net/wireless/scan.c

   1 /*
   2  * cfg80211 scan result handling
   3  *
   4  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6 #include <linux/kernel.h>
   7 #include <linux/module.h>
   8 #include <linux/netdevice.h>
   9 #include <linux/wireless.h>
  10 #include <linux/nl80211.h>
  11 #include <linux/etherdevice.h>
  12 #include <net/arp.h>
  13 #include <net/cfg80211.h>
  14 #include <net/iw_handler.h>
  15 #include "core.h"
  16 #include "nl80211.h"
  17 #include "wext-compat.h"
  18
  19 #define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
  20
  21 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
  22 {
  23         struct cfg80211_scan_request *request;
  24         struct net_device *dev;
  25 #ifdef CONFIG_CFG80211_WEXT
  26         union iwreq_data wrqu;
  27 #endif
  28
  29         ASSERT_RDEV_LOCK(rdev);
  30
  31         request = rdev->scan_req;
  32
  33         if (!request)
  34                 return;
  35
  36         dev = request->dev;
  37
  38         /*
  39          * This must be before sending the other events!
  40          * Otherwise, wpa_supplicant gets completely confused with
  41          * wext events.
  42          */
  43         cfg80211_sme_scan_done(dev);
  44
  45         if (request->aborted)
  46                 nl80211_send_scan_aborted(rdev, dev);
  47         else
  48                 nl80211_send_scan_done(rdev, dev);
  49
  50 #ifdef CONFIG_CFG80211_WEXT
  51         if (!request->aborted) {
  52                 memset(&wrqu, 0, sizeof(wrqu));
  53
  54                 wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
  55         }
  56 #endif
  57
  58         dev_put(dev);
  59
  60         rdev->scan_req = NULL;
  61
  62         /*
  63          * OK. If this is invoked with "leak" then we can't
  64          * free this ... but we've cleaned it up anyway. The
  65          * driver failed to call the scan_done callback, so
  66          * all bets are off, it might still be trying to use
  67          * the scan request or not ... if it accesses the dev
  68          * in there (it shouldn't anyway) then it may crash.
  69          */
  70         if (!leak)
  71                 kfree(request);
  72 }
  73
  74 void __cfg80211_scan_done(struct work_struct *wk)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77
  78         rdev = container_of(wk, struct cfg80211_registered_device,
  79                             scan_done_wk);
  80
  81         cfg80211_lock_rdev(rdev);
  82         ___cfg80211_scan_done(rdev, false);
  83         cfg80211_unlock_rdev(rdev);
  84 }
  85
  86 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
  87 {
  88         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
  89
  90         request->aborted = aborted;
  91         schedule_work(&wiphy_to_dev(request->wiphy)->scan_done_wk);
  92 }
  93 EXPORT_SYMBOL(cfg80211_scan_done);
  94
  95 static void bss_release(struct kref *ref)
  96 {
  97         struct cfg80211_internal_bss *bss;
  98
  99         bss = container_of(ref, struct cfg80211_internal_bss, ref);
 100         if (bss->pub.free_priv)
 101                 bss->pub.free_priv(&bss->pub);
 102
 103         if (bss->ies_allocated)
 104                 kfree(bss->pub.information_elements);
 105
 106         BUG_ON(atomic_read(&bss->hold));
 107
 108         kfree(bss);
 109 }
 110
 111 /* must hold dev->bss_lock! */
 112 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
 113                       unsigned long age_secs)
 114 {
 115         struct cfg80211_internal_bss *bss;
 116         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
 117
 118         list_for_each_entry(bss, &dev->bss_list, list) {
 119                 bss->ts -= age_jiffies;
 120         }
 121 }
 122
 123 /* must hold dev->bss_lock! */
 124 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
 125 {
 126         struct cfg80211_internal_bss *bss, *tmp;
 127         bool expired = false;
 128
 129         list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
 130                 if (atomic_read(&bss->hold))
 131                         continue;
 132                 if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
 133                         continue;
 134                 list_del(&bss->list);
 135                 rb_erase(&bss->rbn, &dev->bss_tree);
 136                 kref_put(&bss->ref, bss_release);
 137                 expired = true;
 138         }
 139
 140         if (expired)
 141                 dev->bss_generation++;
 142 }
 143
 144 static u8 *find_ie(u8 num, u8 *ies, int len)
 145 {
 146         while (len > 2 && ies[0] != num) {
 147                 len -= ies[1] + 2;
 148                 ies += ies[1] + 2;
 149         }
 150         if (len < 2)
 151                 return NULL;
 152         if (len < 2 + ies[1])
 153                 return NULL;
 154         return ies;
 155 }
 156
 157 static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 158 {
 159         const u8 *ie1 = find_ie(num, ies1, len1);
 160         const u8 *ie2 = find_ie(num, ies2, len2);
 161         int r;
 162
 163         if (!ie1 && !ie2)
 164                 return 0;
 165         if (!ie1 || !ie2)
 166                 return -1;
 167
 168         r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
 169         if (r == 0 && ie1[1] != ie2[1])
 170                 return ie2[1] - ie1[1];
 171         return r;
 172 }
 173
 174 static bool is_bss(struct cfg80211_bss *a,
 175                    const u8 *bssid,
 176                    const u8 *ssid, size_t ssid_len)
 177 {
 178         const u8 *ssidie;
 179
 180         if (bssid && compare_ether_addr(a->bssid, bssid))
 181                 return false;
 182
 183         if (!ssid)
 184                 return true;
 185
 186         ssidie = find_ie(WLAN_EID_SSID,
 187                          a->information_elements,
 188                          a->len_information_elements);
 189         if (!ssidie)
 190                 return false;
 191         if (ssidie[1] != ssid_len)
 192                 return false;
 193         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
 194 }
 195
 196 static bool is_mesh(struct cfg80211_bss *a,
 197                     const u8 *meshid, size_t meshidlen,
 198                     const u8 *meshcfg)
 199 {
 200         const u8 *ie;
 201
 202         if (!is_zero_ether_addr(a->bssid))
 203                 return false;
 204
 205         ie = find_ie(WLAN_EID_MESH_ID,
 206                      a->information_elements,
 207                      a->len_information_elements);
 208         if (!ie)
 209                 return false;
 210         if (ie[1] != meshidlen)
 211                 return false;
 212         if (memcmp(ie + 2, meshid, meshidlen))
 213                 return false;
 214
 215         ie = find_ie(WLAN_EID_MESH_CONFIG,
 216                      a->information_elements,
 217                      a->len_information_elements);
 218         if (!ie)
 219                 return false;
 220         if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
 221                 return false;
 222
 223         /*
 224          * Ignore mesh capability (last two bytes of the IE) when
 225          * comparing since that may differ between stations taking
 226          * part in the same mesh.
 227          */
 228         return memcmp(ie + 2, meshcfg,
 229             sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
 230 }
 231
 232 static int cmp_bss(struct cfg80211_bss *a,
 233                    struct cfg80211_bss *b)
 234 {
 235         int r;
 236
 237         if (a->channel != b->channel)
 238                 return b->channel->center_freq - a->channel->center_freq;
 239
 240         r = memcmp(a->bssid, b->bssid, ETH_ALEN);
 241         if (r)
 242                 return r;
 243
 244         if (is_zero_ether_addr(a->bssid)) {
 245                 r = cmp_ies(WLAN_EID_MESH_ID,
 246                             a->information_elements,
 247                             a->len_information_elements,
 248                             b->information_elements,
 249                             b->len_information_elements);
 250                 if (r)
 251                         return r;
 252                 return cmp_ies(WLAN_EID_MESH_CONFIG,
 253                                a->information_elements,
 254                                a->len_information_elements,
 255                                b->information_elements,
 256                                b->len_information_elements);
 257         }
 258
 259         return cmp_ies(WLAN_EID_SSID,
 260                        a->information_elements,
 261                        a->len_information_elements,
 262                        b->information_elements,
 263                        b->len_information_elements);
 264 }
 265
 266 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
 267                                       struct ieee80211_channel *channel,
 268                                       const u8 *bssid,
 269                                       const u8 *ssid, size_t ssid_len,
 270                                       u16 capa_mask, u16 capa_val)
 271 {
 272         struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
 273         struct cfg80211_internal_bss *bss, *res = NULL;
 274
 275         spin_lock_bh(&dev->bss_lock);
 276
 277         list_for_each_entry(bss, &dev->bss_list, list) {
 278                 if ((bss->pub.capability & capa_mask) != capa_val)
 279                         continue;
 280                 if (channel && bss->pub.channel != channel)
 281                         continue;
 282                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
 283                         res = bss;
 284                         kref_get(&res->ref);
 285                         break;
 286                 }
 287         }
 288
 289         spin_unlock_bh(&dev->bss_lock);
 290         if (!res)
 291                 return NULL;
 292         return &res->pub;
 293 }
 294 EXPORT_SYMBOL(cfg80211_get_bss);
 295
 296 struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
 297                                        struct ieee80211_channel *channel,
 298                                        const u8 *meshid, size_t meshidlen,
 299                                        const u8 *meshcfg)
 300 {
 301         struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
 302         struct cfg80211_internal_bss *bss, *res = NULL;
 303
 304         spin_lock_bh(&dev->bss_lock);
 305
 306         list_for_each_entry(bss, &dev->bss_list, list) {
 307                 if (channel && bss->pub.channel != channel)
 308                         continue;
 309                 if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
 310                         res = bss;
 311                         kref_get(&res->ref);
 312                         break;
 313                 }
 314         }
 315
 316         spin_unlock_bh(&dev->bss_lock);
 317         if (!res)
 318                 return NULL;
 319         return &res->pub;
 320 }
 321 EXPORT_SYMBOL(cfg80211_get_mesh);
 322
 323
 324 static void rb_insert_bss(struct cfg80211_registered_device *dev,
 325                           struct cfg80211_internal_bss *bss)
 326 {
 327         struct rb_node **p = &dev->bss_tree.rb_node;
 328         struct rb_node *parent = NULL;
 329         struct cfg80211_internal_bss *tbss;
 330         int cmp;
 331
 332         while (*p) {
 333                 parent = *p;
 334                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
 335
 336                 cmp = cmp_bss(&bss->pub, &tbss->pub);
 337
 338                 if (WARN_ON(!cmp)) {
 339                         /* will sort of leak this BSS */
 340                         return;
 341                 }
 342
 343                 if (cmp < 0)
 344                         p = &(*p)->rb_left;
 345                 else
 346                         p = &(*p)->rb_right;
 347         }
 348
 349         rb_link_node(&bss->rbn, parent, p);
 350         rb_insert_color(&bss->rbn, &dev->bss_tree);
 351 }
 352
 353 static struct cfg80211_internal_bss *
 354 rb_find_bss(struct cfg80211_registered_device *dev,
 355             struct cfg80211_internal_bss *res)
 356 {
 357         struct rb_node *n = dev->bss_tree.rb_node;
 358         struct cfg80211_internal_bss *bss;
 359         int r;
 360
 361         while (n) {
 362                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
 363                 r = cmp_bss(&res->pub, &bss->pub);
 364
 365                 if (r == 0)
 366                         return bss;
 367                 else if (r < 0)
 368                         n = n->rb_left;
 369                 else
 370                         n = n->rb_right;
 371         }
 372
 373         return NULL;
 374 }
 375
 376 static struct cfg80211_internal_bss *
 377 cfg80211_bss_update(struct cfg80211_registered_device *dev,
 378                     struct cfg80211_internal_bss *res,
 379                     bool overwrite)
 380 {
 381         struct cfg80211_internal_bss *found = NULL;
 382         const u8 *meshid, *meshcfg;
 383
 384         /*
 385          * The reference to "res" is donated to this function.
 386          */
 387
 388         if (WARN_ON(!res->pub.channel)) {
 389                 kref_put(&res->ref, bss_release);
 390                 return NULL;
 391         }
 392
 393         res->ts = jiffies;
 394
 395         if (is_zero_ether_addr(res->pub.bssid)) {
 396                 /* must be mesh, verify */
 397                 meshid = find_ie(WLAN_EID_MESH_ID, res->pub.information_elements,
 398                                  res->pub.len_information_elements);
 399                 meshcfg = find_ie(WLAN_EID_MESH_CONFIG,
 400                                   res->pub.information_elements,
 401                                   res->pub.len_information_elements);
 402                 if (!meshid || !meshcfg ||
 403                     meshcfg[1] != sizeof(struct ieee80211_meshconf_ie)) {
 404                         /* bogus mesh */
 405                         kref_put(&res->ref, bss_release);
 406                         return NULL;
 407                 }
 408         }
 409
 410         spin_lock_bh(&dev->bss_lock);
 411
 412         found = rb_find_bss(dev, res);
 413
 414         if (found) {
 415                 found->pub.beacon_interval = res->pub.beacon_interval;
 416                 found->pub.tsf = res->pub.tsf;
 417                 found->pub.signal = res->pub.signal;
 418                 found->pub.capability = res->pub.capability;
 419                 found->ts = res->ts;
 420
 421                 /* overwrite IEs */
 422                 if (overwrite) {
 423                         size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
 424                         size_t ielen = res->pub.len_information_elements;
 425
 426                         if (!found->ies_allocated && ksize(found) >= used + ielen) {
 427                                 memcpy(found->pub.information_elements,
 428                                        res->pub.information_elements, ielen);
 429                                 found->pub.len_information_elements = ielen;
 430                         } else {
 431                                 u8 *ies = found->pub.information_elements;
 432
 433                                 if (found->ies_allocated)
 434                                         ies = krealloc(ies, ielen, GFP_ATOMIC);
 435                                 else
 436                                         ies = kmalloc(ielen, GFP_ATOMIC);
 437
 438                                 if (ies) {
 439                                         memcpy(ies, res->pub.information_elements, ielen);
 440                                         found->ies_allocated = true;
 441                                         found->pub.information_elements = ies;
 442                                         found->pub.len_information_elements = ielen;
 443                                 }
 444                         }
 445                 }
 446
 447                 kref_put(&res->ref, bss_release);
 448         } else {
 449                 /* this "consumes" the reference */
 450                 list_add_tail(&res->list, &dev->bss_list);
 451                 rb_insert_bss(dev, res);
 452                 found = res;
 453         }
 454
 455         dev->bss_generation++;
 456         spin_unlock_bh(&dev->bss_lock);
 457
 458         kref_get(&found->ref);
 459         return found;
 460 }
 461
 462 struct cfg80211_bss*
 463 cfg80211_inform_bss(struct wiphy *wiphy,
 464                     struct ieee80211_channel *channel,
 465                     const u8 *bssid,
 466                     u64 timestamp, u16 capability, u16 beacon_interval,
 467                     const u8 *ie, size_t ielen,
 468                     s32 signal, gfp_t gfp)
 469 {
 470         struct cfg80211_internal_bss *res;
 471         size_t privsz;
 472
 473         if (WARN_ON(!wiphy))
 474                 return NULL;
 475
 476         privsz = wiphy->bss_priv_size;
 477
 478         if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
 479                         (signal < 0 || signal > 100)))
 480                 return NULL;
 481
 482         res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
 483         if (!res)
 484                 return NULL;
 485
 486         memcpy(res->pub.bssid, bssid, ETH_ALEN);
 487         res->pub.channel = channel;
 488         res->pub.signal = signal;
 489         res->pub.tsf = timestamp;
 490         res->pub.beacon_interval = beacon_interval;
 491         res->pub.capability = capability;
 492         /* point to after the private area */
 493         res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
 494         memcpy(res->pub.information_elements, ie, ielen);
 495         res->pub.len_information_elements = ielen;
 496
 497         kref_init(&res->ref);
 498
 499         res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, 0);
 500         if (!res)
 501                 return NULL;
 502
 503         if (res->pub.capability & WLAN_CAPABILITY_ESS)
 504                 regulatory_hint_found_beacon(wiphy, channel, gfp);
 505
 506         /* cfg80211_bss_update gives us a referenced result */
 507         return &res->pub;
 508 }
 509 EXPORT_SYMBOL(cfg80211_inform_bss);
 510
 511 struct cfg80211_bss *
 512 cfg80211_inform_bss_frame(struct wiphy *wiphy,
 513                           struct ieee80211_channel *channel,
 514                           struct ieee80211_mgmt *mgmt, size_t len,
 515                           s32 signal, gfp_t gfp)
 516 {
 517         struct cfg80211_internal_bss *res;
 518         size_t ielen = len - offsetof(struct ieee80211_mgmt,
 519                                       u.probe_resp.variable);
 520         bool overwrite;
 521         size_t privsz = wiphy->bss_priv_size;
 522
 523         if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
 524                     (signal < 0 || signal > 100)))
 525                 return NULL;
 526
 527         if (WARN_ON(!mgmt || !wiphy ||
 528                     len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
 529                 return NULL;
 530
 531         res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
 532         if (!res)
 533                 return NULL;
 534
 535         memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
 536         res->pub.channel = channel;
 537         res->pub.signal = signal;
 538         res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
 539         res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
 540         res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 541         /* point to after the private area */
 542         res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
 543         memcpy(res->pub.information_elements, mgmt->u.probe_resp.variable, ielen);
 544         res->pub.len_information_elements = ielen;
 545
 546         kref_init(&res->ref);
 547
 548         overwrite = ieee80211_is_probe_resp(mgmt->frame_control);
 549
 550         res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, overwrite);
 551         if (!res)
 552                 return NULL;
 553
 554         if (res->pub.capability & WLAN_CAPABILITY_ESS)
 555                 regulatory_hint_found_beacon(wiphy, channel, gfp);
 556
 557         /* cfg80211_bss_update gives us a referenced result */
 558         return &res->pub;
 559 }
 560 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
 561
 562 void cfg80211_put_bss(struct cfg80211_bss *pub)
 563 {
 564         struct cfg80211_internal_bss *bss;
 565
 566         if (!pub)
 567                 return;
 568
 569         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 570         kref_put(&bss->ref, bss_release);
 571 }
 572 EXPORT_SYMBOL(cfg80211_put_bss);
 573
 574 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 575 {
 576         struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
 577         struct cfg80211_internal_bss *bss;
 578
 579         if (WARN_ON(!pub))
 580                 return;
 581
 582         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 583
 584         spin_lock_bh(&dev->bss_lock);
 585
 586         list_del(&bss->list);
 587         dev->bss_generation++;
 588         rb_erase(&bss->rbn, &dev->bss_tree);
 589
 590         spin_unlock_bh(&dev->bss_lock);
 591
 592         kref_put(&bss->ref, bss_release);
 593 }
 594 EXPORT_SYMBOL(cfg80211_unlink_bss);
 595
 596 #ifdef CONFIG_CFG80211_WEXT
 597 int cfg80211_wext_siwscan(struct net_device *dev,
 598                           struct iw_request_info *info,
 599                           union iwreq_data *wrqu, char *extra)
 600 {
 601         struct cfg80211_registered_device *rdev;
 602         struct wiphy *wiphy;
 603         struct iw_scan_req *wreq = NULL;
 604         struct cfg80211_scan_request *creq;
 605         int i, err, n_channels = 0;
 606         enum ieee80211_band band;
 607
 608         if (!netif_running(dev))
 609                 return -ENETDOWN;
 610
 611         if (wrqu->data.length == sizeof(struct iw_scan_req))
 612                 wreq = (struct iw_scan_req *)extra;
 613
 614         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
 615
 616         if (IS_ERR(rdev))
 617                 return PTR_ERR(rdev);
 618
 619         if (rdev->scan_req) {
 620                 err = -EBUSY;
 621                 goto out;
 622         }
 623
 624         wiphy = &rdev->wiphy;
 625
 626         /* Determine number of channels, needed to allocate creq */
 627         if (wreq && wreq->num_channels)
 628                 n_channels = wreq->num_channels;
 629         else {
 630                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
 631                         if (wiphy->bands[band])
 632                                 n_channels += wiphy->bands[band]->n_channels;
 633         }
 634
 635         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
 636                        n_channels * sizeof(void *),
 637                        GFP_ATOMIC);
 638         if (!creq) {
 639                 err = -ENOMEM;
 640                 goto out;
 641         }
 642
 643         creq->wiphy = wiphy;
 644         creq->dev = dev;
 645         /* SSIDs come after channels */
 646         creq->ssids = (void *)&creq->channels[n_channels];
 647         creq->n_channels = n_channels;
 648         creq->n_ssids = 1;
 649
 650         /* translate "Scan on frequencies" request */
 651         i = 0;
 652         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 653                 int j;
 654
 655                 if (!wiphy->bands[band])
 656                         continue;
 657
 658                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
 659                         /* ignore disabled channels */
 660                         if (wiphy->bands[band]->channels[j].flags &
 661                                                 IEEE80211_CHAN_DISABLED)
 662                                 continue;
 663
 664                         /* If we have a wireless request structure and the
 665                          * wireless request specifies frequencies, then search
 666                          * for the matching hardware channel.
 667                          */
 668                         if (wreq && wreq->num_channels) {
 669                                 int k;
 670                                 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
 671                                 for (k = 0; k < wreq->num_channels; k++) {
 672                                         int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
 673                                         if (wext_freq == wiphy_freq)
 674                                                 goto wext_freq_found;
 675                                 }
 676                                 goto wext_freq_not_found;
 677                         }
 678
 679                 wext_freq_found:
 680                         creq->channels[i] = &wiphy->bands[band]->channels[j];
 681                         i++;
 682                 wext_freq_not_found: ;
 683                 }
 684         }
 685         /* No channels found? */
 686         if (!i) {
 687                 err = -EINVAL;
 688                 goto out;
 689         }
 690
 691         /* Set real number of channels specified in creq->channels[] */
 692         creq->n_channels = i;
 693
 694         /* translate "Scan for SSID" request */
 695         if (wreq) {
 696                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
 697                         if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
 698                                 return -EINVAL;
 699                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
 700                         creq->ssids[0].ssid_len = wreq->essid_len;
 701                 }
 702                 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
 703                         creq->n_ssids = 0;
 704         }
 705
 706         rdev->scan_req = creq;
 707         err = rdev->ops->scan(wiphy, dev, creq);
 708         if (err) {
 709                 rdev->scan_req = NULL;
 710                 kfree(creq);
 711         } else {
 712                 nl80211_send_scan_start(rdev, dev);
 713                 dev_hold(dev);
 714         }
 715  out:
 716         cfg80211_unlock_rdev(rdev);
 717         return err;
 718 }
 719 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
 720
 721 static void ieee80211_scan_add_ies(struct iw_request_info *info,
 722                                    struct cfg80211_bss *bss,
 723                                    char **current_ev, char *end_buf)
 724 {
 725         u8 *pos, *end, *next;
 726         struct iw_event iwe;
 727
 728         if (!bss->information_elements ||
 729             !bss->len_information_elements)
 730                 return;
 731
 732         /*
 733          * If needed, fragment the IEs buffer (at IE boundaries) into short
 734          * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
 735          */
 736         pos = bss->information_elements;
 737         end = pos + bss->len_information_elements;
 738
 739         while (end - pos > IW_GENERIC_IE_MAX) {
 740                 next = pos + 2 + pos[1];
 741                 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
 742                         next = next + 2 + next[1];
 743
 744                 memset(&iwe, 0, sizeof(iwe));
 745                 iwe.cmd = IWEVGENIE;
 746                 iwe.u.data.length = next - pos;
 747                 *current_ev = iwe_stream_add_point(info, *current_ev,
 748                                                    end_buf, &iwe, pos);
 749
 750                 pos = next;
 751         }
 752
 753         if (end > pos) {
 754                 memset(&iwe, 0, sizeof(iwe));
 755                 iwe.cmd = IWEVGENIE;
 756                 iwe.u.data.length = end - pos;
 757                 *current_ev = iwe_stream_add_point(info, *current_ev,
 758                                                    end_buf, &iwe, pos);
 759         }
 760 }
 761
 762 static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
 763 {
 764         unsigned long end = jiffies;
 765
 766         if (end >= start)
 767                 return jiffies_to_msecs(end - start);
 768
 769         return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
 770 }
 771
 772 static char *
 773 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
 774               struct cfg80211_internal_bss *bss, char *current_ev,
 775               char *end_buf)
 776 {
 777         struct iw_event iwe;
 778         u8 *buf, *cfg, *p;
 779         u8 *ie = bss->pub.information_elements;
 780         int rem = bss->pub.len_information_elements, i, sig;
 781         bool ismesh = false;
 782
 783         memset(&iwe, 0, sizeof(iwe));
 784         iwe.cmd = SIOCGIWAP;
 785         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
 786         memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
 787         current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
 788                                           IW_EV_ADDR_LEN);
 789
 790         memset(&iwe, 0, sizeof(iwe));
 791         iwe.cmd = SIOCGIWFREQ;
 792         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
 793         iwe.u.freq.e = 0;
 794         current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
 795                                           IW_EV_FREQ_LEN);
 796
 797         memset(&iwe, 0, sizeof(iwe));
 798         iwe.cmd = SIOCGIWFREQ;
 799         iwe.u.freq.m = bss->pub.channel->center_freq;
 800         iwe.u.freq.e = 6;
 801         current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
 802                                           IW_EV_FREQ_LEN);
 803
 804         if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
 805                 memset(&iwe, 0, sizeof(iwe));
 806                 iwe.cmd = IWEVQUAL;
 807                 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
 808                                      IW_QUAL_NOISE_INVALID |
 809                                      IW_QUAL_QUAL_UPDATED;
 810                 switch (wiphy->signal_type) {
 811                 case CFG80211_SIGNAL_TYPE_MBM:
 812                         sig = bss->pub.signal / 100;
 813                         iwe.u.qual.level = sig;
 814                         iwe.u.qual.updated |= IW_QUAL_DBM;
 815                         if (sig < -110)         /* rather bad */
 816                                 sig = -110;
 817                         else if (sig > -40)     /* perfect */
 818                                 sig = -40;
 819                         /* will give a range of 0 .. 70 */
 820                         iwe.u.qual.qual = sig + 110;
 821                         break;
 822                 case CFG80211_SIGNAL_TYPE_UNSPEC:
 823                         iwe.u.qual.level = bss->pub.signal;
 824                         /* will give range 0 .. 100 */
 825                         iwe.u.qual.qual = bss->pub.signal;
 826                         break;
 827                 default:
 828                         /* not reached */
 829                         break;
 830                 }
 831                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
 832                                                   &iwe, IW_EV_QUAL_LEN);
 833         }
 834
 835         memset(&iwe, 0, sizeof(iwe));
 836         iwe.cmd = SIOCGIWENCODE;
 837         if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
 838                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
 839         else
 840                 iwe.u.data.flags = IW_ENCODE_DISABLED;
 841         iwe.u.data.length = 0;
 842         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 843                                           &iwe, "");
 844
 845         while (rem >= 2) {
 846                 /* invalid data */
 847                 if (ie[1] > rem - 2)
 848                         break;
 849
 850                 switch (ie[0]) {
 851                 case WLAN_EID_SSID:
 852                         memset(&iwe, 0, sizeof(iwe));
 853                         iwe.cmd = SIOCGIWESSID;
 854                         iwe.u.data.length = ie[1];
 855                         iwe.u.data.flags = 1;
 856                         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 857                                                           &iwe, ie + 2);
 858                         break;
 859                 case WLAN_EID_MESH_ID:
 860                         memset(&iwe, 0, sizeof(iwe));
 861                         iwe.cmd = SIOCGIWESSID;
 862                         iwe.u.data.length = ie[1];
 863                         iwe.u.data.flags = 1;
 864                         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 865                                                           &iwe, ie + 2);
 866                         break;
 867                 case WLAN_EID_MESH_CONFIG:
 868                         ismesh = true;
 869                         if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
 870                                 break;
 871                         buf = kmalloc(50, GFP_ATOMIC);
 872                         if (!buf)
 873                                 break;
 874                         cfg = ie + 2;
 875                         memset(&iwe, 0, sizeof(iwe));
 876                         iwe.cmd = IWEVCUSTOM;
 877                         sprintf(buf, "Mesh Network Path Selection Protocol ID: "
 878                                 "0x%02X", cfg[0]);
 879                         iwe.u.data.length = strlen(buf);
 880                         current_ev = iwe_stream_add_point(info, current_ev,
 881                                                           end_buf,
 882                                                           &iwe, buf);
 883                         sprintf(buf, "Path Selection Metric ID: 0x%02X",
 884                                 cfg[1]);
 885                         iwe.u.data.length = strlen(buf);
 886                         current_ev = iwe_stream_add_point(info, current_ev,
 887                                                           end_buf,
 888                                                           &iwe, buf);
 889                         sprintf(buf, "Congestion Control Mode ID: 0x%02X",
 890                                 cfg[2]);
 891                         iwe.u.data.length = strlen(buf);
 892                         current_ev = iwe_stream_add_point(info, current_ev,
 893                                                           end_buf,
 894                                                           &iwe, buf);
 895                         sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
 896                         iwe.u.data.length = strlen(buf);
 897                         current_ev = iwe_stream_add_point(info, current_ev,
 898                                                           end_buf,
 899                                                           &iwe, buf);
 900                         sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
 901                         iwe.u.data.length = strlen(buf);
 902                         current_ev = iwe_stream_add_point(info, current_ev,
 903                                                           end_buf,
 904                                                           &iwe, buf);
 905                         sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
 906                         iwe.u.data.length = strlen(buf);
 907                         current_ev = iwe_stream_add_point(info, current_ev,
 908                                                           end_buf,
 909                                                           &iwe, buf);
 910                         sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
 911                         iwe.u.data.length = strlen(buf);
 912                         current_ev = iwe_stream_add_point(info, current_ev,
 913                                                           end_buf,
 914                                                           &iwe, buf);
 915                         kfree(buf);
 916                         break;
 917                 case WLAN_EID_SUPP_RATES:
 918                 case WLAN_EID_EXT_SUPP_RATES:
 919                         /* display all supported rates in readable format */
 920                         p = current_ev + iwe_stream_lcp_len(info);
 921
 922                         memset(&iwe, 0, sizeof(iwe));
 923                         iwe.cmd = SIOCGIWRATE;
 924                         /* Those two flags are ignored... */
 925                         iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
 926
 927                         for (i = 0; i < ie[1]; i++) {
 928                                 iwe.u.bitrate.value =
 929                                         ((ie[i + 2] & 0x7f) * 500000);
 930                                 p = iwe_stream_add_value(info, current_ev, p,
 931                                                 end_buf, &iwe, IW_EV_PARAM_LEN);
 932                         }
 933                         current_ev = p;
 934                         break;
 935                 }
 936                 rem -= ie[1] + 2;
 937                 ie += ie[1] + 2;
 938         }
 939
 940         if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
 941             || ismesh) {
 942                 memset(&iwe, 0, sizeof(iwe));
 943                 iwe.cmd = SIOCGIWMODE;
 944                 if (ismesh)
 945                         iwe.u.mode = IW_MODE_MESH;
 946                 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
 947                         iwe.u.mode = IW_MODE_MASTER;
 948                 else
 949                         iwe.u.mode = IW_MODE_ADHOC;
 950                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
 951                                                   &iwe, IW_EV_UINT_LEN);
 952         }
 953
 954         buf = kmalloc(30, GFP_ATOMIC);
 955         if (buf) {
 956                 memset(&iwe, 0, sizeof(iwe));
 957                 iwe.cmd = IWEVCUSTOM;
 958                 sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
 959                 iwe.u.data.length = strlen(buf);
 960                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 961                                                   &iwe, buf);
 962                 memset(&iwe, 0, sizeof(iwe));
 963                 iwe.cmd = IWEVCUSTOM;
 964                 sprintf(buf, " Last beacon: %ums ago",
 965                         elapsed_jiffies_msecs(bss->ts));
 966                 iwe.u.data.length = strlen(buf);
 967                 current_ev = iwe_stream_add_point(info, current_ev,
 968                                                   end_buf, &iwe, buf);
 969                 kfree(buf);
 970         }
 971
 972         ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
 973
 974         return current_ev;
 975 }
 976
 977
 978 static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
 979                                   struct iw_request_info *info,
 980                                   char *buf, size_t len)
 981 {
 982         char *current_ev = buf;
 983         char *end_buf = buf + len;
 984         struct cfg80211_internal_bss *bss;
 985
 986         spin_lock_bh(&dev->bss_lock);
 987         cfg80211_bss_expire(dev);
 988
 989         list_for_each_entry(bss, &dev->bss_list, list) {
 990                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
 991                         spin_unlock_bh(&dev->bss_lock);
 992                         return -E2BIG;
 993                 }
 994                 current_ev = ieee80211_bss(&dev->wiphy, info, bss,
 995                                            current_ev, end_buf);
 996         }
 997         spin_unlock_bh(&dev->bss_lock);
 998         return current_ev - buf;
 999 }
1000
1001
1002 int cfg80211_wext_giwscan(struct net_device *dev,
1003                           struct iw_request_info *info,
1004                           struct iw_point *data, char *extra)
1005 {
1006         struct cfg80211_registered_device *rdev;
1007         int res;
1008
1009         if (!netif_running(dev))
1010                 return -ENETDOWN;
1011
1012         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
1013
1014         if (IS_ERR(rdev))
1015                 return PTR_ERR(rdev);
1016
1017         if (rdev->scan_req) {
1018                 res = -EAGAIN;
1019                 goto out;
1020         }
1021
1022         res = ieee80211_scan_results(rdev, info, extra, data->length);
1023         data->length = 0;
1024         if (res >= 0) {
1025                 data->length = res;
1026                 res = 0;
1027         }
1028
1029  out:
1030         cfg80211_unlock_rdev(rdev);
1031         return res;
1032 }
1033 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
1034 #endif