1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * cfg80211 scan result handling
4 *
5 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2016 Intel Deutschland GmbH
8 * Copyright (C) 2018-2020 Intel Corporation
9 */
10 #include <linux/kernel.h>
11 #include <linux/slab.h>
12 #include <linux/module.h>
13 #include <linux/netdevice.h>
14 #include <linux/wireless.h>
15 #include <linux/nl80211.h>
16 #include <linux/etherdevice.h>
17 #include <linux/crc32.h>
18 #include <linux/bitfield.h>
19 #include <net/arp.h>
20 #include <net/cfg80211.h>
21 #include <net/cfg80211-wext.h>
22 #include <net/iw_handler.h>
23 #include "core.h"
24 #include "nl80211.h"
25 #include "wext-compat.h"
26 #include "rdev-ops.h"
27
28 /**
29 * DOC: BSS tree/list structure
30 *
31 * At the top level, the BSS list is kept in both a list in each
32 * registered device (@bss_list) as well as an RB-tree for faster
33 * lookup. In the RB-tree, entries can be looked up using their
34 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
35 * for other BSSes.
36 *
37 * Due to the possibility of hidden SSIDs, there's a second level
38 * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
39 * The hidden_list connects all BSSes belonging to a single AP
40 * that has a hidden SSID, and connects beacon and probe response
41 * entries. For a probe response entry for a hidden SSID, the
42 * hidden_beacon_bss pointer points to the BSS struct holding the
43 * beacon's information.
44 *
45 * Reference counting is done for all these references except for
46 * the hidden_list, so that a beacon BSS struct that is otherwise
47 * not referenced has one reference for being on the bss_list and
48 * one for each probe response entry that points to it using the
49 * hidden_beacon_bss pointer. When a BSS struct that has such a
50 * pointer is get/put, the refcount update is also propagated to
51 * the referenced struct, this ensure that it cannot get removed
52 * while somebody is using the probe response version.
53 *
54 * Note that the hidden_beacon_bss pointer never changes, due to
55 * the reference counting. Therefore, no locking is needed for
56 * it.
57 *
58 * Also note that the hidden_beacon_bss pointer is only relevant
59 * if the driver uses something other than the IEs, e.g. private
60 * data stored in the BSS struct, since the beacon IEs are
61 * also linked into the probe response struct.
62 */
63
64 /*
65 * Limit the number of BSS entries stored in mac80211. Each one is
66 * a bit over 4k at most, so this limits to roughly 4-5M of memory.
67 * If somebody wants to really attack this though, they'd likely
68 * use small beacons, and only one type of frame, limiting each of
69 * the entries to a much smaller size (in order to generate more
70 * entries in total, so overhead is bigger.)
71 */
72 static int bss_entries_limit = 1000;
73 module_param(bss_entries_limit, int, 0644);
74 MODULE_PARM_DESC(bss_entries_limit,
75 "limit to number of scan BSS entries (per wiphy, default 1000)");
76
77 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
78
79 /**
80 * struct cfg80211_colocated_ap - colocated AP information
81 *
82 * @list: linked list to all colocated aPS
83 * @bssid: BSSID of the reported AP
84 * @ssid: SSID of the reported AP
85 * @ssid_len: length of the ssid
86 * @center_freq: frequency the reported AP is on
87 * @unsolicited_probe: the reported AP is part of an ESS, where all the APs
88 * that operate in the same channel as the reported AP and that might be
89 * detected by a STA receiving this frame, are transmitting unsolicited
90 * Probe Response frames every 20 TUs
91 * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP
92 * @same_ssid: the reported AP has the same SSID as the reporting AP
93 * @multi_bss: the reported AP is part of a multiple BSSID set
94 * @transmitted_bssid: the reported AP is the transmitting BSSID
95 * @colocated_ess: all the APs that share the same ESS as the reported AP are
96 * colocated and can be discovered via legacy bands.
97 * @short_ssid_valid: short_ssid is valid and can be used
98 * @short_ssid: the short SSID for this SSID
99 */
100 struct cfg80211_colocated_ap {
101 struct list_head list;
102 u8 bssid[ETH_ALEN];
103 u8 ssid[IEEE80211_MAX_SSID_LEN];
104 size_t ssid_len;
105 u32 short_ssid;
106 u32 center_freq;
107 u8 unsolicited_probe:1,
108 oct_recommended:1,
109 same_ssid:1,
110 multi_bss:1,
111 transmitted_bssid:1,
112 colocated_ess:1,
113 short_ssid_valid:1;
114 };
115
bss_free(struct cfg80211_internal_bss * bss)116 static void bss_free(struct cfg80211_internal_bss *bss)
117 {
118 struct cfg80211_bss_ies *ies;
119
120 if (WARN_ON(atomic_read(&bss->hold)))
121 return;
122
123 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
124 if (ies && !bss->pub.hidden_beacon_bss)
125 kfree_rcu(ies, rcu_head);
126 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
127 if (ies)
128 kfree_rcu(ies, rcu_head);
129
130 /*
131 * This happens when the module is removed, it doesn't
132 * really matter any more save for completeness
133 */
134 if (!list_empty(&bss->hidden_list))
135 list_del(&bss->hidden_list);
136
137 kfree(bss);
138 }
139
bss_ref_get(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)140 static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
141 struct cfg80211_internal_bss *bss)
142 {
143 lockdep_assert_held(&rdev->bss_lock);
144
145 bss->refcount++;
146
147 if (bss->pub.hidden_beacon_bss)
148 bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++;
149
150 if (bss->pub.transmitted_bss)
151 bss_from_pub(bss->pub.transmitted_bss)->refcount++;
152 }
153
bss_ref_put(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)154 static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
155 struct cfg80211_internal_bss *bss)
156 {
157 lockdep_assert_held(&rdev->bss_lock);
158
159 if (bss->pub.hidden_beacon_bss) {
160 struct cfg80211_internal_bss *hbss;
161 hbss = container_of(bss->pub.hidden_beacon_bss,
162 struct cfg80211_internal_bss,
163 pub);
164 hbss->refcount--;
165 if (hbss->refcount == 0)
166 bss_free(hbss);
167 }
168
169 if (bss->pub.transmitted_bss) {
170 struct cfg80211_internal_bss *tbss;
171
172 tbss = container_of(bss->pub.transmitted_bss,
173 struct cfg80211_internal_bss,
174 pub);
175 tbss->refcount--;
176 if (tbss->refcount == 0)
177 bss_free(tbss);
178 }
179
180 bss->refcount--;
181 if (bss->refcount == 0)
182 bss_free(bss);
183 }
184
__cfg80211_unlink_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)185 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
186 struct cfg80211_internal_bss *bss)
187 {
188 lockdep_assert_held(&rdev->bss_lock);
189
190 if (!list_empty(&bss->hidden_list)) {
191 /*
192 * don't remove the beacon entry if it has
193 * probe responses associated with it
194 */
195 if (!bss->pub.hidden_beacon_bss)
196 return false;
197 /*
198 * if it's a probe response entry break its
199 * link to the other entries in the group
200 */
201 list_del_init(&bss->hidden_list);
202 }
203
204 list_del_init(&bss->list);
205 list_del_init(&bss->pub.nontrans_list);
206 rb_erase(&bss->rbn, &rdev->bss_tree);
207 rdev->bss_entries--;
208 WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
209 "rdev bss entries[%d]/list[empty:%d] corruption\n",
210 rdev->bss_entries, list_empty(&rdev->bss_list));
211 bss_ref_put(rdev, bss);
212 return true;
213 }
214
cfg80211_is_element_inherited(const struct element * elem,const struct element * non_inherit_elem)215 bool cfg80211_is_element_inherited(const struct element *elem,
216 const struct element *non_inherit_elem)
217 {
218 u8 id_len, ext_id_len, i, loop_len, id;
219 const u8 *list;
220
221 if (elem->id == WLAN_EID_MULTIPLE_BSSID)
222 return false;
223
224 if (!non_inherit_elem || non_inherit_elem->datalen < 2)
225 return true;
226
227 /*
228 * non inheritance element format is:
229 * ext ID (56) | IDs list len | list | extension IDs list len | list
230 * Both lists are optional. Both lengths are mandatory.
231 * This means valid length is:
232 * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
233 */
234 id_len = non_inherit_elem->data[1];
235 if (non_inherit_elem->datalen < 3 + id_len)
236 return true;
237
238 ext_id_len = non_inherit_elem->data[2 + id_len];
239 if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
240 return true;
241
242 if (elem->id == WLAN_EID_EXTENSION) {
243 if (!ext_id_len)
244 return true;
245 loop_len = ext_id_len;
246 list = &non_inherit_elem->data[3 + id_len];
247 id = elem->data[0];
248 } else {
249 if (!id_len)
250 return true;
251 loop_len = id_len;
252 list = &non_inherit_elem->data[2];
253 id = elem->id;
254 }
255
256 for (i = 0; i < loop_len; i++) {
257 if (list[i] == id)
258 return false;
259 }
260
261 return true;
262 }
263 EXPORT_SYMBOL(cfg80211_is_element_inherited);
264
cfg80211_gen_new_ie(const u8 * ie,size_t ielen,const u8 * subelement,size_t subie_len,u8 * new_ie,gfp_t gfp)265 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
266 const u8 *subelement, size_t subie_len,
267 u8 *new_ie, gfp_t gfp)
268 {
269 u8 *pos, *tmp;
270 const u8 *tmp_old, *tmp_new;
271 const struct element *non_inherit_elem;
272 u8 *sub_copy;
273
274 /* copy subelement as we need to change its content to
275 * mark an ie after it is processed.
276 */
277 sub_copy = kmemdup(subelement, subie_len, gfp);
278 if (!sub_copy)
279 return 0;
280
281 pos = &new_ie[0];
282
283 /* set new ssid */
284 tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len);
285 if (tmp_new) {
286 memcpy(pos, tmp_new, tmp_new[1] + 2);
287 pos += (tmp_new[1] + 2);
288 }
289
290 /* get non inheritance list if exists */
291 non_inherit_elem =
292 cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
293 sub_copy, subie_len);
294
295 /* go through IEs in ie (skip SSID) and subelement,
296 * merge them into new_ie
297 */
298 tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
299 tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
300
301 while (tmp_old + 2 - ie <= ielen &&
302 tmp_old + tmp_old[1] + 2 - ie <= ielen) {
303 if (tmp_old[0] == 0) {
304 tmp_old++;
305 continue;
306 }
307
308 if (tmp_old[0] == WLAN_EID_EXTENSION)
309 tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy,
310 subie_len);
311 else
312 tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy,
313 subie_len);
314
315 if (!tmp) {
316 const struct element *old_elem = (void *)tmp_old;
317
318 /* ie in old ie but not in subelement */
319 if (cfg80211_is_element_inherited(old_elem,
320 non_inherit_elem)) {
321 memcpy(pos, tmp_old, tmp_old[1] + 2);
322 pos += tmp_old[1] + 2;
323 }
324 } else {
325 /* ie in transmitting ie also in subelement,
326 * copy from subelement and flag the ie in subelement
327 * as copied (by setting eid field to WLAN_EID_SSID,
328 * which is skipped anyway).
329 * For vendor ie, compare OUI + type + subType to
330 * determine if they are the same ie.
331 */
332 if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) {
333 if (tmp_old[1] >= 5 && tmp[1] >= 5 &&
334 !memcmp(tmp_old + 2, tmp + 2, 5)) {
335 /* same vendor ie, copy from
336 * subelement
337 */
338 memcpy(pos, tmp, tmp[1] + 2);
339 pos += tmp[1] + 2;
340 tmp[0] = WLAN_EID_SSID;
341 } else {
342 memcpy(pos, tmp_old, tmp_old[1] + 2);
343 pos += tmp_old[1] + 2;
344 }
345 } else {
346 /* copy ie from subelement into new ie */
347 memcpy(pos, tmp, tmp[1] + 2);
348 pos += tmp[1] + 2;
349 tmp[0] = WLAN_EID_SSID;
350 }
351 }
352
353 if (tmp_old + tmp_old[1] + 2 - ie == ielen)
354 break;
355
356 tmp_old += tmp_old[1] + 2;
357 }
358
359 /* go through subelement again to check if there is any ie not
360 * copied to new ie, skip ssid, capability, bssid-index ie
361 */
362 tmp_new = sub_copy;
363 while (tmp_new + 2 - sub_copy <= subie_len &&
364 tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
365 if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
366 tmp_new[0] == WLAN_EID_SSID)) {
367 memcpy(pos, tmp_new, tmp_new[1] + 2);
368 pos += tmp_new[1] + 2;
369 }
370 if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len)
371 break;
372 tmp_new += tmp_new[1] + 2;
373 }
374
375 kfree(sub_copy);
376 return pos - new_ie;
377 }
378
is_bss(struct cfg80211_bss * a,const u8 * bssid,const u8 * ssid,size_t ssid_len)379 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
380 const u8 *ssid, size_t ssid_len)
381 {
382 const struct cfg80211_bss_ies *ies;
383 const u8 *ssidie;
384
385 if (bssid && !ether_addr_equal(a->bssid, bssid))
386 return false;
387
388 if (!ssid)
389 return true;
390
391 ies = rcu_access_pointer(a->ies);
392 if (!ies)
393 return false;
394 ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
395 if (!ssidie)
396 return false;
397 if (ssidie[1] != ssid_len)
398 return false;
399 return memcmp(ssidie + 2, ssid, ssid_len) == 0;
400 }
401
402 static int
cfg80211_add_nontrans_list(struct cfg80211_bss * trans_bss,struct cfg80211_bss * nontrans_bss)403 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
404 struct cfg80211_bss *nontrans_bss)
405 {
406 const u8 *ssid;
407 size_t ssid_len;
408 struct cfg80211_bss *bss = NULL;
409
410 rcu_read_lock();
411 ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
412 if (!ssid) {
413 rcu_read_unlock();
414 return -EINVAL;
415 }
416 ssid_len = ssid[1];
417 ssid = ssid + 2;
418
419 /* check if nontrans_bss is in the list */
420 list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
421 if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) {
422 rcu_read_unlock();
423 return 0;
424 }
425 }
426
427 rcu_read_unlock();
428
429 /*
430 * This is a bit weird - it's not on the list, but already on another
431 * one! The only way that could happen is if there's some BSSID/SSID
432 * shared by multiple APs in their multi-BSSID profiles, potentially
433 * with hidden SSID mixed in ... ignore it.
434 */
435 if (!list_empty(&nontrans_bss->nontrans_list))
436 return -EINVAL;
437
438 /* add to the list */
439 list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
440 return 0;
441 }
442
__cfg80211_bss_expire(struct cfg80211_registered_device * rdev,unsigned long expire_time)443 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
444 unsigned long expire_time)
445 {
446 struct cfg80211_internal_bss *bss, *tmp;
447 bool expired = false;
448
449 lockdep_assert_held(&rdev->bss_lock);
450
451 list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
452 if (atomic_read(&bss->hold))
453 continue;
454 if (!time_after(expire_time, bss->ts))
455 continue;
456
457 if (__cfg80211_unlink_bss(rdev, bss))
458 expired = true;
459 }
460
461 if (expired)
462 rdev->bss_generation++;
463 }
464
cfg80211_bss_expire_oldest(struct cfg80211_registered_device * rdev)465 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
466 {
467 struct cfg80211_internal_bss *bss, *oldest = NULL;
468 bool ret;
469
470 lockdep_assert_held(&rdev->bss_lock);
471
472 list_for_each_entry(bss, &rdev->bss_list, list) {
473 if (atomic_read(&bss->hold))
474 continue;
475
476 if (!list_empty(&bss->hidden_list) &&
477 !bss->pub.hidden_beacon_bss)
478 continue;
479
480 if (oldest && time_before(oldest->ts, bss->ts))
481 continue;
482 oldest = bss;
483 }
484
485 if (WARN_ON(!oldest))
486 return false;
487
488 /*
489 * The callers make sure to increase rdev->bss_generation if anything
490 * gets removed (and a new entry added), so there's no need to also do
491 * it here.
492 */
493
494 ret = __cfg80211_unlink_bss(rdev, oldest);
495 WARN_ON(!ret);
496 return ret;
497 }
498
cfg80211_parse_bss_param(u8 data,struct cfg80211_colocated_ap * coloc_ap)499 static u8 cfg80211_parse_bss_param(u8 data,
500 struct cfg80211_colocated_ap *coloc_ap)
501 {
502 coloc_ap->oct_recommended =
503 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
504 coloc_ap->same_ssid =
505 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
506 coloc_ap->multi_bss =
507 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
508 coloc_ap->transmitted_bssid =
509 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
510 coloc_ap->unsolicited_probe =
511 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
512 coloc_ap->colocated_ess =
513 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
514
515 return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
516 }
517
cfg80211_calc_short_ssid(const struct cfg80211_bss_ies * ies,const struct element ** elem,u32 * s_ssid)518 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
519 const struct element **elem, u32 *s_ssid)
520 {
521
522 *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
523 if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
524 return -EINVAL;
525
526 *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen);
527 return 0;
528 }
529
cfg80211_free_coloc_ap_list(struct list_head * coloc_ap_list)530 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
531 {
532 struct cfg80211_colocated_ap *ap, *tmp_ap;
533
534 list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
535 list_del(&ap->list);
536 kfree(ap);
537 }
538 }
539
cfg80211_parse_ap_info(struct cfg80211_colocated_ap * entry,const u8 * pos,u8 length,const struct element * ssid_elem,int s_ssid_tmp)540 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
541 const u8 *pos, u8 length,
542 const struct element *ssid_elem,
543 int s_ssid_tmp)
544 {
545 /* skip the TBTT offset */
546 pos++;
547
548 memcpy(entry->bssid, pos, ETH_ALEN);
549 pos += ETH_ALEN;
550
551 if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM) {
552 memcpy(&entry->short_ssid, pos,
553 sizeof(entry->short_ssid));
554 entry->short_ssid_valid = true;
555 pos += 4;
556 }
557
558 /* skip non colocated APs */
559 if (!cfg80211_parse_bss_param(*pos, entry))
560 return -EINVAL;
561 pos++;
562
563 if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM) {
564 /*
565 * no information about the short ssid. Consider the entry valid
566 * for now. It would later be dropped in case there are explicit
567 * SSIDs that need to be matched
568 */
569 if (!entry->same_ssid)
570 return 0;
571 }
572
573 if (entry->same_ssid) {
574 entry->short_ssid = s_ssid_tmp;
575 entry->short_ssid_valid = true;
576
577 /*
578 * This is safe because we validate datalen in
579 * cfg80211_parse_colocated_ap(), before calling this
580 * function.
581 */
582 memcpy(&entry->ssid, &ssid_elem->data,
583 ssid_elem->datalen);
584 entry->ssid_len = ssid_elem->datalen;
585 }
586 return 0;
587 }
588
cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies * ies,struct list_head * list)589 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
590 struct list_head *list)
591 {
592 struct ieee80211_neighbor_ap_info *ap_info;
593 const struct element *elem, *ssid_elem;
594 const u8 *pos, *end;
595 u32 s_ssid_tmp;
596 int n_coloc = 0, ret;
597 LIST_HEAD(ap_list);
598
599 elem = cfg80211_find_elem(WLAN_EID_REDUCED_NEIGHBOR_REPORT, ies->data,
600 ies->len);
601 if (!elem || elem->datalen > IEEE80211_MAX_SSID_LEN)
602 return 0;
603
604 pos = elem->data;
605 end = pos + elem->datalen;
606
607 ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp);
608 if (ret)
609 return ret;
610
611 /* RNR IE may contain more than one NEIGHBOR_AP_INFO */
612 while (pos + sizeof(*ap_info) <= end) {
613 enum nl80211_band band;
614 int freq;
615 u8 length, i, count;
616
617 ap_info = (void *)pos;
618 count = u8_get_bits(ap_info->tbtt_info_hdr,
619 IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
620 length = ap_info->tbtt_info_len;
621
622 pos += sizeof(*ap_info);
623
624 if (!ieee80211_operating_class_to_band(ap_info->op_class,
625 &band))
626 break;
627
628 freq = ieee80211_channel_to_frequency(ap_info->channel, band);
629
630 if (end - pos < count * ap_info->tbtt_info_len)
631 break;
632
633 /*
634 * TBTT info must include bss param + BSSID +
635 * (short SSID or same_ssid bit to be set).
636 * ignore other options, and move to the
637 * next AP info
638 */
639 if (band != NL80211_BAND_6GHZ ||
640 (length != IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM &&
641 length < IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM)) {
642 pos += count * ap_info->tbtt_info_len;
643 continue;
644 }
645
646 for (i = 0; i < count; i++) {
647 struct cfg80211_colocated_ap *entry;
648
649 entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
650 GFP_ATOMIC);
651
652 if (!entry)
653 break;
654
655 entry->center_freq = freq;
656
657 if (!cfg80211_parse_ap_info(entry, pos, length,
658 ssid_elem, s_ssid_tmp)) {
659 n_coloc++;
660 list_add_tail(&entry->list, &ap_list);
661 } else {
662 kfree(entry);
663 }
664
665 pos += ap_info->tbtt_info_len;
666 }
667 }
668
669 if (pos != end) {
670 cfg80211_free_coloc_ap_list(&ap_list);
671 return 0;
672 }
673
674 list_splice_tail(&ap_list, list);
675 return n_coloc;
676 }
677
cfg80211_scan_req_add_chan(struct cfg80211_scan_request * request,struct ieee80211_channel * chan,bool add_to_6ghz)678 static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
679 struct ieee80211_channel *chan,
680 bool add_to_6ghz)
681 {
682 int i;
683 u32 n_channels = request->n_channels;
684 struct cfg80211_scan_6ghz_params *params =
685 &request->scan_6ghz_params[request->n_6ghz_params];
686
687 for (i = 0; i < n_channels; i++) {
688 if (request->channels[i] == chan) {
689 if (add_to_6ghz)
690 params->channel_idx = i;
691 return;
692 }
693 }
694
695 request->channels[n_channels] = chan;
696 if (add_to_6ghz)
697 request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
698 n_channels;
699
700 request->n_channels++;
701 }
702
cfg80211_find_ssid_match(struct cfg80211_colocated_ap * ap,struct cfg80211_scan_request * request)703 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
704 struct cfg80211_scan_request *request)
705 {
706 int i;
707 u32 s_ssid;
708
709 for (i = 0; i < request->n_ssids; i++) {
710 /* wildcard ssid in the scan request */
711 if (!request->ssids[i].ssid_len) {
712 if (ap->multi_bss && !ap->transmitted_bssid)
713 continue;
714
715 return true;
716 }
717
718 if (ap->ssid_len &&
719 ap->ssid_len == request->ssids[i].ssid_len) {
720 if (!memcmp(request->ssids[i].ssid, ap->ssid,
721 ap->ssid_len))
722 return true;
723 } else if (ap->short_ssid_valid) {
724 s_ssid = ~crc32_le(~0, request->ssids[i].ssid,
725 request->ssids[i].ssid_len);
726
727 if (ap->short_ssid == s_ssid)
728 return true;
729 }
730 }
731
732 return false;
733 }
734
cfg80211_scan_6ghz(struct cfg80211_registered_device * rdev)735 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
736 {
737 u8 i;
738 struct cfg80211_colocated_ap *ap;
739 int n_channels, count = 0, err;
740 struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
741 LIST_HEAD(coloc_ap_list);
742 bool need_scan_psc;
743 const struct ieee80211_sband_iftype_data *iftd;
744
745 rdev_req->scan_6ghz = true;
746
747 if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
748 return -EOPNOTSUPP;
749
750 iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ],
751 rdev_req->wdev->iftype);
752 if (!iftd || !iftd->he_cap.has_he)
753 return -EOPNOTSUPP;
754
755 n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
756
757 if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
758 struct cfg80211_internal_bss *intbss;
759
760 spin_lock_bh(&rdev->bss_lock);
761 list_for_each_entry(intbss, &rdev->bss_list, list) {
762 struct cfg80211_bss *res = &intbss->pub;
763 const struct cfg80211_bss_ies *ies;
764
765 ies = rcu_access_pointer(res->ies);
766 count += cfg80211_parse_colocated_ap(ies,
767 &coloc_ap_list);
768 }
769 spin_unlock_bh(&rdev->bss_lock);
770 }
771
772 request = kzalloc(struct_size(request, channels, n_channels) +
773 sizeof(*request->scan_6ghz_params) * count,
774 GFP_KERNEL);
775 if (!request) {
776 cfg80211_free_coloc_ap_list(&coloc_ap_list);
777 return -ENOMEM;
778 }
779
780 *request = *rdev_req;
781 request->n_channels = 0;
782 request->scan_6ghz_params =
783 (void *)&request->channels[n_channels];
784
785 /*
786 * PSC channels should not be scanned if all the reported co-located APs
787 * are indicating that all APs in the same ESS are co-located
788 */
789 if (count) {
790 need_scan_psc = false;
791
792 list_for_each_entry(ap, &coloc_ap_list, list) {
793 if (!ap->colocated_ess) {
794 need_scan_psc = true;
795 break;
796 }
797 }
798 } else {
799 need_scan_psc = true;
800 }
801
802 /*
803 * add to the scan request the channels that need to be scanned
804 * regardless of the collocated APs (PSC channels or all channels
805 * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
806 */
807 for (i = 0; i < rdev_req->n_channels; i++) {
808 if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ &&
809 ((need_scan_psc &&
810 cfg80211_channel_is_psc(rdev_req->channels[i])) ||
811 !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
812 cfg80211_scan_req_add_chan(request,
813 rdev_req->channels[i],
814 false);
815 }
816 }
817
818 if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
819 goto skip;
820
821 list_for_each_entry(ap, &coloc_ap_list, list) {
822 bool found = false;
823 struct cfg80211_scan_6ghz_params *scan_6ghz_params =
824 &request->scan_6ghz_params[request->n_6ghz_params];
825 struct ieee80211_channel *chan =
826 ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
827
828 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
829 continue;
830
831 for (i = 0; i < rdev_req->n_channels; i++) {
832 if (rdev_req->channels[i] == chan)
833 found = true;
834 }
835
836 if (!found)
837 continue;
838
839 if (request->n_ssids > 0 &&
840 !cfg80211_find_ssid_match(ap, request))
841 continue;
842
843 if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
844 continue;
845
846 cfg80211_scan_req_add_chan(request, chan, true);
847 memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
848 scan_6ghz_params->short_ssid = ap->short_ssid;
849 scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
850 scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
851
852 /*
853 * If a PSC channel is added to the scan and 'need_scan_psc' is
854 * set to false, then all the APs that the scan logic is
855 * interested with on the channel are collocated and thus there
856 * is no need to perform the initial PSC channel listen.
857 */
858 if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
859 scan_6ghz_params->psc_no_listen = true;
860
861 request->n_6ghz_params++;
862 }
863
864 skip:
865 cfg80211_free_coloc_ap_list(&coloc_ap_list);
866
867 if (request->n_channels) {
868 struct cfg80211_scan_request *old = rdev->int_scan_req;
869
870 rdev->int_scan_req = request;
871
872 /*
873 * If this scan follows a previous scan, save the scan start
874 * info from the first part of the scan
875 */
876 if (old)
877 rdev->int_scan_req->info = old->info;
878
879 err = rdev_scan(rdev, request);
880 if (err) {
881 rdev->int_scan_req = old;
882 kfree(request);
883 } else {
884 kfree(old);
885 }
886
887 return err;
888 }
889
890 kfree(request);
891 return -EINVAL;
892 }
893
cfg80211_scan(struct cfg80211_registered_device * rdev)894 int cfg80211_scan(struct cfg80211_registered_device *rdev)
895 {
896 struct cfg80211_scan_request *request;
897 struct cfg80211_scan_request *rdev_req = rdev->scan_req;
898 u32 n_channels = 0, idx, i;
899
900 if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ))
901 return rdev_scan(rdev, rdev_req);
902
903 for (i = 0; i < rdev_req->n_channels; i++) {
904 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
905 n_channels++;
906 }
907
908 if (!n_channels)
909 return cfg80211_scan_6ghz(rdev);
910
911 request = kzalloc(struct_size(request, channels, n_channels),
912 GFP_KERNEL);
913 if (!request)
914 return -ENOMEM;
915
916 *request = *rdev_req;
917 request->n_channels = n_channels;
918
919 for (i = idx = 0; i < rdev_req->n_channels; i++) {
920 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
921 request->channels[idx++] = rdev_req->channels[i];
922 }
923
924 rdev_req->scan_6ghz = false;
925 rdev->int_scan_req = request;
926 return rdev_scan(rdev, request);
927 }
928
___cfg80211_scan_done(struct cfg80211_registered_device * rdev,bool send_message)929 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
930 bool send_message)
931 {
932 struct cfg80211_scan_request *request, *rdev_req;
933 struct wireless_dev *wdev;
934 struct sk_buff *msg;
935 #ifdef CONFIG_CFG80211_WEXT
936 union iwreq_data wrqu;
937 #endif
938
939 ASSERT_RTNL();
940
941 if (rdev->scan_msg) {
942 nl80211_send_scan_msg(rdev, rdev->scan_msg);
943 rdev->scan_msg = NULL;
944 return;
945 }
946
947 rdev_req = rdev->scan_req;
948 if (!rdev_req)
949 return;
950
951 wdev = rdev_req->wdev;
952 request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
953
954 if (wdev_running(wdev) &&
955 (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
956 !rdev_req->scan_6ghz && !request->info.aborted &&
957 !cfg80211_scan_6ghz(rdev))
958 return;
959
960 /*
961 * This must be before sending the other events!
962 * Otherwise, wpa_supplicant gets completely confused with
963 * wext events.
964 */
965 if (wdev->netdev)
966 cfg80211_sme_scan_done(wdev->netdev);
967
968 if (!request->info.aborted &&
969 request->flags & NL80211_SCAN_FLAG_FLUSH) {
970 /* flush entries from previous scans */
971 spin_lock_bh(&rdev->bss_lock);
972 __cfg80211_bss_expire(rdev, request->scan_start);
973 spin_unlock_bh(&rdev->bss_lock);
974 }
975
976 msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
977
978 #ifdef CONFIG_CFG80211_WEXT
979 if (wdev->netdev && !request->info.aborted) {
980 memset(&wrqu, 0, sizeof(wrqu));
981
982 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
983 }
984 #endif
985
986 if (wdev->netdev)
987 dev_put(wdev->netdev);
988
989 kfree(rdev->int_scan_req);
990 rdev->int_scan_req = NULL;
991
992 kfree(rdev->scan_req);
993 rdev->scan_req = NULL;
994
995 if (!send_message)
996 rdev->scan_msg = msg;
997 else
998 nl80211_send_scan_msg(rdev, msg);
999 }
1000
__cfg80211_scan_done(struct work_struct * wk)1001 void __cfg80211_scan_done(struct work_struct *wk)
1002 {
1003 struct cfg80211_registered_device *rdev;
1004
1005 rdev = container_of(wk, struct cfg80211_registered_device,
1006 scan_done_wk);
1007
1008 rtnl_lock();
1009 ___cfg80211_scan_done(rdev, true);
1010 rtnl_unlock();
1011 }
1012
cfg80211_scan_done(struct cfg80211_scan_request * request,struct cfg80211_scan_info * info)1013 void cfg80211_scan_done(struct cfg80211_scan_request *request,
1014 struct cfg80211_scan_info *info)
1015 {
1016 struct cfg80211_scan_info old_info = request->info;
1017
1018 trace_cfg80211_scan_done(request, info);
1019 WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req &&
1020 request != wiphy_to_rdev(request->wiphy)->int_scan_req);
1021
1022 request->info = *info;
1023
1024 /*
1025 * In case the scan is split, the scan_start_tsf and tsf_bssid should
1026 * be of the first part. In such a case old_info.scan_start_tsf should
1027 * be non zero.
1028 */
1029 if (request->scan_6ghz && old_info.scan_start_tsf) {
1030 request->info.scan_start_tsf = old_info.scan_start_tsf;
1031 memcpy(request->info.tsf_bssid, old_info.tsf_bssid,
1032 sizeof(request->info.tsf_bssid));
1033 }
1034
1035 request->notified = true;
1036 queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
1037 }
1038 EXPORT_SYMBOL(cfg80211_scan_done);
1039
cfg80211_add_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req)1040 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
1041 struct cfg80211_sched_scan_request *req)
1042 {
1043 ASSERT_RTNL();
1044
1045 list_add_rcu(&req->list, &rdev->sched_scan_req_list);
1046 }
1047
cfg80211_del_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req)1048 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
1049 struct cfg80211_sched_scan_request *req)
1050 {
1051 ASSERT_RTNL();
1052
1053 list_del_rcu(&req->list);
1054 kfree_rcu(req, rcu_head);
1055 }
1056
1057 static struct cfg80211_sched_scan_request *
cfg80211_find_sched_scan_req(struct cfg80211_registered_device * rdev,u64 reqid)1058 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
1059 {
1060 struct cfg80211_sched_scan_request *pos;
1061
1062 list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
1063 lockdep_rtnl_is_held()) {
1064 if (pos->reqid == reqid)
1065 return pos;
1066 }
1067 return NULL;
1068 }
1069
1070 /*
1071 * Determines if a scheduled scan request can be handled. When a legacy
1072 * scheduled scan is running no other scheduled scan is allowed regardless
1073 * whether the request is for legacy or multi-support scan. When a multi-support
1074 * scheduled scan is running a request for legacy scan is not allowed. In this
1075 * case a request for multi-support scan can be handled if resources are
1076 * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
1077 */
cfg80211_sched_scan_req_possible(struct cfg80211_registered_device * rdev,bool want_multi)1078 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
1079 bool want_multi)
1080 {
1081 struct cfg80211_sched_scan_request *pos;
1082 int i = 0;
1083
1084 list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
1085 /* request id zero means legacy in progress */
1086 if (!i && !pos->reqid)
1087 return -EINPROGRESS;
1088 i++;
1089 }
1090
1091 if (i) {
1092 /* no legacy allowed when multi request(s) are active */
1093 if (!want_multi)
1094 return -EINPROGRESS;
1095
1096 /* resource limit reached */
1097 if (i == rdev->wiphy.max_sched_scan_reqs)
1098 return -ENOSPC;
1099 }
1100 return 0;
1101 }
1102
cfg80211_sched_scan_results_wk(struct work_struct * work)1103 void cfg80211_sched_scan_results_wk(struct work_struct *work)
1104 {
1105 struct cfg80211_registered_device *rdev;
1106 struct cfg80211_sched_scan_request *req, *tmp;
1107
1108 rdev = container_of(work, struct cfg80211_registered_device,
1109 sched_scan_res_wk);
1110
1111 rtnl_lock();
1112 list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
1113 if (req->report_results) {
1114 req->report_results = false;
1115 if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
1116 /* flush entries from previous scans */
1117 spin_lock_bh(&rdev->bss_lock);
1118 __cfg80211_bss_expire(rdev, req->scan_start);
1119 spin_unlock_bh(&rdev->bss_lock);
1120 req->scan_start = jiffies;
1121 }
1122 nl80211_send_sched_scan(req,
1123 NL80211_CMD_SCHED_SCAN_RESULTS);
1124 }
1125 }
1126 rtnl_unlock();
1127 }
1128
cfg80211_sched_scan_results(struct wiphy * wiphy,u64 reqid)1129 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
1130 {
1131 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1132 struct cfg80211_sched_scan_request *request;
1133
1134 trace_cfg80211_sched_scan_results(wiphy, reqid);
1135 /* ignore if we're not scanning */
1136
1137 rcu_read_lock();
1138 request = cfg80211_find_sched_scan_req(rdev, reqid);
1139 if (request) {
1140 request->report_results = true;
1141 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
1142 }
1143 rcu_read_unlock();
1144 }
1145 EXPORT_SYMBOL(cfg80211_sched_scan_results);
1146
cfg80211_sched_scan_stopped_rtnl(struct wiphy * wiphy,u64 reqid)1147 void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy, u64 reqid)
1148 {
1149 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1150
1151 ASSERT_RTNL();
1152
1153 trace_cfg80211_sched_scan_stopped(wiphy, reqid);
1154
1155 __cfg80211_stop_sched_scan(rdev, reqid, true);
1156 }
1157 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
1158
cfg80211_sched_scan_stopped(struct wiphy * wiphy,u64 reqid)1159 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
1160 {
1161 rtnl_lock();
1162 cfg80211_sched_scan_stopped_rtnl(wiphy, reqid);
1163 rtnl_unlock();
1164 }
1165 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
1166
cfg80211_stop_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req,bool driver_initiated)1167 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
1168 struct cfg80211_sched_scan_request *req,
1169 bool driver_initiated)
1170 {
1171 ASSERT_RTNL();
1172
1173 if (!driver_initiated) {
1174 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
1175 if (err)
1176 return err;
1177 }
1178
1179 nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
1180
1181 cfg80211_del_sched_scan_req(rdev, req);
1182
1183 return 0;
1184 }
1185
__cfg80211_stop_sched_scan(struct cfg80211_registered_device * rdev,u64 reqid,bool driver_initiated)1186 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
1187 u64 reqid, bool driver_initiated)
1188 {
1189 struct cfg80211_sched_scan_request *sched_scan_req;
1190
1191 ASSERT_RTNL();
1192
1193 sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
1194 if (!sched_scan_req)
1195 return -ENOENT;
1196
1197 return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
1198 driver_initiated);
1199 }
1200
cfg80211_bss_age(struct cfg80211_registered_device * rdev,unsigned long age_secs)1201 void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
1202 unsigned long age_secs)
1203 {
1204 struct cfg80211_internal_bss *bss;
1205 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
1206
1207 spin_lock_bh(&rdev->bss_lock);
1208 list_for_each_entry(bss, &rdev->bss_list, list)
1209 bss->ts -= age_jiffies;
1210 spin_unlock_bh(&rdev->bss_lock);
1211 }
1212
cfg80211_bss_expire(struct cfg80211_registered_device * rdev)1213 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
1214 {
1215 __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
1216 }
1217
cfg80211_bss_flush(struct wiphy * wiphy)1218 void cfg80211_bss_flush(struct wiphy *wiphy)
1219 {
1220 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1221
1222 spin_lock_bh(&rdev->bss_lock);
1223 __cfg80211_bss_expire(rdev, jiffies);
1224 spin_unlock_bh(&rdev->bss_lock);
1225 }
1226 EXPORT_SYMBOL(cfg80211_bss_flush);
1227
1228 const struct element *
cfg80211_find_elem_match(u8 eid,const u8 * ies,unsigned int len,const u8 * match,unsigned int match_len,unsigned int match_offset)1229 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
1230 const u8 *match, unsigned int match_len,
1231 unsigned int match_offset)
1232 {
1233 const struct element *elem;
1234
1235 for_each_element_id(elem, eid, ies, len) {
1236 if (elem->datalen >= match_offset + match_len &&
1237 !memcmp(elem->data + match_offset, match, match_len))
1238 return elem;
1239 }
1240
1241 return NULL;
1242 }
1243 EXPORT_SYMBOL(cfg80211_find_elem_match);
1244
cfg80211_find_vendor_elem(unsigned int oui,int oui_type,const u8 * ies,unsigned int len)1245 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
1246 const u8 *ies,
1247 unsigned int len)
1248 {
1249 const struct element *elem;
1250 u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
1251 int match_len = (oui_type < 0) ? 3 : sizeof(match);
1252
1253 if (WARN_ON(oui_type > 0xff))
1254 return NULL;
1255
1256 elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
1257 match, match_len, 0);
1258
1259 if (!elem || elem->datalen < 4)
1260 return NULL;
1261
1262 return elem;
1263 }
1264 EXPORT_SYMBOL(cfg80211_find_vendor_elem);
1265
1266 /**
1267 * enum bss_compare_mode - BSS compare mode
1268 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
1269 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
1270 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
1271 */
1272 enum bss_compare_mode {
1273 BSS_CMP_REGULAR,
1274 BSS_CMP_HIDE_ZLEN,
1275 BSS_CMP_HIDE_NUL,
1276 };
1277
cmp_bss(struct cfg80211_bss * a,struct cfg80211_bss * b,enum bss_compare_mode mode)1278 static int cmp_bss(struct cfg80211_bss *a,
1279 struct cfg80211_bss *b,
1280 enum bss_compare_mode mode)
1281 {
1282 const struct cfg80211_bss_ies *a_ies, *b_ies;
1283 const u8 *ie1 = NULL;
1284 const u8 *ie2 = NULL;
1285 int i, r;
1286
1287 if (a->channel != b->channel)
1288 return b->channel->center_freq - a->channel->center_freq;
1289
1290 a_ies = rcu_access_pointer(a->ies);
1291 if (!a_ies)
1292 return -1;
1293 b_ies = rcu_access_pointer(b->ies);
1294 if (!b_ies)
1295 return 1;
1296
1297 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
1298 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1299 a_ies->data, a_ies->len);
1300 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
1301 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1302 b_ies->data, b_ies->len);
1303 if (ie1 && ie2) {
1304 int mesh_id_cmp;
1305
1306 if (ie1[1] == ie2[1])
1307 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1308 else
1309 mesh_id_cmp = ie2[1] - ie1[1];
1310
1311 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1312 a_ies->data, a_ies->len);
1313 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1314 b_ies->data, b_ies->len);
1315 if (ie1 && ie2) {
1316 if (mesh_id_cmp)
1317 return mesh_id_cmp;
1318 if (ie1[1] != ie2[1])
1319 return ie2[1] - ie1[1];
1320 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1321 }
1322 }
1323
1324 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
1325 if (r)
1326 return r;
1327
1328 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
1329 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
1330
1331 if (!ie1 && !ie2)
1332 return 0;
1333
1334 /*
1335 * Note that with "hide_ssid", the function returns a match if
1336 * the already-present BSS ("b") is a hidden SSID beacon for
1337 * the new BSS ("a").
1338 */
1339
1340 /* sort missing IE before (left of) present IE */
1341 if (!ie1)
1342 return -1;
1343 if (!ie2)
1344 return 1;
1345
1346 switch (mode) {
1347 case BSS_CMP_HIDE_ZLEN:
1348 /*
1349 * In ZLEN mode we assume the BSS entry we're
1350 * looking for has a zero-length SSID. So if
1351 * the one we're looking at right now has that,
1352 * return 0. Otherwise, return the difference
1353 * in length, but since we're looking for the
1354 * 0-length it's really equivalent to returning
1355 * the length of the one we're looking at.
1356 *
1357 * No content comparison is needed as we assume
1358 * the content length is zero.
1359 */
1360 return ie2[1];
1361 case BSS_CMP_REGULAR:
1362 default:
1363 /* sort by length first, then by contents */
1364 if (ie1[1] != ie2[1])
1365 return ie2[1] - ie1[1];
1366 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1367 case BSS_CMP_HIDE_NUL:
1368 if (ie1[1] != ie2[1])
1369 return ie2[1] - ie1[1];
1370 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
1371 for (i = 0; i < ie2[1]; i++)
1372 if (ie2[i + 2])
1373 return -1;
1374 return 0;
1375 }
1376 }
1377
cfg80211_bss_type_match(u16 capability,enum nl80211_band band,enum ieee80211_bss_type bss_type)1378 static bool cfg80211_bss_type_match(u16 capability,
1379 enum nl80211_band band,
1380 enum ieee80211_bss_type bss_type)
1381 {
1382 bool ret = true;
1383 u16 mask, val;
1384
1385 if (bss_type == IEEE80211_BSS_TYPE_ANY)
1386 return ret;
1387
1388 if (band == NL80211_BAND_60GHZ) {
1389 mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
1390 switch (bss_type) {
1391 case IEEE80211_BSS_TYPE_ESS:
1392 val = WLAN_CAPABILITY_DMG_TYPE_AP;
1393 break;
1394 case IEEE80211_BSS_TYPE_PBSS:
1395 val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
1396 break;
1397 case IEEE80211_BSS_TYPE_IBSS:
1398 val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
1399 break;
1400 default:
1401 return false;
1402 }
1403 } else {
1404 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
1405 switch (bss_type) {
1406 case IEEE80211_BSS_TYPE_ESS:
1407 val = WLAN_CAPABILITY_ESS;
1408 break;
1409 case IEEE80211_BSS_TYPE_IBSS:
1410 val = WLAN_CAPABILITY_IBSS;
1411 break;
1412 case IEEE80211_BSS_TYPE_MBSS:
1413 val = 0;
1414 break;
1415 default:
1416 return false;
1417 }
1418 }
1419
1420 ret = ((capability & mask) == val);
1421 return ret;
1422 }
1423
1424 /* Returned bss is reference counted and must be cleaned up appropriately. */
cfg80211_get_bss(struct wiphy * wiphy,struct ieee80211_channel * channel,const u8 * bssid,const u8 * ssid,size_t ssid_len,enum ieee80211_bss_type bss_type,enum ieee80211_privacy privacy)1425 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
1426 struct ieee80211_channel *channel,
1427 const u8 *bssid,
1428 const u8 *ssid, size_t ssid_len,
1429 enum ieee80211_bss_type bss_type,
1430 enum ieee80211_privacy privacy)
1431 {
1432 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1433 struct cfg80211_internal_bss *bss, *res = NULL;
1434 unsigned long now = jiffies;
1435 int bss_privacy;
1436
1437 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
1438 privacy);
1439
1440 spin_lock_bh(&rdev->bss_lock);
1441
1442 list_for_each_entry(bss, &rdev->bss_list, list) {
1443 if (!cfg80211_bss_type_match(bss->pub.capability,
1444 bss->pub.channel->band, bss_type))
1445 continue;
1446
1447 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
1448 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
1449 (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
1450 continue;
1451 if (channel && bss->pub.channel != channel)
1452 continue;
1453 if (!is_valid_ether_addr(bss->pub.bssid))
1454 continue;
1455 /* Don't get expired BSS structs */
1456 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
1457 !atomic_read(&bss->hold))
1458 continue;
1459 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
1460 res = bss;
1461 bss_ref_get(rdev, res);
1462 break;
1463 }
1464 }
1465
1466 spin_unlock_bh(&rdev->bss_lock);
1467 if (!res)
1468 return NULL;
1469 trace_cfg80211_return_bss(&res->pub);
1470 return &res->pub;
1471 }
1472 EXPORT_SYMBOL(cfg80211_get_bss);
1473
rb_insert_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)1474 static void rb_insert_bss(struct cfg80211_registered_device *rdev,
1475 struct cfg80211_internal_bss *bss)
1476 {
1477 struct rb_node **p = &rdev->bss_tree.rb_node;
1478 struct rb_node *parent = NULL;
1479 struct cfg80211_internal_bss *tbss;
1480 int cmp;
1481
1482 while (*p) {
1483 parent = *p;
1484 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
1485
1486 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
1487
1488 if (WARN_ON(!cmp)) {
1489 /* will sort of leak this BSS */
1490 return;
1491 }
1492
1493 if (cmp < 0)
1494 p = &(*p)->rb_left;
1495 else
1496 p = &(*p)->rb_right;
1497 }
1498
1499 rb_link_node(&bss->rbn, parent, p);
1500 rb_insert_color(&bss->rbn, &rdev->bss_tree);
1501 }
1502
1503 static struct cfg80211_internal_bss *
rb_find_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * res,enum bss_compare_mode mode)1504 rb_find_bss(struct cfg80211_registered_device *rdev,
1505 struct cfg80211_internal_bss *res,
1506 enum bss_compare_mode mode)
1507 {
1508 struct rb_node *n = rdev->bss_tree.rb_node;
1509 struct cfg80211_internal_bss *bss;
1510 int r;
1511
1512 while (n) {
1513 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
1514 r = cmp_bss(&res->pub, &bss->pub, mode);
1515
1516 if (r == 0)
1517 return bss;
1518 else if (r < 0)
1519 n = n->rb_left;
1520 else
1521 n = n->rb_right;
1522 }
1523
1524 return NULL;
1525 }
1526
cfg80211_combine_bsses(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * new)1527 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
1528 struct cfg80211_internal_bss *new)
1529 {
1530 const struct cfg80211_bss_ies *ies;
1531 struct cfg80211_internal_bss *bss;
1532 const u8 *ie;
1533 int i, ssidlen;
1534 u8 fold = 0;
1535 u32 n_entries = 0;
1536
1537 ies = rcu_access_pointer(new->pub.beacon_ies);
1538 if (WARN_ON(!ies))
1539 return false;
1540
1541 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1542 if (!ie) {
1543 /* nothing to do */
1544 return true;
1545 }
1546
1547 ssidlen = ie[1];
1548 for (i = 0; i < ssidlen; i++)
1549 fold |= ie[2 + i];
1550
1551 if (fold) {
1552 /* not a hidden SSID */
1553 return true;
1554 }
1555
1556 /* This is the bad part ... */
1557
1558 list_for_each_entry(bss, &rdev->bss_list, list) {
1559 /*
1560 * we're iterating all the entries anyway, so take the
1561 * opportunity to validate the list length accounting
1562 */
1563 n_entries++;
1564
1565 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
1566 continue;
1567 if (bss->pub.channel != new->pub.channel)
1568 continue;
1569 if (bss->pub.scan_width != new->pub.scan_width)
1570 continue;
1571 if (rcu_access_pointer(bss->pub.beacon_ies))
1572 continue;
1573 ies = rcu_access_pointer(bss->pub.ies);
1574 if (!ies)
1575 continue;
1576 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1577 if (!ie)
1578 continue;
1579 if (ssidlen && ie[1] != ssidlen)
1580 continue;
1581 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
1582 continue;
1583 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
1584 list_del(&bss->hidden_list);
1585 /* combine them */
1586 list_add(&bss->hidden_list, &new->hidden_list);
1587 bss->pub.hidden_beacon_bss = &new->pub;
1588 new->refcount += bss->refcount;
1589 rcu_assign_pointer(bss->pub.beacon_ies,
1590 new->pub.beacon_ies);
1591 }
1592
1593 WARN_ONCE(n_entries != rdev->bss_entries,
1594 "rdev bss entries[%d]/list[len:%d] corruption\n",
1595 rdev->bss_entries, n_entries);
1596
1597 return true;
1598 }
1599
1600 struct cfg80211_non_tx_bss {
1601 struct cfg80211_bss *tx_bss;
1602 u8 max_bssid_indicator;
1603 u8 bssid_index;
1604 };
1605
cfg80211_update_hidden_bsses(struct cfg80211_internal_bss * known,const struct cfg80211_bss_ies * new_ies,const struct cfg80211_bss_ies * old_ies)1606 static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
1607 const struct cfg80211_bss_ies *new_ies,
1608 const struct cfg80211_bss_ies *old_ies)
1609 {
1610 struct cfg80211_internal_bss *bss;
1611
1612 /* Assign beacon IEs to all sub entries */
1613 list_for_each_entry(bss, &known->hidden_list, hidden_list) {
1614 const struct cfg80211_bss_ies *ies;
1615
1616 ies = rcu_access_pointer(bss->pub.beacon_ies);
1617 WARN_ON(ies != old_ies);
1618
1619 rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
1620 }
1621 }
1622
1623 static bool
cfg80211_update_known_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * known,struct cfg80211_internal_bss * new,bool signal_valid)1624 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
1625 struct cfg80211_internal_bss *known,
1626 struct cfg80211_internal_bss *new,
1627 bool signal_valid)
1628 {
1629 lockdep_assert_held(&rdev->bss_lock);
1630
1631 /* Update IEs */
1632 if (rcu_access_pointer(new->pub.proberesp_ies)) {
1633 const struct cfg80211_bss_ies *old;
1634
1635 old = rcu_access_pointer(known->pub.proberesp_ies);
1636
1637 rcu_assign_pointer(known->pub.proberesp_ies,
1638 new->pub.proberesp_ies);
1639 /* Override possible earlier Beacon frame IEs */
1640 rcu_assign_pointer(known->pub.ies,
1641 new->pub.proberesp_ies);
1642 if (old)
1643 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1644 } else if (rcu_access_pointer(new->pub.beacon_ies)) {
1645 const struct cfg80211_bss_ies *old;
1646
1647 if (known->pub.hidden_beacon_bss &&
1648 !list_empty(&known->hidden_list)) {
1649 const struct cfg80211_bss_ies *f;
1650
1651 /* The known BSS struct is one of the probe
1652 * response members of a group, but we're
1653 * receiving a beacon (beacon_ies in the new
1654 * bss is used). This can only mean that the
1655 * AP changed its beacon from not having an
1656 * SSID to showing it, which is confusing so
1657 * drop this information.
1658 */
1659
1660 f = rcu_access_pointer(new->pub.beacon_ies);
1661 kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
1662 return false;
1663 }
1664
1665 old = rcu_access_pointer(known->pub.beacon_ies);
1666
1667 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
1668
1669 /* Override IEs if they were from a beacon before */
1670 if (old == rcu_access_pointer(known->pub.ies))
1671 rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
1672
1673 cfg80211_update_hidden_bsses(known,
1674 rcu_access_pointer(new->pub.beacon_ies),
1675 old);
1676
1677 if (old)
1678 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1679 }
1680
1681 known->pub.beacon_interval = new->pub.beacon_interval;
1682
1683 /* don't update the signal if beacon was heard on
1684 * adjacent channel.
1685 */
1686 if (signal_valid)
1687 known->pub.signal = new->pub.signal;
1688 known->pub.capability = new->pub.capability;
1689 known->ts = new->ts;
1690 known->ts_boottime = new->ts_boottime;
1691 known->parent_tsf = new->parent_tsf;
1692 known->pub.chains = new->pub.chains;
1693 memcpy(known->pub.chain_signal, new->pub.chain_signal,
1694 IEEE80211_MAX_CHAINS);
1695 ether_addr_copy(known->parent_bssid, new->parent_bssid);
1696 known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
1697 known->pub.bssid_index = new->pub.bssid_index;
1698
1699 return true;
1700 }
1701
1702 /* Returned bss is reference counted and must be cleaned up appropriately. */
1703 struct cfg80211_internal_bss *
cfg80211_bss_update(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * tmp,bool signal_valid,unsigned long ts)1704 cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1705 struct cfg80211_internal_bss *tmp,
1706 bool signal_valid, unsigned long ts)
1707 {
1708 struct cfg80211_internal_bss *found = NULL;
1709
1710 if (WARN_ON(!tmp->pub.channel))
1711 return NULL;
1712
1713 tmp->ts = ts;
1714
1715 spin_lock_bh(&rdev->bss_lock);
1716
1717 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
1718 spin_unlock_bh(&rdev->bss_lock);
1719 return NULL;
1720 }
1721
1722 found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
1723
1724 if (found) {
1725 if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid))
1726 goto drop;
1727 } else {
1728 struct cfg80211_internal_bss *new;
1729 struct cfg80211_internal_bss *hidden;
1730 struct cfg80211_bss_ies *ies;
1731
1732 /*
1733 * create a copy -- the "res" variable that is passed in
1734 * is allocated on the stack since it's not needed in the
1735 * more common case of an update
1736 */
1737 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
1738 GFP_ATOMIC);
1739 if (!new) {
1740 ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
1741 if (ies)
1742 kfree_rcu(ies, rcu_head);
1743 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1744 if (ies)
1745 kfree_rcu(ies, rcu_head);
1746 goto drop;
1747 }
1748 memcpy(new, tmp, sizeof(*new));
1749 new->refcount = 1;
1750 INIT_LIST_HEAD(&new->hidden_list);
1751 INIT_LIST_HEAD(&new->pub.nontrans_list);
1752 /* we'll set this later if it was non-NULL */
1753 new->pub.transmitted_bss = NULL;
1754
1755 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1756 hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1757 if (!hidden)
1758 hidden = rb_find_bss(rdev, tmp,
1759 BSS_CMP_HIDE_NUL);
1760 if (hidden) {
1761 new->pub.hidden_beacon_bss = &hidden->pub;
1762 list_add(&new->hidden_list,
1763 &hidden->hidden_list);
1764 hidden->refcount++;
1765 rcu_assign_pointer(new->pub.beacon_ies,
1766 hidden->pub.beacon_ies);
1767 }
1768 } else {
1769 /*
1770 * Ok so we found a beacon, and don't have an entry. If
1771 * it's a beacon with hidden SSID, we might be in for an
1772 * expensive search for any probe responses that should
1773 * be grouped with this beacon for updates ...
1774 */
1775 if (!cfg80211_combine_bsses(rdev, new)) {
1776 bss_ref_put(rdev, new);
1777 goto drop;
1778 }
1779 }
1780
1781 if (rdev->bss_entries >= bss_entries_limit &&
1782 !cfg80211_bss_expire_oldest(rdev)) {
1783 bss_ref_put(rdev, new);
1784 goto drop;
1785 }
1786
1787 /* This must be before the call to bss_ref_get */
1788 if (tmp->pub.transmitted_bss) {
1789 struct cfg80211_internal_bss *pbss =
1790 container_of(tmp->pub.transmitted_bss,
1791 struct cfg80211_internal_bss,
1792 pub);
1793
1794 new->pub.transmitted_bss = tmp->pub.transmitted_bss;
1795 bss_ref_get(rdev, pbss);
1796 }
1797
1798 list_add_tail(&new->list, &rdev->bss_list);
1799 rdev->bss_entries++;
1800 rb_insert_bss(rdev, new);
1801 found = new;
1802 }
1803
1804 rdev->bss_generation++;
1805 bss_ref_get(rdev, found);
1806 spin_unlock_bh(&rdev->bss_lock);
1807
1808 return found;
1809 drop:
1810 spin_unlock_bh(&rdev->bss_lock);
1811 return NULL;
1812 }
1813
1814 /*
1815 * Update RX channel information based on the available frame payload
1816 * information. This is mainly for the 2.4 GHz band where frames can be received
1817 * from neighboring channels and the Beacon frames use the DSSS Parameter Set
1818 * element to indicate the current (transmitting) channel, but this might also
1819 * be needed on other bands if RX frequency does not match with the actual
1820 * operating channel of a BSS.
1821 */
1822 static struct ieee80211_channel *
cfg80211_get_bss_channel(struct wiphy * wiphy,const u8 * ie,size_t ielen,struct ieee80211_channel * channel,enum nl80211_bss_scan_width scan_width)1823 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1824 struct ieee80211_channel *channel,
1825 enum nl80211_bss_scan_width scan_width)
1826 {
1827 const u8 *tmp;
1828 u32 freq;
1829 int channel_number = -1;
1830 struct ieee80211_channel *alt_channel;
1831
1832 if (channel->band == NL80211_BAND_S1GHZ) {
1833 tmp = cfg80211_find_ie(WLAN_EID_S1G_OPERATION, ie, ielen);
1834 if (tmp && tmp[1] >= sizeof(struct ieee80211_s1g_oper_ie)) {
1835 struct ieee80211_s1g_oper_ie *s1gop = (void *)(tmp + 2);
1836
1837 channel_number = s1gop->primary_ch;
1838 }
1839 } else {
1840 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
1841 if (tmp && tmp[1] == 1) {
1842 channel_number = tmp[2];
1843 } else {
1844 tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
1845 if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
1846 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
1847
1848 channel_number = htop->primary_chan;
1849 }
1850 }
1851 }
1852
1853 if (channel_number < 0) {
1854 /* No channel information in frame payload */
1855 return channel;
1856 }
1857
1858 freq = ieee80211_channel_to_freq_khz(channel_number, channel->band);
1859 alt_channel = ieee80211_get_channel_khz(wiphy, freq);
1860 if (!alt_channel) {
1861 if (channel->band == NL80211_BAND_2GHZ) {
1862 /*
1863 * Better not allow unexpected channels when that could
1864 * be going beyond the 1-11 range (e.g., discovering
1865 * BSS on channel 12 when radio is configured for
1866 * channel 11.
1867 */
1868 return NULL;
1869 }
1870
1871 /* No match for the payload channel number - ignore it */
1872 return channel;
1873 }
1874
1875 if (scan_width == NL80211_BSS_CHAN_WIDTH_10 ||
1876 scan_width == NL80211_BSS_CHAN_WIDTH_5) {
1877 /*
1878 * Ignore channel number in 5 and 10 MHz channels where there
1879 * may not be an n:1 or 1:n mapping between frequencies and
1880 * channel numbers.
1881 */
1882 return channel;
1883 }
1884
1885 /*
1886 * Use the channel determined through the payload channel number
1887 * instead of the RX channel reported by the driver.
1888 */
1889 if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
1890 return NULL;
1891 return alt_channel;
1892 }
1893
1894 /* Returned bss is reference counted and must be cleaned up appropriately. */
1895 static struct cfg80211_bss *
cfg80211_inform_single_bss_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,enum cfg80211_bss_frame_type ftype,const u8 * bssid,u64 tsf,u16 capability,u16 beacon_interval,const u8 * ie,size_t ielen,struct cfg80211_non_tx_bss * non_tx_data,gfp_t gfp)1896 cfg80211_inform_single_bss_data(struct wiphy *wiphy,
1897 struct cfg80211_inform_bss *data,
1898 enum cfg80211_bss_frame_type ftype,
1899 const u8 *bssid, u64 tsf, u16 capability,
1900 u16 beacon_interval, const u8 *ie, size_t ielen,
1901 struct cfg80211_non_tx_bss *non_tx_data,
1902 gfp_t gfp)
1903 {
1904 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1905 struct cfg80211_bss_ies *ies;
1906 struct ieee80211_channel *channel;
1907 struct cfg80211_internal_bss tmp = {}, *res;
1908 int bss_type;
1909 bool signal_valid;
1910 unsigned long ts;
1911
1912 if (WARN_ON(!wiphy))
1913 return NULL;
1914
1915 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1916 (data->signal < 0 || data->signal > 100)))
1917 return NULL;
1918
1919 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan,
1920 data->scan_width);
1921 if (!channel)
1922 return NULL;
1923
1924 memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
1925 tmp.pub.channel = channel;
1926 tmp.pub.scan_width = data->scan_width;
1927 tmp.pub.signal = data->signal;
1928 tmp.pub.beacon_interval = beacon_interval;
1929 tmp.pub.capability = capability;
1930 tmp.ts_boottime = data->boottime_ns;
1931 if (non_tx_data) {
1932 tmp.pub.transmitted_bss = non_tx_data->tx_bss;
1933 ts = bss_from_pub(non_tx_data->tx_bss)->ts;
1934 tmp.pub.bssid_index = non_tx_data->bssid_index;
1935 tmp.pub.max_bssid_indicator = non_tx_data->max_bssid_indicator;
1936 } else {
1937 ts = jiffies;
1938 }
1939
1940 /*
1941 * If we do not know here whether the IEs are from a Beacon or Probe
1942 * Response frame, we need to pick one of the options and only use it
1943 * with the driver that does not provide the full Beacon/Probe Response
1944 * frame. Use Beacon frame pointer to avoid indicating that this should
1945 * override the IEs pointer should we have received an earlier
1946 * indication of Probe Response data.
1947 */
1948 ies = kzalloc(sizeof(*ies) + ielen, gfp);
1949 if (!ies)
1950 return NULL;
1951 ies->len = ielen;
1952 ies->tsf = tsf;
1953 ies->from_beacon = false;
1954 memcpy(ies->data, ie, ielen);
1955
1956 switch (ftype) {
1957 case CFG80211_BSS_FTYPE_BEACON:
1958 ies->from_beacon = true;
1959 fallthrough;
1960 case CFG80211_BSS_FTYPE_UNKNOWN:
1961 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1962 break;
1963 case CFG80211_BSS_FTYPE_PRESP:
1964 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1965 break;
1966 }
1967 rcu_assign_pointer(tmp.pub.ies, ies);
1968
1969 signal_valid = data->chan == channel;
1970 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, ts);
1971 if (!res)
1972 return NULL;
1973
1974 if (channel->band == NL80211_BAND_60GHZ) {
1975 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1976 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1977 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1978 regulatory_hint_found_beacon(wiphy, channel, gfp);
1979 } else {
1980 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1981 regulatory_hint_found_beacon(wiphy, channel, gfp);
1982 }
1983
1984 if (non_tx_data) {
1985 /* this is a nontransmitting bss, we need to add it to
1986 * transmitting bss' list if it is not there
1987 */
1988 spin_lock_bh(&rdev->bss_lock);
1989 if (cfg80211_add_nontrans_list(non_tx_data->tx_bss,
1990 &res->pub)) {
1991 if (__cfg80211_unlink_bss(rdev, res)) {
1992 rdev->bss_generation++;
1993 res = NULL;
1994 }
1995 }
1996 spin_unlock_bh(&rdev->bss_lock);
1997
1998 if (!res)
1999 return NULL;
2000 }
2001
2002 trace_cfg80211_return_bss(&res->pub);
2003 /* cfg80211_bss_update gives us a referenced result */
2004 return &res->pub;
2005 }
2006
2007 static const struct element
cfg80211_get_profile_continuation(const u8 * ie,size_t ielen,const struct element * mbssid_elem,const struct element * sub_elem)2008 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
2009 const struct element *mbssid_elem,
2010 const struct element *sub_elem)
2011 {
2012 const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
2013 const struct element *next_mbssid;
2014 const struct element *next_sub;
2015
2016 next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
2017 mbssid_end,
2018 ielen - (mbssid_end - ie));
2019
2020 /*
2021 * If it is not the last subelement in current MBSSID IE or there isn't
2022 * a next MBSSID IE - profile is complete.
2023 */
2024 if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
2025 !next_mbssid)
2026 return NULL;
2027
2028 /* For any length error, just return NULL */
2029
2030 if (next_mbssid->datalen < 4)
2031 return NULL;
2032
2033 next_sub = (void *)&next_mbssid->data[1];
2034
2035 if (next_mbssid->data + next_mbssid->datalen <
2036 next_sub->data + next_sub->datalen)
2037 return NULL;
2038
2039 if (next_sub->id != 0 || next_sub->datalen < 2)
2040 return NULL;
2041
2042 /*
2043 * Check if the first element in the next sub element is a start
2044 * of a new profile
2045 */
2046 return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
2047 NULL : next_mbssid;
2048 }
2049
cfg80211_merge_profile(const u8 * ie,size_t ielen,const struct element * mbssid_elem,const struct element * sub_elem,u8 * merged_ie,size_t max_copy_len)2050 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
2051 const struct element *mbssid_elem,
2052 const struct element *sub_elem,
2053 u8 *merged_ie, size_t max_copy_len)
2054 {
2055 size_t copied_len = sub_elem->datalen;
2056 const struct element *next_mbssid;
2057
2058 if (sub_elem->datalen > max_copy_len)
2059 return 0;
2060
2061 memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
2062
2063 while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
2064 mbssid_elem,
2065 sub_elem))) {
2066 const struct element *next_sub = (void *)&next_mbssid->data[1];
2067
2068 if (copied_len + next_sub->datalen > max_copy_len)
2069 break;
2070 memcpy(merged_ie + copied_len, next_sub->data,
2071 next_sub->datalen);
2072 copied_len += next_sub->datalen;
2073 }
2074
2075 return copied_len;
2076 }
2077 EXPORT_SYMBOL(cfg80211_merge_profile);
2078
cfg80211_parse_mbssid_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,enum cfg80211_bss_frame_type ftype,const u8 * bssid,u64 tsf,u16 beacon_interval,const u8 * ie,size_t ielen,struct cfg80211_non_tx_bss * non_tx_data,gfp_t gfp)2079 static void cfg80211_parse_mbssid_data(struct wiphy *wiphy,
2080 struct cfg80211_inform_bss *data,
2081 enum cfg80211_bss_frame_type ftype,
2082 const u8 *bssid, u64 tsf,
2083 u16 beacon_interval, const u8 *ie,
2084 size_t ielen,
2085 struct cfg80211_non_tx_bss *non_tx_data,
2086 gfp_t gfp)
2087 {
2088 const u8 *mbssid_index_ie;
2089 const struct element *elem, *sub;
2090 size_t new_ie_len;
2091 u8 new_bssid[ETH_ALEN];
2092 u8 *new_ie, *profile;
2093 u64 seen_indices = 0;
2094 u16 capability;
2095 struct cfg80211_bss *bss;
2096
2097 if (!non_tx_data)
2098 return;
2099 if (!cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2100 return;
2101 if (!wiphy->support_mbssid)
2102 return;
2103 if (wiphy->support_only_he_mbssid &&
2104 !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2105 return;
2106
2107 new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2108 if (!new_ie)
2109 return;
2110
2111 profile = kmalloc(ielen, gfp);
2112 if (!profile)
2113 goto out;
2114
2115 for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
2116 if (elem->datalen < 4)
2117 continue;
2118 if (elem->data[0] < 1 || (int)elem->data[0] > 8)
2119 continue;
2120 for_each_element(sub, elem->data + 1, elem->datalen - 1) {
2121 u8 profile_len;
2122
2123 if (sub->id != 0 || sub->datalen < 4) {
2124 /* not a valid BSS profile */
2125 continue;
2126 }
2127
2128 if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
2129 sub->data[1] != 2) {
2130 /* The first element within the Nontransmitted
2131 * BSSID Profile is not the Nontransmitted
2132 * BSSID Capability element.
2133 */
2134 continue;
2135 }
2136
2137 memset(profile, 0, ielen);
2138 profile_len = cfg80211_merge_profile(ie, ielen,
2139 elem,
2140 sub,
2141 profile,
2142 ielen);
2143
2144 /* found a Nontransmitted BSSID Profile */
2145 mbssid_index_ie = cfg80211_find_ie
2146 (WLAN_EID_MULTI_BSSID_IDX,
2147 profile, profile_len);
2148 if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
2149 mbssid_index_ie[2] == 0 ||
2150 mbssid_index_ie[2] > 46) {
2151 /* No valid Multiple BSSID-Index element */
2152 continue;
2153 }
2154
2155 if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
2156 /* We don't support legacy split of a profile */
2157 net_dbg_ratelimited("Partial info for BSSID index %d\n",
2158 mbssid_index_ie[2]);
2159
2160 seen_indices |= BIT_ULL(mbssid_index_ie[2]);
2161
2162 non_tx_data->bssid_index = mbssid_index_ie[2];
2163 non_tx_data->max_bssid_indicator = elem->data[0];
2164
2165 cfg80211_gen_new_bssid(bssid,
2166 non_tx_data->max_bssid_indicator,
2167 non_tx_data->bssid_index,
2168 new_bssid);
2169 memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2170 new_ie_len = cfg80211_gen_new_ie(ie, ielen,
2171 profile,
2172 profile_len, new_ie,
2173 gfp);
2174 if (!new_ie_len)
2175 continue;
2176
2177 capability = get_unaligned_le16(profile + 2);
2178 bss = cfg80211_inform_single_bss_data(wiphy, data,
2179 ftype,
2180 new_bssid, tsf,
2181 capability,
2182 beacon_interval,
2183 new_ie,
2184 new_ie_len,
2185 non_tx_data,
2186 gfp);
2187 if (!bss)
2188 break;
2189 cfg80211_put_bss(wiphy, bss);
2190 }
2191 }
2192
2193 out:
2194 kfree(new_ie);
2195 kfree(profile);
2196 }
2197
2198 struct cfg80211_bss *
cfg80211_inform_bss_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,enum cfg80211_bss_frame_type ftype,const u8 * bssid,u64 tsf,u16 capability,u16 beacon_interval,const u8 * ie,size_t ielen,gfp_t gfp)2199 cfg80211_inform_bss_data(struct wiphy *wiphy,
2200 struct cfg80211_inform_bss *data,
2201 enum cfg80211_bss_frame_type ftype,
2202 const u8 *bssid, u64 tsf, u16 capability,
2203 u16 beacon_interval, const u8 *ie, size_t ielen,
2204 gfp_t gfp)
2205 {
2206 struct cfg80211_bss *res;
2207 struct cfg80211_non_tx_bss non_tx_data;
2208
2209 res = cfg80211_inform_single_bss_data(wiphy, data, ftype, bssid, tsf,
2210 capability, beacon_interval, ie,
2211 ielen, NULL, gfp);
2212 if (!res)
2213 return NULL;
2214 non_tx_data.tx_bss = res;
2215 cfg80211_parse_mbssid_data(wiphy, data, ftype, bssid, tsf,
2216 beacon_interval, ie, ielen, &non_tx_data,
2217 gfp);
2218 return res;
2219 }
2220 EXPORT_SYMBOL(cfg80211_inform_bss_data);
2221
2222 static void
cfg80211_parse_mbssid_frame_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,struct ieee80211_mgmt * mgmt,size_t len,struct cfg80211_non_tx_bss * non_tx_data,gfp_t gfp)2223 cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy,
2224 struct cfg80211_inform_bss *data,
2225 struct ieee80211_mgmt *mgmt, size_t len,
2226 struct cfg80211_non_tx_bss *non_tx_data,
2227 gfp_t gfp)
2228 {
2229 enum cfg80211_bss_frame_type ftype;
2230 const u8 *ie = mgmt->u.probe_resp.variable;
2231 size_t ielen = len - offsetof(struct ieee80211_mgmt,
2232 u.probe_resp.variable);
2233
2234 ftype = ieee80211_is_beacon(mgmt->frame_control) ?
2235 CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
2236
2237 cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
2238 le64_to_cpu(mgmt->u.probe_resp.timestamp),
2239 le16_to_cpu(mgmt->u.probe_resp.beacon_int),
2240 ie, ielen, non_tx_data, gfp);
2241 }
2242
2243 static void
cfg80211_update_notlisted_nontrans(struct wiphy * wiphy,struct cfg80211_bss * nontrans_bss,struct ieee80211_mgmt * mgmt,size_t len)2244 cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
2245 struct cfg80211_bss *nontrans_bss,
2246 struct ieee80211_mgmt *mgmt, size_t len)
2247 {
2248 u8 *ie, *new_ie, *pos;
2249 const u8 *nontrans_ssid, *trans_ssid, *mbssid;
2250 size_t ielen = len - offsetof(struct ieee80211_mgmt,
2251 u.probe_resp.variable);
2252 size_t new_ie_len;
2253 struct cfg80211_bss_ies *new_ies;
2254 const struct cfg80211_bss_ies *old;
2255 size_t cpy_len;
2256
2257 lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
2258
2259 ie = mgmt->u.probe_resp.variable;
2260
2261 new_ie_len = ielen;
2262 trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
2263 if (!trans_ssid)
2264 return;
2265 new_ie_len -= trans_ssid[1];
2266 mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen);
2267 /*
2268 * It's not valid to have the MBSSID element before SSID
2269 * ignore if that happens - the code below assumes it is
2270 * after (while copying things inbetween).
2271 */
2272 if (!mbssid || mbssid < trans_ssid)
2273 return;
2274 new_ie_len -= mbssid[1];
2275
2276 nontrans_ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
2277 if (!nontrans_ssid)
2278 return;
2279
2280 new_ie_len += nontrans_ssid[1];
2281
2282 /* generate new ie for nontrans BSS
2283 * 1. replace SSID with nontrans BSS' SSID
2284 * 2. skip MBSSID IE
2285 */
2286 new_ie = kzalloc(new_ie_len, GFP_ATOMIC);
2287 if (!new_ie)
2288 return;
2289
2290 new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC);
2291 if (!new_ies)
2292 goto out_free;
2293
2294 pos = new_ie;
2295
2296 /* copy the nontransmitted SSID */
2297 cpy_len = nontrans_ssid[1] + 2;
2298 memcpy(pos, nontrans_ssid, cpy_len);
2299 pos += cpy_len;
2300 /* copy the IEs between SSID and MBSSID */
2301 cpy_len = trans_ssid[1] + 2;
2302 memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len)));
2303 pos += (mbssid - (trans_ssid + cpy_len));
2304 /* copy the IEs after MBSSID */
2305 cpy_len = mbssid[1] + 2;
2306 memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len)));
2307
2308 /* update ie */
2309 new_ies->len = new_ie_len;
2310 new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2311 new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
2312 memcpy(new_ies->data, new_ie, new_ie_len);
2313 if (ieee80211_is_probe_resp(mgmt->frame_control)) {
2314 old = rcu_access_pointer(nontrans_bss->proberesp_ies);
2315 rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies);
2316 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2317 if (old)
2318 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2319 } else {
2320 old = rcu_access_pointer(nontrans_bss->beacon_ies);
2321 rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
2322 cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss),
2323 new_ies, old);
2324 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2325 if (old)
2326 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2327 }
2328
2329 out_free:
2330 kfree(new_ie);
2331 }
2332
2333 /* cfg80211_inform_bss_width_frame helper */
2334 static struct cfg80211_bss *
cfg80211_inform_single_bss_frame_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,struct ieee80211_mgmt * mgmt,size_t len,gfp_t gfp)2335 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
2336 struct cfg80211_inform_bss *data,
2337 struct ieee80211_mgmt *mgmt, size_t len,
2338 gfp_t gfp)
2339 {
2340 struct cfg80211_internal_bss tmp = {}, *res;
2341 struct cfg80211_bss_ies *ies;
2342 struct ieee80211_channel *channel;
2343 bool signal_valid;
2344 struct ieee80211_ext *ext = NULL;
2345 u8 *bssid, *variable;
2346 u16 capability, beacon_int;
2347 size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
2348 u.probe_resp.variable);
2349 int bss_type;
2350
2351 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
2352 offsetof(struct ieee80211_mgmt, u.beacon.variable));
2353
2354 trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
2355
2356 if (WARN_ON(!mgmt))
2357 return NULL;
2358
2359 if (WARN_ON(!wiphy))
2360 return NULL;
2361
2362 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2363 (data->signal < 0 || data->signal > 100)))
2364 return NULL;
2365
2366 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2367 ext = (void *) mgmt;
2368 min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
2369 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2370 min_hdr_len = offsetof(struct ieee80211_ext,
2371 u.s1g_short_beacon.variable);
2372 }
2373
2374 if (WARN_ON(len < min_hdr_len))
2375 return NULL;
2376
2377 ielen = len - min_hdr_len;
2378 variable = mgmt->u.probe_resp.variable;
2379 if (ext) {
2380 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2381 variable = ext->u.s1g_short_beacon.variable;
2382 else
2383 variable = ext->u.s1g_beacon.variable;
2384 }
2385
2386 channel = cfg80211_get_bss_channel(wiphy, variable,
2387 ielen, data->chan, data->scan_width);
2388 if (!channel)
2389 return NULL;
2390
2391 if (ext) {
2392 const struct ieee80211_s1g_bcn_compat_ie *compat;
2393 const struct element *elem;
2394
2395 elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT,
2396 variable, ielen);
2397 if (!elem)
2398 return NULL;
2399 if (elem->datalen < sizeof(*compat))
2400 return NULL;
2401 compat = (void *)elem->data;
2402 bssid = ext->u.s1g_beacon.sa;
2403 capability = le16_to_cpu(compat->compat_info);
2404 beacon_int = le16_to_cpu(compat->beacon_int);
2405 } else {
2406 bssid = mgmt->bssid;
2407 beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2408 capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
2409 }
2410
2411 ies = kzalloc(sizeof(*ies) + ielen, gfp);
2412 if (!ies)
2413 return NULL;
2414 ies->len = ielen;
2415 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2416 ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) ||
2417 ieee80211_is_s1g_beacon(mgmt->frame_control);
2418 memcpy(ies->data, variable, ielen);
2419
2420 if (ieee80211_is_probe_resp(mgmt->frame_control))
2421 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2422 else
2423 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2424 rcu_assign_pointer(tmp.pub.ies, ies);
2425
2426 memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
2427 tmp.pub.beacon_interval = beacon_int;
2428 tmp.pub.capability = capability;
2429 tmp.pub.channel = channel;
2430 tmp.pub.scan_width = data->scan_width;
2431 tmp.pub.signal = data->signal;
2432 tmp.ts_boottime = data->boottime_ns;
2433 tmp.parent_tsf = data->parent_tsf;
2434 tmp.pub.chains = data->chains;
2435 memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS);
2436 ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
2437
2438 signal_valid = data->chan == channel;
2439 res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid,
2440 jiffies);
2441 if (!res)
2442 return NULL;
2443
2444 if (channel->band == NL80211_BAND_60GHZ) {
2445 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
2446 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2447 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2448 regulatory_hint_found_beacon(wiphy, channel, gfp);
2449 } else {
2450 if (res->pub.capability & WLAN_CAPABILITY_ESS)
2451 regulatory_hint_found_beacon(wiphy, channel, gfp);
2452 }
2453
2454 trace_cfg80211_return_bss(&res->pub);
2455 /* cfg80211_bss_update gives us a referenced result */
2456 return &res->pub;
2457 }
2458
2459 struct cfg80211_bss *
cfg80211_inform_bss_frame_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,struct ieee80211_mgmt * mgmt,size_t len,gfp_t gfp)2460 cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
2461 struct cfg80211_inform_bss *data,
2462 struct ieee80211_mgmt *mgmt, size_t len,
2463 gfp_t gfp)
2464 {
2465 struct cfg80211_bss *res, *tmp_bss;
2466 const u8 *ie = mgmt->u.probe_resp.variable;
2467 const struct cfg80211_bss_ies *ies1, *ies2;
2468 size_t ielen = len - offsetof(struct ieee80211_mgmt,
2469 u.probe_resp.variable);
2470 struct cfg80211_non_tx_bss non_tx_data = {};
2471
2472 res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
2473 len, gfp);
2474
2475 /* don't do any further MBSSID handling for S1G */
2476 if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2477 return res;
2478
2479 if (!res || !wiphy->support_mbssid ||
2480 !cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2481 return res;
2482 if (wiphy->support_only_he_mbssid &&
2483 !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2484 return res;
2485
2486 non_tx_data.tx_bss = res;
2487 /* process each non-transmitting bss */
2488 cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len,
2489 &non_tx_data, gfp);
2490
2491 spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2492
2493 /* check if the res has other nontransmitting bss which is not
2494 * in MBSSID IE
2495 */
2496 ies1 = rcu_access_pointer(res->ies);
2497
2498 /* go through nontrans_list, if the timestamp of the BSS is
2499 * earlier than the timestamp of the transmitting BSS then
2500 * update it
2501 */
2502 list_for_each_entry(tmp_bss, &res->nontrans_list,
2503 nontrans_list) {
2504 ies2 = rcu_access_pointer(tmp_bss->ies);
2505 if (ies2->tsf < ies1->tsf)
2506 cfg80211_update_notlisted_nontrans(wiphy, tmp_bss,
2507 mgmt, len);
2508 }
2509 spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2510
2511 return res;
2512 }
2513 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
2514
cfg80211_ref_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)2515 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2516 {
2517 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2518 struct cfg80211_internal_bss *bss;
2519
2520 if (!pub)
2521 return;
2522
2523 bss = container_of(pub, struct cfg80211_internal_bss, pub);
2524
2525 spin_lock_bh(&rdev->bss_lock);
2526 bss_ref_get(rdev, bss);
2527 spin_unlock_bh(&rdev->bss_lock);
2528 }
2529 EXPORT_SYMBOL(cfg80211_ref_bss);
2530
cfg80211_put_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)2531 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2532 {
2533 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2534 struct cfg80211_internal_bss *bss;
2535
2536 if (!pub)
2537 return;
2538
2539 bss = container_of(pub, struct cfg80211_internal_bss, pub);
2540
2541 spin_lock_bh(&rdev->bss_lock);
2542 bss_ref_put(rdev, bss);
2543 spin_unlock_bh(&rdev->bss_lock);
2544 }
2545 EXPORT_SYMBOL(cfg80211_put_bss);
2546
cfg80211_unlink_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)2547 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2548 {
2549 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2550 struct cfg80211_internal_bss *bss, *tmp1;
2551 struct cfg80211_bss *nontrans_bss, *tmp;
2552
2553 if (WARN_ON(!pub))
2554 return;
2555
2556 bss = container_of(pub, struct cfg80211_internal_bss, pub);
2557
2558 spin_lock_bh(&rdev->bss_lock);
2559 if (list_empty(&bss->list))
2560 goto out;
2561
2562 list_for_each_entry_safe(nontrans_bss, tmp,
2563 &pub->nontrans_list,
2564 nontrans_list) {
2565 tmp1 = container_of(nontrans_bss,
2566 struct cfg80211_internal_bss, pub);
2567 if (__cfg80211_unlink_bss(rdev, tmp1))
2568 rdev->bss_generation++;
2569 }
2570
2571 if (__cfg80211_unlink_bss(rdev, bss))
2572 rdev->bss_generation++;
2573 out:
2574 spin_unlock_bh(&rdev->bss_lock);
2575 }
2576 EXPORT_SYMBOL(cfg80211_unlink_bss);
2577
cfg80211_bss_iter(struct wiphy * wiphy,struct cfg80211_chan_def * chandef,void (* iter)(struct wiphy * wiphy,struct cfg80211_bss * bss,void * data),void * iter_data)2578 void cfg80211_bss_iter(struct wiphy *wiphy,
2579 struct cfg80211_chan_def *chandef,
2580 void (*iter)(struct wiphy *wiphy,
2581 struct cfg80211_bss *bss,
2582 void *data),
2583 void *iter_data)
2584 {
2585 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2586 struct cfg80211_internal_bss *bss;
2587
2588 spin_lock_bh(&rdev->bss_lock);
2589
2590 list_for_each_entry(bss, &rdev->bss_list, list) {
2591 if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel))
2592 iter(wiphy, &bss->pub, iter_data);
2593 }
2594
2595 spin_unlock_bh(&rdev->bss_lock);
2596 }
2597 EXPORT_SYMBOL(cfg80211_bss_iter);
2598
cfg80211_update_assoc_bss_entry(struct wireless_dev * wdev,struct ieee80211_channel * chan)2599 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
2600 struct ieee80211_channel *chan)
2601 {
2602 struct wiphy *wiphy = wdev->wiphy;
2603 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2604 struct cfg80211_internal_bss *cbss = wdev->current_bss;
2605 struct cfg80211_internal_bss *new = NULL;
2606 struct cfg80211_internal_bss *bss;
2607 struct cfg80211_bss *nontrans_bss;
2608 struct cfg80211_bss *tmp;
2609
2610 spin_lock_bh(&rdev->bss_lock);
2611
2612 /*
2613 * Some APs use CSA also for bandwidth changes, i.e., without actually
2614 * changing the control channel, so no need to update in such a case.
2615 */
2616 if (cbss->pub.channel == chan)
2617 goto done;
2618
2619 /* use transmitting bss */
2620 if (cbss->pub.transmitted_bss)
2621 cbss = container_of(cbss->pub.transmitted_bss,
2622 struct cfg80211_internal_bss,
2623 pub);
2624
2625 cbss->pub.channel = chan;
2626
2627 list_for_each_entry(bss, &rdev->bss_list, list) {
2628 if (!cfg80211_bss_type_match(bss->pub.capability,
2629 bss->pub.channel->band,
2630 wdev->conn_bss_type))
2631 continue;
2632
2633 if (bss == cbss)
2634 continue;
2635
2636 if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) {
2637 new = bss;
2638 break;
2639 }
2640 }
2641
2642 if (new) {
2643 /* to save time, update IEs for transmitting bss only */
2644 if (cfg80211_update_known_bss(rdev, cbss, new, false)) {
2645 new->pub.proberesp_ies = NULL;
2646 new->pub.beacon_ies = NULL;
2647 }
2648
2649 list_for_each_entry_safe(nontrans_bss, tmp,
2650 &new->pub.nontrans_list,
2651 nontrans_list) {
2652 bss = container_of(nontrans_bss,
2653 struct cfg80211_internal_bss, pub);
2654 if (__cfg80211_unlink_bss(rdev, bss))
2655 rdev->bss_generation++;
2656 }
2657
2658 WARN_ON(atomic_read(&new->hold));
2659 if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
2660 rdev->bss_generation++;
2661 }
2662
2663 rb_erase(&cbss->rbn, &rdev->bss_tree);
2664 rb_insert_bss(rdev, cbss);
2665 rdev->bss_generation++;
2666
2667 list_for_each_entry_safe(nontrans_bss, tmp,
2668 &cbss->pub.nontrans_list,
2669 nontrans_list) {
2670 bss = container_of(nontrans_bss,
2671 struct cfg80211_internal_bss, pub);
2672 bss->pub.channel = chan;
2673 rb_erase(&bss->rbn, &rdev->bss_tree);
2674 rb_insert_bss(rdev, bss);
2675 rdev->bss_generation++;
2676 }
2677
2678 done:
2679 spin_unlock_bh(&rdev->bss_lock);
2680 }
2681
2682 #ifdef CONFIG_CFG80211_WEXT
2683 static struct cfg80211_registered_device *
cfg80211_get_dev_from_ifindex(struct net * net,int ifindex)2684 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
2685 {
2686 struct cfg80211_registered_device *rdev;
2687 struct net_device *dev;
2688
2689 ASSERT_RTNL();
2690
2691 dev = dev_get_by_index(net, ifindex);
2692 if (!dev)
2693 return ERR_PTR(-ENODEV);
2694 if (dev->ieee80211_ptr)
2695 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
2696 else
2697 rdev = ERR_PTR(-ENODEV);
2698 dev_put(dev);
2699 return rdev;
2700 }
2701
cfg80211_wext_siwscan(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)2702 int cfg80211_wext_siwscan(struct net_device *dev,
2703 struct iw_request_info *info,
2704 union iwreq_data *wrqu, char *extra)
2705 {
2706 struct cfg80211_registered_device *rdev;
2707 struct wiphy *wiphy;
2708 struct iw_scan_req *wreq = NULL;
2709 struct cfg80211_scan_request *creq = NULL;
2710 int i, err, n_channels = 0;
2711 enum nl80211_band band;
2712
2713 if (!netif_running(dev))
2714 return -ENETDOWN;
2715
2716 if (wrqu->data.length == sizeof(struct iw_scan_req))
2717 wreq = (struct iw_scan_req *)extra;
2718
2719 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
2720
2721 if (IS_ERR(rdev))
2722 return PTR_ERR(rdev);
2723
2724 if (rdev->scan_req || rdev->scan_msg) {
2725 err = -EBUSY;
2726 goto out;
2727 }
2728
2729 wiphy = &rdev->wiphy;
2730
2731 /* Determine number of channels, needed to allocate creq */
2732 if (wreq && wreq->num_channels)
2733 n_channels = wreq->num_channels;
2734 else
2735 n_channels = ieee80211_get_num_supported_channels(wiphy);
2736
2737 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
2738 n_channels * sizeof(void *),
2739 GFP_ATOMIC);
2740 if (!creq) {
2741 err = -ENOMEM;
2742 goto out;
2743 }
2744
2745 creq->wiphy = wiphy;
2746 creq->wdev = dev->ieee80211_ptr;
2747 /* SSIDs come after channels */
2748 creq->ssids = (void *)&creq->channels[n_channels];
2749 creq->n_channels = n_channels;
2750 creq->n_ssids = 1;
2751 creq->scan_start = jiffies;
2752
2753 /* translate "Scan on frequencies" request */
2754 i = 0;
2755 for (band = 0; band < NUM_NL80211_BANDS; band++) {
2756 int j;
2757
2758 if (!wiphy->bands[band])
2759 continue;
2760
2761 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2762 /* ignore disabled channels */
2763 if (wiphy->bands[band]->channels[j].flags &
2764 IEEE80211_CHAN_DISABLED)
2765 continue;
2766
2767 /* If we have a wireless request structure and the
2768 * wireless request specifies frequencies, then search
2769 * for the matching hardware channel.
2770 */
2771 if (wreq && wreq->num_channels) {
2772 int k;
2773 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
2774 for (k = 0; k < wreq->num_channels; k++) {
2775 struct iw_freq *freq =
2776 &wreq->channel_list[k];
2777 int wext_freq =
2778 cfg80211_wext_freq(freq);
2779
2780 if (wext_freq == wiphy_freq)
2781 goto wext_freq_found;
2782 }
2783 goto wext_freq_not_found;
2784 }
2785
2786 wext_freq_found:
2787 creq->channels[i] = &wiphy->bands[band]->channels[j];
2788 i++;
2789 wext_freq_not_found: ;
2790 }
2791 }
2792 /* No channels found? */
2793 if (!i) {
2794 err = -EINVAL;
2795 goto out;
2796 }
2797
2798 /* Set real number of channels specified in creq->channels[] */
2799 creq->n_channels = i;
2800
2801 /* translate "Scan for SSID" request */
2802 if (wreq) {
2803 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
2804 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
2805 err = -EINVAL;
2806 goto out;
2807 }
2808 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
2809 creq->ssids[0].ssid_len = wreq->essid_len;
2810 }
2811 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
2812 creq->n_ssids = 0;
2813 }
2814
2815 for (i = 0; i < NUM_NL80211_BANDS; i++)
2816 if (wiphy->bands[i])
2817 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
2818
2819 eth_broadcast_addr(creq->bssid);
2820
2821 rdev->scan_req = creq;
2822 err = rdev_scan(rdev, creq);
2823 if (err) {
2824 rdev->scan_req = NULL;
2825 /* creq will be freed below */
2826 } else {
2827 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
2828 /* creq now owned by driver */
2829 creq = NULL;
2830 dev_hold(dev);
2831 }
2832 out:
2833 kfree(creq);
2834 return err;
2835 }
2836 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
2837
ieee80211_scan_add_ies(struct iw_request_info * info,const struct cfg80211_bss_ies * ies,char * current_ev,char * end_buf)2838 static char *ieee80211_scan_add_ies(struct iw_request_info *info,
2839 const struct cfg80211_bss_ies *ies,
2840 char *current_ev, char *end_buf)
2841 {
2842 const u8 *pos, *end, *next;
2843 struct iw_event iwe;
2844
2845 if (!ies)
2846 return current_ev;
2847
2848 /*
2849 * If needed, fragment the IEs buffer (at IE boundaries) into short
2850 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
2851 */
2852 pos = ies->data;
2853 end = pos + ies->len;
2854
2855 while (end - pos > IW_GENERIC_IE_MAX) {
2856 next = pos + 2 + pos[1];
2857 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
2858 next = next + 2 + next[1];
2859
2860 memset(&iwe, 0, sizeof(iwe));
2861 iwe.cmd = IWEVGENIE;
2862 iwe.u.data.length = next - pos;
2863 current_ev = iwe_stream_add_point_check(info, current_ev,
2864 end_buf, &iwe,
2865 (void *)pos);
2866 if (IS_ERR(current_ev))
2867 return current_ev;
2868 pos = next;
2869 }
2870
2871 if (end > pos) {
2872 memset(&iwe, 0, sizeof(iwe));
2873 iwe.cmd = IWEVGENIE;
2874 iwe.u.data.length = end - pos;
2875 current_ev = iwe_stream_add_point_check(info, current_ev,
2876 end_buf, &iwe,
2877 (void *)pos);
2878 if (IS_ERR(current_ev))
2879 return current_ev;
2880 }
2881
2882 return current_ev;
2883 }
2884
2885 static char *
ieee80211_bss(struct wiphy * wiphy,struct iw_request_info * info,struct cfg80211_internal_bss * bss,char * current_ev,char * end_buf)2886 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
2887 struct cfg80211_internal_bss *bss, char *current_ev,
2888 char *end_buf)
2889 {
2890 const struct cfg80211_bss_ies *ies;
2891 struct iw_event iwe;
2892 const u8 *ie;
2893 u8 buf[50];
2894 u8 *cfg, *p, *tmp;
2895 int rem, i, sig;
2896 bool ismesh = false;
2897
2898 memset(&iwe, 0, sizeof(iwe));
2899 iwe.cmd = SIOCGIWAP;
2900 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2901 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
2902 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2903 IW_EV_ADDR_LEN);
2904 if (IS_ERR(current_ev))
2905 return current_ev;
2906
2907 memset(&iwe, 0, sizeof(iwe));
2908 iwe.cmd = SIOCGIWFREQ;
2909 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
2910 iwe.u.freq.e = 0;
2911 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2912 IW_EV_FREQ_LEN);
2913 if (IS_ERR(current_ev))
2914 return current_ev;
2915
2916 memset(&iwe, 0, sizeof(iwe));
2917 iwe.cmd = SIOCGIWFREQ;
2918 iwe.u.freq.m = bss->pub.channel->center_freq;
2919 iwe.u.freq.e = 6;
2920 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2921 IW_EV_FREQ_LEN);
2922 if (IS_ERR(current_ev))
2923 return current_ev;
2924
2925 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
2926 memset(&iwe, 0, sizeof(iwe));
2927 iwe.cmd = IWEVQUAL;
2928 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
2929 IW_QUAL_NOISE_INVALID |
2930 IW_QUAL_QUAL_UPDATED;
2931 switch (wiphy->signal_type) {
2932 case CFG80211_SIGNAL_TYPE_MBM:
2933 sig = bss->pub.signal / 100;
2934 iwe.u.qual.level = sig;
2935 iwe.u.qual.updated |= IW_QUAL_DBM;
2936 if (sig < -110) /* rather bad */
2937 sig = -110;
2938 else if (sig > -40) /* perfect */
2939 sig = -40;
2940 /* will give a range of 0 .. 70 */
2941 iwe.u.qual.qual = sig + 110;
2942 break;
2943 case CFG80211_SIGNAL_TYPE_UNSPEC:
2944 iwe.u.qual.level = bss->pub.signal;
2945 /* will give range 0 .. 100 */
2946 iwe.u.qual.qual = bss->pub.signal;
2947 break;
2948 default:
2949 /* not reached */
2950 break;
2951 }
2952 current_ev = iwe_stream_add_event_check(info, current_ev,
2953 end_buf, &iwe,
2954 IW_EV_QUAL_LEN);
2955 if (IS_ERR(current_ev))
2956 return current_ev;
2957 }
2958
2959 memset(&iwe, 0, sizeof(iwe));
2960 iwe.cmd = SIOCGIWENCODE;
2961 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
2962 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2963 else
2964 iwe.u.data.flags = IW_ENCODE_DISABLED;
2965 iwe.u.data.length = 0;
2966 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
2967 &iwe, "");
2968 if (IS_ERR(current_ev))
2969 return current_ev;
2970
2971 rcu_read_lock();
2972 ies = rcu_dereference(bss->pub.ies);
2973 rem = ies->len;
2974 ie = ies->data;
2975
2976 while (rem >= 2) {
2977 /* invalid data */
2978 if (ie[1] > rem - 2)
2979 break;
2980
2981 switch (ie[0]) {
2982 case WLAN_EID_SSID:
2983 memset(&iwe, 0, sizeof(iwe));
2984 iwe.cmd = SIOCGIWESSID;
2985 iwe.u.data.length = ie[1];
2986 iwe.u.data.flags = 1;
2987 current_ev = iwe_stream_add_point_check(info,
2988 current_ev,
2989 end_buf, &iwe,
2990 (u8 *)ie + 2);
2991 if (IS_ERR(current_ev))
2992 goto unlock;
2993 break;
2994 case WLAN_EID_MESH_ID:
2995 memset(&iwe, 0, sizeof(iwe));
2996 iwe.cmd = SIOCGIWESSID;
2997 iwe.u.data.length = ie[1];
2998 iwe.u.data.flags = 1;
2999 current_ev = iwe_stream_add_point_check(info,
3000 current_ev,
3001 end_buf, &iwe,
3002 (u8 *)ie + 2);
3003 if (IS_ERR(current_ev))
3004 goto unlock;
3005 break;
3006 case WLAN_EID_MESH_CONFIG:
3007 ismesh = true;
3008 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
3009 break;
3010 cfg = (u8 *)ie + 2;
3011 memset(&iwe, 0, sizeof(iwe));
3012 iwe.cmd = IWEVCUSTOM;
3013 sprintf(buf, "Mesh Network Path Selection Protocol ID: "
3014 "0x%02X", cfg[0]);
3015 iwe.u.data.length = strlen(buf);
3016 current_ev = iwe_stream_add_point_check(info,
3017 current_ev,
3018 end_buf,
3019 &iwe, buf);
3020 if (IS_ERR(current_ev))
3021 goto unlock;
3022 sprintf(buf, "Path Selection Metric ID: 0x%02X",
3023 cfg[1]);
3024 iwe.u.data.length = strlen(buf);
3025 current_ev = iwe_stream_add_point_check(info,
3026 current_ev,
3027 end_buf,
3028 &iwe, buf);
3029 if (IS_ERR(current_ev))
3030 goto unlock;
3031 sprintf(buf, "Congestion Control Mode ID: 0x%02X",
3032 cfg[2]);
3033 iwe.u.data.length = strlen(buf);
3034 current_ev = iwe_stream_add_point_check(info,
3035 current_ev,
3036 end_buf,
3037 &iwe, buf);
3038 if (IS_ERR(current_ev))
3039 goto unlock;
3040 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
3041 iwe.u.data.length = strlen(buf);
3042 current_ev = iwe_stream_add_point_check(info,
3043 current_ev,
3044 end_buf,
3045 &iwe, buf);
3046 if (IS_ERR(current_ev))
3047 goto unlock;
3048 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
3049 iwe.u.data.length = strlen(buf);
3050 current_ev = iwe_stream_add_point_check(info,
3051 current_ev,
3052 end_buf,
3053 &iwe, buf);
3054 if (IS_ERR(current_ev))
3055 goto unlock;
3056 sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
3057 iwe.u.data.length = strlen(buf);
3058 current_ev = iwe_stream_add_point_check(info,
3059 current_ev,
3060 end_buf,
3061 &iwe, buf);
3062 if (IS_ERR(current_ev))
3063 goto unlock;
3064 sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
3065 iwe.u.data.length = strlen(buf);
3066 current_ev = iwe_stream_add_point_check(info,
3067 current_ev,
3068 end_buf,
3069 &iwe, buf);
3070 if (IS_ERR(current_ev))
3071 goto unlock;
3072 break;
3073 case WLAN_EID_SUPP_RATES:
3074 case WLAN_EID_EXT_SUPP_RATES:
3075 /* display all supported rates in readable format */
3076 p = current_ev + iwe_stream_lcp_len(info);
3077
3078 memset(&iwe, 0, sizeof(iwe));
3079 iwe.cmd = SIOCGIWRATE;
3080 /* Those two flags are ignored... */
3081 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3082
3083 for (i = 0; i < ie[1]; i++) {
3084 iwe.u.bitrate.value =
3085 ((ie[i + 2] & 0x7f) * 500000);
3086 tmp = p;
3087 p = iwe_stream_add_value(info, current_ev, p,
3088 end_buf, &iwe,
3089 IW_EV_PARAM_LEN);
3090 if (p == tmp) {
3091 current_ev = ERR_PTR(-E2BIG);
3092 goto unlock;
3093 }
3094 }
3095 current_ev = p;
3096 break;
3097 }
3098 rem -= ie[1] + 2;
3099 ie += ie[1] + 2;
3100 }
3101
3102 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
3103 ismesh) {
3104 memset(&iwe, 0, sizeof(iwe));
3105 iwe.cmd = SIOCGIWMODE;
3106 if (ismesh)
3107 iwe.u.mode = IW_MODE_MESH;
3108 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
3109 iwe.u.mode = IW_MODE_MASTER;
3110 else
3111 iwe.u.mode = IW_MODE_ADHOC;
3112 current_ev = iwe_stream_add_event_check(info, current_ev,
3113 end_buf, &iwe,
3114 IW_EV_UINT_LEN);
3115 if (IS_ERR(current_ev))
3116 goto unlock;
3117 }
3118
3119 memset(&iwe, 0, sizeof(iwe));
3120 iwe.cmd = IWEVCUSTOM;
3121 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
3122 iwe.u.data.length = strlen(buf);
3123 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3124 &iwe, buf);
3125 if (IS_ERR(current_ev))
3126 goto unlock;
3127 memset(&iwe, 0, sizeof(iwe));
3128 iwe.cmd = IWEVCUSTOM;
3129 sprintf(buf, " Last beacon: %ums ago",
3130 elapsed_jiffies_msecs(bss->ts));
3131 iwe.u.data.length = strlen(buf);
3132 current_ev = iwe_stream_add_point_check(info, current_ev,
3133 end_buf, &iwe, buf);
3134 if (IS_ERR(current_ev))
3135 goto unlock;
3136
3137 current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
3138
3139 unlock:
3140 rcu_read_unlock();
3141 return current_ev;
3142 }
3143
3144
ieee80211_scan_results(struct cfg80211_registered_device * rdev,struct iw_request_info * info,char * buf,size_t len)3145 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
3146 struct iw_request_info *info,
3147 char *buf, size_t len)
3148 {
3149 char *current_ev = buf;
3150 char *end_buf = buf + len;
3151 struct cfg80211_internal_bss *bss;
3152 int err = 0;
3153
3154 spin_lock_bh(&rdev->bss_lock);
3155 cfg80211_bss_expire(rdev);
3156
3157 list_for_each_entry(bss, &rdev->bss_list, list) {
3158 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3159 err = -E2BIG;
3160 break;
3161 }
3162 current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
3163 current_ev, end_buf);
3164 if (IS_ERR(current_ev)) {
3165 err = PTR_ERR(current_ev);
3166 break;
3167 }
3168 }
3169 spin_unlock_bh(&rdev->bss_lock);
3170
3171 if (err)
3172 return err;
3173 return current_ev - buf;
3174 }
3175
3176
cfg80211_wext_giwscan(struct net_device * dev,struct iw_request_info * info,struct iw_point * data,char * extra)3177 int cfg80211_wext_giwscan(struct net_device *dev,
3178 struct iw_request_info *info,
3179 struct iw_point *data, char *extra)
3180 {
3181 struct cfg80211_registered_device *rdev;
3182 int res;
3183
3184 if (!netif_running(dev))
3185 return -ENETDOWN;
3186
3187 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3188
3189 if (IS_ERR(rdev))
3190 return PTR_ERR(rdev);
3191
3192 if (rdev->scan_req || rdev->scan_msg)
3193 return -EAGAIN;
3194
3195 res = ieee80211_scan_results(rdev, info, extra, data->length);
3196 data->length = 0;
3197 if (res >= 0) {
3198 data->length = res;
3199 res = 0;
3200 }
3201
3202 return res;
3203 }
3204 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
3205 #endif
3206