2 * cfg80211 scan result handling
4 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
6 #include <linux/kernel.h>
7 #include <linux/slab.h>
8 #include <linux/module.h>
9 #include <linux/netdevice.h>
10 #include <linux/wireless.h>
11 #include <linux/nl80211.h>
12 #include <linux/etherdevice.h>
14 #include <net/cfg80211.h>
15 #include <net/cfg80211-wext.h>
16 #include <net/iw_handler.h>
19 #include "wext-compat.h"
23 * DOC: BSS tree/list structure
25 * At the top level, the BSS list is kept in both a list in each
26 * registered device (@bss_list) as well as an RB-tree for faster
27 * lookup. In the RB-tree, entries can be looked up using their
28 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
31 * Due to the possibility of hidden SSIDs, there's a second level
32 * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
33 * The hidden_list connects all BSSes belonging to a single AP
34 * that has a hidden SSID, and connects beacon and probe response
35 * entries. For a probe response entry for a hidden SSID, the
36 * hidden_beacon_bss pointer points to the BSS struct holding the
37 * beacon's information.
39 * Reference counting is done for all these references except for
40 * the hidden_list, so that a beacon BSS struct that is otherwise
41 * not referenced has one reference for being on the bss_list and
42 * one for each probe response entry that points to it using the
43 * hidden_beacon_bss pointer. When a BSS struct that has such a
44 * pointer is get/put, the refcount update is also propagated to
45 * the referenced struct, this ensure that it cannot get removed
46 * while somebody is using the probe response version.
48 * Note that the hidden_beacon_bss pointer never changes, due to
49 * the reference counting. Therefore, no locking is needed for
52 * Also note that the hidden_beacon_bss pointer is only relevant
53 * if the driver uses something other than the IEs, e.g. private
54 * data stored stored in the BSS struct, since the beacon IEs are
55 * also linked into the probe response struct.
58 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
60 static void bss_free(struct cfg80211_internal_bss *bss)
62 struct cfg80211_bss_ies *ies;
64 if (WARN_ON(atomic_read(&bss->hold)))
67 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
68 if (ies && !bss->pub.hidden_beacon_bss)
69 kfree_rcu(ies, rcu_head);
70 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
72 kfree_rcu(ies, rcu_head);
75 * This happens when the module is removed, it doesn't
76 * really matter any more save for completeness
78 if (!list_empty(&bss->hidden_list))
79 list_del(&bss->hidden_list);
84 static inline void bss_ref_get(struct cfg80211_registered_device *dev,
85 struct cfg80211_internal_bss *bss)
87 lockdep_assert_held(&dev->bss_lock);
90 if (bss->pub.hidden_beacon_bss) {
91 bss = container_of(bss->pub.hidden_beacon_bss,
92 struct cfg80211_internal_bss,
98 static inline void bss_ref_put(struct cfg80211_registered_device *dev,
99 struct cfg80211_internal_bss *bss)
101 lockdep_assert_held(&dev->bss_lock);
103 if (bss->pub.hidden_beacon_bss) {
104 struct cfg80211_internal_bss *hbss;
105 hbss = container_of(bss->pub.hidden_beacon_bss,
106 struct cfg80211_internal_bss,
109 if (hbss->refcount == 0)
113 if (bss->refcount == 0)
117 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
118 struct cfg80211_internal_bss *bss)
120 lockdep_assert_held(&dev->bss_lock);
122 if (!list_empty(&bss->hidden_list)) {
124 * don't remove the beacon entry if it has
125 * probe responses associated with it
127 if (!bss->pub.hidden_beacon_bss)
130 * if it's a probe response entry break its
131 * link to the other entries in the group
133 list_del_init(&bss->hidden_list);
136 list_del_init(&bss->list);
137 rb_erase(&bss->rbn, &dev->bss_tree);
138 bss_ref_put(dev, bss);
142 static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
143 unsigned long expire_time)
145 struct cfg80211_internal_bss *bss, *tmp;
146 bool expired = false;
148 lockdep_assert_held(&dev->bss_lock);
150 list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
151 if (atomic_read(&bss->hold))
153 if (!time_after(expire_time, bss->ts))
156 if (__cfg80211_unlink_bss(dev, bss))
161 dev->bss_generation++;
164 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
167 struct cfg80211_scan_request *request;
168 struct wireless_dev *wdev;
170 #ifdef CONFIG_CFG80211_WEXT
171 union iwreq_data wrqu;
176 if (rdev->scan_msg) {
177 nl80211_send_scan_result(rdev, rdev->scan_msg);
178 rdev->scan_msg = NULL;
182 request = rdev->scan_req;
186 wdev = request->wdev;
189 * This must be before sending the other events!
190 * Otherwise, wpa_supplicant gets completely confused with
194 cfg80211_sme_scan_done(wdev->netdev);
196 if (!request->aborted &&
197 request->flags & NL80211_SCAN_FLAG_FLUSH) {
198 /* flush entries from previous scans */
199 spin_lock_bh(&rdev->bss_lock);
200 __cfg80211_bss_expire(rdev, request->scan_start);
201 spin_unlock_bh(&rdev->bss_lock);
204 msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);
206 #ifdef CONFIG_CFG80211_WEXT
207 if (wdev->netdev && !request->aborted) {
208 memset(&wrqu, 0, sizeof(wrqu));
210 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
215 dev_put(wdev->netdev);
217 rdev->scan_req = NULL;
221 rdev->scan_msg = msg;
223 nl80211_send_scan_result(rdev, msg);
226 void __cfg80211_scan_done(struct work_struct *wk)
228 struct cfg80211_registered_device *rdev;
230 rdev = container_of(wk, struct cfg80211_registered_device,
234 ___cfg80211_scan_done(rdev, true);
238 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
240 trace_cfg80211_scan_done(request, aborted);
241 WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
243 request->aborted = aborted;
244 request->notified = true;
245 queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
247 EXPORT_SYMBOL(cfg80211_scan_done);
249 void __cfg80211_sched_scan_results(struct work_struct *wk)
251 struct cfg80211_registered_device *rdev;
252 struct cfg80211_sched_scan_request *request;
254 rdev = container_of(wk, struct cfg80211_registered_device,
255 sched_scan_results_wk);
259 request = rdev->sched_scan_req;
261 /* we don't have sched_scan_req anymore if the scan is stopping */
263 if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
264 /* flush entries from previous scans */
265 spin_lock_bh(&rdev->bss_lock);
266 __cfg80211_bss_expire(rdev, request->scan_start);
267 spin_unlock_bh(&rdev->bss_lock);
268 request->scan_start =
269 jiffies + msecs_to_jiffies(request->interval);
271 nl80211_send_sched_scan_results(rdev, request->dev);
277 void cfg80211_sched_scan_results(struct wiphy *wiphy)
279 trace_cfg80211_sched_scan_results(wiphy);
280 /* ignore if we're not scanning */
281 if (wiphy_to_dev(wiphy)->sched_scan_req)
282 queue_work(cfg80211_wq,
283 &wiphy_to_dev(wiphy)->sched_scan_results_wk);
285 EXPORT_SYMBOL(cfg80211_sched_scan_results);
287 void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy)
289 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
293 trace_cfg80211_sched_scan_stopped(wiphy);
295 __cfg80211_stop_sched_scan(rdev, true);
297 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
299 void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
302 cfg80211_sched_scan_stopped_rtnl(wiphy);
305 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
307 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
308 bool driver_initiated)
310 struct net_device *dev;
314 if (!rdev->sched_scan_req)
317 dev = rdev->sched_scan_req->dev;
319 if (!driver_initiated) {
320 int err = rdev_sched_scan_stop(rdev, dev);
325 nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);
327 kfree(rdev->sched_scan_req);
328 rdev->sched_scan_req = NULL;
333 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
334 unsigned long age_secs)
336 struct cfg80211_internal_bss *bss;
337 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
339 spin_lock_bh(&dev->bss_lock);
340 list_for_each_entry(bss, &dev->bss_list, list)
341 bss->ts -= age_jiffies;
342 spin_unlock_bh(&dev->bss_lock);
345 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
347 __cfg80211_bss_expire(dev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
350 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
352 while (len > 2 && ies[0] != eid) {
358 if (len < 2 + ies[1])
362 EXPORT_SYMBOL(cfg80211_find_ie);
364 const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
365 const u8 *ies, int len)
367 struct ieee80211_vendor_ie *ie;
368 const u8 *pos = ies, *end = ies + len;
372 pos = cfg80211_find_ie(WLAN_EID_VENDOR_SPECIFIC, pos,
377 ie = (struct ieee80211_vendor_ie *)pos;
379 /* make sure we can access ie->len */
380 BUILD_BUG_ON(offsetof(struct ieee80211_vendor_ie, len) != 1);
382 if (ie->len < sizeof(*ie))
385 ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
386 if (ie_oui == oui && ie->oui_type == oui_type)
393 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
395 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
396 const u8 *ssid, size_t ssid_len)
398 const struct cfg80211_bss_ies *ies;
401 if (bssid && !ether_addr_equal(a->bssid, bssid))
407 ies = rcu_access_pointer(a->ies);
410 ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
413 if (ssidie[1] != ssid_len)
415 return memcmp(ssidie + 2, ssid, ssid_len) == 0;
419 * enum bss_compare_mode - BSS compare mode
420 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
421 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
422 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
424 enum bss_compare_mode {
430 static int cmp_bss(struct cfg80211_bss *a,
431 struct cfg80211_bss *b,
432 enum bss_compare_mode mode)
434 const struct cfg80211_bss_ies *a_ies, *b_ies;
435 const u8 *ie1 = NULL;
436 const u8 *ie2 = NULL;
439 if (a->channel != b->channel)
440 return b->channel->center_freq - a->channel->center_freq;
442 a_ies = rcu_access_pointer(a->ies);
445 b_ies = rcu_access_pointer(b->ies);
449 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
450 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
451 a_ies->data, a_ies->len);
452 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
453 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
454 b_ies->data, b_ies->len);
458 if (ie1[1] == ie2[1])
459 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
461 mesh_id_cmp = ie2[1] - ie1[1];
463 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
464 a_ies->data, a_ies->len);
465 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
466 b_ies->data, b_ies->len);
470 if (ie1[1] != ie2[1])
471 return ie2[1] - ie1[1];
472 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
476 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
480 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
481 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
487 * Note that with "hide_ssid", the function returns a match if
488 * the already-present BSS ("b") is a hidden SSID beacon for
492 /* sort missing IE before (left of) present IE */
499 case BSS_CMP_HIDE_ZLEN:
501 * In ZLEN mode we assume the BSS entry we're
502 * looking for has a zero-length SSID. So if
503 * the one we're looking at right now has that,
504 * return 0. Otherwise, return the difference
505 * in length, but since we're looking for the
506 * 0-length it's really equivalent to returning
507 * the length of the one we're looking at.
509 * No content comparison is needed as we assume
510 * the content length is zero.
513 case BSS_CMP_REGULAR:
515 /* sort by length first, then by contents */
516 if (ie1[1] != ie2[1])
517 return ie2[1] - ie1[1];
518 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
519 case BSS_CMP_HIDE_NUL:
520 if (ie1[1] != ie2[1])
521 return ie2[1] - ie1[1];
522 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
523 for (i = 0; i < ie2[1]; i++)
530 /* Returned bss is reference counted and must be cleaned up appropriately. */
531 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
532 struct ieee80211_channel *channel,
534 const u8 *ssid, size_t ssid_len,
535 u16 capa_mask, u16 capa_val)
537 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
538 struct cfg80211_internal_bss *bss, *res = NULL;
539 unsigned long now = jiffies;
541 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, capa_mask,
544 spin_lock_bh(&dev->bss_lock);
546 list_for_each_entry(bss, &dev->bss_list, list) {
547 if ((bss->pub.capability & capa_mask) != capa_val)
549 if (channel && bss->pub.channel != channel)
551 /* Don't get expired BSS structs */
552 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
553 !atomic_read(&bss->hold))
555 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
557 bss_ref_get(dev, res);
562 spin_unlock_bh(&dev->bss_lock);
565 trace_cfg80211_return_bss(&res->pub);
568 EXPORT_SYMBOL(cfg80211_get_bss);
570 static void rb_insert_bss(struct cfg80211_registered_device *dev,
571 struct cfg80211_internal_bss *bss)
573 struct rb_node **p = &dev->bss_tree.rb_node;
574 struct rb_node *parent = NULL;
575 struct cfg80211_internal_bss *tbss;
580 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
582 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
585 /* will sort of leak this BSS */
595 rb_link_node(&bss->rbn, parent, p);
596 rb_insert_color(&bss->rbn, &dev->bss_tree);
599 static struct cfg80211_internal_bss *
600 rb_find_bss(struct cfg80211_registered_device *dev,
601 struct cfg80211_internal_bss *res,
602 enum bss_compare_mode mode)
604 struct rb_node *n = dev->bss_tree.rb_node;
605 struct cfg80211_internal_bss *bss;
609 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
610 r = cmp_bss(&res->pub, &bss->pub, mode);
623 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
624 struct cfg80211_internal_bss *new)
626 const struct cfg80211_bss_ies *ies;
627 struct cfg80211_internal_bss *bss;
632 ies = rcu_access_pointer(new->pub.beacon_ies);
636 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
643 for (i = 0; i < ssidlen; i++)
647 /* not a hidden SSID */
651 /* This is the bad part ... */
653 list_for_each_entry(bss, &dev->bss_list, list) {
654 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
656 if (bss->pub.channel != new->pub.channel)
658 if (bss->pub.scan_width != new->pub.scan_width)
660 if (rcu_access_pointer(bss->pub.beacon_ies))
662 ies = rcu_access_pointer(bss->pub.ies);
665 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
668 if (ssidlen && ie[1] != ssidlen)
670 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
672 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
673 list_del(&bss->hidden_list);
675 list_add(&bss->hidden_list, &new->hidden_list);
676 bss->pub.hidden_beacon_bss = &new->pub;
677 new->refcount += bss->refcount;
678 rcu_assign_pointer(bss->pub.beacon_ies,
679 new->pub.beacon_ies);
685 /* Returned bss is reference counted and must be cleaned up appropriately. */
686 static struct cfg80211_internal_bss *
687 cfg80211_bss_update(struct cfg80211_registered_device *dev,
688 struct cfg80211_internal_bss *tmp,
691 struct cfg80211_internal_bss *found = NULL;
693 if (WARN_ON(!tmp->pub.channel))
698 spin_lock_bh(&dev->bss_lock);
700 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
701 spin_unlock_bh(&dev->bss_lock);
705 found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
709 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
710 const struct cfg80211_bss_ies *old;
712 old = rcu_access_pointer(found->pub.proberesp_ies);
714 rcu_assign_pointer(found->pub.proberesp_ies,
715 tmp->pub.proberesp_ies);
716 /* Override possible earlier Beacon frame IEs */
717 rcu_assign_pointer(found->pub.ies,
718 tmp->pub.proberesp_ies);
720 kfree_rcu((struct cfg80211_bss_ies *)old,
722 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
723 const struct cfg80211_bss_ies *old;
724 struct cfg80211_internal_bss *bss;
726 if (found->pub.hidden_beacon_bss &&
727 !list_empty(&found->hidden_list)) {
728 const struct cfg80211_bss_ies *f;
731 * The found BSS struct is one of the probe
732 * response members of a group, but we're
733 * receiving a beacon (beacon_ies in the tmp
734 * bss is used). This can only mean that the
735 * AP changed its beacon from not having an
736 * SSID to showing it, which is confusing so
737 * drop this information.
740 f = rcu_access_pointer(tmp->pub.beacon_ies);
741 kfree_rcu((struct cfg80211_bss_ies *)f,
746 old = rcu_access_pointer(found->pub.beacon_ies);
748 rcu_assign_pointer(found->pub.beacon_ies,
749 tmp->pub.beacon_ies);
751 /* Override IEs if they were from a beacon before */
752 if (old == rcu_access_pointer(found->pub.ies))
753 rcu_assign_pointer(found->pub.ies,
754 tmp->pub.beacon_ies);
756 /* Assign beacon IEs to all sub entries */
757 list_for_each_entry(bss, &found->hidden_list,
759 const struct cfg80211_bss_ies *ies;
761 ies = rcu_access_pointer(bss->pub.beacon_ies);
764 rcu_assign_pointer(bss->pub.beacon_ies,
765 tmp->pub.beacon_ies);
769 kfree_rcu((struct cfg80211_bss_ies *)old,
773 found->pub.beacon_interval = tmp->pub.beacon_interval;
775 * don't update the signal if beacon was heard on
779 found->pub.signal = tmp->pub.signal;
780 found->pub.capability = tmp->pub.capability;
783 struct cfg80211_internal_bss *new;
784 struct cfg80211_internal_bss *hidden;
785 struct cfg80211_bss_ies *ies;
788 * create a copy -- the "res" variable that is passed in
789 * is allocated on the stack since it's not needed in the
790 * more common case of an update
792 new = kzalloc(sizeof(*new) + dev->wiphy.bss_priv_size,
795 ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
797 kfree_rcu(ies, rcu_head);
798 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
800 kfree_rcu(ies, rcu_head);
803 memcpy(new, tmp, sizeof(*new));
805 INIT_LIST_HEAD(&new->hidden_list);
807 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
808 hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_ZLEN);
810 hidden = rb_find_bss(dev, tmp,
813 new->pub.hidden_beacon_bss = &hidden->pub;
814 list_add(&new->hidden_list,
815 &hidden->hidden_list);
817 rcu_assign_pointer(new->pub.beacon_ies,
818 hidden->pub.beacon_ies);
822 * Ok so we found a beacon, and don't have an entry. If
823 * it's a beacon with hidden SSID, we might be in for an
824 * expensive search for any probe responses that should
825 * be grouped with this beacon for updates ...
827 if (!cfg80211_combine_bsses(dev, new)) {
833 list_add_tail(&new->list, &dev->bss_list);
834 rb_insert_bss(dev, new);
838 dev->bss_generation++;
839 bss_ref_get(dev, found);
840 spin_unlock_bh(&dev->bss_lock);
844 spin_unlock_bh(&dev->bss_lock);
848 static struct ieee80211_channel *
849 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
850 struct ieee80211_channel *channel)
854 int channel_number = -1;
856 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
857 if (tmp && tmp[1] == 1) {
858 channel_number = tmp[2];
860 tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
861 if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
862 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
864 channel_number = htop->primary_chan;
868 if (channel_number < 0)
871 freq = ieee80211_channel_to_frequency(channel_number, channel->band);
872 channel = ieee80211_get_channel(wiphy, freq);
875 if (channel->flags & IEEE80211_CHAN_DISABLED)
880 /* Returned bss is reference counted and must be cleaned up appropriately. */
882 cfg80211_inform_bss_width(struct wiphy *wiphy,
883 struct ieee80211_channel *rx_channel,
884 enum nl80211_bss_scan_width scan_width,
885 const u8 *bssid, u64 tsf, u16 capability,
886 u16 beacon_interval, const u8 *ie, size_t ielen,
887 s32 signal, gfp_t gfp)
889 struct cfg80211_bss_ies *ies;
890 struct ieee80211_channel *channel;
891 struct cfg80211_internal_bss tmp = {}, *res;
896 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
897 (signal < 0 || signal > 100)))
900 channel = cfg80211_get_bss_channel(wiphy, ie, ielen, rx_channel);
904 memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
905 tmp.pub.channel = channel;
906 tmp.pub.scan_width = scan_width;
907 tmp.pub.signal = signal;
908 tmp.pub.beacon_interval = beacon_interval;
909 tmp.pub.capability = capability;
911 * Since we do not know here whether the IEs are from a Beacon or Probe
912 * Response frame, we need to pick one of the options and only use it
913 * with the driver that does not provide the full Beacon/Probe Response
914 * frame. Use Beacon frame pointer to avoid indicating that this should
915 * override the IEs pointer should we have received an earlier
916 * indication of Probe Response data.
918 ies = kmalloc(sizeof(*ies) + ielen, gfp);
923 memcpy(ies->data, ie, ielen);
925 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
926 rcu_assign_pointer(tmp.pub.ies, ies);
928 res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
929 rx_channel == channel);
933 if (res->pub.capability & WLAN_CAPABILITY_ESS)
934 regulatory_hint_found_beacon(wiphy, channel, gfp);
936 trace_cfg80211_return_bss(&res->pub);
937 /* cfg80211_bss_update gives us a referenced result */
940 EXPORT_SYMBOL(cfg80211_inform_bss_width);
942 /* Returned bss is reference counted and must be cleaned up appropriately. */
943 struct cfg80211_bss *
944 cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
945 struct ieee80211_channel *rx_channel,
946 enum nl80211_bss_scan_width scan_width,
947 struct ieee80211_mgmt *mgmt, size_t len,
948 s32 signal, gfp_t gfp)
950 struct cfg80211_internal_bss tmp = {}, *res;
951 struct cfg80211_bss_ies *ies;
952 struct ieee80211_channel *channel;
953 size_t ielen = len - offsetof(struct ieee80211_mgmt,
954 u.probe_resp.variable);
956 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
957 offsetof(struct ieee80211_mgmt, u.beacon.variable));
959 trace_cfg80211_inform_bss_width_frame(wiphy, rx_channel, scan_width, mgmt,
968 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
969 (signal < 0 || signal > 100)))
972 if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
975 channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
980 ies = kmalloc(sizeof(*ies) + ielen, gfp);
984 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
985 memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
987 if (ieee80211_is_probe_resp(mgmt->frame_control))
988 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
990 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
991 rcu_assign_pointer(tmp.pub.ies, ies);
993 memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
994 tmp.pub.channel = channel;
995 tmp.pub.scan_width = scan_width;
996 tmp.pub.signal = signal;
997 tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
998 tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
1000 res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
1001 rx_channel == channel);
1005 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1006 regulatory_hint_found_beacon(wiphy, channel, gfp);
1008 trace_cfg80211_return_bss(&res->pub);
1009 /* cfg80211_bss_update gives us a referenced result */
1012 EXPORT_SYMBOL(cfg80211_inform_bss_width_frame);
1014 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1016 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
1017 struct cfg80211_internal_bss *bss;
1022 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1024 spin_lock_bh(&dev->bss_lock);
1025 bss_ref_get(dev, bss);
1026 spin_unlock_bh(&dev->bss_lock);
1028 EXPORT_SYMBOL(cfg80211_ref_bss);
1030 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1032 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
1033 struct cfg80211_internal_bss *bss;
1038 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1040 spin_lock_bh(&dev->bss_lock);
1041 bss_ref_put(dev, bss);
1042 spin_unlock_bh(&dev->bss_lock);
1044 EXPORT_SYMBOL(cfg80211_put_bss);
1046 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
1048 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
1049 struct cfg80211_internal_bss *bss;
1054 bss = container_of(pub, struct cfg80211_internal_bss, pub);
1056 spin_lock_bh(&dev->bss_lock);
1057 if (!list_empty(&bss->list)) {
1058 if (__cfg80211_unlink_bss(dev, bss))
1059 dev->bss_generation++;
1061 spin_unlock_bh(&dev->bss_lock);
1063 EXPORT_SYMBOL(cfg80211_unlink_bss);
1065 #ifdef CONFIG_CFG80211_WEXT
1066 static struct cfg80211_registered_device *
1067 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
1069 struct cfg80211_registered_device *rdev;
1070 struct net_device *dev;
1074 dev = dev_get_by_index(net, ifindex);
1076 return ERR_PTR(-ENODEV);
1077 if (dev->ieee80211_ptr)
1078 rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
1080 rdev = ERR_PTR(-ENODEV);
1085 int cfg80211_wext_siwscan(struct net_device *dev,
1086 struct iw_request_info *info,
1087 union iwreq_data *wrqu, char *extra)
1089 struct cfg80211_registered_device *rdev;
1090 struct wiphy *wiphy;
1091 struct iw_scan_req *wreq = NULL;
1092 struct cfg80211_scan_request *creq = NULL;
1093 int i, err, n_channels = 0;
1094 enum ieee80211_band band;
1096 if (!netif_running(dev))
1099 if (wrqu->data.length == sizeof(struct iw_scan_req))
1100 wreq = (struct iw_scan_req *)extra;
1102 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1105 return PTR_ERR(rdev);
1107 if (rdev->scan_req || rdev->scan_msg) {
1112 wiphy = &rdev->wiphy;
1114 /* Determine number of channels, needed to allocate creq */
1115 if (wreq && wreq->num_channels)
1116 n_channels = wreq->num_channels;
1118 n_channels = ieee80211_get_num_supported_channels(wiphy);
1120 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
1121 n_channels * sizeof(void *),
1128 creq->wiphy = wiphy;
1129 creq->wdev = dev->ieee80211_ptr;
1130 /* SSIDs come after channels */
1131 creq->ssids = (void *)&creq->channels[n_channels];
1132 creq->n_channels = n_channels;
1134 creq->scan_start = jiffies;
1136 /* translate "Scan on frequencies" request */
1138 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1141 if (!wiphy->bands[band])
1144 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
1145 /* ignore disabled channels */
1146 if (wiphy->bands[band]->channels[j].flags &
1147 IEEE80211_CHAN_DISABLED)
1150 /* If we have a wireless request structure and the
1151 * wireless request specifies frequencies, then search
1152 * for the matching hardware channel.
1154 if (wreq && wreq->num_channels) {
1156 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
1157 for (k = 0; k < wreq->num_channels; k++) {
1158 int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
1159 if (wext_freq == wiphy_freq)
1160 goto wext_freq_found;
1162 goto wext_freq_not_found;
1166 creq->channels[i] = &wiphy->bands[band]->channels[j];
1168 wext_freq_not_found: ;
1171 /* No channels found? */
1177 /* Set real number of channels specified in creq->channels[] */
1178 creq->n_channels = i;
1180 /* translate "Scan for SSID" request */
1182 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
1183 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
1187 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
1188 creq->ssids[0].ssid_len = wreq->essid_len;
1190 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
1194 for (i = 0; i < IEEE80211_NUM_BANDS; i++)
1195 if (wiphy->bands[i])
1196 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
1198 rdev->scan_req = creq;
1199 err = rdev_scan(rdev, creq);
1201 rdev->scan_req = NULL;
1202 /* creq will be freed below */
1204 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
1205 /* creq now owned by driver */
1213 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
1215 static void ieee80211_scan_add_ies(struct iw_request_info *info,
1216 const struct cfg80211_bss_ies *ies,
1217 char **current_ev, char *end_buf)
1219 const u8 *pos, *end, *next;
1220 struct iw_event iwe;
1226 * If needed, fragment the IEs buffer (at IE boundaries) into short
1227 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
1230 end = pos + ies->len;
1232 while (end - pos > IW_GENERIC_IE_MAX) {
1233 next = pos + 2 + pos[1];
1234 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
1235 next = next + 2 + next[1];
1237 memset(&iwe, 0, sizeof(iwe));
1238 iwe.cmd = IWEVGENIE;
1239 iwe.u.data.length = next - pos;
1240 *current_ev = iwe_stream_add_point(info, *current_ev,
1248 memset(&iwe, 0, sizeof(iwe));
1249 iwe.cmd = IWEVGENIE;
1250 iwe.u.data.length = end - pos;
1251 *current_ev = iwe_stream_add_point(info, *current_ev,
1258 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
1259 struct cfg80211_internal_bss *bss, char *current_ev,
1262 const struct cfg80211_bss_ies *ies;
1263 struct iw_event iwe;
1267 bool ismesh = false;
1269 memset(&iwe, 0, sizeof(iwe));
1270 iwe.cmd = SIOCGIWAP;
1271 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
1272 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
1273 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1276 memset(&iwe, 0, sizeof(iwe));
1277 iwe.cmd = SIOCGIWFREQ;
1278 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
1280 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1283 memset(&iwe, 0, sizeof(iwe));
1284 iwe.cmd = SIOCGIWFREQ;
1285 iwe.u.freq.m = bss->pub.channel->center_freq;
1287 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1290 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
1291 memset(&iwe, 0, sizeof(iwe));
1293 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
1294 IW_QUAL_NOISE_INVALID |
1295 IW_QUAL_QUAL_UPDATED;
1296 switch (wiphy->signal_type) {
1297 case CFG80211_SIGNAL_TYPE_MBM:
1298 sig = bss->pub.signal / 100;
1299 iwe.u.qual.level = sig;
1300 iwe.u.qual.updated |= IW_QUAL_DBM;
1301 if (sig < -110) /* rather bad */
1303 else if (sig > -40) /* perfect */
1305 /* will give a range of 0 .. 70 */
1306 iwe.u.qual.qual = sig + 110;
1308 case CFG80211_SIGNAL_TYPE_UNSPEC:
1309 iwe.u.qual.level = bss->pub.signal;
1310 /* will give range 0 .. 100 */
1311 iwe.u.qual.qual = bss->pub.signal;
1317 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
1318 &iwe, IW_EV_QUAL_LEN);
1321 memset(&iwe, 0, sizeof(iwe));
1322 iwe.cmd = SIOCGIWENCODE;
1323 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
1324 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
1326 iwe.u.data.flags = IW_ENCODE_DISABLED;
1327 iwe.u.data.length = 0;
1328 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1332 ies = rcu_dereference(bss->pub.ies);
1338 if (ie[1] > rem - 2)
1343 memset(&iwe, 0, sizeof(iwe));
1344 iwe.cmd = SIOCGIWESSID;
1345 iwe.u.data.length = ie[1];
1346 iwe.u.data.flags = 1;
1347 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1348 &iwe, (u8 *)ie + 2);
1350 case WLAN_EID_MESH_ID:
1351 memset(&iwe, 0, sizeof(iwe));
1352 iwe.cmd = SIOCGIWESSID;
1353 iwe.u.data.length = ie[1];
1354 iwe.u.data.flags = 1;
1355 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1356 &iwe, (u8 *)ie + 2);
1358 case WLAN_EID_MESH_CONFIG:
1360 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1362 buf = kmalloc(50, GFP_ATOMIC);
1366 memset(&iwe, 0, sizeof(iwe));
1367 iwe.cmd = IWEVCUSTOM;
1368 sprintf(buf, "Mesh Network Path Selection Protocol ID: "
1370 iwe.u.data.length = strlen(buf);
1371 current_ev = iwe_stream_add_point(info, current_ev,
1374 sprintf(buf, "Path Selection Metric ID: 0x%02X",
1376 iwe.u.data.length = strlen(buf);
1377 current_ev = iwe_stream_add_point(info, current_ev,
1380 sprintf(buf, "Congestion Control Mode ID: 0x%02X",
1382 iwe.u.data.length = strlen(buf);
1383 current_ev = iwe_stream_add_point(info, current_ev,
1386 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1387 iwe.u.data.length = strlen(buf);
1388 current_ev = iwe_stream_add_point(info, current_ev,
1391 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
1392 iwe.u.data.length = strlen(buf);
1393 current_ev = iwe_stream_add_point(info, current_ev,
1396 sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
1397 iwe.u.data.length = strlen(buf);
1398 current_ev = iwe_stream_add_point(info, current_ev,
1401 sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1402 iwe.u.data.length = strlen(buf);
1403 current_ev = iwe_stream_add_point(info, current_ev,
1408 case WLAN_EID_SUPP_RATES:
1409 case WLAN_EID_EXT_SUPP_RATES:
1410 /* display all supported rates in readable format */
1411 p = current_ev + iwe_stream_lcp_len(info);
1413 memset(&iwe, 0, sizeof(iwe));
1414 iwe.cmd = SIOCGIWRATE;
1415 /* Those two flags are ignored... */
1416 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
1418 for (i = 0; i < ie[1]; i++) {
1419 iwe.u.bitrate.value =
1420 ((ie[i + 2] & 0x7f) * 500000);
1421 p = iwe_stream_add_value(info, current_ev, p,
1422 end_buf, &iwe, IW_EV_PARAM_LEN);
1431 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
1433 memset(&iwe, 0, sizeof(iwe));
1434 iwe.cmd = SIOCGIWMODE;
1436 iwe.u.mode = IW_MODE_MESH;
1437 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
1438 iwe.u.mode = IW_MODE_MASTER;
1440 iwe.u.mode = IW_MODE_ADHOC;
1441 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
1442 &iwe, IW_EV_UINT_LEN);
1445 buf = kmalloc(31, GFP_ATOMIC);
1447 memset(&iwe, 0, sizeof(iwe));
1448 iwe.cmd = IWEVCUSTOM;
1449 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
1450 iwe.u.data.length = strlen(buf);
1451 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1453 memset(&iwe, 0, sizeof(iwe));
1454 iwe.cmd = IWEVCUSTOM;
1455 sprintf(buf, " Last beacon: %ums ago",
1456 elapsed_jiffies_msecs(bss->ts));
1457 iwe.u.data.length = strlen(buf);
1458 current_ev = iwe_stream_add_point(info, current_ev,
1459 end_buf, &iwe, buf);
1463 ieee80211_scan_add_ies(info, ies, ¤t_ev, end_buf);
1470 static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
1471 struct iw_request_info *info,
1472 char *buf, size_t len)
1474 char *current_ev = buf;
1475 char *end_buf = buf + len;
1476 struct cfg80211_internal_bss *bss;
1478 spin_lock_bh(&dev->bss_lock);
1479 cfg80211_bss_expire(dev);
1481 list_for_each_entry(bss, &dev->bss_list, list) {
1482 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
1483 spin_unlock_bh(&dev->bss_lock);
1486 current_ev = ieee80211_bss(&dev->wiphy, info, bss,
1487 current_ev, end_buf);
1489 spin_unlock_bh(&dev->bss_lock);
1490 return current_ev - buf;
1494 int cfg80211_wext_giwscan(struct net_device *dev,
1495 struct iw_request_info *info,
1496 struct iw_point *data, char *extra)
1498 struct cfg80211_registered_device *rdev;
1501 if (!netif_running(dev))
1504 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1507 return PTR_ERR(rdev);
1509 if (rdev->scan_req || rdev->scan_msg)
1512 res = ieee80211_scan_results(rdev, info, extra, data->length);
1521 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);