?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
drivers: cma: Fix wrong CMA selected region size default value
[linux-2.6.git] / net / wireless / scan.c
blob9730c9862bdcfd624af15641deefe95c0b12c8de
1 /*
2 * cfg80211 scan result handling
3 *
4 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
5 */
6 #include <linux/kernel.h>
7 #include <linux/slab.h>
8 #include <linux/module.h>
9 #include <linux/netdevice.h>
10 #include <linux/wireless.h>
11 #include <linux/nl80211.h>
12 #include <linux/etherdevice.h>
13 #include <net/arp.h>
14 #include <net/cfg80211.h>
15 #include <net/cfg80211-wext.h>
16 #include <net/iw_handler.h>
17 #include "core.h"
18 #include "nl80211.h"
19 #include "wext-compat.h"
20
21 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
22
23 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
24 {
25 struct cfg80211_scan_request *request;
26 struct wireless_dev *wdev;
27 #ifdef CONFIG_CFG80211_WEXT
28 union iwreq_data wrqu;
29 #endif
30
31 ASSERT_RDEV_LOCK(rdev);
32
33 request = rdev->scan_req;
34
35 if (!request)
36 return;
37
38 wdev = request->wdev;
39
40 /*
41 * This must be before sending the other events!
42 * Otherwise, wpa_supplicant gets completely confused with
43 * wext events.
44 */
45 if (wdev->netdev)
46 cfg80211_sme_scan_done(wdev->netdev);
47
48 if (request->aborted)
49 nl80211_send_scan_aborted(rdev, wdev);
50 else
51 nl80211_send_scan_done(rdev, wdev);
52
53 #ifdef CONFIG_CFG80211_WEXT
54 if (wdev->netdev && !request->aborted) {
55 memset(&wrqu, 0, sizeof(wrqu));
56
57 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
58 }
59 #endif
60
61 if (wdev->netdev)
62 dev_put(wdev->netdev);
63
64 rdev->scan_req = NULL;
65
66 /*
67 * OK. If this is invoked with "leak" then we can't
68 * free this ... but we've cleaned it up anyway. The
69 * driver failed to call the scan_done callback, so
70 * all bets are off, it might still be trying to use
71 * the scan request or not ... if it accesses the dev
72 * in there (it shouldn't anyway) then it may crash.
73 */
74 if (!leak)
75 kfree(request);
76 }
77
78 void __cfg80211_scan_done(struct work_struct *wk)
79 {
80 struct cfg80211_registered_device *rdev;
81
82 rdev = container_of(wk, struct cfg80211_registered_device,
83 scan_done_wk);
84
85 cfg80211_lock_rdev(rdev);
86 ___cfg80211_scan_done(rdev, false);
87 cfg80211_unlock_rdev(rdev);
88 }
89
90 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
91 {
92 WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
93
94 request->aborted = aborted;
95 queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
96 }
97 EXPORT_SYMBOL(cfg80211_scan_done);
98
99 void __cfg80211_sched_scan_results(struct work_struct *wk)
100 {
101 struct cfg80211_registered_device *rdev;
102
103 rdev = container_of(wk, struct cfg80211_registered_device,
104 sched_scan_results_wk);
105
106 mutex_lock(&rdev->sched_scan_mtx);
107
108 /* we don't have sched_scan_req anymore if the scan is stopping */
109 if (rdev->sched_scan_req)
110 nl80211_send_sched_scan_results(rdev,
111 rdev->sched_scan_req->dev);
112
113 mutex_unlock(&rdev->sched_scan_mtx);
114 }
115
116 void cfg80211_sched_scan_results(struct wiphy *wiphy)
117 {
118 /* ignore if we're not scanning */
119 if (wiphy_to_dev(wiphy)->sched_scan_req)
120 queue_work(cfg80211_wq,
121 &wiphy_to_dev(wiphy)->sched_scan_results_wk);
122 }
123 EXPORT_SYMBOL(cfg80211_sched_scan_results);
124
125 void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
126 {
127 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
128
129 mutex_lock(&rdev->sched_scan_mtx);
130 __cfg80211_stop_sched_scan(rdev, true);
131 mutex_unlock(&rdev->sched_scan_mtx);
132 }
133 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
134
135 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
136 bool driver_initiated)
137 {
138 struct net_device *dev;
139
140 lockdep_assert_held(&rdev->sched_scan_mtx);
141
142 if (!rdev->sched_scan_req)
143 return -ENOENT;
144
145 dev = rdev->sched_scan_req->dev;
146
147 if (!driver_initiated) {
148 int err = rdev->ops->sched_scan_stop(&rdev->wiphy, dev);
149 if (err)
150 return err;
151 }
152
153 nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);
154
155 kfree(rdev->sched_scan_req);
156 rdev->sched_scan_req = NULL;
157
158 return 0;
159 }
160
161 static void bss_release(struct kref *ref)
162 {
163 struct cfg80211_internal_bss *bss;
164
165 bss = container_of(ref, struct cfg80211_internal_bss, ref);
166 if (bss->pub.free_priv)
167 bss->pub.free_priv(&bss->pub);
168
169 if (bss->beacon_ies_allocated)
170 kfree(bss->pub.beacon_ies);
171 if (bss->proberesp_ies_allocated)
172 kfree(bss->pub.proberesp_ies);
173
174 BUG_ON(atomic_read(&bss->hold));
175
176 kfree(bss);
177 }
178
179 /* must hold dev->bss_lock! */
180 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
181 unsigned long age_secs)
182 {
183 struct cfg80211_internal_bss *bss;
184 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
185
186 list_for_each_entry(bss, &dev->bss_list, list) {
187 bss->ts -= age_jiffies;
188 }
189 }
190
191 /* must hold dev->bss_lock! */
192 static void __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
193 struct cfg80211_internal_bss *bss)
194 {
195 list_del_init(&bss->list);
196 rb_erase(&bss->rbn, &dev->bss_tree);
197 kref_put(&bss->ref, bss_release);
198 }
199
200 /* must hold dev->bss_lock! */
201 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
202 {
203 struct cfg80211_internal_bss *bss, *tmp;
204 bool expired = false;
205
206 list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
207 if (atomic_read(&bss->hold))
208 continue;
209 if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
210 continue;
211 __cfg80211_unlink_bss(dev, bss);
212 expired = true;
213 }
214
215 if (expired)
216 dev->bss_generation++;
217 }
218
219 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
220 {
221 while (len > 2 && ies[0] != eid) {
222 len -= ies[1] + 2;
223 ies += ies[1] + 2;
224 }
225 if (len < 2)
226 return NULL;
227 if (len < 2 + ies[1])
228 return NULL;
229 return ies;
230 }
231 EXPORT_SYMBOL(cfg80211_find_ie);
232
233 const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
234 const u8 *ies, int len)
235 {
236 struct ieee80211_vendor_ie *ie;
237 const u8 *pos = ies, *end = ies + len;
238 int ie_oui;
239
240 while (pos < end) {
241 pos = cfg80211_find_ie(WLAN_EID_VENDOR_SPECIFIC, pos,
242 end - pos);
243 if (!pos)
244 return NULL;
245
246 if (end - pos < sizeof(*ie))
247 return NULL;
248
249 ie = (struct ieee80211_vendor_ie *)pos;
250 ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
251 if (ie_oui == oui && ie->oui_type == oui_type)
252 return pos;
253
254 pos += 2 + ie->len;
255 }
256 return NULL;
257 }
258 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
259
260 static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
261 {
262 const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
263 const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
264
265 /* equal if both missing */
266 if (!ie1 && !ie2)
267 return 0;
268 /* sort missing IE before (left of) present IE */
269 if (!ie1)
270 return -1;
271 if (!ie2)
272 return 1;
273
274 /* sort by length first, then by contents */
275 if (ie1[1] != ie2[1])
276 return ie2[1] - ie1[1];
277 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
278 }
279
280 static bool is_bss(struct cfg80211_bss *a,
281 const u8 *bssid,
282 const u8 *ssid, size_t ssid_len)
283 {
284 const u8 *ssidie;
285
286 if (bssid && !ether_addr_equal(a->bssid, bssid))
287 return false;
288
289 if (!ssid)
290 return true;
291
292 ssidie = cfg80211_find_ie(WLAN_EID_SSID,
293 a->information_elements,
294 a->len_information_elements);
295 if (!ssidie)
296 return false;
297 if (ssidie[1] != ssid_len)
298 return false;
299 return memcmp(ssidie + 2, ssid, ssid_len) == 0;
300 }
301
302 static bool is_mesh_bss(struct cfg80211_bss *a)
303 {
304 const u8 *ie;
305
306 if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
307 return false;
308
309 ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
310 a->information_elements,
311 a->len_information_elements);
312 if (!ie)
313 return false;
314
315 ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
316 a->information_elements,
317 a->len_information_elements);
318 if (!ie)
319 return false;
320
321 return true;
322 }
323
324 static bool is_mesh(struct cfg80211_bss *a,
325 const u8 *meshid, size_t meshidlen,
326 const u8 *meshcfg)
327 {
328 const u8 *ie;
329
330 if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
331 return false;
332
333 ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
334 a->information_elements,
335 a->len_information_elements);
336 if (!ie)
337 return false;
338 if (ie[1] != meshidlen)
339 return false;
340 if (memcmp(ie + 2, meshid, meshidlen))
341 return false;
342
343 ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
344 a->information_elements,
345 a->len_information_elements);
346 if (!ie)
347 return false;
348 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
349 return false;
350
351 /*
352 * Ignore mesh capability (last two bytes of the IE) when
353 * comparing since that may differ between stations taking
354 * part in the same mesh.
355 */
356 return memcmp(ie + 2, meshcfg,
357 sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
358 }
359
360 static int cmp_bss_core(struct cfg80211_bss *a,
361 struct cfg80211_bss *b)
362 {
363 int r;
364
365 if (a->channel != b->channel)
366 return b->channel->center_freq - a->channel->center_freq;
367
368 if (is_mesh_bss(a) && is_mesh_bss(b)) {
369 r = cmp_ies(WLAN_EID_MESH_ID,
370 a->information_elements,
371 a->len_information_elements,
372 b->information_elements,
373 b->len_information_elements);
374 if (r)
375 return r;
376 return cmp_ies(WLAN_EID_MESH_CONFIG,
377 a->information_elements,
378 a->len_information_elements,
379 b->information_elements,
380 b->len_information_elements);
381 }
382
383 /*
384 * we can't use compare_ether_addr here since we need a < > operator.
385 * The binary return value of compare_ether_addr isn't enough
386 */
387 return memcmp(a->bssid, b->bssid, sizeof(a->bssid));
388 }
389
390 static int cmp_bss(struct cfg80211_bss *a,
391 struct cfg80211_bss *b)
392 {
393 int r;
394
395 r = cmp_bss_core(a, b);
396 if (r)
397 return r;
398
399 return cmp_ies(WLAN_EID_SSID,
400 a->information_elements,
401 a->len_information_elements,
402 b->information_elements,
403 b->len_information_elements);
404 }
405
406 static int cmp_hidden_bss(struct cfg80211_bss *a,
407 struct cfg80211_bss *b)
408 {
409 const u8 *ie1;
410 const u8 *ie2;
411 int i;
412 int r;
413
414 r = cmp_bss_core(a, b);
415 if (r)
416 return r;
417
418 ie1 = cfg80211_find_ie(WLAN_EID_SSID,
419 a->information_elements,
420 a->len_information_elements);
421 ie2 = cfg80211_find_ie(WLAN_EID_SSID,
422 b->information_elements,
423 b->len_information_elements);
424
425 /* Key comparator must use same algorithm in any rb-tree
426 * search function (order is important), otherwise ordering
427 * of items in the tree is broken and search gives incorrect
428 * results. This code uses same order as cmp_ies() does. */
429
430 /* sort missing IE before (left of) present IE */
431 if (!ie1)
432 return -1;
433 if (!ie2)
434 return 1;
435
436 /* zero-size SSID is used as an indication of the hidden bss */
437 if (!ie2[1])
438 return 0;
439
440 /* sort by length first, then by contents */
441 if (ie1[1] != ie2[1])
442 return ie2[1] - ie1[1];
443
444 /* zeroed SSID ie is another indication of a hidden bss */
445 for (i = 0; i < ie2[1]; i++)
446 if (ie2[i + 2])
447 return -1;
448
449 return 0;
450 }
451
452 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
453 struct ieee80211_channel *channel,
454 const u8 *bssid,
455 const u8 *ssid, size_t ssid_len,
456 u16 capa_mask, u16 capa_val)
457 {
458 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
459 struct cfg80211_internal_bss *bss, *res = NULL;
460 unsigned long now = jiffies;
461
462 spin_lock_bh(&dev->bss_lock);
463
464 list_for_each_entry(bss, &dev->bss_list, list) {
465 if ((bss->pub.capability & capa_mask) != capa_val)
466 continue;
467 if (channel && bss->pub.channel != channel)
468 continue;
469 /* Don't get expired BSS structs */
470 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
471 !atomic_read(&bss->hold))
472 continue;
473 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
474 res = bss;
475 kref_get(&res->ref);
476 break;
477 }
478 }
479
480 spin_unlock_bh(&dev->bss_lock);
481 if (!res)
482 return NULL;
483 return &res->pub;
484 }
485 EXPORT_SYMBOL(cfg80211_get_bss);
486
487 struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
488 struct ieee80211_channel *channel,
489 const u8 *meshid, size_t meshidlen,
490 const u8 *meshcfg)
491 {
492 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
493 struct cfg80211_internal_bss *bss, *res = NULL;
494
495 spin_lock_bh(&dev->bss_lock);
496
497 list_for_each_entry(bss, &dev->bss_list, list) {
498 if (channel && bss->pub.channel != channel)
499 continue;
500 if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
501 res = bss;
502 kref_get(&res->ref);
503 break;
504 }
505 }
506
507 spin_unlock_bh(&dev->bss_lock);
508 if (!res)
509 return NULL;
510 return &res->pub;
511 }
512 EXPORT_SYMBOL(cfg80211_get_mesh);
513
514
515 static void rb_insert_bss(struct cfg80211_registered_device *dev,
516 struct cfg80211_internal_bss *bss)
517 {
518 struct rb_node **p = &dev->bss_tree.rb_node;
519 struct rb_node *parent = NULL;
520 struct cfg80211_internal_bss *tbss;
521 int cmp;
522
523 while (*p) {
524 parent = *p;
525 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
526
527 cmp = cmp_bss(&bss->pub, &tbss->pub);
528
529 if (WARN_ON(!cmp)) {
530 /* will sort of leak this BSS */
531 return;
532 }
533
534 if (cmp < 0)
535 p = &(*p)->rb_left;
536 else
537 p = &(*p)->rb_right;
538 }
539
540 rb_link_node(&bss->rbn, parent, p);
541 rb_insert_color(&bss->rbn, &dev->bss_tree);
542 }
543
544 static struct cfg80211_internal_bss *
545 rb_find_bss(struct cfg80211_registered_device *dev,
546 struct cfg80211_internal_bss *res)
547 {
548 struct rb_node *n = dev->bss_tree.rb_node;
549 struct cfg80211_internal_bss *bss;
550 int r;
551
552 while (n) {
553 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
554 r = cmp_bss(&res->pub, &bss->pub);
555
556 if (r == 0)
557 return bss;
558 else if (r < 0)
559 n = n->rb_left;
560 else
561 n = n->rb_right;
562 }
563
564 return NULL;
565 }
566
567 static struct cfg80211_internal_bss *
568 rb_find_hidden_bss(struct cfg80211_registered_device *dev,
569 struct cfg80211_internal_bss *res)
570 {
571 struct rb_node *n = dev->bss_tree.rb_node;
572 struct cfg80211_internal_bss *bss;
573 int r;
574
575 while (n) {
576 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
577 r = cmp_hidden_bss(&res->pub, &bss->pub);
578
579 if (r == 0)
580 return bss;
581 else if (r < 0)
582 n = n->rb_left;
583 else
584 n = n->rb_right;
585 }
586
587 return NULL;
588 }
589
590 static void
591 copy_hidden_ies(struct cfg80211_internal_bss *res,
592 struct cfg80211_internal_bss *hidden)
593 {
594 if (unlikely(res->pub.beacon_ies))
595 return;
596 if (WARN_ON(!hidden->pub.beacon_ies))
597 return;
598
599 res->pub.beacon_ies = kmalloc(hidden->pub.len_beacon_ies, GFP_ATOMIC);
600 if (unlikely(!res->pub.beacon_ies))
601 return;
602
603 res->beacon_ies_allocated = true;
604 res->pub.len_beacon_ies = hidden->pub.len_beacon_ies;
605 memcpy(res->pub.beacon_ies, hidden->pub.beacon_ies,
606 res->pub.len_beacon_ies);
607 }
608
609 static struct cfg80211_internal_bss *
610 cfg80211_bss_update(struct cfg80211_registered_device *dev,
611 struct cfg80211_internal_bss *res)
612 {
613 struct cfg80211_internal_bss *found = NULL;
614
615 /*
616 * The reference to "res" is donated to this function.
617 */
618
619 if (WARN_ON(!res->pub.channel)) {
620 kref_put(&res->ref, bss_release);
621 return NULL;
622 }
623
624 res->ts = jiffies;
625
626 spin_lock_bh(&dev->bss_lock);
627
628 found = rb_find_bss(dev, res);
629
630 if (found) {
631 found->pub.beacon_interval = res->pub.beacon_interval;
632 found->pub.tsf = res->pub.tsf;
633 found->pub.signal = res->pub.signal;
634 found->pub.capability = res->pub.capability;
635 found->ts = res->ts;
636
637 /* Update IEs */
638 if (res->pub.proberesp_ies) {
639 size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
640 size_t ielen = res->pub.len_proberesp_ies;
641
642 if (found->pub.proberesp_ies &&
643 !found->proberesp_ies_allocated &&
644 ksize(found) >= used + ielen) {
645 memcpy(found->pub.proberesp_ies,
646 res->pub.proberesp_ies, ielen);
647 found->pub.len_proberesp_ies = ielen;
648 } else {
649 u8 *ies = found->pub.proberesp_ies;
650
651 if (found->proberesp_ies_allocated)
652 ies = krealloc(ies, ielen, GFP_ATOMIC);
653 else
654 ies = kmalloc(ielen, GFP_ATOMIC);
655
656 if (ies) {
657 memcpy(ies, res->pub.proberesp_ies,
658 ielen);
659 found->proberesp_ies_allocated = true;
660 found->pub.proberesp_ies = ies;
661 found->pub.len_proberesp_ies = ielen;
662 }
663 }
664
665 /* Override possible earlier Beacon frame IEs */
666 found->pub.information_elements =
667 found->pub.proberesp_ies;
668 found->pub.len_information_elements =
669 found->pub.len_proberesp_ies;
670 }
671 if (res->pub.beacon_ies) {
672 size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
673 size_t ielen = res->pub.len_beacon_ies;
674 bool information_elements_is_beacon_ies =
675 (found->pub.information_elements ==
676 found->pub.beacon_ies);
677
678 if (found->pub.beacon_ies &&
679 !found->beacon_ies_allocated &&
680 ksize(found) >= used + ielen) {
681 memcpy(found->pub.beacon_ies,
682 res->pub.beacon_ies, ielen);
683 found->pub.len_beacon_ies = ielen;
684 } else {
685 u8 *ies = found->pub.beacon_ies;
686
687 if (found->beacon_ies_allocated)
688 ies = krealloc(ies, ielen, GFP_ATOMIC);
689 else
690 ies = kmalloc(ielen, GFP_ATOMIC);
691
692 if (ies) {
693 memcpy(ies, res->pub.beacon_ies,
694 ielen);
695 found->beacon_ies_allocated = true;
696 found->pub.beacon_ies = ies;
697 found->pub.len_beacon_ies = ielen;
698 }
699 }
700
701 /* Override IEs if they were from a beacon before */
702 if (information_elements_is_beacon_ies) {
703 found->pub.information_elements =
704 found->pub.beacon_ies;
705 found->pub.len_information_elements =
706 found->pub.len_beacon_ies;
707 }
708 }
709
710 kref_put(&res->ref, bss_release);
711 } else {
712 struct cfg80211_internal_bss *hidden;
713
714 /* First check if the beacon is a probe response from
715 * a hidden bss. If so, copy beacon ies (with nullified
716 * ssid) into the probe response bss entry (with real ssid).
717 * It is required basically for PSM implementation
718 * (probe responses do not contain tim ie) */
719
720 /* TODO: The code is not trying to update existing probe
721 * response bss entries when beacon ies are
722 * getting changed. */
723 hidden = rb_find_hidden_bss(dev, res);
724 if (hidden)
725 copy_hidden_ies(res, hidden);
726
727 /* this "consumes" the reference */
728 list_add_tail(&res->list, &dev->bss_list);
729 rb_insert_bss(dev, res);
730 found = res;
731 }
732
733 dev->bss_generation++;
734 spin_unlock_bh(&dev->bss_lock);
735
736 kref_get(&found->ref);
737 return found;
738 }
739
740 struct cfg80211_bss*
741 cfg80211_inform_bss(struct wiphy *wiphy,
742 struct ieee80211_channel *channel,
743 const u8 *bssid, u64 tsf, u16 capability,
744 u16 beacon_interval, const u8 *ie, size_t ielen,
745 s32 signal, gfp_t gfp)
746 {
747 struct cfg80211_internal_bss *res;
748 size_t privsz;
749
750 if (WARN_ON(!wiphy))
751 return NULL;
752
753 privsz = wiphy->bss_priv_size;
754
755 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
756 (signal < 0 || signal > 100)))
757 return NULL;
758
759 res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
760 if (!res)
761 return NULL;
762
763 memcpy(res->pub.bssid, bssid, ETH_ALEN);
764 res->pub.channel = channel;
765 res->pub.signal = signal;
766 res->pub.tsf = tsf;
767 res->pub.beacon_interval = beacon_interval;
768 res->pub.capability = capability;
769 /*
770 * Since we do not know here whether the IEs are from a Beacon or Probe
771 * Response frame, we need to pick one of the options and only use it
772 * with the driver that does not provide the full Beacon/Probe Response
773 * frame. Use Beacon frame pointer to avoid indicating that this should
774 * override the information_elements pointer should we have received an
775 * earlier indication of Probe Response data.
776 *
777 * The initial buffer for the IEs is allocated with the BSS entry and
778 * is located after the private area.
779 */
780 res->pub.beacon_ies = (u8 *)res + sizeof(*res) + privsz;
781 memcpy(res->pub.beacon_ies, ie, ielen);
782 res->pub.len_beacon_ies = ielen;
783 res->pub.information_elements = res->pub.beacon_ies;
784 res->pub.len_information_elements = res->pub.len_beacon_ies;
785
786 kref_init(&res->ref);
787
788 res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
789 if (!res)
790 return NULL;
791
792 if (res->pub.capability & WLAN_CAPABILITY_ESS)
793 regulatory_hint_found_beacon(wiphy, channel, gfp);
794
795 /* cfg80211_bss_update gives us a referenced result */
796 return &res->pub;
797 }
798 EXPORT_SYMBOL(cfg80211_inform_bss);
799
800 struct cfg80211_bss *
801 cfg80211_inform_bss_frame(struct wiphy *wiphy,
802 struct ieee80211_channel *channel,
803 struct ieee80211_mgmt *mgmt, size_t len,
804 s32 signal, gfp_t gfp)
805 {
806 struct cfg80211_internal_bss *res;
807 size_t ielen = len - offsetof(struct ieee80211_mgmt,
808 u.probe_resp.variable);
809 size_t privsz;
810
811 if (WARN_ON(!mgmt))
812 return NULL;
813
814 if (WARN_ON(!wiphy))
815 return NULL;
816
817 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
818 (signal < 0 || signal > 100)))
819 return NULL;
820
821 if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
822 return NULL;
823
824 privsz = wiphy->bss_priv_size;
825
826 res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
827 if (!res)
828 return NULL;
829
830 memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
831 res->pub.channel = channel;
832 res->pub.signal = signal;
833 res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
834 res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
835 res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
836 /*
837 * The initial buffer for the IEs is allocated with the BSS entry and
838 * is located after the private area.
839 */
840 if (ieee80211_is_probe_resp(mgmt->frame_control)) {
841 res->pub.proberesp_ies = (u8 *) res + sizeof(*res) + privsz;
842 memcpy(res->pub.proberesp_ies, mgmt->u.probe_resp.variable,
843 ielen);
844 res->pub.len_proberesp_ies = ielen;
845 res->pub.information_elements = res->pub.proberesp_ies;
846 res->pub.len_information_elements = res->pub.len_proberesp_ies;
847 } else {
848 res->pub.beacon_ies = (u8 *) res + sizeof(*res) + privsz;
849 memcpy(res->pub.beacon_ies, mgmt->u.beacon.variable, ielen);
850 res->pub.len_beacon_ies = ielen;
851 res->pub.information_elements = res->pub.beacon_ies;
852 res->pub.len_information_elements = res->pub.len_beacon_ies;
853 }
854
855 kref_init(&res->ref);
856
857 res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
858 if (!res)
859 return NULL;
860
861 if (res->pub.capability & WLAN_CAPABILITY_ESS)
862 regulatory_hint_found_beacon(wiphy, channel, gfp);
863
864 /* cfg80211_bss_update gives us a referenced result */
865 return &res->pub;
866 }
867 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
868
869 void cfg80211_ref_bss(struct cfg80211_bss *pub)
870 {
871 struct cfg80211_internal_bss *bss;
872
873 if (!pub)
874 return;
875
876 bss = container_of(pub, struct cfg80211_internal_bss, pub);
877 kref_get(&bss->ref);
878 }
879 EXPORT_SYMBOL(cfg80211_ref_bss);
880
881 void cfg80211_put_bss(struct cfg80211_bss *pub)
882 {
883 struct cfg80211_internal_bss *bss;
884
885 if (!pub)
886 return;
887
888 bss = container_of(pub, struct cfg80211_internal_bss, pub);
889 kref_put(&bss->ref, bss_release);
890 }
891 EXPORT_SYMBOL(cfg80211_put_bss);
892
893 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
894 {
895 struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
896 struct cfg80211_internal_bss *bss;
897
898 if (WARN_ON(!pub))
899 return;
900
901 bss = container_of(pub, struct cfg80211_internal_bss, pub);
902
903 spin_lock_bh(&dev->bss_lock);
904 if (!list_empty(&bss->list)) {
905 __cfg80211_unlink_bss(dev, bss);
906 dev->bss_generation++;
907 }
908 spin_unlock_bh(&dev->bss_lock);
909 }
910 EXPORT_SYMBOL(cfg80211_unlink_bss);
911
912 #ifdef CONFIG_CFG80211_WEXT
913 int cfg80211_wext_siwscan(struct net_device *dev,
914 struct iw_request_info *info,
915 union iwreq_data *wrqu, char *extra)
916 {
917 struct cfg80211_registered_device *rdev;
918 struct wiphy *wiphy;
919 struct iw_scan_req *wreq = NULL;
920 struct cfg80211_scan_request *creq = NULL;
921 int i, err, n_channels = 0;
922 enum ieee80211_band band;
923
924 if (!netif_running(dev))
925 return -ENETDOWN;
926
927 if (wrqu->data.length == sizeof(struct iw_scan_req))
928 wreq = (struct iw_scan_req *)extra;
929
930 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
931
932 if (IS_ERR(rdev))
933 return PTR_ERR(rdev);
934
935 if (rdev->scan_req) {
936 err = -EBUSY;
937 goto out;
938 }
939
940 wiphy = &rdev->wiphy;
941
942 /* Determine number of channels, needed to allocate creq */
943 if (wreq && wreq->num_channels)
944 n_channels = wreq->num_channels;
945 else {
946 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
947 if (wiphy->bands[band])
948 n_channels += wiphy->bands[band]->n_channels;
949 }
950
951 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
952 n_channels * sizeof(void *),
953 GFP_ATOMIC);
954 if (!creq) {
955 err = -ENOMEM;
956 goto out;
957 }
958
959 creq->wiphy = wiphy;
960 creq->wdev = dev->ieee80211_ptr;
961 /* SSIDs come after channels */
962 creq->ssids = (void *)&creq->channels[n_channels];
963 creq->n_channels = n_channels;
964 creq->n_ssids = 1;
965
966 /* translate "Scan on frequencies" request */
967 i = 0;
968 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
969 int j;
970
971 if (!wiphy->bands[band])
972 continue;
973
974 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
975 /* ignore disabled channels */
976 if (wiphy->bands[band]->channels[j].flags &
977 IEEE80211_CHAN_DISABLED)
978 continue;
979
980 /* If we have a wireless request structure and the
981 * wireless request specifies frequencies, then search
982 * for the matching hardware channel.
983 */
984 if (wreq && wreq->num_channels) {
985 int k;
986 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
987 for (k = 0; k < wreq->num_channels; k++) {
988 int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
989 if (wext_freq == wiphy_freq)
990 goto wext_freq_found;
991 }
992 goto wext_freq_not_found;
993 }
994
995 wext_freq_found:
996 creq->channels[i] = &wiphy->bands[band]->channels[j];
997 i++;
998 wext_freq_not_found: ;
999 }
1000 }
1001 /* No channels found? */
1002 if (!i) {
1003 err = -EINVAL;
1004 goto out;
1005 }
1006
1007 /* Set real number of channels specified in creq->channels[] */
1008 creq->n_channels = i;
1009
1010 /* translate "Scan for SSID" request */
1011 if (wreq) {
1012 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
1013 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
1014 err = -EINVAL;
1015 goto out;
1016 }
1017 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
1018 creq->ssids[0].ssid_len = wreq->essid_len;
1019 }
1020 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
1021 creq->n_ssids = 0;
1022 }
1023
1024 for (i = 0; i < IEEE80211_NUM_BANDS; i++)
1025 if (wiphy->bands[i])
1026 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
1027
1028 rdev->scan_req = creq;
1029 err = rdev->ops->scan(wiphy, creq);
1030 if (err) {
1031 rdev->scan_req = NULL;
1032 /* creq will be freed below */
1033 } else {
1034 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
1035 /* creq now owned by driver */
1036 creq = NULL;
1037 dev_hold(dev);
1038 }
1039 out:
1040 kfree(creq);
1041 cfg80211_unlock_rdev(rdev);
1042 return err;
1043 }
1044 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
1045
1046 static void ieee80211_scan_add_ies(struct iw_request_info *info,
1047 struct cfg80211_bss *bss,
1048 char **current_ev, char *end_buf)
1049 {
1050 u8 *pos, *end, *next;
1051 struct iw_event iwe;
1052
1053 if (!bss->information_elements ||
1054 !bss->len_information_elements)
1055 return;
1056
1057 /*
1058 * If needed, fragment the IEs buffer (at IE boundaries) into short
1059 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
1060 */
1061 pos = bss->information_elements;
1062 end = pos + bss->len_information_elements;
1063
1064 while (end - pos > IW_GENERIC_IE_MAX) {
1065 next = pos + 2 + pos[1];
1066 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
1067 next = next + 2 + next[1];
1068
1069 memset(&iwe, 0, sizeof(iwe));
1070 iwe.cmd = IWEVGENIE;
1071 iwe.u.data.length = next - pos;
1072 *current_ev = iwe_stream_add_point(info, *current_ev,
1073 end_buf, &iwe, pos);
1074
1075 pos = next;
1076 }
1077
1078 if (end > pos) {
1079 memset(&iwe, 0, sizeof(iwe));
1080 iwe.cmd = IWEVGENIE;
1081 iwe.u.data.length = end - pos;
1082 *current_ev = iwe_stream_add_point(info, *current_ev,
1083 end_buf, &iwe, pos);
1084 }
1085 }
1086
1087 static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
1088 {
1089 unsigned long end = jiffies;
1090
1091 if (end >= start)
1092 return jiffies_to_msecs(end - start);
1093
1094 return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
1095 }
1096
1097 static char *
1098 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
1099 struct cfg80211_internal_bss *bss, char *current_ev,
1100 char *end_buf)
1101 {
1102 struct iw_event iwe;
1103 u8 *buf, *cfg, *p;
1104 u8 *ie = bss->pub.information_elements;
1105 int rem = bss->pub.len_information_elements, i, sig;
1106 bool ismesh = false;
1107
1108 memset(&iwe, 0, sizeof(iwe));
1109 iwe.cmd = SIOCGIWAP;
1110 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
1111 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
1112 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1113 IW_EV_ADDR_LEN);
1114
1115 memset(&iwe, 0, sizeof(iwe));
1116 iwe.cmd = SIOCGIWFREQ;
1117 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
1118 iwe.u.freq.e = 0;
1119 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1120 IW_EV_FREQ_LEN);
1121
1122 memset(&iwe, 0, sizeof(iwe));
1123 iwe.cmd = SIOCGIWFREQ;
1124 iwe.u.freq.m = bss->pub.channel->center_freq;
1125 iwe.u.freq.e = 6;
1126 current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
1127 IW_EV_FREQ_LEN);
1128
1129 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
1130 memset(&iwe, 0, sizeof(iwe));
1131 iwe.cmd = IWEVQUAL;
1132 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
1133 IW_QUAL_NOISE_INVALID |
1134 IW_QUAL_QUAL_UPDATED;
1135 switch (wiphy->signal_type) {
1136 case CFG80211_SIGNAL_TYPE_MBM:
1137 sig = bss->pub.signal / 100;
1138 iwe.u.qual.level = sig;
1139 iwe.u.qual.updated |= IW_QUAL_DBM;
1140 if (sig < -110) /* rather bad */
1141 sig = -110;
1142 else if (sig > -40) /* perfect */
1143 sig = -40;
1144 /* will give a range of 0 .. 70 */
1145 iwe.u.qual.qual = sig + 110;
1146 break;
1147 case CFG80211_SIGNAL_TYPE_UNSPEC:
1148 iwe.u.qual.level = bss->pub.signal;
1149 /* will give range 0 .. 100 */
1150 iwe.u.qual.qual = bss->pub.signal;
1151 break;
1152 default:
1153 /* not reached */
1154 break;
1155 }
1156 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
1157 &iwe, IW_EV_QUAL_LEN);
1158 }
1159
1160 memset(&iwe, 0, sizeof(iwe));
1161 iwe.cmd = SIOCGIWENCODE;
1162 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
1163 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
1164 else
1165 iwe.u.data.flags = IW_ENCODE_DISABLED;
1166 iwe.u.data.length = 0;
1167 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1168 &iwe, "");
1169
1170 while (rem >= 2) {
1171 /* invalid data */
1172 if (ie[1] > rem - 2)
1173 break;
1174
1175 switch (ie[0]) {
1176 case WLAN_EID_SSID:
1177 memset(&iwe, 0, sizeof(iwe));
1178 iwe.cmd = SIOCGIWESSID;
1179 iwe.u.data.length = ie[1];
1180 iwe.u.data.flags = 1;
1181 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1182 &iwe, ie + 2);
1183 break;
1184 case WLAN_EID_MESH_ID:
1185 memset(&iwe, 0, sizeof(iwe));
1186 iwe.cmd = SIOCGIWESSID;
1187 iwe.u.data.length = ie[1];
1188 iwe.u.data.flags = 1;
1189 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1190 &iwe, ie + 2);
1191 break;
1192 case WLAN_EID_MESH_CONFIG:
1193 ismesh = true;
1194 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
1195 break;
1196 buf = kmalloc(50, GFP_ATOMIC);
1197 if (!buf)
1198 break;
1199 cfg = ie + 2;
1200 memset(&iwe, 0, sizeof(iwe));
1201 iwe.cmd = IWEVCUSTOM;
1202 sprintf(buf, "Mesh Network Path Selection Protocol ID: "
1203 "0x%02X", cfg[0]);
1204 iwe.u.data.length = strlen(buf);
1205 current_ev = iwe_stream_add_point(info, current_ev,
1206 end_buf,
1207 &iwe, buf);
1208 sprintf(buf, "Path Selection Metric ID: 0x%02X",
1209 cfg[1]);
1210 iwe.u.data.length = strlen(buf);
1211 current_ev = iwe_stream_add_point(info, current_ev,
1212 end_buf,
1213 &iwe, buf);
1214 sprintf(buf, "Congestion Control Mode ID: 0x%02X",
1215 cfg[2]);
1216 iwe.u.data.length = strlen(buf);
1217 current_ev = iwe_stream_add_point(info, current_ev,
1218 end_buf,
1219 &iwe, buf);
1220 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
1221 iwe.u.data.length = strlen(buf);
1222 current_ev = iwe_stream_add_point(info, current_ev,
1223 end_buf,
1224 &iwe, buf);
1225 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
1226 iwe.u.data.length = strlen(buf);
1227 current_ev = iwe_stream_add_point(info, current_ev,
1228 end_buf,
1229 &iwe, buf);
1230 sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
1231 iwe.u.data.length = strlen(buf);
1232 current_ev = iwe_stream_add_point(info, current_ev,
1233 end_buf,
1234 &iwe, buf);
1235 sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
1236 iwe.u.data.length = strlen(buf);
1237 current_ev = iwe_stream_add_point(info, current_ev,
1238 end_buf,
1239 &iwe, buf);
1240 kfree(buf);
1241 break;
1242 case WLAN_EID_SUPP_RATES:
1243 case WLAN_EID_EXT_SUPP_RATES:
1244 /* display all supported rates in readable format */
1245 p = current_ev + iwe_stream_lcp_len(info);
1246
1247 memset(&iwe, 0, sizeof(iwe));
1248 iwe.cmd = SIOCGIWRATE;
1249 /* Those two flags are ignored... */
1250 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
1251
1252 for (i = 0; i < ie[1]; i++) {
1253 iwe.u.bitrate.value =
1254 ((ie[i + 2] & 0x7f) * 500000);
1255 p = iwe_stream_add_value(info, current_ev, p,
1256 end_buf, &iwe, IW_EV_PARAM_LEN);
1257 }
1258 current_ev = p;
1259 break;
1260 }
1261 rem -= ie[1] + 2;
1262 ie += ie[1] + 2;
1263 }
1264
1265 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
1266 ismesh) {
1267 memset(&iwe, 0, sizeof(iwe));
1268 iwe.cmd = SIOCGIWMODE;
1269 if (ismesh)
1270 iwe.u.mode = IW_MODE_MESH;
1271 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
1272 iwe.u.mode = IW_MODE_MASTER;
1273 else
1274 iwe.u.mode = IW_MODE_ADHOC;
1275 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
1276 &iwe, IW_EV_UINT_LEN);
1277 }
1278
1279 buf = kmalloc(30, GFP_ATOMIC);
1280 if (buf) {
1281 memset(&iwe, 0, sizeof(iwe));
1282 iwe.cmd = IWEVCUSTOM;
1283 sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
1284 iwe.u.data.length = strlen(buf);
1285 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
1286 &iwe, buf);
1287 memset(&iwe, 0, sizeof(iwe));
1288 iwe.cmd = IWEVCUSTOM;
1289 sprintf(buf, " Last beacon: %ums ago",
1290 elapsed_jiffies_msecs(bss->ts));
1291 iwe.u.data.length = strlen(buf);
1292 current_ev = iwe_stream_add_point(info, current_ev,
1293 end_buf, &iwe, buf);
1294 kfree(buf);
1295 }
1296
1297 ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
1298
1299 return current_ev;
1300 }
1301
1302
1303 static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
1304 struct iw_request_info *info,
1305 char *buf, size_t len)
1306 {
1307 char *current_ev = buf;
1308 char *end_buf = buf + len;
1309 struct cfg80211_internal_bss *bss;
1310
1311 spin_lock_bh(&dev->bss_lock);
1312 cfg80211_bss_expire(dev);
1313
1314 list_for_each_entry(bss, &dev->bss_list, list) {
1315 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
1316 spin_unlock_bh(&dev->bss_lock);
1317 return -E2BIG;
1318 }
1319 current_ev = ieee80211_bss(&dev->wiphy, info, bss,
1320 current_ev, end_buf);
1321 }
1322 spin_unlock_bh(&dev->bss_lock);
1323 return current_ev - buf;
1324 }
1325
1326
1327 int cfg80211_wext_giwscan(struct net_device *dev,
1328 struct iw_request_info *info,
1329 struct iw_point *data, char *extra)
1330 {
1331 struct cfg80211_registered_device *rdev;
1332 int res;
1333
1334 if (!netif_running(dev))
1335 return -ENETDOWN;
1336
1337 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1338
1339 if (IS_ERR(rdev))
1340 return PTR_ERR(rdev);
1341
1342 if (rdev->scan_req) {
1343 res = -EAGAIN;
1344 goto out;
1345 }
1346
1347 res = ieee80211_scan_results(rdev, info, extra, data->length);
1348 data->length = 0;
1349 if (res >= 0) {
1350 data->length = res;
1351 res = 0;
1352 }
1353
1354 out:
1355 cfg80211_unlock_rdev(rdev);
1356 return res;
1357 }
1358 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
1359 #endif
Linus' kernel tree