe, pos);
  680. pos = next;
  681. }
  682. if (end > pos) {
  683. memset(&iwe, 0, sizeof(iwe));
  684. iwe.cmd = IWEVGENIE;
  685. iwe.u.data.length = end - pos;
  686. *current_ev = iwe_stream_add_point(info, *current_ev,
  687. end_buf, &iwe, pos);
  688. }
  689. }
  690. static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
  691. {
  692. unsigned long end = jiffies;
  693. if (end >= start)
  694. return jiffies_to_msecs(end - start);
  695. return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
  696. }
  697. static char *
  698. ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
  699. struct cfg80211_internal_bss *bss, char *current_ev,
  700. char *end_buf)
  701. {
  702. struct iw_event iwe;
  703. u8 *buf, *cfg, *p;
  704. u8 *ie = bss->pub.information_elements;
  705. int rem = bss->pub.len_information_elements, i, sig;
  706. bool ismesh = false;
  707. memset(&iwe, 0, sizeof(iwe));
  708. iwe.cmd = SIOCGIWAP;
  709. iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
  710. memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
  711. current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
  712. IW_EV_ADDR_LEN);
  713. memset(&iwe, 0, sizeof(iwe));
  714. iwe.cmd = SIOCGIWFREQ;
  715. iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
  716. iwe.u.freq.e = 0;
  717. current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
  718. IW_EV_FREQ_LEN);
  719. memset(&iwe, 0, sizeof(iwe));
  720. iwe.cmd = SIOCGIWFREQ;
  721. iwe.u.freq.m = bss->pub.channel->center_freq;
  722. iwe.u.freq.e = 6;
  723. current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
  724. IW_EV_FREQ_LEN);
  725. if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
  726. memset(&iwe, 0, sizeof(iwe));
  727. iwe.cmd = IWEVQUAL;
  728. iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
  729. IW_QUAL_NOISE_INVALID |
  730. IW_QUAL_QUAL_UPDATED;
  731. switch (wiphy->signal_type) {
  732. case CFG80211_SIGNAL_TYPE_MBM:
  733. sig = bss->pub.signal / 100;
  734. iwe.u.qual.level = sig;
  735. iwe.u.qual.updated |= IW_QUAL_DBM;
  736. if (sig < -110) /* rather bad */
  737. sig = -110;
  738. else if (sig > -40) /* perfect */
  739. sig = -40;
  740. /* will give a range of 0 .. 70 */
  741. iwe.u.qual.qual = sig + 110;
  742. break;
  743. case CFG80211_SIGNAL_TYPE_UNSPEC:
  744. iwe.u.qual.level = bss->pub.signal;
  745. /* will give range 0 .. 100 */
  746. iwe.u.qual.qual = bss->pub.signal;
  747. break;
  748. default:
  749. /* not reached */
  750. break;
  751. }
  752. current_ev = iwe_stream_add_event(info, current_ev, end_buf,
  753. &iwe, IW_EV_QUAL_LEN);
  754. }
  755. memset(&iwe, 0, sizeof(iwe));
  756. iwe.cmd = SIOCGIWENCODE;
  757. if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
  758. iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
  759. else
  760. iwe.u.data.flags = IW_ENCODE_DISABLED;
  761. iwe.u.data.length = 0;
  762. current_ev = iwe_stream_add_point(info, current_ev, end_buf,
  763. &iwe, "");
  764. while (rem >= 2) {
  765. /* invalid data */
  766. if (ie[1] > rem - 2)
  767. break;
  768. switch (ie[0]) {
  769. case WLAN_EID_SSID:
  770. memset(&iwe, 0, sizeof(iwe));
  771. iwe.cmd = SIOCGIWESSID;
  772. iwe.u.data.length = ie[1];
  773. iwe.u.data.flags = 1;
  774. current_ev = iwe_stream_add_point(info, current_ev, end_buf,
  775. &iwe, ie + 2);
  776. break;
  777. case WLAN_EID_MESH_ID:
  778. memset(&iwe, 0, sizeof(iwe));
  779. iwe.cmd = SIOCGIWESSID;
  780. iwe.u.data.length = ie[1];
  781. iwe.u.data.flags = 1;
  782. current_ev = iwe_stream_add_point(info, current_ev, end_buf,
  783. &iwe, ie + 2);
  784. break;
  785. case WLAN_EID_MESH_CONFIG:
  786. ismesh = true;
  787. if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
  788. break;
  789. buf = kmalloc(50, GFP_ATOMIC);
  790. if (!buf)
  791. break;
  792. cfg = ie + 2;
  793. memset(&iwe, 0, sizeof(iwe));
  794. iwe.cmd = IWEVCUSTOM;
  795. sprintf(buf, "Mesh Network Path Selection Protocol ID: "
  796. "0x%02X", cfg[0]);
  797. iwe.u.data.length = strlen(buf);
  798. current_ev = iwe_stream_add_point(info, current_ev,
  799. end_buf,
  800. &iwe, buf);
  801. sprintf(buf, "Path Selection Metric ID: 0x%02X",
  802. cfg[1]);
  803. iwe.u.data.length = strlen(buf);
  804. current_ev = iwe_stream_add_point(info, current_ev,
  805. end_buf,
  806. &iwe, buf);
  807. sprintf(buf, "Congestion Control Mode ID: 0x%02X",
  808. cfg[2]);
  809. iwe.u.data.length = strlen(buf);
  810. current_ev = iwe_stream_add_point(info, current_ev,
  811. end_buf,
  812. &iwe, buf);
  813. sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
  814. iwe.u.data.length = strlen(buf);
  815. current_ev = iwe_stream_add_point(info, current_ev,
  816. end_buf,
  817. &iwe, buf);
  818. sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
  819. iwe.u.data.length = strlen(buf);
  820. current_ev = iwe_stream_add_point(info, current_ev,
  821. end_buf,
  822. &iwe, buf);
  823. sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
  824. iwe.u.data.length = strlen(buf);
  825. current_ev = iwe_stream_add_point(info, current_ev,
  826. end_buf,
  827. &iwe, buf);
  828. sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
  829. iwe.u.data.length = strlen(buf);
  830. current_ev = iwe_stream_add_point(info, current_ev,
  831. end_buf,
  832. &iwe, buf);
  833. kfree(buf);
  834. break;
  835. case WLAN_EID_SUPP_RATES:
  836. case WLAN_EID_EXT_SUPP_RATES:
  837. /* display all supported rates in readable format */
  838. p = current_ev + iwe_stream_lcp_len(info);
  839. memset(&iwe, 0, sizeof(iwe));
  840. iwe.cmd = SIOCGIWRATE;
  841. /* Those two flags are ignored... */
  842. iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
  843. for (i = 0; i < ie[1]; i++) {
  844. iwe.u.bitrate.value =
  845. ((ie[i + 2] & 0x7f) * 500000);
  846. p = iwe_stream_add_value(info, current_ev, p,
  847. end_buf, &iwe, IW_EV_PARAM_LEN);
  848. }
  849. current_ev = p;
  850. break;
  851. }
  852. rem -= ie[1] + 2;
  853. ie += ie[1] + 2;
  854. }
  855. if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
  856. ismesh) {
  857. memset(&iwe, 0, sizeof(iwe));
  858. iwe.cmd = SIOCGIWMODE;
  859. if (ismesh)
  860. iwe.u.mode = IW_MODE_MESH;
  861. else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
  862. iwe.u.mode = IW_MODE_MASTER;
  863. else
  864. iwe.u.mode = IW_MODE_ADHOC;
  865. current_ev = iwe_stream_add_event(info, current_ev, end_buf,
  866. &iwe, IW_EV_UINT_LEN);
  867. }
  868. buf = kmalloc(30, GFP_ATOMIC);
  869. if (buf) {
  870. memset(&iwe, 0, sizeof(iwe));
  871. iwe.cmd = IWEVCUSTOM;
  872. sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
  873. iwe.u.data.length = strlen(buf);
  874. current_ev = iwe_stream_add_point(info, current_ev, end_buf,
  875. &iwe, buf);
  876. memset(&iwe, 0, sizeof(iwe));
  877. iwe.cmd = IWEVCUSTOM;
  878. sprintf(buf, " Last beacon: %ums ago",
  879. elapsed_jiffies_msecs(bss->ts));
  880. iwe.u.data.length = strlen(buf);
  881. current_ev = iwe_stream_add_point(info, current_ev,
  882. end_buf, &iwe, buf);
  883. kfree(buf);
  884. }
  885. ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
  886. return current_ev;
  887. }
  888. static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
  889. struct iw_request_info *info,
  890. char *buf, size_t len)
  891. {
  892. char *current_ev = buf;
  893. char *end_buf = buf + len;
  894. struct cfg80211_internal_bss *bss;
  895. spin_lock_bh(&dev->bss_lock);
  896. cfg80211_bss_expire(dev);
  897. list_for_each_entry(bss, &dev->bss_list, list) {
  898. if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
  899. spin_unlock_bh(&dev->bss_lock);
  900. return -E2BIG;
  901. }
  902. current_ev = ieee80211_bss(&dev->wiphy, info, bss,
  903. current_ev, end_buf);
  904. }
  905. spin_unlock_bh(&dev->bss_lock);
  906. return current_ev - buf;
  907. }
  908. int cfg80211_wext_giwscan(struct net_device *dev,
  909. struct iw_request_info *info,
  910. struct iw_point *data, char *extra)
  911. {
  912. struct cfg80211_registered_device *rdev;
  913. int res;
  914. if (!netif_running(dev))
  915. return -ENETDOWN;
  916. rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
  917. if (IS_ERR(rdev))
  918. return PTR_ERR(rdev);
  919. if (rdev->scan_req) {
  920. res = -EAGAIN;
  921. goto out;
  922. }
  923. res = ieee80211_scan_results(rdev, info, extra, data->length);
  924. data->length = 0;
  925. if (res >= 0) {
  926. data->length = res;
  927. res = 0;
  928. }
  929. out:
  930. cfg80211_unlock_rdev(rdev);
  931. return res;
  932. }
  933. EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
  934. #endif