net/wireless/scan.c

   1 /*
   2  * cfg80211 scan result handling
   3  *
   4  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6 #include <linux/kernel.h>
   7 #include <linux/module.h>
   8 #include <linux/netdevice.h>
   9 #include <linux/wireless.h>
  10 #include <linux/nl80211.h>
  11 #include <linux/etherdevice.h>
  12 #include <net/arp.h>
  13 #include <net/cfg80211.h>
  14 #include <net/iw_handler.h>
  15 #include "core.h"
  16 #include "nl80211.h"
  17 #include "wext-compat.h"
  18
  19 #define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
  20
  21 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
  22 {
  23         struct cfg80211_scan_request *request;
  24         struct net_device *dev;
  25 #ifdef CONFIG_WIRELESS_EXT
  26         union iwreq_data wrqu;
  27 #endif
  28
  29         request = rdev->scan_req;
  30
  31         dev = request->dev;
  32
  33         /*
  34          * This must be before sending the other events!
  35          * Otherwise, wpa_supplicant gets completely confused with
  36          * wext events.
  37          */
  38         cfg80211_sme_scan_done(dev);
  39
  40         if (request->aborted)
  41                 nl80211_send_scan_aborted(rdev, dev);
  42         else
  43                 nl80211_send_scan_done(rdev, dev);
  44
  45 #ifdef CONFIG_WIRELESS_EXT
  46         if (!request->aborted) {
  47                 memset(&wrqu, 0, sizeof(wrqu));
  48
  49                 wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
  50         }
  51 #endif
  52
  53         dev_put(dev);
  54
  55         rdev->scan_req = NULL;
  56         kfree(request);
  57 }
  58
  59 void __cfg80211_scan_done(struct work_struct *wk)
  60 {
  61         struct cfg80211_registered_device *rdev;
  62
  63         rdev = container_of(wk, struct cfg80211_registered_device,
  64                             scan_done_wk);
  65
  66         cfg80211_lock_rdev(rdev);
  67         ___cfg80211_scan_done(rdev);
  68         cfg80211_unlock_rdev(rdev);
  69 }
  70
  71 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
  72 {
  73         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
  74
  75         request->aborted = aborted;
  76         schedule_work(&wiphy_to_dev(request->wiphy)->scan_done_wk);
  77 }
  78 EXPORT_SYMBOL(cfg80211_scan_done);
  79
  80 static void bss_release(struct kref *ref)
  81 {
  82         struct cfg80211_internal_bss *bss;
  83
  84         bss = container_of(ref, struct cfg80211_internal_bss, ref);
  85         if (bss->pub.free_priv)
  86                 bss->pub.free_priv(&bss->pub);
  87
  88         if (bss->ies_allocated)
  89                 kfree(bss->pub.information_elements);
  90
  91         BUG_ON(atomic_read(&bss->hold));
  92
  93         kfree(bss);
  94 }
  95
  96 /* must hold dev->bss_lock! */
  97 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
  98                       unsigned long age_secs)
  99 {
 100         struct cfg80211_internal_bss *bss;
 101         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
 102
 103         list_for_each_entry(bss, &dev->bss_list, list) {
 104                 bss->ts -= age_jiffies;
 105         }
 106 }
 107
 108 /* must hold dev->bss_lock! */
 109 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
 110 {
 111         struct cfg80211_internal_bss *bss, *tmp;
 112         bool expired = false;
 113
 114         list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
 115                 if (atomic_read(&bss->hold))
 116                         continue;
 117                 if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
 118                         continue;
 119                 list_del(&bss->list);
 120                 rb_erase(&bss->rbn, &dev->bss_tree);
 121                 kref_put(&bss->ref, bss_release);
 122                 expired = true;
 123         }
 124
 125         if (expired)
 126                 dev->bss_generation++;
 127 }
 128
 129 static u8 *find_ie(u8 num, u8 *ies, size_t len)
 130 {
 131         while (len > 2 && ies[0] != num) {
 132                 len -= ies[1] + 2;
 133                 ies += ies[1] + 2;
 134         }
 135         if (len < 2)
 136                 return NULL;
 137         if (len < 2 + ies[1])
 138                 return NULL;
 139         return ies;
 140 }
 141
 142 static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 143 {
 144         const u8 *ie1 = find_ie(num, ies1, len1);
 145         const u8 *ie2 = find_ie(num, ies2, len2);
 146         int r;
 147
 148         if (!ie1 && !ie2)
 149                 return 0;
 150         if (!ie1 || !ie2)
 151                 return -1;
 152
 153         r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
 154         if (r == 0 && ie1[1] != ie2[1])
 155                 return ie2[1] - ie1[1];
 156         return r;
 157 }
 158
 159 static bool is_bss(struct cfg80211_bss *a,
 160                    const u8 *bssid,
 161                    const u8 *ssid, size_t ssid_len)
 162 {
 163         const u8 *ssidie;
 164
 165         if (bssid && compare_ether_addr(a->bssid, bssid))
 166                 return false;
 167
 168         if (!ssid)
 169                 return true;
 170
 171         ssidie = find_ie(WLAN_EID_SSID,
 172                          a->information_elements,
 173                          a->len_information_elements);
 174         if (!ssidie)
 175                 return false;
 176         if (ssidie[1] != ssid_len)
 177                 return false;
 178         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
 179 }
 180
 181 static bool is_mesh(struct cfg80211_bss *a,
 182                     const u8 *meshid, size_t meshidlen,
 183                     const u8 *meshcfg)
 184 {
 185         const u8 *ie;
 186
 187         if (!is_zero_ether_addr(a->bssid))
 188                 return false;
 189
 190         ie = find_ie(WLAN_EID_MESH_ID,
 191                      a->information_elements,
 192                      a->len_information_elements);
 193         if (!ie)
 194                 return false;
 195         if (ie[1] != meshidlen)
 196                 return false;
 197         if (memcmp(ie + 2, meshid, meshidlen))
 198                 return false;
 199
 200         ie = find_ie(WLAN_EID_MESH_CONFIG,
 201                      a->information_elements,
 202                      a->len_information_elements);
 203         if (!ie)
 204                 return false;
 205         if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
 206                 return false;
 207
 208         /*
 209          * Ignore mesh capability (last two bytes of the IE) when
 210          * comparing since that may differ between stations taking
 211          * part in the same mesh.
 212          */
 213         return memcmp(ie + 2, meshcfg, IEEE80211_MESH_CONFIG_LEN - 2) == 0;
 214 }
 215
 216 static int cmp_bss(struct cfg80211_bss *a,
 217                    struct cfg80211_bss *b)
 218 {
 219         int r;
 220
 221         if (a->channel != b->channel)
 222                 return b->channel->center_freq - a->channel->center_freq;
 223
 224         r = memcmp(a->bssid, b->bssid, ETH_ALEN);
 225         if (r)
 226                 return r;
 227
 228         if (is_zero_ether_addr(a->bssid)) {
 229                 r = cmp_ies(WLAN_EID_MESH_ID,
 230                             a->information_elements,
 231                             a->len_information_elements,
 232                             b->information_elements,
 233                             b->len_information_elements);
 234                 if (r)
 235                         return r;
 236                 return cmp_ies(WLAN_EID_MESH_CONFIG,
 237                                a->information_elements,
 238                                a->len_information_elements,
 239                                b->information_elements,
 240                                b->len_information_elements);
 241         }
 242
 243         return cmp_ies(WLAN_EID_SSID,
 244                        a->information_elements,
 245                        a->len_information_elements,
 246                        b->information_elements,
 247                        b->len_information_elements);
 248 }
 249
 250 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
 251                                       struct ieee80211_channel *channel,
 252                                       const u8 *bssid,
 253                                       const u8 *ssid, size_t ssid_len,
 254                                       u16 capa_mask, u16 capa_val)
 255 {
 256         struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
 257         struct cfg80211_internal_bss *bss, *res = NULL;
 258
 259         spin_lock_bh(&dev->bss_lock);
 260
 261         list_for_each_entry(bss, &dev->bss_list, list) {
 262                 if ((bss->pub.capability & capa_mask) != capa_val)
 263                         continue;
 264                 if (channel && bss->pub.channel != channel)
 265                         continue;
 266                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
 267                         res = bss;
 268                         kref_get(&res->ref);
 269                         break;
 270                 }
 271         }
 272
 273         spin_unlock_bh(&dev->bss_lock);
 274         if (!res)
 275                 return NULL;
 276         return &res->pub;
 277 }
 278 EXPORT_SYMBOL(cfg80211_get_bss);
 279
 280 struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
 281                                        struct ieee80211_channel *channel,
 282                                        const u8 *meshid, size_t meshidlen,
 283                                        const u8 *meshcfg)
 284 {
 285         struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
 286         struct cfg80211_internal_bss *bss, *res = NULL;
 287
 288         spin_lock_bh(&dev->bss_lock);
 289
 290         list_for_each_entry(bss, &dev->bss_list, list) {
 291                 if (channel && bss->pub.channel != channel)
 292                         continue;
 293                 if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
 294                         res = bss;
 295                         kref_get(&res->ref);
 296                         break;
 297                 }
 298         }
 299
 300         spin_unlock_bh(&dev->bss_lock);
 301         if (!res)
 302                 return NULL;
 303         return &res->pub;
 304 }
 305 EXPORT_SYMBOL(cfg80211_get_mesh);
 306
 307
 308 static void rb_insert_bss(struct cfg80211_registered_device *dev,
 309                           struct cfg80211_internal_bss *bss)
 310 {
 311         struct rb_node **p = &dev->bss_tree.rb_node;
 312         struct rb_node *parent = NULL;
 313         struct cfg80211_internal_bss *tbss;
 314         int cmp;
 315
 316         while (*p) {
 317                 parent = *p;
 318                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
 319
 320                 cmp = cmp_bss(&bss->pub, &tbss->pub);
 321
 322                 if (WARN_ON(!cmp)) {
 323                         /* will sort of leak this BSS */
 324                         return;
 325                 }
 326
 327                 if (cmp < 0)
 328                         p = &(*p)->rb_left;
 329                 else
 330                         p = &(*p)->rb_right;
 331         }
 332
 333         rb_link_node(&bss->rbn, parent, p);
 334         rb_insert_color(&bss->rbn, &dev->bss_tree);
 335 }
 336
 337 static struct cfg80211_internal_bss *
 338 rb_find_bss(struct cfg80211_registered_device *dev,
 339             struct cfg80211_internal_bss *res)
 340 {
 341         struct rb_node *n = dev->bss_tree.rb_node;
 342         struct cfg80211_internal_bss *bss;
 343         int r;
 344
 345         while (n) {
 346                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
 347                 r = cmp_bss(&res->pub, &bss->pub);
 348
 349                 if (r == 0)
 350                         return bss;
 351                 else if (r < 0)
 352                         n = n->rb_left;
 353                 else
 354                         n = n->rb_right;
 355         }
 356
 357         return NULL;
 358 }
 359
 360 static struct cfg80211_internal_bss *
 361 cfg80211_bss_update(struct cfg80211_registered_device *dev,
 362                     struct cfg80211_internal_bss *res,
 363                     bool overwrite)
 364 {
 365         struct cfg80211_internal_bss *found = NULL;
 366         const u8 *meshid, *meshcfg;
 367
 368         /*
 369          * The reference to "res" is donated to this function.
 370          */
 371
 372         if (WARN_ON(!res->pub.channel)) {
 373                 kref_put(&res->ref, bss_release);
 374                 return NULL;
 375         }
 376
 377         res->ts = jiffies;
 378
 379         if (is_zero_ether_addr(res->pub.bssid)) {
 380                 /* must be mesh, verify */
 381                 meshid = find_ie(WLAN_EID_MESH_ID, res->pub.information_elements,
 382                                  res->pub.len_information_elements);
 383                 meshcfg = find_ie(WLAN_EID_MESH_CONFIG,
 384                                   res->pub.information_elements,
 385                                   res->pub.len_information_elements);
 386                 if (!meshid || !meshcfg ||
 387                     meshcfg[1] != IEEE80211_MESH_CONFIG_LEN) {
 388                         /* bogus mesh */
 389                         kref_put(&res->ref, bss_release);
 390                         return NULL;
 391                 }
 392         }
 393
 394         spin_lock_bh(&dev->bss_lock);
 395
 396         found = rb_find_bss(dev, res);
 397
 398         if (found) {
 399                 found->pub.beacon_interval = res->pub.beacon_interval;
 400                 found->pub.tsf = res->pub.tsf;
 401                 found->pub.signal = res->pub.signal;
 402                 found->pub.capability = res->pub.capability;
 403                 found->ts = res->ts;
 404
 405                 /* overwrite IEs */
 406                 if (overwrite) {
 407                         size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
 408                         size_t ielen = res->pub.len_information_elements;
 409
 410                         if (!found->ies_allocated && ksize(found) >= used + ielen) {
 411                                 memcpy(found->pub.information_elements,
 412                                        res->pub.information_elements, ielen);
 413                                 found->pub.len_information_elements = ielen;
 414                         } else {
 415                                 u8 *ies = found->pub.information_elements;
 416
 417                                 if (found->ies_allocated)
 418                                         ies = krealloc(ies, ielen, GFP_ATOMIC);
 419                                 else
 420                                         ies = kmalloc(ielen, GFP_ATOMIC);
 421
 422                                 if (ies) {
 423                                         memcpy(ies, res->pub.information_elements, ielen);
 424                                         found->ies_allocated = true;
 425                                         found->pub.information_elements = ies;
 426                                         found->pub.len_information_elements = ielen;
 427                                 }
 428                         }
 429                 }
 430
 431                 kref_put(&res->ref, bss_release);
 432         } else {
 433                 /* this "consumes" the reference */
 434                 list_add_tail(&res->list, &dev->bss_list);
 435                 rb_insert_bss(dev, res);
 436                 found = res;
 437         }
 438
 439         dev->bss_generation++;
 440         spin_unlock_bh(&dev->bss_lock);
 441
 442         kref_get(&found->ref);
 443         return found;
 444 }
 445
 446 struct cfg80211_bss*
 447 cfg80211_inform_bss(struct wiphy *wiphy,
 448                     struct ieee80211_channel *channel,
 449                     const u8 *bssid,
 450                     u64 timestamp, u16 capability, u16 beacon_interval,
 451                     const u8 *ie, size_t ielen,
 452                     s32 signal, gfp_t gfp)
 453 {
 454         struct cfg80211_internal_bss *res;
 455         size_t privsz;
 456
 457         if (WARN_ON(!wiphy))
 458                 return NULL;
 459
 460         privsz = wiphy->bss_priv_size;
 461
 462         if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
 463                         (signal < 0 || signal > 100)))
 464                 return NULL;
 465
 466         res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
 467         if (!res)
 468                 return NULL;
 469
 470         memcpy(res->pub.bssid, bssid, ETH_ALEN);
 471         res->pub.channel = channel;
 472         res->pub.signal = signal;
 473         res->pub.tsf = timestamp;
 474         res->pub.beacon_interval = beacon_interval;
 475         res->pub.capability = capability;
 476         /* point to after the private area */
 477         res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
 478         memcpy(res->pub.information_elements, ie, ielen);
 479         res->pub.len_information_elements = ielen;
 480
 481         kref_init(&res->ref);
 482
 483         res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, 0);
 484         if (!res)
 485                 return NULL;
 486
 487         if (res->pub.capability & WLAN_CAPABILITY_ESS)
 488                 regulatory_hint_found_beacon(wiphy, channel, gfp);
 489
 490         /* cfg80211_bss_update gives us a referenced result */
 491         return &res->pub;
 492 }
 493 EXPORT_SYMBOL(cfg80211_inform_bss);
 494
 495 struct cfg80211_bss *
 496 cfg80211_inform_bss_frame(struct wiphy *wiphy,
 497                           struct ieee80211_channel *channel,
 498                           struct ieee80211_mgmt *mgmt, size_t len,
 499                           s32 signal, gfp_t gfp)
 500 {
 501         struct cfg80211_internal_bss *res;
 502         size_t ielen = len - offsetof(struct ieee80211_mgmt,
 503                                       u.probe_resp.variable);
 504         bool overwrite;
 505         size_t privsz = wiphy->bss_priv_size;
 506
 507         if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
 508                     (signal < 0 || signal > 100)))
 509                 return NULL;
 510
 511         if (WARN_ON(!mgmt || !wiphy ||
 512                     len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
 513                 return NULL;
 514
 515         res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
 516         if (!res)
 517                 return NULL;
 518
 519         memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
 520         res->pub.channel = channel;
 521         res->pub.signal = signal;
 522         res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
 523         res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
 524         res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 525         /* point to after the private area */
 526         res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
 527         memcpy(res->pub.information_elements, mgmt->u.probe_resp.variable, ielen);
 528         res->pub.len_information_elements = ielen;
 529
 530         kref_init(&res->ref);
 531
 532         overwrite = ieee80211_is_probe_resp(mgmt->frame_control);
 533
 534         res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, overwrite);
 535         if (!res)
 536                 return NULL;
 537
 538         if (res->pub.capability & WLAN_CAPABILITY_ESS)
 539                 regulatory_hint_found_beacon(wiphy, channel, gfp);
 540
 541         /* cfg80211_bss_update gives us a referenced result */
 542         return &res->pub;
 543 }
 544 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
 545
 546 void cfg80211_put_bss(struct cfg80211_bss *pub)
 547 {
 548         struct cfg80211_internal_bss *bss;
 549
 550         if (!pub)
 551                 return;
 552
 553         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 554         kref_put(&bss->ref, bss_release);
 555 }
 556 EXPORT_SYMBOL(cfg80211_put_bss);
 557
 558 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 559 {
 560         struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
 561         struct cfg80211_internal_bss *bss;
 562
 563         if (WARN_ON(!pub))
 564                 return;
 565
 566         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 567
 568         spin_lock_bh(&dev->bss_lock);
 569
 570         list_del(&bss->list);
 571         dev->bss_generation++;
 572         rb_erase(&bss->rbn, &dev->bss_tree);
 573
 574         spin_unlock_bh(&dev->bss_lock);
 575
 576         kref_put(&bss->ref, bss_release);
 577 }
 578 EXPORT_SYMBOL(cfg80211_unlink_bss);
 579
 580 #ifdef CONFIG_WIRELESS_EXT
 581 int cfg80211_wext_siwscan(struct net_device *dev,
 582                           struct iw_request_info *info,
 583                           union iwreq_data *wrqu, char *extra)
 584 {
 585         struct cfg80211_registered_device *rdev;
 586         struct wiphy *wiphy;
 587         struct iw_scan_req *wreq = NULL;
 588         struct cfg80211_scan_request *creq;
 589         int i, err, n_channels = 0;
 590         enum ieee80211_band band;
 591
 592         if (!netif_running(dev))
 593                 return -ENETDOWN;
 594
 595         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
 596
 597         if (IS_ERR(rdev))
 598                 return PTR_ERR(rdev);
 599
 600         if (rdev->scan_req) {
 601                 err = -EBUSY;
 602                 goto out;
 603         }
 604
 605         wiphy = &rdev->wiphy;
 606
 607         for (band = 0; band < IEEE80211_NUM_BANDS; band++)
 608                 if (wiphy->bands[band])
 609                         n_channels += wiphy->bands[band]->n_channels;
 610
 611         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
 612                        n_channels * sizeof(void *),
 613                        GFP_ATOMIC);
 614         if (!creq) {
 615                 err = -ENOMEM;
 616                 goto out;
 617         }
 618
 619         creq->wiphy = wiphy;
 620         creq->dev = dev;
 621         /* SSIDs come after channels */
 622         creq->ssids = (void *)&creq->channels[n_channels];
 623         creq->n_channels = n_channels;
 624         creq->n_ssids = 1;
 625
 626         /* all channels */
 627         i = 0;
 628         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 629                 int j;
 630                 if (!wiphy->bands[band])
 631                         continue;
 632                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
 633                         creq->channels[i] = &wiphy->bands[band]->channels[j];
 634                         i++;
 635                 }
 636         }
 637
 638         /* translate scan request */
 639         if (wrqu->data.length == sizeof(struct iw_scan_req)) {
 640                 wreq = (struct iw_scan_req *)extra;
 641
 642                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
 643                         if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
 644                                 return -EINVAL;
 645                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
 646                         creq->ssids[0].ssid_len = wreq->essid_len;
 647                 }
 648                 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
 649                         creq->n_ssids = 0;
 650         }
 651
 652         rdev->scan_req = creq;
 653         err = rdev->ops->scan(wiphy, dev, creq);
 654         if (err) {
 655                 rdev->scan_req = NULL;
 656                 kfree(creq);
 657         } else {
 658                 nl80211_send_scan_start(rdev, dev);
 659                 dev_hold(dev);
 660         }
 661  out:
 662         cfg80211_unlock_rdev(rdev);
 663         return err;
 664 }
 665 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
 666
 667 static void ieee80211_scan_add_ies(struct iw_request_info *info,
 668                                    struct cfg80211_bss *bss,
 669                                    char **current_ev, char *end_buf)
 670 {
 671         u8 *pos, *end, *next;
 672         struct iw_event iwe;
 673
 674         if (!bss->information_elements ||
 675             !bss->len_information_elements)
 676                 return;
 677
 678         /*
 679          * If needed, fragment the IEs buffer (at IE boundaries) into short
 680          * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
 681          */
 682         pos = bss->information_elements;
 683         end = pos + bss->len_information_elements;
 684
 685         while (end - pos > IW_GENERIC_IE_MAX) {
 686                 next = pos + 2 + pos[1];
 687                 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
 688                         next = next + 2 + next[1];
 689
 690                 memset(&iwe, 0, sizeof(iwe));
 691                 iwe.cmd = IWEVGENIE;
 692                 iwe.u.data.length = next - pos;
 693                 *current_ev = iwe_stream_add_point(info, *current_ev,
 694                                                    end_buf, &iwe, pos);
 695
 696                 pos = next;
 697         }
 698
 699         if (end > pos) {
 700                 memset(&iwe, 0, sizeof(iwe));
 701                 iwe.cmd = IWEVGENIE;
 702                 iwe.u.data.length = end - pos;
 703                 *current_ev = iwe_stream_add_point(info, *current_ev,
 704                                                    end_buf, &iwe, pos);
 705         }
 706 }
 707
 708 static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
 709 {
 710         unsigned long end = jiffies;
 711
 712         if (end >= start)
 713                 return jiffies_to_msecs(end - start);
 714
 715         return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
 716 }
 717
 718 static char *
 719 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
 720               struct cfg80211_internal_bss *bss, char *current_ev,
 721               char *end_buf)
 722 {
 723         struct iw_event iwe;
 724         u8 *buf, *cfg, *p;
 725         u8 *ie = bss->pub.information_elements;
 726         int rem = bss->pub.len_information_elements, i, sig;
 727         bool ismesh = false;
 728
 729         memset(&iwe, 0, sizeof(iwe));
 730         iwe.cmd = SIOCGIWAP;
 731         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
 732         memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
 733         current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
 734                                           IW_EV_ADDR_LEN);
 735
 736         memset(&iwe, 0, sizeof(iwe));
 737         iwe.cmd = SIOCGIWFREQ;
 738         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
 739         iwe.u.freq.e = 0;
 740         current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
 741                                           IW_EV_FREQ_LEN);
 742
 743         memset(&iwe, 0, sizeof(iwe));
 744         iwe.cmd = SIOCGIWFREQ;
 745         iwe.u.freq.m = bss->pub.channel->center_freq;
 746         iwe.u.freq.e = 6;
 747         current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
 748                                           IW_EV_FREQ_LEN);
 749
 750         if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
 751                 memset(&iwe, 0, sizeof(iwe));
 752                 iwe.cmd = IWEVQUAL;
 753                 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
 754                                      IW_QUAL_NOISE_INVALID |
 755                                      IW_QUAL_QUAL_UPDATED;
 756                 switch (wiphy->signal_type) {
 757                 case CFG80211_SIGNAL_TYPE_MBM:
 758                         sig = bss->pub.signal / 100;
 759                         iwe.u.qual.level = sig;
 760                         iwe.u.qual.updated |= IW_QUAL_DBM;
 761                         if (sig < -110)         /* rather bad */
 762                                 sig = -110;
 763                         else if (sig > -40)     /* perfect */
 764                                 sig = -40;
 765                         /* will give a range of 0 .. 70 */
 766                         iwe.u.qual.qual = sig + 110;
 767                         break;
 768                 case CFG80211_SIGNAL_TYPE_UNSPEC:
 769                         iwe.u.qual.level = bss->pub.signal;
 770                         /* will give range 0 .. 100 */
 771                         iwe.u.qual.qual = bss->pub.signal;
 772                         break;
 773                 default:
 774                         /* not reached */
 775                         break;
 776                 }
 777                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
 778                                                   &iwe, IW_EV_QUAL_LEN);
 779         }
 780
 781         memset(&iwe, 0, sizeof(iwe));
 782         iwe.cmd = SIOCGIWENCODE;
 783         if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
 784                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
 785         else
 786                 iwe.u.data.flags = IW_ENCODE_DISABLED;
 787         iwe.u.data.length = 0;
 788         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 789                                           &iwe, "");
 790
 791         while (rem >= 2) {
 792                 /* invalid data */
 793                 if (ie[1] > rem - 2)
 794                         break;
 795
 796                 switch (ie[0]) {
 797                 case WLAN_EID_SSID:
 798                         memset(&iwe, 0, sizeof(iwe));
 799                         iwe.cmd = SIOCGIWESSID;
 800                         iwe.u.data.length = ie[1];
 801                         iwe.u.data.flags = 1;
 802                         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 803                                                           &iwe, ie + 2);
 804                         break;
 805                 case WLAN_EID_MESH_ID:
 806                         memset(&iwe, 0, sizeof(iwe));
 807                         iwe.cmd = SIOCGIWESSID;
 808                         iwe.u.data.length = ie[1];
 809                         iwe.u.data.flags = 1;
 810                         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 811                                                           &iwe, ie + 2);
 812                         break;
 813                 case WLAN_EID_MESH_CONFIG:
 814                         ismesh = true;
 815                         if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
 816                                 break;
 817                         buf = kmalloc(50, GFP_ATOMIC);
 818                         if (!buf)
 819                                 break;
 820                         cfg = ie + 2;
 821                         memset(&iwe, 0, sizeof(iwe));
 822                         iwe.cmd = IWEVCUSTOM;
 823                         sprintf(buf, "Mesh network (version %d)", cfg[0]);
 824                         iwe.u.data.length = strlen(buf);
 825                         current_ev = iwe_stream_add_point(info, current_ev,
 826                                                           end_buf,
 827                                                           &iwe, buf);
 828                         sprintf(buf, "Path Selection Protocol ID: "
 829                                 "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
 830                                                         cfg[4]);
 831                         iwe.u.data.length = strlen(buf);
 832                         current_ev = iwe_stream_add_point(info, current_ev,
 833                                                           end_buf,
 834                                                           &iwe, buf);
 835                         sprintf(buf, "Path Selection Metric ID: "
 836                                 "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
 837                                                         cfg[8]);
 838                         iwe.u.data.length = strlen(buf);
 839                         current_ev = iwe_stream_add_point(info, current_ev,
 840                                                           end_buf,
 841                                                           &iwe, buf);
 842                         sprintf(buf, "Congestion Control Mode ID: "
 843                                 "0x%02X%02X%02X%02X", cfg[9], cfg[10],
 844                                                         cfg[11], cfg[12]);
 845                         iwe.u.data.length = strlen(buf);
 846                         current_ev = iwe_stream_add_point(info, current_ev,
 847                                                           end_buf,
 848                                                           &iwe, buf);
 849                         sprintf(buf, "Channel Precedence: "
 850                                 "0x%02X%02X%02X%02X", cfg[13], cfg[14],
 851                                                         cfg[15], cfg[16]);
 852                         iwe.u.data.length = strlen(buf);
 853                         current_ev = iwe_stream_add_point(info, current_ev,
 854                                                           end_buf,
 855                                                           &iwe, buf);
 856                         kfree(buf);
 857                         break;
 858                 case WLAN_EID_SUPP_RATES:
 859                 case WLAN_EID_EXT_SUPP_RATES:
 860                         /* display all supported rates in readable format */
 861                         p = current_ev + iwe_stream_lcp_len(info);
 862
 863                         memset(&iwe, 0, sizeof(iwe));
 864                         iwe.cmd = SIOCGIWRATE;
 865                         /* Those two flags are ignored... */
 866                         iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
 867
 868                         for (i = 0; i < ie[1]; i++) {
 869                                 iwe.u.bitrate.value =
 870                                         ((ie[i + 2] & 0x7f) * 500000);
 871                                 p = iwe_stream_add_value(info, current_ev, p,
 872                                                 end_buf, &iwe, IW_EV_PARAM_LEN);
 873                         }
 874                         current_ev = p;
 875                         break;
 876                 }
 877                 rem -= ie[1] + 2;
 878                 ie += ie[1] + 2;
 879         }
 880
 881         if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
 882             || ismesh) {
 883                 memset(&iwe, 0, sizeof(iwe));
 884                 iwe.cmd = SIOCGIWMODE;
 885                 if (ismesh)
 886                         iwe.u.mode = IW_MODE_MESH;
 887                 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
 888                         iwe.u.mode = IW_MODE_MASTER;
 889                 else
 890                         iwe.u.mode = IW_MODE_ADHOC;
 891                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
 892                                                   &iwe, IW_EV_UINT_LEN);
 893         }
 894
 895         buf = kmalloc(30, GFP_ATOMIC);
 896         if (buf) {
 897                 memset(&iwe, 0, sizeof(iwe));
 898                 iwe.cmd = IWEVCUSTOM;
 899                 sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
 900                 iwe.u.data.length = strlen(buf);
 901                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
 902                                                   &iwe, buf);
 903                 memset(&iwe, 0, sizeof(iwe));
 904                 iwe.cmd = IWEVCUSTOM;
 905                 sprintf(buf, " Last beacon: %ums ago",
 906                         elapsed_jiffies_msecs(bss->ts));
 907                 iwe.u.data.length = strlen(buf);
 908                 current_ev = iwe_stream_add_point(info, current_ev,
 909                                                   end_buf, &iwe, buf);
 910                 kfree(buf);
 911         }
 912
 913         ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
 914
 915         return current_ev;
 916 }
 917
 918
 919 static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
 920                                   struct iw_request_info *info,
 921                                   char *buf, size_t len)
 922 {
 923         char *current_ev = buf;
 924         char *end_buf = buf + len;
 925         struct cfg80211_internal_bss *bss;
 926
 927         spin_lock_bh(&dev->bss_lock);
 928         cfg80211_bss_expire(dev);
 929
 930         list_for_each_entry(bss, &dev->bss_list, list) {
 931                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
 932                         spin_unlock_bh(&dev->bss_lock);
 933                         return -E2BIG;
 934                 }
 935                 current_ev = ieee80211_bss(&dev->wiphy, info, bss,
 936                                            current_ev, end_buf);
 937         }
 938         spin_unlock_bh(&dev->bss_lock);
 939         return current_ev - buf;
 940 }
 941
 942
 943 int cfg80211_wext_giwscan(struct net_device *dev,
 944                           struct iw_request_info *info,
 945                           struct iw_point *data, char *extra)
 946 {
 947         struct cfg80211_registered_device *rdev;
 948         int res;
 949
 950         if (!netif_running(dev))
 951                 return -ENETDOWN;
 952
 953         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
 954
 955         if (IS_ERR(rdev))
 956                 return PTR_ERR(rdev);
 957
 958         if (rdev->scan_req) {
 959                 res = -EAGAIN;
 960                 goto out;
 961         }
 962
 963         res = ieee80211_scan_results(rdev, info, extra, data->length);
 964         data->length = 0;
 965         if (res >= 0) {
 966                 data->length = res;
 967                 res = 0;
 968         }
 969
 970  out:
 971         cfg80211_unlock_rdev(rdev);
 972         return res;
 973 }
 974 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
 975 #endif