~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/wireless/scan.c

Version: ~ [ linux-5.10-rc5 ] ~ [ linux-5.9.10 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.79 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.159 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.208 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.245 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.245 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0
  2 /*
  3  * cfg80211 scan result handling
  4  *
  5  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
  6  * Copyright 2013-2014  Intel Mobile Communications GmbH
  7  * Copyright 2016       Intel Deutschland GmbH
  8  * Copyright (C) 2018-2020 Intel Corporation
  9  */
 10 #include <linux/kernel.h>
 11 #include <linux/slab.h>
 12 #include <linux/module.h>
 13 #include <linux/netdevice.h>
 14 #include <linux/wireless.h>
 15 #include <linux/nl80211.h>
 16 #include <linux/etherdevice.h>
 17 #include <linux/crc32.h>
 18 #include <linux/bitfield.h>
 19 #include <net/arp.h>
 20 #include <net/cfg80211.h>
 21 #include <net/cfg80211-wext.h>
 22 #include <net/iw_handler.h>
 23 #include "core.h"
 24 #include "nl80211.h"
 25 #include "wext-compat.h"
 26 #include "rdev-ops.h"
 27 
 28 /**
 29  * DOC: BSS tree/list structure
 30  *
 31  * At the top level, the BSS list is kept in both a list in each
 32  * registered device (@bss_list) as well as an RB-tree for faster
 33  * lookup. In the RB-tree, entries can be looked up using their
 34  * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
 35  * for other BSSes.
 36  *
 37  * Due to the possibility of hidden SSIDs, there's a second level
 38  * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
 39  * The hidden_list connects all BSSes belonging to a single AP
 40  * that has a hidden SSID, and connects beacon and probe response
 41  * entries. For a probe response entry for a hidden SSID, the
 42  * hidden_beacon_bss pointer points to the BSS struct holding the
 43  * beacon's information.
 44  *
 45  * Reference counting is done for all these references except for
 46  * the hidden_list, so that a beacon BSS struct that is otherwise
 47  * not referenced has one reference for being on the bss_list and
 48  * one for each probe response entry that points to it using the
 49  * hidden_beacon_bss pointer. When a BSS struct that has such a
 50  * pointer is get/put, the refcount update is also propagated to
 51  * the referenced struct, this ensure that it cannot get removed
 52  * while somebody is using the probe response version.
 53  *
 54  * Note that the hidden_beacon_bss pointer never changes, due to
 55  * the reference counting. Therefore, no locking is needed for
 56  * it.
 57  *
 58  * Also note that the hidden_beacon_bss pointer is only relevant
 59  * if the driver uses something other than the IEs, e.g. private
 60  * data stored in the BSS struct, since the beacon IEs are
 61  * also linked into the probe response struct.
 62  */
 63 
 64 /*
 65  * Limit the number of BSS entries stored in mac80211. Each one is
 66  * a bit over 4k at most, so this limits to roughly 4-5M of memory.
 67  * If somebody wants to really attack this though, they'd likely
 68  * use small beacons, and only one type of frame, limiting each of
 69  * the entries to a much smaller size (in order to generate more
 70  * entries in total, so overhead is bigger.)
 71  */
 72 static int bss_entries_limit = 1000;
 73 module_param(bss_entries_limit, int, 0644);
 74 MODULE_PARM_DESC(bss_entries_limit,
 75                  "limit to number of scan BSS entries (per wiphy, default 1000)");
 76 
 77 #define IEEE80211_SCAN_RESULT_EXPIRE    (30 * HZ)
 78 
 79 /**
 80  * struct cfg80211_colocated_ap - colocated AP information
 81  *
 82  * @list: linked list to all colocated aPS
 83  * @bssid: BSSID of the reported AP
 84  * @ssid: SSID of the reported AP
 85  * @ssid_len: length of the ssid
 86  * @center_freq: frequency the reported AP is on
 87  * @unsolicited_probe: the reported AP is part of an ESS, where all the APs
 88  *      that operate in the same channel as the reported AP and that might be
 89  *      detected by a STA receiving this frame, are transmitting unsolicited
 90  *      Probe Response frames every 20 TUs
 91  * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP
 92  * @same_ssid: the reported AP has the same SSID as the reporting AP
 93  * @multi_bss: the reported AP is part of a multiple BSSID set
 94  * @transmitted_bssid: the reported AP is the transmitting BSSID
 95  * @colocated_ess: all the APs that share the same ESS as the reported AP are
 96  *      colocated and can be discovered via legacy bands.
 97  * @short_ssid_valid: short_ssid is valid and can be used
 98  * @short_ssid: the short SSID for this SSID
 99  */
100 struct cfg80211_colocated_ap {
101         struct list_head list;
102         u8 bssid[ETH_ALEN];
103         u8 ssid[IEEE80211_MAX_SSID_LEN];
104         size_t ssid_len;
105         u32 short_ssid;
106         u32 center_freq;
107         u8 unsolicited_probe:1,
108            oct_recommended:1,
109            same_ssid:1,
110            multi_bss:1,
111            transmitted_bssid:1,
112            colocated_ess:1,
113            short_ssid_valid:1;
114 };
115 
116 static void bss_free(struct cfg80211_internal_bss *bss)
117 {
118         struct cfg80211_bss_ies *ies;
119 
120         if (WARN_ON(atomic_read(&bss->hold)))
121                 return;
122 
123         ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
124         if (ies && !bss->pub.hidden_beacon_bss)
125                 kfree_rcu(ies, rcu_head);
126         ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
127         if (ies)
128                 kfree_rcu(ies, rcu_head);
129 
130         /*
131          * This happens when the module is removed, it doesn't
132          * really matter any more save for completeness
133          */
134         if (!list_empty(&bss->hidden_list))
135                 list_del(&bss->hidden_list);
136 
137         kfree(bss);
138 }
139 
140 static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
141                                struct cfg80211_internal_bss *bss)
142 {
143         lockdep_assert_held(&rdev->bss_lock);
144 
145         bss->refcount++;
146         if (bss->pub.hidden_beacon_bss) {
147                 bss = container_of(bss->pub.hidden_beacon_bss,
148                                    struct cfg80211_internal_bss,
149                                    pub);
150                 bss->refcount++;
151         }
152         if (bss->pub.transmitted_bss) {
153                 bss = container_of(bss->pub.transmitted_bss,
154                                    struct cfg80211_internal_bss,
155                                    pub);
156                 bss->refcount++;
157         }
158 }
159 
160 static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
161                                struct cfg80211_internal_bss *bss)
162 {
163         lockdep_assert_held(&rdev->bss_lock);
164 
165         if (bss->pub.hidden_beacon_bss) {
166                 struct cfg80211_internal_bss *hbss;
167                 hbss = container_of(bss->pub.hidden_beacon_bss,
168                                     struct cfg80211_internal_bss,
169                                     pub);
170                 hbss->refcount--;
171                 if (hbss->refcount == 0)
172                         bss_free(hbss);
173         }
174 
175         if (bss->pub.transmitted_bss) {
176                 struct cfg80211_internal_bss *tbss;
177 
178                 tbss = container_of(bss->pub.transmitted_bss,
179                                     struct cfg80211_internal_bss,
180                                     pub);
181                 tbss->refcount--;
182                 if (tbss->refcount == 0)
183                         bss_free(tbss);
184         }
185 
186         bss->refcount--;
187         if (bss->refcount == 0)
188                 bss_free(bss);
189 }
190 
191 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
192                                   struct cfg80211_internal_bss *bss)
193 {
194         lockdep_assert_held(&rdev->bss_lock);
195 
196         if (!list_empty(&bss->hidden_list)) {
197                 /*
198                  * don't remove the beacon entry if it has
199                  * probe responses associated with it
200                  */
201                 if (!bss->pub.hidden_beacon_bss)
202                         return false;
203                 /*
204                  * if it's a probe response entry break its
205                  * link to the other entries in the group
206                  */
207                 list_del_init(&bss->hidden_list);
208         }
209 
210         list_del_init(&bss->list);
211         list_del_init(&bss->pub.nontrans_list);
212         rb_erase(&bss->rbn, &rdev->bss_tree);
213         rdev->bss_entries--;
214         WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
215                   "rdev bss entries[%d]/list[empty:%d] corruption\n",
216                   rdev->bss_entries, list_empty(&rdev->bss_list));
217         bss_ref_put(rdev, bss);
218         return true;
219 }
220 
221 bool cfg80211_is_element_inherited(const struct element *elem,
222                                    const struct element *non_inherit_elem)
223 {
224         u8 id_len, ext_id_len, i, loop_len, id;
225         const u8 *list;
226 
227         if (elem->id == WLAN_EID_MULTIPLE_BSSID)
228                 return false;
229 
230         if (!non_inherit_elem || non_inherit_elem->datalen < 2)
231                 return true;
232 
233         /*
234          * non inheritance element format is:
235          * ext ID (56) | IDs list len | list | extension IDs list len | list
236          * Both lists are optional. Both lengths are mandatory.
237          * This means valid length is:
238          * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
239          */
240         id_len = non_inherit_elem->data[1];
241         if (non_inherit_elem->datalen < 3 + id_len)
242                 return true;
243 
244         ext_id_len = non_inherit_elem->data[2 + id_len];
245         if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
246                 return true;
247 
248         if (elem->id == WLAN_EID_EXTENSION) {
249                 if (!ext_id_len)
250                         return true;
251                 loop_len = ext_id_len;
252                 list = &non_inherit_elem->data[3 + id_len];
253                 id = elem->data[0];
254         } else {
255                 if (!id_len)
256                         return true;
257                 loop_len = id_len;
258                 list = &non_inherit_elem->data[2];
259                 id = elem->id;
260         }
261 
262         for (i = 0; i < loop_len; i++) {
263                 if (list[i] == id)
264                         return false;
265         }
266 
267         return true;
268 }
269 EXPORT_SYMBOL(cfg80211_is_element_inherited);
270 
271 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
272                                   const u8 *subelement, size_t subie_len,
273                                   u8 *new_ie, gfp_t gfp)
274 {
275         u8 *pos, *tmp;
276         const u8 *tmp_old, *tmp_new;
277         const struct element *non_inherit_elem;
278         u8 *sub_copy;
279 
280         /* copy subelement as we need to change its content to
281          * mark an ie after it is processed.
282          */
283         sub_copy = kmemdup(subelement, subie_len, gfp);
284         if (!sub_copy)
285                 return 0;
286 
287         pos = &new_ie[0];
288 
289         /* set new ssid */
290         tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len);
291         if (tmp_new) {
292                 memcpy(pos, tmp_new, tmp_new[1] + 2);
293                 pos += (tmp_new[1] + 2);
294         }
295 
296         /* get non inheritance list if exists */
297         non_inherit_elem =
298                 cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
299                                        sub_copy, subie_len);
300 
301         /* go through IEs in ie (skip SSID) and subelement,
302          * merge them into new_ie
303          */
304         tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
305         tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
306 
307         while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
308                 if (tmp_old[0] == 0) {
309                         tmp_old++;
310                         continue;
311                 }
312 
313                 if (tmp_old[0] == WLAN_EID_EXTENSION)
314                         tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy,
315                                                          subie_len);
316                 else
317                         tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy,
318                                                      subie_len);
319 
320                 if (!tmp) {
321                         const struct element *old_elem = (void *)tmp_old;
322 
323                         /* ie in old ie but not in subelement */
324                         if (cfg80211_is_element_inherited(old_elem,
325                                                           non_inherit_elem)) {
326                                 memcpy(pos, tmp_old, tmp_old[1] + 2);
327                                 pos += tmp_old[1] + 2;
328                         }
329                 } else {
330                         /* ie in transmitting ie also in subelement,
331                          * copy from subelement and flag the ie in subelement
332                          * as copied (by setting eid field to WLAN_EID_SSID,
333                          * which is skipped anyway).
334                          * For vendor ie, compare OUI + type + subType to
335                          * determine if they are the same ie.
336                          */
337                         if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) {
338                                 if (!memcmp(tmp_old + 2, tmp + 2, 5)) {
339                                         /* same vendor ie, copy from
340                                          * subelement
341                                          */
342                                         memcpy(pos, tmp, tmp[1] + 2);
343                                         pos += tmp[1] + 2;
344                                         tmp[0] = WLAN_EID_SSID;
345                                 } else {
346                                         memcpy(pos, tmp_old, tmp_old[1] + 2);
347                                         pos += tmp_old[1] + 2;
348                                 }
349                         } else {
350                                 /* copy ie from subelement into new ie */
351                                 memcpy(pos, tmp, tmp[1] + 2);
352                                 pos += tmp[1] + 2;
353                                 tmp[0] = WLAN_EID_SSID;
354                         }
355                 }
356 
357                 if (tmp_old + tmp_old[1] + 2 - ie == ielen)
358                         break;
359 
360                 tmp_old += tmp_old[1] + 2;
361         }
362 
363         /* go through subelement again to check if there is any ie not
364          * copied to new ie, skip ssid, capability, bssid-index ie
365          */
366         tmp_new = sub_copy;
367         while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
368                 if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
369                       tmp_new[0] == WLAN_EID_SSID)) {
370                         memcpy(pos, tmp_new, tmp_new[1] + 2);
371                         pos += tmp_new[1] + 2;
372                 }
373                 if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len)
374                         break;
375                 tmp_new += tmp_new[1] + 2;
376         }
377 
378         kfree(sub_copy);
379         return pos - new_ie;
380 }
381 
382 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
383                    const u8 *ssid, size_t ssid_len)
384 {
385         const struct cfg80211_bss_ies *ies;
386         const u8 *ssidie;
387 
388         if (bssid && !ether_addr_equal(a->bssid, bssid))
389                 return false;
390 
391         if (!ssid)
392                 return true;
393 
394         ies = rcu_access_pointer(a->ies);
395         if (!ies)
396                 return false;
397         ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
398         if (!ssidie)
399                 return false;
400         if (ssidie[1] != ssid_len)
401                 return false;
402         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
403 }
404 
405 static int
406 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
407                            struct cfg80211_bss *nontrans_bss)
408 {
409         const u8 *ssid;
410         size_t ssid_len;
411         struct cfg80211_bss *bss = NULL;
412 
413         rcu_read_lock();
414         ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
415         if (!ssid) {
416                 rcu_read_unlock();
417                 return -EINVAL;
418         }
419         ssid_len = ssid[1];
420         ssid = ssid + 2;
421         rcu_read_unlock();
422 
423         /* check if nontrans_bss is in the list */
424         list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
425                 if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len))
426                         return 0;
427         }
428 
429         /* add to the list */
430         list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
431         return 0;
432 }
433 
434 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
435                                   unsigned long expire_time)
436 {
437         struct cfg80211_internal_bss *bss, *tmp;
438         bool expired = false;
439 
440         lockdep_assert_held(&rdev->bss_lock);
441 
442         list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
443                 if (atomic_read(&bss->hold))
444                         continue;
445                 if (!time_after(expire_time, bss->ts))
446                         continue;
447 
448                 if (__cfg80211_unlink_bss(rdev, bss))
449                         expired = true;
450         }
451 
452         if (expired)
453                 rdev->bss_generation++;
454 }
455 
456 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
457 {
458         struct cfg80211_internal_bss *bss, *oldest = NULL;
459         bool ret;
460 
461         lockdep_assert_held(&rdev->bss_lock);
462 
463         list_for_each_entry(bss, &rdev->bss_list, list) {
464                 if (atomic_read(&bss->hold))
465                         continue;
466 
467                 if (!list_empty(&bss->hidden_list) &&
468                     !bss->pub.hidden_beacon_bss)
469                         continue;
470 
471                 if (oldest && time_before(oldest->ts, bss->ts))
472                         continue;
473                 oldest = bss;
474         }
475 
476         if (WARN_ON(!oldest))
477                 return false;
478 
479         /*
480          * The callers make sure to increase rdev->bss_generation if anything
481          * gets removed (and a new entry added), so there's no need to also do
482          * it here.
483          */
484 
485         ret = __cfg80211_unlink_bss(rdev, oldest);
486         WARN_ON(!ret);
487         return ret;
488 }
489 
490 static u8 cfg80211_parse_bss_param(u8 data,
491                                    struct cfg80211_colocated_ap *coloc_ap)
492 {
493         coloc_ap->oct_recommended =
494                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
495         coloc_ap->same_ssid =
496                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
497         coloc_ap->multi_bss =
498                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
499         coloc_ap->transmitted_bssid =
500                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
501         coloc_ap->unsolicited_probe =
502                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
503         coloc_ap->colocated_ess =
504                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
505 
506         return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
507 }
508 
509 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
510                                     const struct element **elem, u32 *s_ssid)
511 {
512 
513         *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
514         if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
515                 return -EINVAL;
516 
517         *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen);
518         return 0;
519 }
520 
521 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
522 {
523         struct cfg80211_colocated_ap *ap, *tmp_ap;
524 
525         list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
526                 list_del(&ap->list);
527                 kfree(ap);
528         }
529 }
530 
531 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
532                                   const u8 *pos, u8 length,
533                                   const struct element *ssid_elem,
534                                   int s_ssid_tmp)
535 {
536         /* skip the TBTT offset */
537         pos++;
538 
539         memcpy(entry->bssid, pos, ETH_ALEN);
540         pos += ETH_ALEN;
541 
542         if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM) {
543                 memcpy(&entry->short_ssid, pos,
544                        sizeof(entry->short_ssid));
545                 entry->short_ssid_valid = true;
546                 pos += 4;
547         }
548 
549         /* skip non colocated APs */
550         if (!cfg80211_parse_bss_param(*pos, entry))
551                 return -EINVAL;
552         pos++;
553 
554         if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM) {
555                 /*
556                  * no information about the short ssid. Consider the entry valid
557                  * for now. It would later be dropped in case there are explicit
558                  * SSIDs that need to be matched
559                  */
560                 if (!entry->same_ssid)
561                         return 0;
562         }
563 
564         if (entry->same_ssid) {
565                 entry->short_ssid = s_ssid_tmp;
566                 entry->short_ssid_valid = true;
567 
568                 /*
569                  * This is safe because we validate datalen in
570                  * cfg80211_parse_colocated_ap(), before calling this
571                  * function.
572                  */
573                 memcpy(&entry->ssid, &ssid_elem->data,
574                        ssid_elem->datalen);
575                 entry->ssid_len = ssid_elem->datalen;
576         }
577         return 0;
578 }
579 
580 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
581                                        struct list_head *list)
582 {
583         struct ieee80211_neighbor_ap_info *ap_info;
584         const struct element *elem, *ssid_elem;
585         const u8 *pos, *end;
586         u32 s_ssid_tmp;
587         int n_coloc = 0, ret;
588         LIST_HEAD(ap_list);
589 
590         elem = cfg80211_find_elem(WLAN_EID_REDUCED_NEIGHBOR_REPORT, ies->data,
591                                   ies->len);
592         if (!elem || elem->datalen > IEEE80211_MAX_SSID_LEN)
593                 return 0;
594 
595         pos = elem->data;
596         end = pos + elem->datalen;
597 
598         ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp);
599         if (ret)
600                 return ret;
601 
602         /* RNR IE may contain more than one NEIGHBOR_AP_INFO */
603         while (pos + sizeof(*ap_info) <= end) {
604                 enum nl80211_band band;
605                 int freq;
606                 u8 length, i, count;
607 
608                 ap_info = (void *)pos;
609                 count = u8_get_bits(ap_info->tbtt_info_hdr,
610                                     IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
611                 length = ap_info->tbtt_info_len;
612 
613                 pos += sizeof(*ap_info);
614 
615                 if (!ieee80211_operating_class_to_band(ap_info->op_class,
616                                                        &band))
617                         break;
618 
619                 freq = ieee80211_channel_to_frequency(ap_info->channel, band);
620 
621                 if (end - pos < count * ap_info->tbtt_info_len)
622                         break;
623 
624                 /*
625                  * TBTT info must include bss param + BSSID +
626                  * (short SSID or same_ssid bit to be set).
627                  * ignore other options, and move to the
628                  * next AP info
629                  */
630                 if (band != NL80211_BAND_6GHZ ||
631                     (length != IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM &&
632                      length < IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM)) {
633                         pos += count * ap_info->tbtt_info_len;
634                         continue;
635                 }
636 
637                 for (i = 0; i < count; i++) {
638                         struct cfg80211_colocated_ap *entry;
639 
640                         entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
641                                         GFP_ATOMIC);
642 
643                         if (!entry)
644                                 break;
645 
646                         entry->center_freq = freq;
647 
648                         if (!cfg80211_parse_ap_info(entry, pos, length,
649                                                     ssid_elem, s_ssid_tmp)) {
650                                 n_coloc++;
651                                 list_add_tail(&entry->list, &ap_list);
652                         } else {
653                                 kfree(entry);
654                         }
655 
656                         pos += ap_info->tbtt_info_len;
657                 }
658         }
659 
660         if (pos != end) {
661                 cfg80211_free_coloc_ap_list(&ap_list);
662                 return 0;
663         }
664 
665         list_splice_tail(&ap_list, list);
666         return n_coloc;
667 }
668 
669 static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
670                                         struct ieee80211_channel *chan,
671                                         bool add_to_6ghz)
672 {
673         int i;
674         u32 n_channels = request->n_channels;
675         struct cfg80211_scan_6ghz_params *params =
676                 &request->scan_6ghz_params[request->n_6ghz_params];
677 
678         for (i = 0; i < n_channels; i++) {
679                 if (request->channels[i] == chan) {
680                         if (add_to_6ghz)
681                                 params->channel_idx = i;
682                         return;
683                 }
684         }
685 
686         request->channels[n_channels] = chan;
687         if (add_to_6ghz)
688                 request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
689                         n_channels;
690 
691         request->n_channels++;
692 }
693 
694 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
695                                      struct cfg80211_scan_request *request)
696 {
697         u8 i;
698         u32 s_ssid;
699 
700         for (i = 0; i < request->n_ssids; i++) {
701                 /* wildcard ssid in the scan request */
702                 if (!request->ssids[i].ssid_len)
703                         return true;
704 
705                 if (ap->ssid_len &&
706                     ap->ssid_len == request->ssids[i].ssid_len) {
707                         if (!memcmp(request->ssids[i].ssid, ap->ssid,
708                                     ap->ssid_len))
709                                 return true;
710                 } else if (ap->short_ssid_valid) {
711                         s_ssid = ~crc32_le(~0, request->ssids[i].ssid,
712                                            request->ssids[i].ssid_len);
713 
714                         if (ap->short_ssid == s_ssid)
715                                 return true;
716                 }
717         }
718 
719         return false;
720 }
721 
722 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
723 {
724         u8 i;
725         struct cfg80211_colocated_ap *ap;
726         int n_channels, count = 0, err;
727         struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
728         LIST_HEAD(coloc_ap_list);
729         bool need_scan_psc;
730         const struct ieee80211_sband_iftype_data *iftd;
731 
732         rdev_req->scan_6ghz = true;
733 
734         if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
735                 return -EOPNOTSUPP;
736 
737         iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ],
738                                                rdev_req->wdev->iftype);
739         if (!iftd || !iftd->he_cap.has_he)
740                 return -EOPNOTSUPP;
741 
742         n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
743 
744         if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
745                 struct cfg80211_internal_bss *intbss;
746 
747                 spin_lock_bh(&rdev->bss_lock);
748                 list_for_each_entry(intbss, &rdev->bss_list, list) {
749                         struct cfg80211_bss *res = &intbss->pub;
750                         const struct cfg80211_bss_ies *ies;
751 
752                         ies = rcu_access_pointer(res->ies);
753                         count += cfg80211_parse_colocated_ap(ies,
754                                                              &coloc_ap_list);
755                 }
756                 spin_unlock_bh(&rdev->bss_lock);
757         }
758 
759         request = kzalloc(struct_size(request, channels, n_channels) +
760                           sizeof(*request->scan_6ghz_params) * count,
761                           GFP_KERNEL);
762         if (!request) {
763                 cfg80211_free_coloc_ap_list(&coloc_ap_list);
764                 return -ENOMEM;
765         }
766 
767         *request = *rdev_req;
768         request->n_channels = 0;
769         request->scan_6ghz_params =
770                 (void *)&request->channels[n_channels];
771 
772         /*
773          * PSC channels should not be scanned if all the reported co-located APs
774          * are indicating that all APs in the same ESS are co-located
775          */
776         if (count) {
777                 need_scan_psc = false;
778 
779                 list_for_each_entry(ap, &coloc_ap_list, list) {
780                         if (!ap->colocated_ess) {
781                                 need_scan_psc = true;
782                                 break;
783                         }
784                 }
785         } else {
786                 need_scan_psc = true;
787         }
788 
789         /*
790          * add to the scan request the channels that need to be scanned
791          * regardless of the collocated APs (PSC channels or all channels
792          * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
793          */
794         for (i = 0; i < rdev_req->n_channels; i++) {
795                 if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ &&
796                     ((need_scan_psc &&
797                       cfg80211_channel_is_psc(rdev_req->channels[i])) ||
798                      !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
799                         cfg80211_scan_req_add_chan(request,
800                                                    rdev_req->channels[i],
801                                                    false);
802                 }
803         }
804 
805         if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
806                 goto skip;
807 
808         list_for_each_entry(ap, &coloc_ap_list, list) {
809                 bool found = false;
810                 struct cfg80211_scan_6ghz_params *scan_6ghz_params =
811                         &request->scan_6ghz_params[request->n_6ghz_params];
812                 struct ieee80211_channel *chan =
813                         ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
814 
815                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
816                         continue;
817 
818                 for (i = 0; i < rdev_req->n_channels; i++) {
819                         if (rdev_req->channels[i] == chan)
820                                 found = true;
821                 }
822 
823                 if (!found)
824                         continue;
825 
826                 if (request->n_ssids > 0 &&
827                     !cfg80211_find_ssid_match(ap, request))
828                         continue;
829 
830                 cfg80211_scan_req_add_chan(request, chan, true);
831                 memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
832                 scan_6ghz_params->short_ssid = ap->short_ssid;
833                 scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
834                 scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
835 
836                 /*
837                  * If a PSC channel is added to the scan and 'need_scan_psc' is
838                  * set to false, then all the APs that the scan logic is
839                  * interested with on the channel are collocated and thus there
840                  * is no need to perform the initial PSC channel listen.
841                  */
842                 if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
843                         scan_6ghz_params->psc_no_listen = true;
844 
845                 request->n_6ghz_params++;
846         }
847 
848 skip:
849         cfg80211_free_coloc_ap_list(&coloc_ap_list);
850 
851         if (request->n_channels) {
852                 struct cfg80211_scan_request *old = rdev->int_scan_req;
853 
854                 rdev->int_scan_req = request;
855 
856                 /*
857                  * If this scan follows a previous scan, save the scan start
858                  * info from the first part of the scan
859                  */
860                 if (old)
861                         rdev->int_scan_req->info = old->info;
862 
863                 err = rdev_scan(rdev, request);
864                 if (err) {
865                         rdev->int_scan_req = old;
866                         kfree(request);
867                 } else {
868                         kfree(old);
869                 }
870 
871                 return err;
872         }
873 
874         kfree(request);
875         return -EINVAL;
876 }
877 
878 int cfg80211_scan(struct cfg80211_registered_device *rdev)
879 {
880         struct cfg80211_scan_request *request;
881         struct cfg80211_scan_request *rdev_req = rdev->scan_req;
882         u32 n_channels = 0, idx, i;
883 
884         if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ))
885                 return rdev_scan(rdev, rdev_req);
886 
887         for (i = 0; i < rdev_req->n_channels; i++) {
888                 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
889                         n_channels++;
890         }
891 
892         if (!n_channels)
893                 return cfg80211_scan_6ghz(rdev);
894 
895         request = kzalloc(struct_size(request, channels, n_channels),
896                           GFP_KERNEL);
897         if (!request)
898                 return -ENOMEM;
899 
900         *request = *rdev_req;
901         request->n_channels = n_channels;
902 
903         for (i = idx = 0; i < rdev_req->n_channels; i++) {
904                 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
905                         request->channels[idx++] = rdev_req->channels[i];
906         }
907 
908         rdev_req->scan_6ghz = false;
909         rdev->int_scan_req = request;
910         return rdev_scan(rdev, request);
911 }
912 
913 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
914                            bool send_message)
915 {
916         struct cfg80211_scan_request *request, *rdev_req;
917         struct wireless_dev *wdev;
918         struct sk_buff *msg;
919 #ifdef CONFIG_CFG80211_WEXT
920         union iwreq_data wrqu;
921 #endif
922 
923         ASSERT_RTNL();
924 
925         if (rdev->scan_msg) {
926                 nl80211_send_scan_msg(rdev, rdev->scan_msg);
927                 rdev->scan_msg = NULL;
928                 return;
929         }
930 
931         rdev_req = rdev->scan_req;
932         if (!rdev_req)
933                 return;
934 
935         wdev = rdev_req->wdev;
936         request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
937 
938         if (wdev_running(wdev) &&
939             (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
940             !rdev_req->scan_6ghz && !request->info.aborted &&
941             !cfg80211_scan_6ghz(rdev))
942                 return;
943 
944         /*
945          * This must be before sending the other events!
946          * Otherwise, wpa_supplicant gets completely confused with
947          * wext events.
948          */
949         if (wdev->netdev)
950                 cfg80211_sme_scan_done(wdev->netdev);
951 
952         if (!request->info.aborted &&
953             request->flags & NL80211_SCAN_FLAG_FLUSH) {
954                 /* flush entries from previous scans */
955                 spin_lock_bh(&rdev->bss_lock);
956                 __cfg80211_bss_expire(rdev, request->scan_start);
957                 spin_unlock_bh(&rdev->bss_lock);
958         }
959 
960         msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
961 
962 #ifdef CONFIG_CFG80211_WEXT
963         if (wdev->netdev && !request->info.aborted) {
964                 memset(&wrqu, 0, sizeof(wrqu));
965 
966                 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
967         }
968 #endif
969 
970         if (wdev->netdev)
971                 dev_put(wdev->netdev);
972 
973         kfree(rdev->int_scan_req);
974         rdev->int_scan_req = NULL;
975 
976         kfree(rdev->scan_req);
977         rdev->scan_req = NULL;
978 
979         if (!send_message)
980                 rdev->scan_msg = msg;
981         else
982                 nl80211_send_scan_msg(rdev, msg);
983 }
984 
985 void __cfg80211_scan_done(struct work_struct *wk)
986 {
987         struct cfg80211_registered_device *rdev;
988 
989         rdev = container_of(wk, struct cfg80211_registered_device,
990                             scan_done_wk);
991 
992         rtnl_lock();
993         ___cfg80211_scan_done(rdev, true);
994         rtnl_unlock();
995 }
996 
997 void cfg80211_scan_done(struct cfg80211_scan_request *request,
998                         struct cfg80211_scan_info *info)
999 {
1000         struct cfg80211_scan_info old_info = request->info;
1001 
1002         trace_cfg80211_scan_done(request, info);
1003         WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req &&
1004                 request != wiphy_to_rdev(request->wiphy)->int_scan_req);
1005 
1006         request->info = *info;
1007 
1008         /*
1009          * In case the scan is split, the scan_start_tsf and tsf_bssid should
1010          * be of the first part. In such a case old_info.scan_start_tsf should
1011          * be non zero.
1012          */
1013         if (request->scan_6ghz && old_info.scan_start_tsf) {
1014                 request->info.scan_start_tsf = old_info.scan_start_tsf;
1015                 memcpy(request->info.tsf_bssid, old_info.tsf_bssid,
1016                        sizeof(request->info.tsf_bssid));
1017         }
1018 
1019         request->notified = true;
1020         queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
1021 }
1022 EXPORT_SYMBOL(cfg80211_scan_done);
1023 
1024 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
1025                                  struct cfg80211_sched_scan_request *req)
1026 {
1027         ASSERT_RTNL();
1028 
1029         list_add_rcu(&req->list, &rdev->sched_scan_req_list);
1030 }
1031 
1032 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
1033                                         struct cfg80211_sched_scan_request *req)
1034 {
1035         ASSERT_RTNL();
1036 
1037         list_del_rcu(&req->list);
1038         kfree_rcu(req, rcu_head);
1039 }
1040 
1041 static struct cfg80211_sched_scan_request *
1042 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
1043 {
1044         struct cfg80211_sched_scan_request *pos;
1045 
1046         list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
1047                                 lockdep_rtnl_is_held()) {
1048                 if (pos->reqid == reqid)
1049                         return pos;
1050         }
1051         return NULL;
1052 }
1053 
1054 /*
1055  * Determines if a scheduled scan request can be handled. When a legacy
1056  * scheduled scan is running no other scheduled scan is allowed regardless
1057  * whether the request is for legacy or multi-support scan. When a multi-support
1058  * scheduled scan is running a request for legacy scan is not allowed. In this
1059  * case a request for multi-support scan can be handled if resources are
1060  * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
1061  */
1062 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
1063                                      bool want_multi)
1064 {
1065         struct cfg80211_sched_scan_request *pos;
1066         int i = 0;
1067 
1068         list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
1069                 /* request id zero means legacy in progress */
1070                 if (!i && !pos->reqid)
1071                         return -EINPROGRESS;
1072                 i++;
1073         }
1074 
1075         if (i) {
1076                 /* no legacy allowed when multi request(s) are active */
1077                 if (!want_multi)
1078                         return -EINPROGRESS;
1079 
1080                 /* resource limit reached */
1081                 if (i == rdev->wiphy.max_sched_scan_reqs)
1082                         return -ENOSPC;
1083         }
1084         return 0;
1085 }
1086 
1087 void cfg80211_sched_scan_results_wk(struct work_struct *work)
1088 {
1089         struct cfg80211_registered_device *rdev;
1090         struct cfg80211_sched_scan_request *req, *tmp;
1091 
1092         rdev = container_of(work, struct cfg80211_registered_device,
1093                            sched_scan_res_wk);
1094 
1095         rtnl_lock();
1096         list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
1097                 if (req->report_results) {
1098                         req->report_results = false;
1099                         if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
1100                                 /* flush entries from previous scans */
1101                                 spin_lock_bh(&rdev->bss_lock);
1102                                 __cfg80211_bss_expire(rdev, req->scan_start);
1103                                 spin_unlock_bh(&rdev->bss_lock);
1104                                 req->scan_start = jiffies;
1105                         }
1106                         nl80211_send_sched_scan(req,
1107                                                 NL80211_CMD_SCHED_SCAN_RESULTS);
1108                 }
1109         }
1110         rtnl_unlock();
1111 }
1112 
1113 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
1114 {
1115         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1116         struct cfg80211_sched_scan_request *request;
1117 
1118         trace_cfg80211_sched_scan_results(wiphy, reqid);
1119         /* ignore if we're not scanning */
1120 
1121         rcu_read_lock();
1122         request = cfg80211_find_sched_scan_req(rdev, reqid);
1123         if (request) {
1124                 request->report_results = true;
1125                 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
1126         }
1127         rcu_read_unlock();
1128 }
1129 EXPORT_SYMBOL(cfg80211_sched_scan_results);
1130 
1131 void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy, u64 reqid)
1132 {
1133         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1134 
1135         ASSERT_RTNL();
1136 
1137         trace_cfg80211_sched_scan_stopped(wiphy, reqid);
1138 
1139         __cfg80211_stop_sched_scan(rdev, reqid, true);
1140 }
1141 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
1142 
1143 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
1144 {
1145         rtnl_lock();
1146         cfg80211_sched_scan_stopped_rtnl(wiphy, reqid);
1147         rtnl_unlock();
1148 }
1149 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
1150 
1151 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
1152                                  struct cfg80211_sched_scan_request *req,
1153                                  bool driver_initiated)
1154 {
1155         ASSERT_RTNL();
1156 
1157         if (!driver_initiated) {
1158                 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
1159                 if (err)
1160                         return err;
1161         }
1162 
1163         nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
1164 
1165         cfg80211_del_sched_scan_req(rdev, req);
1166 
1167         return 0;
1168 }
1169 
1170 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
1171                                u64 reqid, bool driver_initiated)
1172 {
1173         struct cfg80211_sched_scan_request *sched_scan_req;
1174 
1175         ASSERT_RTNL();
1176 
1177         sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
1178         if (!sched_scan_req)
1179                 return -ENOENT;
1180 
1181         return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
1182                                             driver_initiated);
1183 }
1184 
1185 void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
1186                       unsigned long age_secs)
1187 {
1188         struct cfg80211_internal_bss *bss;
1189         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
1190 
1191         spin_lock_bh(&rdev->bss_lock);
1192         list_for_each_entry(bss, &rdev->bss_list, list)
1193                 bss->ts -= age_jiffies;
1194         spin_unlock_bh(&rdev->bss_lock);
1195 }
1196 
1197 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
1198 {
1199         __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
1200 }
1201 
1202 void cfg80211_bss_flush(struct wiphy *wiphy)
1203 {
1204         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1205 
1206         spin_lock_bh(&rdev->bss_lock);
1207         __cfg80211_bss_expire(rdev, jiffies);
1208         spin_unlock_bh(&rdev->bss_lock);
1209 }
1210 EXPORT_SYMBOL(cfg80211_bss_flush);
1211 
1212 const struct element *
1213 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
1214                          const u8 *match, unsigned int match_len,
1215                          unsigned int match_offset)
1216 {
1217         const struct element *elem;
1218 
1219         for_each_element_id(elem, eid, ies, len) {
1220                 if (elem->datalen >= match_offset + match_len &&
1221                     !memcmp(elem->data + match_offset, match, match_len))
1222                         return elem;
1223         }
1224 
1225         return NULL;
1226 }
1227 EXPORT_SYMBOL(cfg80211_find_elem_match);
1228 
1229 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
1230                                                 const u8 *ies,
1231                                                 unsigned int len)
1232 {
1233         const struct element *elem;
1234         u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
1235         int match_len = (oui_type < 0) ? 3 : sizeof(match);
1236 
1237         if (WARN_ON(oui_type > 0xff))
1238                 return NULL;
1239 
1240         elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
1241                                         match, match_len, 0);
1242 
1243         if (!elem || elem->datalen < 4)
1244                 return NULL;
1245 
1246         return elem;
1247 }
1248 EXPORT_SYMBOL(cfg80211_find_vendor_elem);
1249 
1250 /**
1251  * enum bss_compare_mode - BSS compare mode
1252  * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
1253  * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
1254  * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
1255  */
1256 enum bss_compare_mode {
1257         BSS_CMP_REGULAR,
1258         BSS_CMP_HIDE_ZLEN,
1259         BSS_CMP_HIDE_NUL,
1260 };
1261 
1262 static int cmp_bss(struct cfg80211_bss *a,
1263                    struct cfg80211_bss *b,
1264                    enum bss_compare_mode mode)
1265 {
1266         const struct cfg80211_bss_ies *a_ies, *b_ies;
1267         const u8 *ie1 = NULL;
1268         const u8 *ie2 = NULL;
1269         int i, r;
1270 
1271         if (a->channel != b->channel)
1272                 return b->channel->center_freq - a->channel->center_freq;
1273 
1274         a_ies = rcu_access_pointer(a->ies);
1275         if (!a_ies)
1276                 return -1;
1277         b_ies = rcu_access_pointer(b->ies);
1278         if (!b_ies)
1279                 return 1;
1280 
1281         if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
1282                 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1283                                        a_ies->data, a_ies->len);
1284         if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
1285                 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1286                                        b_ies->data, b_ies->len);
1287         if (ie1 && ie2) {
1288                 int mesh_id_cmp;
1289 
1290                 if (ie1[1] == ie2[1])
1291                         mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1292                 else
1293                         mesh_id_cmp = ie2[1] - ie1[1];
1294 
1295                 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1296                                        a_ies->data, a_ies->len);
1297                 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1298                                        b_ies->data, b_ies->len);
1299                 if (ie1 && ie2) {
1300                         if (mesh_id_cmp)
1301                                 return mesh_id_cmp;
1302                         if (ie1[1] != ie2[1])
1303                                 return ie2[1] - ie1[1];
1304                         return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1305                 }
1306         }
1307 
1308         r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
1309         if (r)
1310                 return r;
1311 
1312         ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
1313         ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
1314 
1315         if (!ie1 && !ie2)
1316                 return 0;
1317 
1318         /*
1319          * Note that with "hide_ssid", the function returns a match if
1320          * the already-present BSS ("b") is a hidden SSID beacon for
1321          * the new BSS ("a").
1322          */
1323 
1324         /* sort missing IE before (left of) present IE */
1325         if (!ie1)
1326                 return -1;
1327         if (!ie2)
1328                 return 1;
1329 
1330         switch (mode) {
1331         case BSS_CMP_HIDE_ZLEN:
1332                 /*
1333                  * In ZLEN mode we assume the BSS entry we're
1334                  * looking for has a zero-length SSID. So if
1335                  * the one we're looking at right now has that,
1336                  * return 0. Otherwise, return the difference
1337                  * in length, but since we're looking for the
1338                  * 0-length it's really equivalent to returning
1339                  * the length of the one we're looking at.
1340                  *
1341                  * No content comparison is needed as we assume
1342                  * the content length is zero.
1343                  */
1344                 return ie2[1];
1345         case BSS_CMP_REGULAR:
1346         default:
1347                 /* sort by length first, then by contents */
1348                 if (ie1[1] != ie2[1])
1349                         return ie2[1] - ie1[1];
1350                 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1351         case BSS_CMP_HIDE_NUL:
1352                 if (ie1[1] != ie2[1])
1353                         return ie2[1] - ie1[1];
1354                 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
1355                 for (i = 0; i < ie2[1]; i++)
1356                         if (ie2[i + 2])
1357                                 return -1;
1358                 return 0;
1359         }
1360 }
1361 
1362 static bool cfg80211_bss_type_match(u16 capability,
1363                                     enum nl80211_band band,
1364                                     enum ieee80211_bss_type bss_type)
1365 {
1366         bool ret = true;
1367         u16 mask, val;
1368 
1369         if (bss_type == IEEE80211_BSS_TYPE_ANY)
1370                 return ret;
1371 
1372         if (band == NL80211_BAND_60GHZ) {
1373                 mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
1374                 switch (bss_type) {
1375                 case IEEE80211_BSS_TYPE_ESS:
1376                         val = WLAN_CAPABILITY_DMG_TYPE_AP;
1377                         break;
1378                 case IEEE80211_BSS_TYPE_PBSS:
1379                         val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
1380                         break;
1381                 case IEEE80211_BSS_TYPE_IBSS:
1382                         val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
1383                         break;
1384                 default:
1385                         return false;
1386                 }
1387         } else {
1388                 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
1389                 switch (bss_type) {
1390                 case IEEE80211_BSS_TYPE_ESS:
1391                         val = WLAN_CAPABILITY_ESS;
1392                         break;
1393                 case IEEE80211_BSS_TYPE_IBSS:
1394                         val = WLAN_CAPABILITY_IBSS;
1395                         break;
1396                 case IEEE80211_BSS_TYPE_MBSS:
1397                         val = 0;
1398                         break;
1399                 default:
1400                         return false;
1401                 }
1402         }
1403 
1404         ret = ((capability & mask) == val);
1405         return ret;
1406 }
1407 
1408 /* Returned bss is reference counted and must be cleaned up appropriately. */
1409 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
1410                                       struct ieee80211_channel *channel,
1411                                       const u8 *bssid,
1412                                       const u8 *ssid, size_t ssid_len,
1413                                       enum ieee80211_bss_type bss_type,
1414                                       enum ieee80211_privacy privacy)
1415 {
1416         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1417         struct cfg80211_internal_bss *bss, *res = NULL;
1418         unsigned long now = jiffies;
1419         int bss_privacy;
1420 
1421         trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
1422                                privacy);
1423 
1424         spin_lock_bh(&rdev->bss_lock);
1425 
1426         list_for_each_entry(bss, &rdev->bss_list, list) {
1427                 if (!cfg80211_bss_type_match(bss->pub.capability,
1428                                              bss->pub.channel->band, bss_type))
1429                         continue;
1430 
1431                 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
1432                 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
1433                     (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
1434                         continue;
1435                 if (channel && bss->pub.channel != channel)
1436                         continue;
1437                 if (!is_valid_ether_addr(bss->pub.bssid))
1438                         continue;
1439                 /* Don't get expired BSS structs */
1440                 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
1441                     !atomic_read(&bss->hold))
1442                         continue;
1443                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
1444                         res = bss;
1445                         bss_ref_get(rdev, res);
1446                         break;
1447                 }
1448         }
1449 
1450         spin_unlock_bh(&rdev->bss_lock);
1451         if (!res)
1452                 return NULL;
1453         trace_cfg80211_return_bss(&res->pub);
1454         return &res->pub;
1455 }
1456 EXPORT_SYMBOL(cfg80211_get_bss);
1457 
1458 static void rb_insert_bss(struct cfg80211_registered_device *rdev,
1459                           struct cfg80211_internal_bss *bss)
1460 {
1461         struct rb_node **p = &rdev->bss_tree.rb_node;
1462         struct rb_node *parent = NULL;
1463         struct cfg80211_internal_bss *tbss;
1464         int cmp;
1465 
1466         while (*p) {
1467                 parent = *p;
1468                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
1469 
1470                 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
1471 
1472                 if (WARN_ON(!cmp)) {
1473                         /* will sort of leak this BSS */
1474                         return;
1475                 }
1476 
1477                 if (cmp < 0)
1478                         p = &(*p)->rb_left;
1479                 else
1480                         p = &(*p)->rb_right;
1481         }
1482 
1483         rb_link_node(&bss->rbn, parent, p);
1484         rb_insert_color(&bss->rbn, &rdev->bss_tree);
1485 }
1486 
1487 static struct cfg80211_internal_bss *
1488 rb_find_bss(struct cfg80211_registered_device *rdev,
1489             struct cfg80211_internal_bss *res,
1490             enum bss_compare_mode mode)
1491 {
1492         struct rb_node *n = rdev->bss_tree.rb_node;
1493         struct cfg80211_internal_bss *bss;
1494         int r;
1495 
1496         while (n) {
1497                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
1498                 r = cmp_bss(&res->pub, &bss->pub, mode);
1499 
1500                 if (r == 0)
1501                         return bss;
1502                 else if (r < 0)
1503                         n = n->rb_left;
1504                 else
1505                         n = n->rb_right;
1506         }
1507 
1508         return NULL;
1509 }
1510 
1511 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
1512                                    struct cfg80211_internal_bss *new)
1513 {
1514         const struct cfg80211_bss_ies *ies;
1515         struct cfg80211_internal_bss *bss;
1516         const u8 *ie;
1517         int i, ssidlen;
1518         u8 fold = 0;
1519         u32 n_entries = 0;
1520 
1521         ies = rcu_access_pointer(new->pub.beacon_ies);
1522         if (WARN_ON(!ies))
1523                 return false;
1524 
1525         ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1526         if (!ie) {
1527                 /* nothing to do */
1528                 return true;
1529         }
1530 
1531         ssidlen = ie[1];
1532         for (i = 0; i < ssidlen; i++)
1533                 fold |= ie[2 + i];
1534 
1535         if (fold) {
1536                 /* not a hidden SSID */
1537                 return true;
1538         }
1539 
1540         /* This is the bad part ... */
1541 
1542         list_for_each_entry(bss, &rdev->bss_list, list) {
1543                 /*
1544                  * we're iterating all the entries anyway, so take the
1545                  * opportunity to validate the list length accounting
1546                  */
1547                 n_entries++;
1548 
1549                 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
1550                         continue;
1551                 if (bss->pub.channel != new->pub.channel)
1552                         continue;
1553                 if (bss->pub.scan_width != new->pub.scan_width)
1554                         continue;
1555                 if (rcu_access_pointer(bss->pub.beacon_ies))
1556                         continue;
1557                 ies = rcu_access_pointer(bss->pub.ies);
1558                 if (!ies)
1559                         continue;
1560                 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1561                 if (!ie)
1562                         continue;
1563                 if (ssidlen && ie[1] != ssidlen)
1564                         continue;
1565                 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
1566                         continue;
1567                 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
1568                         list_del(&bss->hidden_list);
1569                 /* combine them */
1570                 list_add(&bss->hidden_list, &new->hidden_list);
1571                 bss->pub.hidden_beacon_bss = &new->pub;
1572                 new->refcount += bss->refcount;
1573                 rcu_assign_pointer(bss->pub.beacon_ies,
1574                                    new->pub.beacon_ies);
1575         }
1576 
1577         WARN_ONCE(n_entries != rdev->bss_entries,
1578                   "rdev bss entries[%d]/list[len:%d] corruption\n",
1579                   rdev->bss_entries, n_entries);
1580 
1581         return true;
1582 }
1583 
1584 struct cfg80211_non_tx_bss {
1585         struct cfg80211_bss *tx_bss;
1586         u8 max_bssid_indicator;
1587         u8 bssid_index;
1588 };
1589 
1590 static bool
1591 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
1592                           struct cfg80211_internal_bss *known,
1593                           struct cfg80211_internal_bss *new,
1594                           bool signal_valid)
1595 {
1596         lockdep_assert_held(&rdev->bss_lock);
1597 
1598         /* Update IEs */
1599         if (rcu_access_pointer(new->pub.proberesp_ies)) {
1600                 const struct cfg80211_bss_ies *old;
1601 
1602                 old = rcu_access_pointer(known->pub.proberesp_ies);
1603 
1604                 rcu_assign_pointer(known->pub.proberesp_ies,
1605                                    new->pub.proberesp_ies);
1606                 /* Override possible earlier Beacon frame IEs */
1607                 rcu_assign_pointer(known->pub.ies,
1608                                    new->pub.proberesp_ies);
1609                 if (old)
1610                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1611         } else if (rcu_access_pointer(new->pub.beacon_ies)) {
1612                 const struct cfg80211_bss_ies *old;
1613                 struct cfg80211_internal_bss *bss;
1614 
1615                 if (known->pub.hidden_beacon_bss &&
1616                     !list_empty(&known->hidden_list)) {
1617                         const struct cfg80211_bss_ies *f;
1618 
1619                         /* The known BSS struct is one of the probe
1620                          * response members of a group, but we're
1621                          * receiving a beacon (beacon_ies in the new
1622                          * bss is used). This can only mean that the
1623                          * AP changed its beacon from not having an
1624                          * SSID to showing it, which is confusing so
1625                          * drop this information.
1626                          */
1627 
1628                         f = rcu_access_pointer(new->pub.beacon_ies);
1629                         kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
1630                         return false;
1631                 }
1632 
1633                 old = rcu_access_pointer(known->pub.beacon_ies);
1634 
1635                 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
1636 
1637                 /* Override IEs if they were from a beacon before */
1638                 if (old == rcu_access_pointer(known->pub.ies))
1639                         rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
1640 
1641                 /* Assign beacon IEs to all sub entries */
1642                 list_for_each_entry(bss, &known->hidden_list, hidden_list) {
1643                         const struct cfg80211_bss_ies *ies;
1644 
1645                         ies = rcu_access_pointer(bss->pub.beacon_ies);
1646                         WARN_ON(ies != old);
1647 
1648                         rcu_assign_pointer(bss->pub.beacon_ies,
1649                                            new->pub.beacon_ies);
1650                 }
1651 
1652                 if (old)
1653                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1654         }
1655 
1656         known->pub.beacon_interval = new->pub.beacon_interval;
1657 
1658         /* don't update the signal if beacon was heard on
1659          * adjacent channel.
1660          */
1661         if (signal_valid)
1662                 known->pub.signal = new->pub.signal;
1663         known->pub.capability = new->pub.capability;
1664         known->ts = new->ts;
1665         known->ts_boottime = new->ts_boottime;
1666         known->parent_tsf = new->parent_tsf;
1667         known->pub.chains = new->pub.chains;
1668         memcpy(known->pub.chain_signal, new->pub.chain_signal,
1669                IEEE80211_MAX_CHAINS);
1670         ether_addr_copy(known->parent_bssid, new->parent_bssid);
1671         known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
1672         known->pub.bssid_index = new->pub.bssid_index;
1673 
1674         return true;
1675 }
1676 
1677 /* Returned bss is reference counted and must be cleaned up appropriately. */
1678 struct cfg80211_internal_bss *
1679 cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1680                     struct cfg80211_internal_bss *tmp,
1681                     bool signal_valid, unsigned long ts)
1682 {
1683         struct cfg80211_internal_bss *found = NULL;
1684 
1685         if (WARN_ON(!tmp->pub.channel))
1686                 return NULL;
1687 
1688         tmp->ts = ts;
1689 
1690         spin_lock_bh(&rdev->bss_lock);
1691 
1692         if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
1693                 spin_unlock_bh(&rdev->bss_lock);
1694                 return NULL;
1695         }
1696 
1697         found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
1698 
1699         if (found) {
1700                 if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid))
1701                         goto drop;
1702         } else {
1703                 struct cfg80211_internal_bss *new;
1704                 struct cfg80211_internal_bss *hidden;
1705                 struct cfg80211_bss_ies *ies;
1706 
1707                 /*
1708                  * create a copy -- the "res" variable that is passed in
1709                  * is allocated on the stack since it's not needed in the
1710                  * more common case of an update
1711                  */
1712                 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
1713                               GFP_ATOMIC);
1714                 if (!new) {
1715                         ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
1716                         if (ies)
1717                                 kfree_rcu(ies, rcu_head);
1718                         ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1719                         if (ies)
1720                                 kfree_rcu(ies, rcu_head);
1721                         goto drop;
1722                 }
1723                 memcpy(new, tmp, sizeof(*new));
1724                 new->refcount = 1;
1725                 INIT_LIST_HEAD(&new->hidden_list);
1726                 INIT_LIST_HEAD(&new->pub.nontrans_list);
1727 
1728                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1729                         hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1730                         if (!hidden)
1731                                 hidden = rb_find_bss(rdev, tmp,
1732                                                      BSS_CMP_HIDE_NUL);
1733                         if (hidden) {
1734                                 new->pub.hidden_beacon_bss = &hidden->pub;
1735                                 list_add(&new->hidden_list,
1736                                          &hidden->hidden_list);
1737                                 hidden->refcount++;
1738                                 rcu_assign_pointer(new->pub.beacon_ies,
1739                                                    hidden->pub.beacon_ies);
1740                         }
1741                 } else {
1742                         /*
1743                          * Ok so we found a beacon, and don't have an entry. If
1744                          * it's a beacon with hidden SSID, we might be in for an
1745                          * expensive search for any probe responses that should
1746                          * be grouped with this beacon for updates ...
1747                          */
1748                         if (!cfg80211_combine_bsses(rdev, new)) {
1749                                 kfree(new);
1750                                 goto drop;
1751                         }
1752                 }
1753 
1754                 if (rdev->bss_entries >= bss_entries_limit &&
1755                     !cfg80211_bss_expire_oldest(rdev)) {
1756                         kfree(new);
1757                         goto drop;
1758                 }
1759 
1760                 /* This must be before the call to bss_ref_get */
1761                 if (tmp->pub.transmitted_bss) {
1762                         struct cfg80211_internal_bss *pbss =
1763                                 container_of(tmp->pub.transmitted_bss,
1764                                              struct cfg80211_internal_bss,
1765                                              pub);
1766 
1767                         new->pub.transmitted_bss = tmp->pub.transmitted_bss;
1768                         bss_ref_get(rdev, pbss);
1769                 }
1770 
1771                 list_add_tail(&new->list, &rdev->bss_list);
1772                 rdev->bss_entries++;
1773                 rb_insert_bss(rdev, new);
1774                 found = new;
1775         }
1776 
1777         rdev->bss_generation++;
1778         bss_ref_get(rdev, found);
1779         spin_unlock_bh(&rdev->bss_lock);
1780 
1781         return found;
1782  drop:
1783         spin_unlock_bh(&rdev->bss_lock);
1784         return NULL;
1785 }
1786 
1787 /*
1788  * Update RX channel information based on the available frame payload
1789  * information. This is mainly for the 2.4 GHz band where frames can be received
1790  * from neighboring channels and the Beacon frames use the DSSS Parameter Set
1791  * element to indicate the current (transmitting) channel, but this might also
1792  * be needed on other bands if RX frequency does not match with the actual
1793  * operating channel of a BSS.
1794  */
1795 static struct ieee80211_channel *
1796 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1797                          struct ieee80211_channel *channel,
1798                          enum nl80211_bss_scan_width scan_width)
1799 {
1800         const u8 *tmp;
1801         u32 freq;
1802         int channel_number = -1;
1803         struct ieee80211_channel *alt_channel;
1804 
1805         if (channel->band == NL80211_BAND_S1GHZ) {
1806                 tmp = cfg80211_find_ie(WLAN_EID_S1G_OPERATION, ie, ielen);
1807                 if (tmp && tmp[1] >= sizeof(struct ieee80211_s1g_oper_ie)) {
1808                         struct ieee80211_s1g_oper_ie *s1gop = (void *)(tmp + 2);
1809 
1810                         channel_number = s1gop->primary_ch;
1811                 }
1812         } else {
1813                 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
1814                 if (tmp && tmp[1] == 1) {
1815                         channel_number = tmp[2];
1816                 } else {
1817                         tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
1818                         if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
1819                                 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
1820 
1821                                 channel_number = htop->primary_chan;
1822                         }
1823                 }
1824         }
1825 
1826         if (channel_number < 0) {
1827                 /* No channel information in frame payload */
1828                 return channel;
1829         }
1830 
1831         freq = ieee80211_channel_to_freq_khz(channel_number, channel->band);
1832         alt_channel = ieee80211_get_channel_khz(wiphy, freq);
1833         if (!alt_channel) {
1834                 if (channel->band == NL80211_BAND_2GHZ) {
1835                         /*
1836                          * Better not allow unexpected channels when that could
1837                          * be going beyond the 1-11 range (e.g., discovering
1838                          * BSS on channel 12 when radio is configured for
1839                          * channel 11.
1840                          */
1841                         return NULL;
1842                 }
1843 
1844                 /* No match for the payload channel number - ignore it */
1845                 return channel;
1846         }
1847 
1848         if (scan_width == NL80211_BSS_CHAN_WIDTH_10 ||
1849             scan_width == NL80211_BSS_CHAN_WIDTH_5) {
1850                 /*
1851                  * Ignore channel number in 5 and 10 MHz channels where there
1852                  * may not be an n:1 or 1:n mapping between frequencies and
1853                  * channel numbers.
1854                  */
1855                 return channel;
1856         }
1857 
1858         /*
1859          * Use the channel determined through the payload channel number
1860          * instead of the RX channel reported by the driver.
1861          */
1862         if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
1863                 return NULL;
1864         return alt_channel;
1865 }
1866 
1867 /* Returned bss is reference counted and must be cleaned up appropriately. */
1868 static struct cfg80211_bss *
1869 cfg80211_inform_single_bss_data(struct wiphy *wiphy,
1870                                 struct cfg80211_inform_bss *data,
1871                                 enum cfg80211_bss_frame_type ftype,
1872                                 const u8 *bssid, u64 tsf, u16 capability,
1873                                 u16 beacon_interval, const u8 *ie, size_t ielen,
1874                                 struct cfg80211_non_tx_bss *non_tx_data,
1875                                 gfp_t gfp)
1876 {
1877         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1878         struct cfg80211_bss_ies *ies;
1879         struct ieee80211_channel *channel;
1880         struct cfg80211_internal_bss tmp = {}, *res;
1881         int bss_type;
1882         bool signal_valid;
1883         unsigned long ts;
1884 
1885         if (WARN_ON(!wiphy))
1886                 return NULL;
1887 
1888         if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1889                     (data->signal < 0 || data->signal > 100)))
1890                 return NULL;
1891 
1892         channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan,
1893                                            data->scan_width);
1894         if (!channel)
1895                 return NULL;
1896 
1897         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
1898         tmp.pub.channel = channel;
1899         tmp.pub.scan_width = data->scan_width;
1900         tmp.pub.signal = data->signal;
1901         tmp.pub.beacon_interval = beacon_interval;
1902         tmp.pub.capability = capability;
1903         tmp.ts_boottime = data->boottime_ns;
1904         if (non_tx_data) {
1905                 tmp.pub.transmitted_bss = non_tx_data->tx_bss;
1906                 ts = bss_from_pub(non_tx_data->tx_bss)->ts;
1907                 tmp.pub.bssid_index = non_tx_data->bssid_index;
1908                 tmp.pub.max_bssid_indicator = non_tx_data->max_bssid_indicator;
1909         } else {
1910                 ts = jiffies;
1911         }
1912 
1913         /*
1914          * If we do not know here whether the IEs are from a Beacon or Probe
1915          * Response frame, we need to pick one of the options and only use it
1916          * with the driver that does not provide the full Beacon/Probe Response
1917          * frame. Use Beacon frame pointer to avoid indicating that this should
1918          * override the IEs pointer should we have received an earlier
1919          * indication of Probe Response data.
1920          */
1921         ies = kzalloc(sizeof(*ies) + ielen, gfp);
1922         if (!ies)
1923                 return NULL;
1924         ies->len = ielen;
1925         ies->tsf = tsf;
1926         ies->from_beacon = false;
1927         memcpy(ies->data, ie, ielen);
1928 
1929         switch (ftype) {
1930         case CFG80211_BSS_FTYPE_BEACON:
1931                 ies->from_beacon = true;
1932                 fallthrough;
1933         case CFG80211_BSS_FTYPE_UNKNOWN:
1934                 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1935                 break;
1936         case CFG80211_BSS_FTYPE_PRESP:
1937                 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1938                 break;
1939         }
1940         rcu_assign_pointer(tmp.pub.ies, ies);
1941 
1942         signal_valid = data->chan == channel;
1943         res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, ts);
1944         if (!res)
1945                 return NULL;
1946 
1947         if (channel->band == NL80211_BAND_60GHZ) {
1948                 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1949                 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1950                     bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1951                         regulatory_hint_found_beacon(wiphy, channel, gfp);
1952         } else {
1953                 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1954                         regulatory_hint_found_beacon(wiphy, channel, gfp);
1955         }
1956 
1957         if (non_tx_data) {
1958                 /* this is a nontransmitting bss, we need to add it to
1959                  * transmitting bss' list if it is not there
1960                  */
1961                 if (cfg80211_add_nontrans_list(non_tx_data->tx_bss,
1962                                                &res->pub)) {
1963                         if (__cfg80211_unlink_bss(rdev, res))
1964                                 rdev->bss_generation++;
1965                 }
1966         }
1967 
1968         trace_cfg80211_return_bss(&res->pub);
1969         /* cfg80211_bss_update gives us a referenced result */
1970         return &res->pub;
1971 }
1972 
1973 static const struct element
1974 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
1975                                    const struct element *mbssid_elem,
1976                                    const struct element *sub_elem)
1977 {
1978         const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
1979         const struct element *next_mbssid;
1980         const struct element *next_sub;
1981 
1982         next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
1983                                          mbssid_end,
1984                                          ielen - (mbssid_end - ie));
1985 
1986         /*
1987          * If it is not the last subelement in current MBSSID IE or there isn't
1988          * a next MBSSID IE - profile is complete.
1989         */
1990         if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
1991             !next_mbssid)
1992                 return NULL;
1993 
1994         /* For any length error, just return NULL */
1995 
1996         if (next_mbssid->datalen < 4)
1997                 return NULL;
1998 
1999         next_sub = (void *)&next_mbssid->data[1];
2000 
2001         if (next_mbssid->data + next_mbssid->datalen <
2002             next_sub->data + next_sub->datalen)
2003                 return NULL;
2004 
2005         if (next_sub->id != 0 || next_sub->datalen < 2)
2006                 return NULL;
2007 
2008         /*
2009          * Check if the first element in the next sub element is a start
2010          * of a new profile
2011          */
2012         return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
2013                NULL : next_mbssid;
2014 }
2015 
2016 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
2017                               const struct element *mbssid_elem,
2018                               const struct element *sub_elem,
2019                               u8 *merged_ie, size_t max_copy_len)
2020 {
2021         size_t copied_len = sub_elem->datalen;
2022         const struct element *next_mbssid;
2023 
2024         if (sub_elem->datalen > max_copy_len)
2025                 return 0;
2026 
2027         memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
2028 
2029         while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
2030                                                                 mbssid_elem,
2031                                                                 sub_elem))) {
2032                 const struct element *next_sub = (void *)&next_mbssid->data[1];
2033 
2034                 if (copied_len + next_sub->datalen > max_copy_len)
2035                         break;
2036                 memcpy(merged_ie + copied_len, next_sub->data,
2037                        next_sub->datalen);
2038                 copied_len += next_sub->datalen;
2039         }
2040 
2041         return copied_len;
2042 }
2043 EXPORT_SYMBOL(cfg80211_merge_profile);
2044 
2045 static void cfg80211_parse_mbssid_data(struct wiphy *wiphy,
2046                                        struct cfg80211_inform_bss *data,
2047                                        enum cfg80211_bss_frame_type ftype,
2048                                        const u8 *bssid, u64 tsf,
2049                                        u16 beacon_interval, const u8 *ie,
2050                                        size_t ielen,
2051                                        struct cfg80211_non_tx_bss *non_tx_data,
2052                                        gfp_t gfp)
2053 {
2054         const u8 *mbssid_index_ie;
2055         const struct element *elem, *sub;
2056         size_t new_ie_len;
2057         u8 new_bssid[ETH_ALEN];
2058         u8 *new_ie, *profile;
2059         u64 seen_indices = 0;
2060         u16 capability;
2061         struct cfg80211_bss *bss;
2062 
2063         if (!non_tx_data)
2064                 return;
2065         if (!cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2066                 return;
2067         if (!wiphy->support_mbssid)
2068                 return;
2069         if (wiphy->support_only_he_mbssid &&
2070             !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2071                 return;
2072 
2073         new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2074         if (!new_ie)
2075                 return;
2076 
2077         profile = kmalloc(ielen, gfp);
2078         if (!profile)
2079                 goto out;
2080 
2081         for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
2082                 if (elem->datalen < 4)
2083                         continue;
2084                 for_each_element(sub, elem->data + 1, elem->datalen - 1) {
2085                         u8 profile_len;
2086 
2087                         if (sub->id != 0 || sub->datalen < 4) {
2088                                 /* not a valid BSS profile */
2089                                 continue;
2090                         }
2091 
2092                         if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
2093                             sub->data[1] != 2) {
2094                                 /* The first element within the Nontransmitted
2095                                  * BSSID Profile is not the Nontransmitted
2096                                  * BSSID Capability element.
2097                                  */
2098                                 continue;
2099                         }
2100 
2101                         memset(profile, 0, ielen);
2102                         profile_len = cfg80211_merge_profile(ie, ielen,
2103                                                              elem,
2104                                                              sub,
2105                                                              profile,
2106                                                              ielen);
2107 
2108                         /* found a Nontransmitted BSSID Profile */
2109                         mbssid_index_ie = cfg80211_find_ie
2110                                 (WLAN_EID_MULTI_BSSID_IDX,
2111                                  profile, profile_len);
2112                         if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
2113                             mbssid_index_ie[2] == 0 ||
2114                             mbssid_index_ie[2] > 46) {
2115                                 /* No valid Multiple BSSID-Index element */
2116                                 continue;
2117                         }
2118 
2119                         if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
2120                                 /* We don't support legacy split of a profile */
2121                                 net_dbg_ratelimited("Partial info for BSSID index %d\n",
2122                                                     mbssid_index_ie[2]);
2123 
2124                         seen_indices |= BIT_ULL(mbssid_index_ie[2]);
2125 
2126                         non_tx_data->bssid_index = mbssid_index_ie[2];
2127                         non_tx_data->max_bssid_indicator = elem->data[0];
2128 
2129                         cfg80211_gen_new_bssid(bssid,
2130                                                non_tx_data->max_bssid_indicator,
2131                                                non_tx_data->bssid_index,
2132                                                new_bssid);
2133                         memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2134                         new_ie_len = cfg80211_gen_new_ie(ie, ielen,
2135                                                          profile,
2136                                                          profile_len, new_ie,
2137                                                          gfp);
2138                         if (!new_ie_len)
2139                                 continue;
2140 
2141                         capability = get_unaligned_le16(profile + 2);
2142                         bss = cfg80211_inform_single_bss_data(wiphy, data,
2143                                                               ftype,
2144                                                               new_bssid, tsf,
2145                                                               capability,
2146                                                               beacon_interval,
2147                                                               new_ie,
2148                                                               new_ie_len,
2149                                                               non_tx_data,
2150                                                               gfp);
2151                         if (!bss)
2152                                 break;
2153                         cfg80211_put_bss(wiphy, bss);
2154                 }
2155         }
2156 
2157 out:
2158         kfree(new_ie);
2159         kfree(profile);
2160 }
2161 
2162 struct cfg80211_bss *
2163 cfg80211_inform_bss_data(struct wiphy *wiphy,
2164                          struct cfg80211_inform_bss *data,
2165                          enum cfg80211_bss_frame_type ftype,
2166                          const u8 *bssid, u64 tsf, u16 capability,
2167                          u16 beacon_interval, const u8 *ie, size_t ielen,
2168                          gfp_t gfp)
2169 {
2170         struct cfg80211_bss *res;
2171         struct cfg80211_non_tx_bss non_tx_data;
2172 
2173         res = cfg80211_inform_single_bss_data(wiphy, data, ftype, bssid, tsf,
2174                                               capability, beacon_interval, ie,
2175                                               ielen, NULL, gfp);
2176         if (!res)
2177                 return NULL;
2178         non_tx_data.tx_bss = res;
2179         cfg80211_parse_mbssid_data(wiphy, data, ftype, bssid, tsf,
2180                                    beacon_interval, ie, ielen, &non_tx_data,
2181                                    gfp);
2182         return res;
2183 }
2184 EXPORT_SYMBOL(cfg80211_inform_bss_data);
2185 
2186 static void
2187 cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy,
2188                                  struct cfg80211_inform_bss *data,
2189                                  struct ieee80211_mgmt *mgmt, size_t len,
2190                                  struct cfg80211_non_tx_bss *non_tx_data,
2191                                  gfp_t gfp)
2192 {
2193         enum cfg80211_bss_frame_type ftype;
2194         const u8 *ie = mgmt->u.probe_resp.variable;
2195         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2196                                       u.probe_resp.variable);
2197 
2198         ftype = ieee80211_is_beacon(mgmt->frame_control) ?
2199                 CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
2200 
2201         cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
2202                                    le64_to_cpu(mgmt->u.probe_resp.timestamp),
2203                                    le16_to_cpu(mgmt->u.probe_resp.beacon_int),
2204                                    ie, ielen, non_tx_data, gfp);
2205 }
2206 
2207 static void
2208 cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
2209                                    struct cfg80211_bss *nontrans_bss,
2210                                    struct ieee80211_mgmt *mgmt, size_t len)
2211 {
2212         u8 *ie, *new_ie, *pos;
2213         const u8 *nontrans_ssid, *trans_ssid, *mbssid;
2214         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2215                                       u.probe_resp.variable);
2216         size_t new_ie_len;
2217         struct cfg80211_bss_ies *new_ies;
2218         const struct cfg80211_bss_ies *old;
2219         u8 cpy_len;
2220 
2221         lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
2222 
2223         ie = mgmt->u.probe_resp.variable;
2224 
2225         new_ie_len = ielen;
2226         trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
2227         if (!trans_ssid)
2228                 return;
2229         new_ie_len -= trans_ssid[1];
2230         mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen);
2231         /*
2232          * It's not valid to have the MBSSID element before SSID
2233          * ignore if that happens - the code below assumes it is
2234          * after (while copying things inbetween).
2235          */
2236         if (!mbssid || mbssid < trans_ssid)
2237                 return;
2238         new_ie_len -= mbssid[1];
2239 
2240         nontrans_ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
2241         if (!nontrans_ssid)
2242                 return;
2243 
2244         new_ie_len += nontrans_ssid[1];
2245 
2246         /* generate new ie for nontrans BSS
2247          * 1. replace SSID with nontrans BSS' SSID
2248          * 2. skip MBSSID IE
2249          */
2250         new_ie = kzalloc(new_ie_len, GFP_ATOMIC);
2251         if (!new_ie)
2252                 return;
2253 
2254         new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC);
2255         if (!new_ies)
2256                 goto out_free;
2257 
2258         pos = new_ie;
2259 
2260         /* copy the nontransmitted SSID */
2261         cpy_len = nontrans_ssid[1] + 2;
2262         memcpy(pos, nontrans_ssid, cpy_len);
2263         pos += cpy_len;
2264         /* copy the IEs between SSID and MBSSID */
2265         cpy_len = trans_ssid[1] + 2;
2266         memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len)));
2267         pos += (mbssid - (trans_ssid + cpy_len));
2268         /* copy the IEs after MBSSID */
2269         cpy_len = mbssid[1] + 2;
2270         memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len)));
2271 
2272         /* update ie */
2273         new_ies->len = new_ie_len;
2274         new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2275         new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
2276         memcpy(new_ies->data, new_ie, new_ie_len);
2277         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
2278                 old = rcu_access_pointer(nontrans_bss->proberesp_ies);
2279                 rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies);
2280                 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2281                 if (old)
2282                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2283         } else {
2284                 old = rcu_access_pointer(nontrans_bss->beacon_ies);
2285                 rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
2286                 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2287                 if (old)
2288                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2289         }
2290 
2291 out_free:
2292         kfree(new_ie);
2293 }
2294 
2295 /* cfg80211_inform_bss_width_frame helper */
2296 static struct cfg80211_bss *
2297 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
2298                                       struct cfg80211_inform_bss *data,
2299                                       struct ieee80211_mgmt *mgmt, size_t len,
2300                                       gfp_t gfp)
2301 {
2302         struct cfg80211_internal_bss tmp = {}, *res;
2303         struct cfg80211_bss_ies *ies;
2304         struct ieee80211_channel *channel;
2305         bool signal_valid;
2306         struct ieee80211_ext *ext = NULL;
2307         u8 *bssid, *variable;
2308         u16 capability, beacon_int;
2309         size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
2310                                              u.probe_resp.variable);
2311         int bss_type;
2312 
2313         BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
2314                         offsetof(struct ieee80211_mgmt, u.beacon.variable));
2315 
2316         trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
2317 
2318         if (WARN_ON(!mgmt))
2319                 return NULL;
2320 
2321         if (WARN_ON(!wiphy))
2322                 return NULL;
2323 
2324         if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2325                     (data->signal < 0 || data->signal > 100)))
2326                 return NULL;
2327 
2328         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2329                 ext = (void *) mgmt;
2330                 min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
2331                 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2332                         min_hdr_len = offsetof(struct ieee80211_ext,
2333                                                u.s1g_short_beacon.variable);
2334         }
2335 
2336         if (WARN_ON(len < min_hdr_len))
2337                 return NULL;
2338 
2339         ielen = len - min_hdr_len;
2340         variable = mgmt->u.probe_resp.variable;
2341         if (ext) {
2342                 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2343                         variable = ext->u.s1g_short_beacon.variable;
2344                 else
2345                         variable = ext->u.s1g_beacon.variable;
2346         }
2347 
2348         channel = cfg80211_get_bss_channel(wiphy, variable,
2349                                            ielen, data->chan, data->scan_width);
2350         if (!channel)
2351                 return NULL;
2352 
2353         if (ext) {
2354                 struct ieee80211_s1g_bcn_compat_ie *compat;
2355                 u8 *ie;
2356 
2357                 ie = (void *)cfg80211_find_ie(WLAN_EID_S1G_BCN_COMPAT,
2358                                               variable, ielen);
2359                 if (!ie)
2360                         return NULL;
2361                 compat = (void *)(ie + 2);
2362                 bssid = ext->u.s1g_beacon.sa;
2363                 capability = le16_to_cpu(compat->compat_info);
2364                 beacon_int = le16_to_cpu(compat->beacon_int);
2365         } else {
2366                 bssid = mgmt->bssid;
2367                 beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2368                 capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
2369         }
2370 
2371         ies = kzalloc(sizeof(*ies) + ielen, gfp);
2372         if (!ies)
2373                 return NULL;
2374         ies->len = ielen;
2375         ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2376         ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) ||
2377                            ieee80211_is_s1g_beacon(mgmt->frame_control);
2378         memcpy(ies->data, variable, ielen);
2379 
2380         if (ieee80211_is_probe_resp(mgmt->frame_control))
2381                 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2382         else
2383                 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2384         rcu_assign_pointer(tmp.pub.ies, ies);
2385 
2386         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
2387         tmp.pub.beacon_interval = beacon_int;
2388         tmp.pub.capability = capability;
2389         tmp.pub.channel = channel;
2390         tmp.pub.scan_width = data->scan_width;
2391         tmp.pub.signal = data->signal;
2392         tmp.ts_boottime = data->boottime_ns;
2393         tmp.parent_tsf = data->parent_tsf;
2394         tmp.pub.chains = data->chains;
2395         memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS);
2396         ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
2397 
2398         signal_valid = data->chan == channel;
2399         res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid,
2400                                   jiffies);
2401         if (!res)
2402                 return NULL;
2403 
2404         if (channel->band == NL80211_BAND_60GHZ) {
2405                 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
2406                 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2407                     bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2408                         regulatory_hint_found_beacon(wiphy, channel, gfp);
2409         } else {
2410                 if (res->pub.capability & WLAN_CAPABILITY_ESS)
2411                         regulatory_hint_found_beacon(wiphy, channel, gfp);
2412         }
2413 
2414         trace_cfg80211_return_bss(&res->pub);
2415         /* cfg80211_bss_update gives us a referenced result */
2416         return &res->pub;
2417 }
2418 
2419 struct cfg80211_bss *
2420 cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
2421                                struct cfg80211_inform_bss *data,
2422                                struct ieee80211_mgmt *mgmt, size_t len,
2423                                gfp_t gfp)
2424 {
2425         struct cfg80211_bss *res, *tmp_bss;
2426         const u8 *ie = mgmt->u.probe_resp.variable;
2427         const struct cfg80211_bss_ies *ies1, *ies2;
2428         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2429                                       u.probe_resp.variable);
2430         struct cfg80211_non_tx_bss non_tx_data;
2431 
2432         res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
2433                                                     len, gfp);
2434         if (!res || !wiphy->support_mbssid ||
2435             !cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2436                 return res;
2437         if (wiphy->support_only_he_mbssid &&
2438             !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2439                 return res;
2440 
2441         non_tx_data.tx_bss = res;
2442         /* process each non-transmitting bss */
2443         cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len,
2444                                          &non_tx_data, gfp);
2445 
2446         spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2447 
2448         /* check if the res has other nontransmitting bss which is not
2449          * in MBSSID IE
2450          */
2451         ies1 = rcu_access_pointer(res->ies);
2452 
2453         /* go through nontrans_list, if the timestamp of the BSS is
2454          * earlier than the timestamp of the transmitting BSS then
2455          * update it
2456          */
2457         list_for_each_entry(tmp_bss, &res->nontrans_list,
2458                             nontrans_list) {
2459                 ies2 = rcu_access_pointer(tmp_bss->ies);
2460                 if (ies2->tsf < ies1->tsf)
2461                         cfg80211_update_notlisted_nontrans(wiphy, tmp_bss,
2462                                                            mgmt, len);
2463         }
2464         spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2465 
2466         return res;
2467 }
2468 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
2469 
2470 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2471 {
2472         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2473         struct cfg80211_internal_bss *bss;
2474 
2475         if (!pub)
2476                 return;
2477 
2478         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2479 
2480         spin_lock_bh(&rdev->bss_lock);
2481         bss_ref_get(rdev, bss);
2482         spin_unlock_bh(&rdev->bss_lock);
2483 }
2484 EXPORT_SYMBOL(cfg80211_ref_bss);
2485 
2486 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2487 {
2488         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2489         struct cfg80211_internal_bss *bss;
2490 
2491         if (!pub)
2492                 return;
2493 
2494         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2495 
2496         spin_lock_bh(&rdev->bss_lock);
2497         bss_ref_put(rdev, bss);
2498         spin_unlock_bh(&rdev->bss_lock);
2499 }
2500 EXPORT_SYMBOL(cfg80211_put_bss);
2501 
2502 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2503 {
2504         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2505         struct cfg80211_internal_bss *bss, *tmp1;
2506         struct cfg80211_bss *nontrans_bss, *tmp;
2507 
2508         if (WARN_ON(!pub))
2509                 return;
2510 
2511         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2512 
2513         spin_lock_bh(&rdev->bss_lock);
2514         if (list_empty(&bss->list))
2515                 goto out;
2516 
2517         list_for_each_entry_safe(nontrans_bss, tmp,
2518                                  &pub->nontrans_list,
2519                                  nontrans_list) {
2520                 tmp1 = container_of(nontrans_bss,
2521                                     struct cfg80211_internal_bss, pub);
2522                 if (__cfg80211_unlink_bss(rdev, tmp1))
2523                         rdev->bss_generation++;
2524         }
2525 
2526         if (__cfg80211_unlink_bss(rdev, bss))
2527                 rdev->bss_generation++;
2528 out:
2529         spin_unlock_bh(&rdev->bss_lock);
2530 }
2531 EXPORT_SYMBOL(cfg80211_unlink_bss);
2532 
2533 void cfg80211_bss_iter(struct wiphy *wiphy,
2534                        struct cfg80211_chan_def *chandef,
2535                        void (*iter)(struct wiphy *wiphy,
2536                                     struct cfg80211_bss *bss,
2537                                     void *data),
2538                        void *iter_data)
2539 {
2540         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2541         struct cfg80211_internal_bss *bss;
2542 
2543         spin_lock_bh(&rdev->bss_lock);
2544 
2545         list_for_each_entry(bss, &rdev->bss_list, list) {
2546                 if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel))
2547                         iter(wiphy, &bss->pub, iter_data);
2548         }
2549 
2550         spin_unlock_bh(&rdev->bss_lock);
2551 }
2552 EXPORT_SYMBOL(cfg80211_bss_iter);
2553 
2554 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
2555                                      struct ieee80211_channel *chan)
2556 {
2557         struct wiphy *wiphy = wdev->wiphy;
2558         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2559         struct cfg80211_internal_bss *cbss = wdev->current_bss;
2560         struct cfg80211_internal_bss *new = NULL;
2561         struct cfg80211_internal_bss *bss;
2562         struct cfg80211_bss *nontrans_bss;
2563         struct cfg80211_bss *tmp;
2564 
2565         spin_lock_bh(&rdev->bss_lock);
2566 
2567         /*
2568          * Some APs use CSA also for bandwidth changes, i.e., without actually
2569          * changing the control channel, so no need to update in such a case.
2570          */
2571         if (cbss->pub.channel == chan)
2572                 goto done;
2573 
2574         /* use transmitting bss */
2575         if (cbss->pub.transmitted_bss)
2576                 cbss = container_of(cbss->pub.transmitted_bss,
2577                                     struct cfg80211_internal_bss,
2578                                     pub);
2579 
2580         cbss->pub.channel = chan;
2581 
2582         list_for_each_entry(bss, &rdev->bss_list, list) {
2583                 if (!cfg80211_bss_type_match(bss->pub.capability,
2584                                              bss->pub.channel->band,
2585                                              wdev->conn_bss_type))
2586                         continue;
2587 
2588                 if (bss == cbss)
2589                         continue;
2590 
2591                 if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) {
2592                         new = bss;
2593                         break;
2594                 }
2595         }
2596 
2597         if (new) {
2598                 /* to save time, update IEs for transmitting bss only */
2599                 if (cfg80211_update_known_bss(rdev, cbss, new, false)) {
2600                         new->pub.proberesp_ies = NULL;
2601                         new->pub.beacon_ies = NULL;
2602                 }
2603 
2604                 list_for_each_entry_safe(nontrans_bss, tmp,
2605                                          &new->pub.nontrans_list,
2606                                          nontrans_list) {
2607                         bss = container_of(nontrans_bss,
2608                                            struct cfg80211_internal_bss, pub);
2609                         if (__cfg80211_unlink_bss(rdev, bss))
2610                                 rdev->bss_generation++;
2611                 }
2612 
2613                 WARN_ON(atomic_read(&new->hold));
2614                 if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
2615                         rdev->bss_generation++;
2616         }
2617 
2618         rb_erase(&cbss->rbn, &rdev->bss_tree);
2619         rb_insert_bss(rdev, cbss);
2620         rdev->bss_generation++;
2621 
2622         list_for_each_entry_safe(nontrans_bss, tmp,
2623                                  &cbss->pub.nontrans_list,
2624                                  nontrans_list) {
2625                 bss = container_of(nontrans_bss,
2626                                    struct cfg80211_internal_bss, pub);
2627                 bss->pub.channel = chan;
2628                 rb_erase(&bss->rbn, &rdev->bss_tree);
2629                 rb_insert_bss(rdev, bss);
2630                 rdev->bss_generation++;
2631         }
2632 
2633 done:
2634         spin_unlock_bh(&rdev->bss_lock);
2635 }
2636 
2637 #ifdef CONFIG_CFG80211_WEXT
2638 static struct cfg80211_registered_device *
2639 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
2640 {
2641         struct cfg80211_registered_device *rdev;
2642         struct net_device *dev;
2643 
2644         ASSERT_RTNL();
2645 
2646         dev = dev_get_by_index(net, ifindex);
2647         if (!dev)
2648                 return ERR_PTR(-ENODEV);
2649         if (dev->ieee80211_ptr)
2650                 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
2651         else
2652                 rdev = ERR_PTR(-ENODEV);
2653         dev_put(dev);
2654         return rdev;
2655 }
2656 
2657 int cfg80211_wext_siwscan(struct net_device *dev,
2658                           struct iw_request_info *info,
2659                           union iwreq_data *wrqu, char *extra)
2660 {
2661         struct cfg80211_registered_device *rdev;
2662         struct wiphy *wiphy;
2663         struct iw_scan_req *wreq = NULL;
2664         struct cfg80211_scan_request *creq = NULL;
2665         int i, err, n_channels = 0;
2666         enum nl80211_band band;
2667 
2668         if (!netif_running(dev))
2669                 return -ENETDOWN;
2670 
2671         if (wrqu->data.length == sizeof(struct iw_scan_req))
2672                 wreq = (struct iw_scan_req *)extra;
2673 
2674         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
2675 
2676         if (IS_ERR(rdev))
2677                 return PTR_ERR(rdev);
2678 
2679         if (rdev->scan_req || rdev->scan_msg) {
2680                 err = -EBUSY;
2681                 goto out;
2682         }
2683 
2684         wiphy = &rdev->wiphy;
2685 
2686         /* Determine number of channels, needed to allocate creq */
2687         if (wreq && wreq->num_channels)
2688                 n_channels = wreq->num_channels;
2689         else
2690                 n_channels = ieee80211_get_num_supported_channels(wiphy);
2691 
2692         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
2693                        n_channels * sizeof(void *),
2694                        GFP_ATOMIC);
2695         if (!creq) {
2696                 err = -ENOMEM;
2697                 goto out;
2698         }
2699 
2700         creq->wiphy = wiphy;
2701         creq->wdev = dev->ieee80211_ptr;
2702         /* SSIDs come after channels */
2703         creq->ssids = (void *)&creq->channels[n_channels];
2704         creq->n_channels = n_channels;
2705         creq->n_ssids = 1;
2706         creq->scan_start = jiffies;
2707 
2708         /* translate "Scan on frequencies" request */
2709         i = 0;
2710         for (band = 0; band < NUM_NL80211_BANDS; band++) {
2711                 int j;
2712 
2713                 if (!wiphy->bands[band])
2714                         continue;
2715 
2716                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2717                         /* ignore disabled channels */
2718                         if (wiphy->bands[band]->channels[j].flags &
2719                                                 IEEE80211_CHAN_DISABLED)
2720                                 continue;
2721 
2722                         /* If we have a wireless request structure and the
2723                          * wireless request specifies frequencies, then search
2724                          * for the matching hardware channel.
2725                          */
2726                         if (wreq && wreq->num_channels) {
2727                                 int k;
2728                                 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
2729                                 for (k = 0; k < wreq->num_channels; k++) {
2730                                         struct iw_freq *freq =
2731                                                 &wreq->channel_list[k];
2732                                         int wext_freq =
2733                                                 cfg80211_wext_freq(freq);
2734 
2735                                         if (wext_freq == wiphy_freq)
2736                                                 goto wext_freq_found;
2737                                 }
2738                                 goto wext_freq_not_found;
2739                         }
2740 
2741                 wext_freq_found:
2742                         creq->channels[i] = &wiphy->bands[band]->channels[j];
2743                         i++;
2744                 wext_freq_not_found: ;
2745                 }
2746         }
2747         /* No channels found? */
2748         if (!i) {
2749                 err = -EINVAL;
2750                 goto out;
2751         }
2752 
2753         /* Set real number of channels specified in creq->channels[] */
2754         creq->n_channels = i;
2755 
2756         /* translate "Scan for SSID" request */
2757         if (wreq) {
2758                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
2759                         if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
2760                                 err = -EINVAL;
2761                                 goto out;
2762                         }
2763                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
2764                         creq->ssids[0].ssid_len = wreq->essid_len;
2765                 }
2766                 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
2767                         creq->n_ssids = 0;
2768         }
2769 
2770         for (i = 0; i < NUM_NL80211_BANDS; i++)
2771                 if (wiphy->bands[i])
2772                         creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
2773 
2774         eth_broadcast_addr(creq->bssid);
2775 
2776         rdev->scan_req = creq;
2777         err = rdev_scan(rdev, creq);
2778         if (err) {
2779                 rdev->scan_req = NULL;
2780                 /* creq will be freed below */
2781         } else {
2782                 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
2783                 /* creq now owned by driver */
2784                 creq = NULL;
2785                 dev_hold(dev);
2786         }
2787  out:
2788         kfree(creq);
2789         return err;
2790 }
2791 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
2792 
2793 static char *ieee80211_scan_add_ies(struct iw_request_info *info,
2794                                     const struct cfg80211_bss_ies *ies,
2795                                     char *current_ev, char *end_buf)
2796 {
2797         const u8 *pos, *end, *next;
2798         struct iw_event iwe;
2799 
2800         if (!ies)
2801                 return current_ev;
2802 
2803         /*
2804          * If needed, fragment the IEs buffer (at IE boundaries) into short
2805          * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
2806          */
2807         pos = ies->data;
2808         end = pos + ies->len;
2809 
2810         while (end - pos > IW_GENERIC_IE_MAX) {
2811                 next = pos + 2 + pos[1];
2812                 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
2813                         next = next + 2 + next[1];
2814 
2815                 memset(&iwe, 0, sizeof(iwe));
2816                 iwe.cmd = IWEVGENIE;
2817                 iwe.u.data.length = next - pos;
2818                 current_ev = iwe_stream_add_point_check(info, current_ev,
2819                                                         end_buf, &iwe,
2820                                                         (void *)pos);
2821                 if (IS_ERR(current_ev))
2822                         return current_ev;
2823                 pos = next;
2824         }
2825 
2826         if (end > pos) {
2827                 memset(&iwe, 0, sizeof(iwe));
2828                 iwe.cmd = IWEVGENIE;
2829                 iwe.u.data.length = end - pos;
2830                 current_ev = iwe_stream_add_point_check(info, current_ev,
2831                                                         end_buf, &iwe,
2832                                                         (void *)pos);
2833                 if (IS_ERR(current_ev))
2834                         return current_ev;
2835         }
2836 
2837         return current_ev;
2838 }
2839 
2840 static char *
2841 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
2842               struct cfg80211_internal_bss *bss, char *current_ev,
2843               char *end_buf)
2844 {
2845         const struct cfg80211_bss_ies *ies;
2846         struct iw_event iwe;
2847         const u8 *ie;
2848         u8 buf[50];
2849         u8 *cfg, *p, *tmp;
2850         int rem, i, sig;
2851         bool ismesh = false;
2852 
2853         memset(&iwe, 0, sizeof(iwe));
2854         iwe.cmd = SIOCGIWAP;
2855         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2856         memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
2857         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2858                                                 IW_EV_ADDR_LEN);
2859         if (IS_ERR(current_ev))
2860                 return current_ev;
2861 
2862         memset(&iwe, 0, sizeof(iwe));
2863         iwe.cmd = SIOCGIWFREQ;
2864         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
2865         iwe.u.freq.e = 0;
2866         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2867                                                 IW_EV_FREQ_LEN);
2868         if (IS_ERR(current_ev))
2869                 return current_ev;
2870 
2871         memset(&iwe, 0, sizeof(iwe));
2872         iwe.cmd = SIOCGIWFREQ;
2873         iwe.u.freq.m = bss->pub.channel->center_freq;
2874         iwe.u.freq.e = 6;
2875         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2876                                                 IW_EV_FREQ_LEN);
2877         if (IS_ERR(current_ev))
2878                 return current_ev;
2879 
2880         if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
2881                 memset(&iwe, 0, sizeof(iwe));
2882                 iwe.cmd = IWEVQUAL;
2883                 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
2884                                      IW_QUAL_NOISE_INVALID |
2885                                      IW_QUAL_QUAL_UPDATED;
2886                 switch (wiphy->signal_type) {
2887                 case CFG80211_SIGNAL_TYPE_MBM:
2888                         sig = bss->pub.signal / 100;
2889                         iwe.u.qual.level = sig;
2890                         iwe.u.qual.updated |= IW_QUAL_DBM;
2891                         if (sig < -110)         /* rather bad */
2892                                 sig = -110;
2893                         else if (sig > -40)     /* perfect */
2894                                 sig = -40;
2895                         /* will give a range of 0 .. 70 */
2896                         iwe.u.qual.qual = sig + 110;
2897                         break;
2898                 case CFG80211_SIGNAL_TYPE_UNSPEC:
2899                         iwe.u.qual.level = bss->pub.signal;
2900                         /* will give range 0 .. 100 */
2901                         iwe.u.qual.qual = bss->pub.signal;
2902                         break;
2903                 default:
2904                         /* not reached */
2905                         break;
2906                 }
2907                 current_ev = iwe_stream_add_event_check(info, current_ev,
2908                                                         end_buf, &iwe,
2909                                                         IW_EV_QUAL_LEN);
2910                 if (IS_ERR(current_ev))
2911                         return current_ev;
2912         }
2913 
2914         memset(&iwe, 0, sizeof(iwe));
2915         iwe.cmd = SIOCGIWENCODE;
2916         if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
2917                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2918         else
2919                 iwe.u.data.flags = IW_ENCODE_DISABLED;
2920         iwe.u.data.length = 0;
2921         current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
2922                                                 &iwe, "");
2923         if (IS_ERR(current_ev))
2924                 return current_ev;
2925 
2926         rcu_read_lock();
2927         ies = rcu_dereference(bss->pub.ies);
2928         rem = ies->len;
2929         ie = ies->data;
2930 
2931         while (rem >= 2) {
2932                 /* invalid data */
2933                 if (ie[1] > rem - 2)
2934                         break;
2935 
2936                 switch (ie[0]) {
2937                 case WLAN_EID_SSID:
2938                         memset(&iwe, 0, sizeof(iwe));
2939                         iwe.cmd = SIOCGIWESSID;
2940                         iwe.u.data.length = ie[1];
2941                         iwe.u.data.flags = 1;
2942                         current_ev = iwe_stream_add_point_check(info,
2943                                                                 current_ev,
2944                                                                 end_buf, &iwe,
2945                                                                 (u8 *)ie + 2);
2946                         if (IS_ERR(current_ev))
2947                                 goto unlock;
2948                         break;
2949                 case WLAN_EID_MESH_ID:
2950                         memset(&iwe, 0, sizeof(iwe));
2951                         iwe.cmd = SIOCGIWESSID;
2952                         iwe.u.data.length = ie[1];
2953                         iwe.u.data.flags = 1;
2954                         current_ev = iwe_stream_add_point_check(info,
2955                                                                 current_ev,
2956                                                                 end_buf, &iwe,
2957                                                                 (u8 *)ie + 2);
2958                         if (IS_ERR(current_ev))
2959                                 goto unlock;
2960                         break;
2961                 case WLAN_EID_MESH_CONFIG:
2962                         ismesh = true;
2963                         if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
2964                                 break;
2965                         cfg = (u8 *)ie + 2;
2966                         memset(&iwe, 0, sizeof(iwe));
2967                         iwe.cmd = IWEVCUSTOM;
2968                         sprintf(buf, "Mesh Network Path Selection Protocol ID: "
2969                                 "0x%02X", cfg[0]);
2970                         iwe.u.data.length = strlen(buf);
2971                         current_ev = iwe_stream_add_point_check(info,
2972                                                                 current_ev,
2973                                                                 end_buf,
2974                                                                 &iwe, buf);
2975                         if (IS_ERR(current_ev))
2976                                 goto unlock;
2977                         sprintf(buf, "Path Selection Metric ID: 0x%02X",
2978                                 cfg[1]);
2979                         iwe.u.data.length = strlen(buf);
2980                         current_ev = iwe_stream_add_point_check(info,
2981                                                                 current_ev,
2982                                                                 end_buf,
2983                                                                 &iwe, buf);
2984                         if (IS_ERR(current_ev))
2985                                 goto unlock;
2986                         sprintf(buf, "Congestion Control Mode ID: 0x%02X",
2987                                 cfg[2]);
2988                         iwe.u.data.length = strlen(buf);
2989                         current_ev = iwe_stream_add_point_check(info,
2990                                                                 current_ev,
2991                                                                 end_buf,
2992                                                                 &iwe, buf);
2993                         if (IS_ERR(current_ev))
2994                                 goto unlock;
2995                         sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
2996                         iwe.u.data.length = strlen(buf);
2997                         current_ev = iwe_stream_add_point_check(info,
2998                                                                 current_ev,
2999                                                                 end_buf,
3000                                                                 &iwe, buf);
3001                         if (IS_ERR(current_ev))
3002                                 goto unlock;
3003                         sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
3004                         iwe.u.data.length = strlen(buf);
3005                         current_ev = iwe_stream_add_point_check(info,
3006                                                                 current_ev,
3007                                                                 end_buf,
3008                                                                 &iwe, buf);
3009                         if (IS_ERR(current_ev))
3010                                 goto unlock;
3011                         sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
3012                         iwe.u.data.length = strlen(buf);
3013                         current_ev = iwe_stream_add_point_check(info,
3014                                                                 current_ev,
3015                                                                 end_buf,
3016                                                                 &iwe, buf);
3017                         if (IS_ERR(current_ev))
3018                                 goto unlock;
3019                         sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
3020                         iwe.u.data.length = strlen(buf);
3021                         current_ev = iwe_stream_add_point_check(info,
3022                                                                 current_ev,
3023                                                                 end_buf,
3024                                                                 &iwe, buf);
3025                         if (IS_ERR(current_ev))
3026                                 goto unlock;
3027                         break;
3028                 case WLAN_EID_SUPP_RATES:
3029                 case WLAN_EID_EXT_SUPP_RATES:
3030                         /* display all supported rates in readable format */
3031                         p = current_ev + iwe_stream_lcp_len(info);
3032 
3033                         memset(&iwe, 0, sizeof(iwe));
3034                         iwe.cmd = SIOCGIWRATE;
3035                         /* Those two flags are ignored... */
3036                         iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3037 
3038                         for (i = 0; i < ie[1]; i++) {
3039                                 iwe.u.bitrate.value =
3040                                         ((ie[i + 2] & 0x7f) * 500000);
3041                                 tmp = p;
3042                                 p = iwe_stream_add_value(info, current_ev, p,
3043                                                          end_buf, &iwe,
3044                                                          IW_EV_PARAM_LEN);
3045                                 if (p == tmp) {
3046                                         current_ev = ERR_PTR(-E2BIG);
3047                                         goto unlock;
3048                                 }
3049                         }
3050                         current_ev = p;
3051                         break;
3052                 }
3053                 rem -= ie[1] + 2;
3054                 ie += ie[1] + 2;
3055         }
3056 
3057         if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
3058             ismesh) {
3059                 memset(&iwe, 0, sizeof(iwe));
3060                 iwe.cmd = SIOCGIWMODE;
3061                 if (ismesh)
3062                         iwe.u.mode = IW_MODE_MESH;
3063                 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
3064                         iwe.u.mode = IW_MODE_MASTER;
3065                 else
3066                         iwe.u.mode = IW_MODE_ADHOC;
3067                 current_ev = iwe_stream_add_event_check(info, current_ev,
3068                                                         end_buf, &iwe,
3069                                                         IW_EV_UINT_LEN);
3070                 if (IS_ERR(current_ev))
3071                         goto unlock;
3072         }
3073 
3074         memset(&iwe, 0, sizeof(iwe));
3075         iwe.cmd = IWEVCUSTOM;
3076         sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
3077         iwe.u.data.length = strlen(buf);
3078         current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3079                                                 &iwe, buf);
3080         if (IS_ERR(current_ev))
3081                 goto unlock;
3082         memset(&iwe, 0, sizeof(iwe));
3083         iwe.cmd = IWEVCUSTOM;
3084         sprintf(buf, " Last beacon: %ums ago",
3085                 elapsed_jiffies_msecs(bss->ts));
3086         iwe.u.data.length = strlen(buf);
3087         current_ev = iwe_stream_add_point_check(info, current_ev,
3088                                                 end_buf, &iwe, buf);
3089         if (IS_ERR(current_ev))
3090                 goto unlock;
3091 
3092         current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
3093 
3094  unlock:
3095         rcu_read_unlock();
3096         return current_ev;
3097 }
3098 
3099 
3100 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
3101                                   struct iw_request_info *info,
3102                                   char *buf, size_t len)
3103 {
3104         char *current_ev = buf;
3105         char *end_buf = buf + len;
3106         struct cfg80211_internal_bss *bss;
3107         int err = 0;
3108 
3109         spin_lock_bh(&rdev->bss_lock);
3110         cfg80211_bss_expire(rdev);
3111 
3112         list_for_each_entry(bss, &rdev->bss_list, list) {
3113                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3114                         err = -E2BIG;
3115                         break;
3116                 }
3117                 current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
3118                                            current_ev, end_buf);
3119                 if (IS_ERR(current_ev)) {
3120                         err = PTR_ERR(current_ev);
3121                         break;
3122                 }
3123         }
3124         spin_unlock_bh(&rdev->bss_lock);
3125 
3126         if (err)
3127                 return err;
3128         return current_ev - buf;
3129 }
3130 
3131 
3132 int cfg80211_wext_giwscan(struct net_device *dev,
3133                           struct iw_request_info *info,
3134                           struct iw_point *data, char *extra)
3135 {
3136         struct cfg80211_registered_device *rdev;
3137         int res;
3138 
3139         if (!netif_running(dev))
3140                 return -ENETDOWN;
3141 
3142         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3143 
3144         if (IS_ERR(rdev))
3145                 return PTR_ERR(rdev);
3146 
3147         if (rdev->scan_req || rdev->scan_msg)
3148                 return -EAGAIN;
3149 
3150         res = ieee80211_scan_results(rdev, info, extra, data->length);
3151         data->length = 0;
3152         if (res >= 0) {
3153                 data->length = res;
3154                 res = 0;
3155         }
3156 
3157         return res;
3158 }
3159 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
3160 #endif
3161 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp