2 * cfg80211 scan result handling
4 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
6 #include <linux/kernel.h>
7 #include <linux/slab.h>
8 #include <linux/module.h>
9 #include <linux/netdevice.h>
10 #include <linux/wireless.h>
11 #include <linux/nl80211.h>
12 #include <linux/etherdevice.h>
14 #include <net/cfg80211.h>
15 #include <net/cfg80211-wext.h>
16 #include <net/iw_handler.h>
19 #include "wext-compat.h"
23 * DOC: BSS tree/list structure
25 * At the top level, the BSS list is kept in both a list in each
26 * registered device (@bss_list) as well as an RB-tree for faster
27 * lookup. In the RB-tree, entries can be looked up using their
28 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
31 * Due to the possibility of hidden SSIDs, there's a second level
32 * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
33 * The hidden_list connects all BSSes belonging to a single AP
34 * that has a hidden SSID, and connects beacon and probe response
35 * entries. For a probe response entry for a hidden SSID, the
36 * hidden_beacon_bss pointer points to the BSS struct holding the
37 * beacon's information.
39 * Reference counting is done for all these references except for
40 * the hidden_list, so that a beacon BSS struct that is otherwise
41 * not referenced has one reference for being on the bss_list and
42 * one for each probe response entry that points to it using the
43 * hidden_beacon_bss pointer. When a BSS struct that has such a
44 * pointer is get/put, the refcount update is also propagated to
45 * the referenced struct, this ensure that it cannot get removed
46 * while somebody is using the probe response version.
48 * Note that the hidden_beacon_bss pointer never changes, due to
49 * the reference counting. Therefore, no locking is needed for
52 * Also note that the hidden_beacon_bss pointer is only relevant
53 * if the driver uses something other than the IEs, e.g. private
54 * data stored stored in the BSS struct, since the beacon IEs are
55 * also linked into the probe response struct.
58 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
60 static void bss_free(struct cfg80211_internal_bss *bss)
62 struct cfg80211_bss_ies *ies;
64 if (WARN_ON(atomic_read(&bss->hold)))
67 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
68 if (ies && !bss->pub.hidden_beacon_bss)
69 kfree_rcu(ies, rcu_head);
70 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
72 kfree_rcu(ies, rcu_head);
75 * This happens when the module is removed, it doesn't
76 * really matter any more save for completeness
78 if (!list_empty(&bss->hidden_list))
79 list_del(&bss->hidden_list);
84 static inline void bss_ref_get(struct cfg80211_registered_device *dev,
85 struct cfg80211_internal_bss *bss)
87 lockdep_assert_held(&dev->bss_lock);
90 if (bss->pub.hidden_beacon_bss) {
91 bss = container_of(bss->pub.hidden_beacon_bss,
92 struct cfg80211_internal_bss,
98 static inline void bss_ref_put(struct cfg80211_registered_device *dev,
99 struct cfg80211_internal_bss *bss)
101 lockdep_assert_held(&dev->bss_lock);
103 if (bss->pub.hidden_beacon_bss) {
104 struct cfg80211_internal_bss *hbss;
105 hbss = container_of(bss->pub.hidden_beacon_bss,
106 struct cfg80211_internal_bss,
109 if (hbss->refcount == 0)
113 if (bss->refcount == 0)
117 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
118 struct cfg80211_internal_bss *bss)
120 lockdep_assert_held(&dev->bss_lock);
122 if (!list_empty(&bss->hidden_list)) {
124 * don't remove the beacon entry if it has
125 * probe responses associated with it
127 if (!bss->pub.hidden_beacon_bss)
130 * if it's a probe response entry break its
131 * link to the other entries in the group
133 list_del_init(&bss->hidden_list);
136 list_del_init(&bss->list);
137 rb_erase(&bss->rbn, &dev->bss_tree);
138 bss_ref_put(dev, bss);
142 static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
143 unsigned long expire_time)
145 struct cfg80211_internal_bss *bss, *tmp;
146 bool expired = false;
148 lockdep_assert_held(&dev->bss_lock);
150 list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
151 if (atomic_read(&bss->hold))
153 if (!time_after(expire_time, bss->ts))
156 if (__cfg80211_unlink_bss(dev, bss))
161 dev->bss_generation++;
164 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
167 struct cfg80211_scan_request *request;
168 struct wireless_dev *wdev;
170 #ifdef CONFIG_CFG80211_WEXT
171 union iwreq_data wrqu;
176 if (rdev->scan_msg) {
177 nl80211_send_scan_result(rdev, rdev->scan_msg);
178 rdev->scan_msg = NULL;
182 request = rdev->scan_req;
186 wdev = request->wdev;
189 * This must be before sending the other events!
190 * Otherwise, wpa_supplicant gets completely confused with
194 cfg80211_sme_scan_done(wdev->netdev);
196 if (!request->aborted &&
197 request->flags & NL80211_SCAN_FLAG_FLUSH) {
198 /* flush entries from previous scans */
199 spin_lock_bh(&rdev->bss_lock);
200 __cfg80211_bss_expire(rdev, request->scan_start);
201 spin_unlock_bh(&rdev->bss_lock);
204 msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);
206 #ifdef CONFIG_CFG80211_WEXT
207 if (wdev->netdev && !request->aborted) {
208 memset(&wrqu, 0, sizeof(wrqu));
210 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
215 dev_put(wdev->netdev);
217 rdev->scan_req = NULL;
221 rdev->scan_msg = msg;
223 nl80211_send_scan_result(rdev, msg);
226 void __cfg80211_scan_done(struct work_struct *wk)
228 struct cfg80211_registered_device *rdev;
230 rdev = container_of(wk, struct cfg80211_registered_device,
234 ___cfg80211_scan_done(rdev, true);
238 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
240 trace_cfg80211_scan_done(request, aborted);
241 WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
243 request->aborted = aborted;
244 request->notified = true;
245 queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
247 EXPORT_SYMBOL(cfg80211_scan_done);
249 void __cfg80211_sched_scan_results(struct work_struct *wk)
251 struct cfg80211_registered_device *rdev;
252 struct cfg80211_sched_scan_request *request;
254 rdev = container_of(wk, struct cfg80211_registered_device,
255 sched_scan_results_wk);
259 request = rdev->sched_scan_req;
261 /* we don't have sched_scan_req anymore if the scan is stopping */
263 if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
264 /* flush entries from previous scans */
265 spin_lock_bh(&rdev->bss_lock);
266 __cfg80211_bss_expire(rdev, request->scan_start);
267 spin_unlock_bh(&rdev->bss_lock);
268 request->scan_start =
269 jiffies + msecs_to_jiffies(request->interval);
271 nl80211_send_sched_scan_results(rdev, request->dev);
277 void cfg80211_sched_scan_results(struct wiphy *wiphy)
279 trace_cfg80211_sched_scan_results(wiphy);
280 /* ignore if we're not scanning */
281 if (wiphy_to_dev(wiphy)->sched_scan_req)
282 queue_work(cfg80211_wq,
283 &wiphy_to_dev(wiphy)->sched_scan_results_wk);
285 EXPORT_SYMBOL(cfg80211_sched_scan_results);
287 void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
289 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
291 trace_cfg80211_sched_scan_stopped(wiphy);
294 __cfg80211_stop_sched_scan(rdev, true);
297 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
299 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
300 bool driver_initiated)
302 struct net_device *dev;
306 if (!rdev->sched_scan_req)
309 dev = rdev->sched_scan_req->dev;
311 if (!driver_initiated) {
312 int err = rdev_sched_scan_stop(rdev, dev);
317 nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);
319 kfree(rdev->sched_scan_req);
320 rdev->sched_scan_req = NULL;
325 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
326 unsigned long age_secs)
328 struct cfg80211_internal_bss *bss;
329 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
331 spin_lock_bh(&dev->bss_lock);
332 list_for_each_entry(bss, &dev->bss_list, list)
333 bss->ts -= age_jiffies;
334 spin_unlock_bh(&dev->bss_lock);
337 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
339 __cfg80211_bss_expire(dev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
342 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
344 while (len > 2 && ies[0] != eid) {
350 if (len < 2 + ies[1])
354 EXPORT_SYMBOL(cfg80211_find_ie);
356 const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
357 const u8 *ies, int len)
359 struct ieee80211_vendor_ie *ie;
360 const u8 *pos = ies, *end = ies + len;
364 pos = cfg80211_find_ie(WLAN_EID_VENDOR_SPECIFIC, pos,
369 ie = (struct ieee80211_vendor_ie *)pos;
371 /* make sure we can access ie->len */
372 BUILD_BUG_ON(offsetof(struct ieee80211_vendor_ie, len) != 1);
374 if (ie->len < sizeof(*ie))
377 ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
378 if (ie_oui == oui && ie->oui_type == oui_type)
385 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
387 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
388 const u8 *ssid, size_t ssid_len)
390 const struct cfg80211_bss_ies *ies;
393 if (bssid && !ether_addr_equal(a->bssid, bssid))
399 ies = rcu_access_pointer(a->ies);
402 ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
405 if (ssidie[1] != ssid_len)
407 return memcmp(ssidie + 2, ssid, ssid_len) == 0;
411 * enum bss_compare_mode - BSS compare mode
412 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
413 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
414 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
416 enum bss_compare_mode {
422 static int cmp_bss(struct cfg80211_bss *a,
423 struct cfg80211_bss *b,
424 enum bss_compare_mode mode)
426 const struct cfg80211_bss_ies *a_ies, *b_ies;
427 const u8 *ie1 = NULL;
428 const u8 *ie2 = NULL;
431 if (a->channel != b->channel)
432 return b->channel->center_freq - a->channel->center_freq;
434 a_ies = rcu_access_pointer(a->ies);
437 b_ies = rcu_access_pointer(b->ies);
441 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
442 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
443 a_ies->data, a_ies->len);
444 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
445 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
446 b_ies->data, b_ies->len);
450 if (ie1[1] == ie2[1])
451 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
453 mesh_id_cmp = ie2[1] - ie1[1];
455 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
456 a_ies->data, a_ies->len);
457 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
458 b_ies->data, b_ies->len);
462 if (ie1[1] != ie2[1])
463 return ie2[1] - ie1[1];
464 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
468 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
472 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
473 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
479 * Note that with "hide_ssid", the function returns a match if
480 * the already-present BSS ("b") is a hidden SSID beacon for
484 /* sort missing IE before (left of) present IE */
491 case BSS_CMP_HIDE_ZLEN:
493 * In ZLEN mode we assume the BSS entry we're
494 * looking for has a zero-length SSID. So if
495 * the one we're looking at right now has that,
496 * return 0. Otherwise, return the difference
497 * in length, but since we're looking for the
498 * 0-length it's really equivalent to returning
499 * the length of the one we're looking at.
501 * No content comparison is needed as we assume
502 * the content length is zero.
505 case BSS_CMP_REGULAR:
507 /* sort by length first, then by contents */
508 if (ie1[1] != ie2[1])
509 return ie2[1] - ie1[1];
510 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
511 case BSS_CMP_HIDE_NUL:
512 if (ie1[1] != ie2[1])
513 return ie2[1] - ie1[1];
514 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
515 for (i = 0; i < ie2[1]; i++)
522 /* Returned bss is reference counted and must be cleaned up appropriately. */
523 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
524 struct ieee80211_channel *channel,
526 const u8 *ssid, size_t ssid_len,
527 u16 capa_mask, u16 capa_val)
529 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
530 struct cfg80211_internal_bss *bss, *res = NULL;
531 unsigned long now = jiffies;
533 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, capa_mask,
536 spin_lock_bh(&dev->bss_lock);
538 list_for_each_entry(bss, &dev->bss_list, list) {
539 if ((bss->pub.capability & capa_mask) != capa_val)
541 if (channel && bss->pub.channel != channel)
543 /* Don't get expired BSS structs */
544 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
545 !atomic_read(&bss->hold))
547 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
549 bss_ref_get(dev, res);
554 spin_unlock_bh(&dev->bss_lock);
557 trace_cfg80211_return_bss(&res->pub);
560 EXPORT_SYMBOL(cfg80211_get_bss);
562 static void rb_insert_bss(struct cfg80211_registered_device *dev,
563 struct cfg80211_internal_bss *bss)
565 struct rb_node **p = &dev->bss_tree.rb_node;
566 struct rb_node *parent = NULL;
567 struct cfg80211_internal_bss *tbss;
572 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
574 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
577 /* will sort of leak this BSS */
587 rb_link_node(&bss->rbn, parent, p);
588 rb_insert_color(&bss->rbn, &dev->bss_tree);
591 static struct cfg80211_internal_bss *
592 rb_find_bss(struct cfg80211_registered_device *dev,
593 struct cfg80211_internal_bss *res,
594 enum bss_compare_mode mode)
596 struct rb_node *n = dev->bss_tree.rb_node;
597 struct cfg80211_internal_bss *bss;
601 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
602 r = cmp_bss(&res->pub, &bss->pub, mode);
615 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
616 struct cfg80211_internal_bss *new)
618 const struct cfg80211_bss_ies *ies;
619 struct cfg80211_internal_bss *bss;
624 ies = rcu_access_pointer(new->pub.beacon_ies);
628 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
635 for (i = 0; i < ssidlen; i++)
639 /* not a hidden SSID */
643 /* This is the bad part ... */
645 list_for_each_entry(bss, &dev->bss_list, list) {
646 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
648 if (bss->pub.channel != new->pub.channel)
650 if (bss->pub.scan_width != new->pub.scan_width)
652 if (rcu_access_pointer(bss->pub.beacon_ies))
654 ies = rcu_access_pointer(bss->pub.ies);
657 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
660 if (ssidlen && ie[1] != ssidlen)
662 /* that would be odd ... */
663 if (bss->pub.beacon_ies)
665 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
667 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
668 list_del(&bss->hidden_list);
670 list_add(&bss->hidden_list, &new->hidden_list);
671 bss->pub.hidden_beacon_bss = &new->pub;
672 new->refcount += bss->refcount;
673 rcu_assign_pointer(bss->pub.beacon_ies,
674 new->pub.beacon_ies);
680 /* Returned bss is reference counted and must be cleaned up appropriately. */
681 static struct cfg80211_internal_bss *
682 cfg80211_bss_update(struct cfg80211_registered_device *dev,
683 struct cfg80211_internal_bss *tmp,
686 struct cfg80211_internal_bss *found = NULL;
688 if (WARN_ON(!tmp->pub.channel))
693 spin_lock_bh(&dev->bss_lock);
695 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
696 spin_unlock_bh(&dev->bss_lock);
700 found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
704 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
705 const struct cfg80211_bss_ies *old;
707 old = rcu_access_pointer(found->pub.proberesp_ies);
709 rcu_assign_pointer(found->pub.proberesp_ies,
710 tmp->pub.proberesp_ies);
711 /* Override possible earlier Beacon frame IEs */
712 rcu_assign_pointer(found->pub.ies,
713 tmp->pub.proberesp_ies);
715 kfree_rcu((struct cfg80211_bss_ies *)old,
717 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
718 const struct cfg80211_bss_ies *old;
719 struct cfg80211_internal_bss *bss;
721 if (found->pub.hidden_beacon_bss &&
722 !list_empty(&found->hidden_list)) {
723 const struct cfg80211_bss_ies *f;
726 * The found BSS struct is one of the probe
727 * response members of a group, but we're
728 * receiving a beacon (beacon_ies in the tmp
729 * bss is used). This can only mean that the
730 * AP changed its beacon from not having an
731 * SSID to showing it, which is confusing so
732 * drop this information.
735 f = rcu_access_pointer(tmp->pub.beacon_ies);
736 kfree_rcu((struct cfg80211_bss_ies *)f,
741 old = rcu_access_pointer(found->pub.beacon_ies);
743 rcu_assign_pointer(found->pub.beacon_ies,
744 tmp->pub.beacon_ies);
746 /* Override IEs if they were from a beacon before */
747 if (old == rcu_access_pointer(found->pub.ies))
748 rcu_assign_pointer(found->pub.ies,
749 tmp->pub.beacon_ies);
751 /* Assign beacon IEs to all sub entries */
752 list_for_each_entry(bss, &found->hidden_list,
754 const struct cfg80211_bss_ies *ies;
756 ies = rcu_access_pointer(bss->pub.beacon_ies);
759 rcu_assign_pointer(bss->pub.beacon_ies,
760 tmp->pub.beacon_ies);
764 kfree_rcu((struct cfg80211_bss_ies *)old,
768 found->pub.beacon_interval = tmp->pub.beacon_interval;
770 * don't update the signal if beacon was heard on
774 found->pub.signal = tmp->pub.signal;
775 found->pub.capability = tmp->pub.capability;
778 struct cfg80211_internal_bss *new;
779 struct cfg80211_internal_bss *hidden;
780 struct cfg80211_bss_ies *ies;
783 * create a copy -- the "res" variable that is passed in
784 * is allocated on the stack since it's not needed in the
785 * more common case of an update
787 new = kzalloc(sizeof(*new) + dev->wiphy.bss_priv_size,
790 ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
792 kfree_rcu(ies, rcu_head);
793 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
795 kfree_rcu(ies, rcu_head);
798 memcpy(new, tmp, sizeof(*new));
800 INIT_LIST_HEAD(&new->hidden_list);
802 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
803 hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_ZLEN);
805 hidden = rb_find_bss(dev, tmp,
808 new->pub.hidden_beacon_bss = &hidden->pub;
809 list_add(&new->hidden_list,
810 &hidden->hidden_list);
812 rcu_assign_pointer(new->pub.beacon_ies,
813 hidden->pub.beacon_ies);
817 * Ok so we found a beacon, and don't have an entry. If
818 * it's a beacon with hidden SSID, we might be in for an
819 * expensive search for any probe responses that should
820 * be grouped with this beacon for updates ...
822 if (!cfg80211_combine_bsses(dev, new)) {
828 list_add_tail(&new->list, &dev->bss_list);
829 rb_insert_bss(dev, new);
833 dev->bss_generation++;
834 bss_ref_get(dev, found);
835 spin_unlock_bh(&dev->bss_lock);
839 spin_unlock_bh(&dev->bss_lock);
843 static struct ieee80211_channel *
844 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
845 struct ieee80211_channel *channel)
849 int channel_number = -1;
851 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
852 if (tmp && tmp[1] == 1) {
853 channel_number = tmp[2];
855 tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
856 if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
857 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
859 channel_number = htop->primary_chan;
863 if (channel_number < 0)
866 freq = ieee80211_channel_to_frequency(channel_number, channel->band);
867 channel = ieee80211_get_channel(wiphy, freq);
870 if (channel->flags & IEEE80211_CHAN_DISABLED)
875 /* Returned bss is reference counted and must be cleaned up appropriately. */
877 cfg80211_inform_bss_width(struct wiphy *wiphy,
878 struct ieee80211_channel *rx_channel,
879 enum nl80211_bss_scan_width scan_width,
880 const u8 *bssid, u64 tsf, u16 capability,
881 u16 beacon_interval, const u8 *ie, size_t ielen,
882 s32 signal, gfp_t gfp)
884 struct cfg80211_bss_ies *ies;
885 struct ieee80211_channel *channel;
886 struct cfg80211_internal_bss tmp = {}, *res;
891 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
892 (signal < 0 || signal > 100)))
895 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, rx_channel);
899 memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
900 tmp.pub.channel = channel;
901 tmp.pub.scan_width = scan_width;
902 tmp.pub.signal = signal;
903 tmp.pub.beacon_interval = beacon_interval;
904 tmp.pub.capability = capability;
906 * Since we do not know here whether the IEs are from a Beacon or Probe
907 * Response frame, we need to pick one of the options and only use it
908 * with the driver that does not provide the full Beacon/Probe Response
909 * frame. Use Beacon frame pointer to avoid indicating that this should
910 * override the IEs pointer should we have received an earlier
911 * indication of Probe Response data.
913 ies = kmalloc(sizeof(*ies) + ielen, gfp);
918 memcpy(ies->data, ie, ielen);
920 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
921 rcu_assign_pointer(tmp.pub.ies, ies);
923 res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
924 rx_channel == channel);
928 if (res->pub.capability & WLAN_CAPABILITY_ESS)
929 regulatory_hint_found_beacon(wiphy, channel, gfp);
931 trace_cfg80211_return_bss(&res->pub);
932 /* cfg80211_bss_update gives us a referenced result */
935 EXPORT_SYMBOL(cfg80211_inform_bss_width);
937 /* Returned bss is reference counted and must be cleaned up appropriately. */
938 struct cfg80211_bss *
939 cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
940 struct ieee80211_channel *rx_channel,
941 enum nl80211_bss_scan_width scan_width,
942 struct ieee80211_mgmt *mgmt, size_t len,
943 s32 signal, gfp_t gfp)
945 struct cfg80211_internal_bss tmp = {}, *res;
946 struct cfg80211_bss_ies *ies;
947 struct ieee80211_channel *channel;
948 size_t ielen = len - offsetof(struct ieee80211_mgmt,
949 u.probe_resp.variable);
951 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
952 offsetof(struct ieee80211_mgmt, u.beacon.variable));
954 trace_cfg80211_inform_bss_width_frame(wiphy, rx_channel, scan_width, mgmt,
963 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
964 (signal < 0 || signal > 100)))
967 if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
970 channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
975 ies = kmalloc(sizeof(*ies) + ielen, gfp);
979 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
980 memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
982 if (ieee80211_is_probe_resp(mgmt->frame_control))
983 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
985 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
986 rcu_assign_pointer(tmp.pub.ies, ies);
988 memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
989 tmp.pub.channel = channel;
990 tmp.pub.scan_width = scan_width;
991 tmp.pub.signal = signal;
992 tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
993 tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
995 res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
996 rx_channel == channel);
1000 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1001 regulatory_hint_found_beacon(wiphy, channel, gfp);
1003 trace_cfg80211_return_bss(&res->pub);
1004 /* cfg80211_bss_update gives us a referenced result */
1007 EXPORT_SYMBOL(cfg80211_inform_bss_width_frame);
1009 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1011 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
1012 struct cfg80211_internal_bss *bss;
1017 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1019 spin_lock_bh(&dev->bss_lock);
1020 bss_ref_get(dev, bss);
1021 spin_unlock_bh(&dev->bss_lock);
1023 EXPORT_SYMBOL(cfg80211_ref_bss);
1025 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1027 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
1028 struct cfg80211_internal_bss *bss;
1033 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1035 spin_lock_bh(&dev->bss_lock);
1036 bss_ref_put(dev, bss);
1037 spin_unlock_bh(&dev->bss_lock);
1039 EXPORT_SYMBOL(cfg80211_put_bss);
1041 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1043 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
1044 struct cfg80211_internal_bss *bss;
1049 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1051 spin_lock_bh(&dev->bss_lock);
1052 if (!list_empty(&bss->list)) {
1053 if (__cfg80211_unlink_bss(dev, bss))
1054 dev->bss_generation++;
1056 spin_unlock_bh(&dev->bss_lock);
1058 EXPORT_SYMBOL(cfg80211_unlink_bss);
1060 #ifdef CONFIG_CFG80211_WEXT
1061 static struct cfg80211_registered_device *
1062 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
1064 struct cfg80211_registered_device *rdev;
1065 struct net_device *dev;
1069 dev = dev_get_by_index(net, ifindex);
1071 return ERR_PTR(-ENODEV);
1072 if (dev->ieee80211_ptr)
1073 rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
1075 rdev = ERR_PTR(-ENODEV);
1080 int cfg80211_wext_siwscan(struct net_device *dev,
1081 struct iw_request_info *info,
1082 union iwreq_data *wrqu, char *extra)
1084 struct cfg80211_registered_device *rdev;
1085 struct wiphy *wiphy;
1086 struct iw_scan_req *wreq = NULL;
1087 struct cfg80211_scan_request *creq = NULL;
1088 int i, err, n_channels = 0;
1089 enum ieee80211_band band;
1091 if (!netif_running(dev))
1094 if (wrqu->data.length == sizeof(struct iw_scan_req))
1095 wreq = (struct iw_scan_req *)extra;
1097 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1100 return PTR_ERR(rdev);
1102 if (rdev->scan_req || rdev->scan_msg) {
1107 wiphy = &rdev->wiphy;
1109 /* Determine number of channels, needed to allocate creq */
1110 if (wreq && wreq->num_channels)
1111 n_channels = wreq->num_channels;
1113 n_channels = ieee80211_get_num_supported_channels(wiphy);
1115 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
1116 n_channels * sizeof(void *),
1123 creq->wiphy = wiphy;
1124 creq->wdev = dev->ieee80211_ptr;
1125 /* SSIDs come after channels */
1126 creq->ssids = (void *)&creq->channels[n_channels];
1127 creq->n_channels = n_channels;
1129 creq->scan_start = jiffies;
1131 /* translate "Scan on frequencies" request */
1133 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1136 if (!wiphy->bands[band])
1139 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
1140 /* ignore disabled channels */
1141 if (wiphy->bands[band]->channels[j].flags &
1142 IEEE80211_CHAN_DISABLED)
1145 /* If we have a wireless request structure and the
1146 * wireless request specifies frequencies, then search
1147 * for the matching hardware channel.
1149 if (wreq && wreq->num_channels) {
1151 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
1152 for (k = 0; k < wreq->num_channels; k++) {
1153 int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
1154 if (wext_freq == wiphy_freq)
1155 goto wext_freq_found;
1157 goto wext_freq_not_found;
1161 creq->channels[i] = &wiphy->bands[band]->channels[j];
1163 wext_freq_not_found: ;
1166 /* No channels found? */
1172 /* Set real number of channels specified in creq->channels[] */
1173 creq->n_channels = i;
1175 /* translate "Scan for SSID" request */
1177 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
1178 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
1182 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
1183 creq->ssids[0].ssid_len = wreq->essid_len;
1185 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
1189 for (i = 0; i < IEEE80211_NUM_BANDS; i++)
1190 if (wiphy->bands[i])
1191 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
1193 rdev->scan_req = creq;
1194 err = rdev_scan(rdev, creq);
1196 rdev->scan_req = NULL;
1197 /* creq will be freed below */
1199 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
1200 /* creq now owned by driver */
1208 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
1210 static void ieee80211_scan_add_ies(struct iw_request_info *info,
1211 const struct cfg80211_bss_ies *ies,
1212 char **current_ev, char *end_buf)
1214 const u8 *pos, *end, *next;
1215 struct iw_event iwe;
1221 * If needed, fragment the IEs buffer (at IE boundaries) into short
1222 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
1225 end = pos + ies->len;
1227 while (end - pos > IW_GENERIC_IE_MAX) {
1228 next = pos + 2 + pos[1];
1229 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
1230 next = next + 2 + next[1];
1232 memset(&iwe, 0, sizeof(iwe));
1233 iwe.cmd = IWEVGENIE;
1234 iwe.u.data.length = next - pos;
1235 *current_ev = iwe_stream_add_point(info, *current_ev,
1243 memset(&iwe, 0, sizeof(iwe));
1244 iwe.cmd = IWEVGENIE;
1245 iwe.u.data.length = end - pos;
1246 *current_ev = iwe_stream_add_point(info, *current_ev,
1253 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
1254 struct cfg80211_internal_bss *bss, char *current_ev,
1257 const struct cfg80211_bss_ies *ies;
1258 struct iw_event iwe;
1262 bool ismesh = false;
1264 memset(&iwe, 0, sizeof(iwe));
1265 iwe.cmd = SIOCGIWAP;
1266 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
1267 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
1268 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1271 memset(&iwe, 0, sizeof(iwe));
1272 iwe.cmd = SIOCGIWFREQ;
1273 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
1275 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1278 memset(&iwe, 0, sizeof(iwe));
1279 iwe.cmd = SIOCGIWFREQ;
1280 iwe.u.freq.m = bss->pub.channel->center_freq;
1282 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1285 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
1286 memset(&iwe, 0, sizeof(iwe));
1288 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
1289 IW_QUAL_NOISE_INVALID |
1290 IW_QUAL_QUAL_UPDATED;
1291 switch (wiphy->signal_type) {
1292 case CFG80211_SIGNAL_TYPE_MBM:
1293 sig = bss->pub.signal / 100;
1294 iwe.u.qual.level = sig;
1295 iwe.u.qual.updated |= IW_QUAL_DBM;
1296 if (sig < -110) /* rather bad */
1298 else if (sig > -40) /* perfect */
1300 /* will give a range of 0 .. 70 */
1301 iwe.u.qual.qual = sig + 110;
1303 case CFG80211_SIGNAL_TYPE_UNSPEC:
1304 iwe.u.qual.level = bss->pub.signal;
1305 /* will give range 0 .. 100 */
1306 iwe.u.qual.qual = bss->pub.signal;
1312 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
1313 &iwe, IW_EV_QUAL_LEN);
1316 memset(&iwe, 0, sizeof(iwe));
1317 iwe.cmd = SIOCGIWENCODE;
1318 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
1319 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
1321 iwe.u.data.flags = IW_ENCODE_DISABLED;
1322 iwe.u.data.length = 0;
1323 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1327 ies = rcu_dereference(bss->pub.ies);
1333 if (ie[1] > rem - 2)
1338 memset(&iwe, 0, sizeof(iwe));
1339 iwe.cmd = SIOCGIWESSID;
1340 iwe.u.data.length = ie[1];
1341 iwe.u.data.flags = 1;
1342 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1343 &iwe, (u8 *)ie + 2);
1345 case WLAN_EID_MESH_ID:
1346 memset(&iwe, 0, sizeof(iwe));
1347 iwe.cmd = SIOCGIWESSID;
1348 iwe.u.data.length = ie[1];
1349 iwe.u.data.flags = 1;
1350 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1351 &iwe, (u8 *)ie + 2);
1353 case WLAN_EID_MESH_CONFIG:
1355 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1357 buf = kmalloc(50, GFP_ATOMIC);
1361 memset(&iwe, 0, sizeof(iwe));
1362 iwe.cmd = IWEVCUSTOM;
1363 sprintf(buf, "Mesh Network Path Selection Protocol ID: "
1365 iwe.u.data.length = strlen(buf);
1366 current_ev = iwe_stream_add_point(info, current_ev,
1369 sprintf(buf, "Path Selection Metric ID: 0x%02X",
1371 iwe.u.data.length = strlen(buf);
1372 current_ev = iwe_stream_add_point(info, current_ev,
1375 sprintf(buf, "Congestion Control Mode ID: 0x%02X",
1377 iwe.u.data.length = strlen(buf);
1378 current_ev = iwe_stream_add_point(info, current_ev,
1381 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1382 iwe.u.data.length = strlen(buf);
1383 current_ev = iwe_stream_add_point(info, current_ev,
1386 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
1387 iwe.u.data.length = strlen(buf);
1388 current_ev = iwe_stream_add_point(info, current_ev,
1391 sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
1392 iwe.u.data.length = strlen(buf);
1393 current_ev = iwe_stream_add_point(info, current_ev,
1396 sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1397 iwe.u.data.length = strlen(buf);
1398 current_ev = iwe_stream_add_point(info, current_ev,
1403 case WLAN_EID_SUPP_RATES:
1404 case WLAN_EID_EXT_SUPP_RATES:
1405 /* display all supported rates in readable format */
1406 p = current_ev + iwe_stream_lcp_len(info);
1408 memset(&iwe, 0, sizeof(iwe));
1409 iwe.cmd = SIOCGIWRATE;
1410 /* Those two flags are ignored... */
1411 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
1413 for (i = 0; i < ie[1]; i++) {
1414 iwe.u.bitrate.value =
1415 ((ie[i + 2] & 0x7f) * 500000);
1416 p = iwe_stream_add_value(info, current_ev, p,
1417 end_buf, &iwe, IW_EV_PARAM_LEN);
1426 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
1428 memset(&iwe, 0, sizeof(iwe));
1429 iwe.cmd = SIOCGIWMODE;
1431 iwe.u.mode = IW_MODE_MESH;
1432 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
1433 iwe.u.mode = IW_MODE_MASTER;
1435 iwe.u.mode = IW_MODE_ADHOC;
1436 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
1437 &iwe, IW_EV_UINT_LEN);
1440 buf = kmalloc(31, GFP_ATOMIC);
1442 memset(&iwe, 0, sizeof(iwe));
1443 iwe.cmd = IWEVCUSTOM;
1444 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
1445 iwe.u.data.length = strlen(buf);
1446 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1448 memset(&iwe, 0, sizeof(iwe));
1449 iwe.cmd = IWEVCUSTOM;
1450 sprintf(buf, " Last beacon: %ums ago",
1451 elapsed_jiffies_msecs(bss->ts));
1452 iwe.u.data.length = strlen(buf);
1453 current_ev = iwe_stream_add_point(info, current_ev,
1454 end_buf, &iwe, buf);
1458 ieee80211_scan_add_ies(info, ies, ¤t_ev, end_buf);
1465 static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
1466 struct iw_request_info *info,
1467 char *buf, size_t len)
1469 char *current_ev = buf;
1470 char *end_buf = buf + len;
1471 struct cfg80211_internal_bss *bss;
1473 spin_lock_bh(&dev->bss_lock);
1474 cfg80211_bss_expire(dev);
1476 list_for_each_entry(bss, &dev->bss_list, list) {
1477 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
1478 spin_unlock_bh(&dev->bss_lock);
1481 current_ev = ieee80211_bss(&dev->wiphy, info, bss,
1482 current_ev, end_buf);
1484 spin_unlock_bh(&dev->bss_lock);
1485 return current_ev - buf;
1489 int cfg80211_wext_giwscan(struct net_device *dev,
1490 struct iw_request_info *info,
1491 struct iw_point *data, char *extra)
1493 struct cfg80211_registered_device *rdev;
1496 if (!netif_running(dev))
1499 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1502 return PTR_ERR(rdev);
1504 if (rdev->scan_req || rdev->scan_msg)
1507 res = ieee80211_scan_results(rdev, info, extra, data->length);
1516 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);