| 1 | |
| 2 | |
| 3 | * cfg80211 scan result handling
|
| 4 | *
|
| 5 | * Copyright 2008 Johannes Berg <[email protected]>
|
| 6 | * Copyright 2013-2014 Intel Mobile Communications GmbH
|
| 7 | * Copyright 2016 Intel Deutschland GmbH
|
| 8 | * Copyright (C) 2018-2026 Intel Corporation
|
| 9 |
|
| 10 | #include <linux/kernel.h>
|
| 11 | #include <linux/slab.h>
|
| 12 | #include <linux/module.h>
|
| 13 | #include <linux/netdevice.h>
|
| 14 | #include <linux/wireless.h>
|
| 15 | #include <linux/nl80211.h>
|
| 16 | #include <linux/etherdevice.h>
|
| 17 | #include <linux/crc32.h>
|
| 18 | #include <linux/bitfield.h>
|
| 19 | #include <net/arp.h>
|
| 20 | #include <net/cfg80211.h>
|
| 21 | #include <net/cfg80211-wext.h>
|
| 22 | #include <net/iw_handler.h>
|
| 23 | #include <kunit/visibility.h>
|
| 24 | #include "core.h"
|
| 25 | #include "nl80211.h"
|
| 26 | #include "wext-compat.h"
|
| 27 | #include "rdev-ops.h"
|
| 28 |
|
| 29 | |
| 30 | * DOC: BSS tree/list structure
|
| 31 | *
|
| 32 | * At the top level, the BSS list is kept in both a list in each
|
| 33 | * registered device (@bss_list) as well as an RB-tree for faster
|
| 34 | * lookup. In the RB-tree, entries can be looked up using their
|
| 35 | * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
|
| 36 | * for other BSSes.
|
| 37 | *
|
| 38 | * Due to the possibility of hidden SSIDs, there's a second level
|
| 39 | * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
|
| 40 | * The hidden_list connects all BSSes belonging to a single AP
|
| 41 | * that has a hidden SSID, and connects beacon and probe response
|
| 42 | * entries. For a probe response entry for a hidden SSID, the
|
| 43 | * hidden_beacon_bss pointer points to the BSS struct holding the
|
| 44 | * beacon's information.
|
| 45 | *
|
| 46 | * Reference counting is done for all these references except for
|
| 47 | * the hidden_list, so that a beacon BSS struct that is otherwise
|
| 48 | * not referenced has one reference for being on the bss_list and
|
| 49 | * one for each probe response entry that points to it using the
|
| 50 | * hidden_beacon_bss pointer. When a BSS struct that has such a
|
| 51 | * pointer is get/put, the refcount update is also propagated to
|
| 52 | * the referenced struct, this ensure that it cannot get removed
|
| 53 | * while somebody is using the probe response version.
|
| 54 | *
|
| 55 | * Note that the hidden_beacon_bss pointer never changes, due to
|
| 56 | * the reference counting. Therefore, no locking is needed for
|
| 57 | * it.
|
| 58 | *
|
| 59 | * Also note that the hidden_beacon_bss pointer is only relevant
|
| 60 | * if the driver uses something other than the IEs, e.g. private
|
| 61 | * data stored in the BSS struct, since the beacon IEs are
|
| 62 | * also linked into the probe response struct.
|
| 63 |
|
| 64 |
|
| 65 | |
| 66 | * Limit the number of BSS entries stored in mac80211. Each one is
|
| 67 | * a bit over 4k at most, so this limits to roughly 4-5M of memory.
|
| 68 | * If somebody wants to really attack this though, they'd likely
|
| 69 | * use small beacons, and only one type of frame, limiting each of
|
| 70 | * the entries to a much smaller size (in order to generate more
|
| 71 | * entries in total, so overhead is bigger.)
|
| 72 |
|
| 73 | static int bss_entries_limit = 1000;
|
| 74 | module_param(bss_entries_limit, int, 0644);
|
| 75 | MODULE_PARM_DESC(bss_entries_limit,
|
| 76 | "limit to number of scan BSS entries (per wiphy, default 1000)");
|
| 77 |
|
| 78 | #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
|
| 79 |
|
| 80 | static void bss_free(struct cfg80211_internal_bss *bss)
|
| 81 | {
|
| 82 | struct cfg80211_bss_ies *ies;
|
| 83 |
|
| 84 | if (WARN_ON(atomic_read(&bss->hold)))
|
| 85 | return;
|
| 86 |
|
| 87 | ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
|
| 88 | if (ies && !bss->pub.hidden_beacon_bss)
|
| 89 | kfree_rcu(ies, rcu_head);
|
| 90 | ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
|
| 91 | if (ies)
|
| 92 | kfree_rcu(ies, rcu_head);
|
| 93 |
|
| 94 | |
| 95 | * This happens when the module is removed, it doesn't
|
| 96 | * really matter any more save for completeness
|
| 97 |
|
| 98 | if (!list_empty(&bss->hidden_list))
|
| 99 | list_del(&bss->hidden_list);
|
| 100 |
|
| 101 | kfree(bss);
|
| 102 | }
|
| 103 |
|
| 104 | static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
|
| 105 | struct cfg80211_internal_bss *bss)
|
| 106 | {
|
| 107 | lockdep_assert_held(&rdev->bss_lock);
|
| 108 |
|
| 109 | bss->refcount++;
|
| 110 |
|
| 111 | if (bss->pub.hidden_beacon_bss)
|
| 112 | bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++;
|
| 113 |
|
| 114 | if (bss->pub.transmitted_bss)
|
| 115 | bss_from_pub(bss->pub.transmitted_bss)->refcount++;
|
| 116 | }
|
| 117 |
|
| 118 | static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
|
| 119 | struct cfg80211_internal_bss *bss)
|
| 120 | {
|
| 121 | lockdep_assert_held(&rdev->bss_lock);
|
| 122 |
|
| 123 | if (bss->pub.hidden_beacon_bss) {
|
| 124 | struct cfg80211_internal_bss *hbss;
|
| 125 |
|
| 126 | hbss = bss_from_pub(bss->pub.hidden_beacon_bss);
|
| 127 | hbss->refcount--;
|
| 128 | if (hbss->refcount == 0)
|
| 129 | bss_free(hbss);
|
| 130 | }
|
| 131 |
|
| 132 | if (bss->pub.transmitted_bss) {
|
| 133 | struct cfg80211_internal_bss *tbss;
|
| 134 |
|
| 135 | tbss = bss_from_pub(bss->pub.transmitted_bss);
|
| 136 | tbss->refcount--;
|
| 137 | if (tbss->refcount == 0)
|
| 138 | bss_free(tbss);
|
| 139 | }
|
| 140 |
|
| 141 | bss->refcount--;
|
| 142 | if (bss->refcount == 0)
|
| 143 | bss_free(bss);
|
| 144 | }
|
| 145 |
|
| 146 | static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
|
| 147 | struct cfg80211_internal_bss *bss)
|
| 148 | {
|
| 149 | lockdep_assert_held(&rdev->bss_lock);
|
| 150 |
|
| 151 | if (!list_empty(&bss->hidden_list)) {
|
| 152 | |
| 153 | * don't remove the beacon entry if it has
|
| 154 | * probe responses associated with it
|
| 155 |
|
| 156 | if (!bss->pub.hidden_beacon_bss)
|
| 157 | return false;
|
| 158 | |
| 159 | * if it's a probe response entry break its
|
| 160 | * link to the other entries in the group
|
| 161 |
|
| 162 | list_del_init(&bss->hidden_list);
|
| 163 | }
|
| 164 |
|
| 165 | list_del_init(&bss->list);
|
| 166 | list_del_init(&bss->pub.nontrans_list);
|
| 167 | rb_erase(&bss->rbn, &rdev->bss_tree);
|
| 168 | rdev->bss_entries--;
|
| 169 | WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
|
| 170 | "rdev bss entries[%d]/list[empty:%d] corruption\n",
|
| 171 | rdev->bss_entries, list_empty(&rdev->bss_list));
|
| 172 | bss_ref_put(rdev, bss);
|
| 173 | return true;
|
| 174 | }
|
| 175 |
|
| 176 | bool cfg80211_is_element_inherited(const struct element *elem,
|
| 177 | const struct element *non_inherit_elem)
|
| 178 | {
|
| 179 | u8 id_len, ext_id_len, i, loop_len, id;
|
| 180 | const u8 *list;
|
| 181 |
|
| 182 | if (elem->id == WLAN_EID_MULTIPLE_BSSID)
|
| 183 | return false;
|
| 184 |
|
| 185 | if (elem->id == WLAN_EID_EXTENSION && elem->datalen > 1 &&
|
| 186 | elem->data[0] == WLAN_EID_EXT_EHT_MULTI_LINK)
|
| 187 | return false;
|
| 188 |
|
| 189 | if (!non_inherit_elem || non_inherit_elem->datalen < 2)
|
| 190 | return true;
|
| 191 |
|
| 192 | |
| 193 | * non inheritance element format is:
|
| 194 | * ext ID (56) | IDs list len | list | extension IDs list len | list
|
| 195 | * Both lists are optional. Both lengths are mandatory.
|
| 196 | * This means valid length is:
|
| 197 | * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
|
| 198 |
|
| 199 | id_len = non_inherit_elem->data[1];
|
| 200 | if (non_inherit_elem->datalen < 3 + id_len)
|
| 201 | return true;
|
| 202 |
|
| 203 | ext_id_len = non_inherit_elem->data[2 + id_len];
|
| 204 | if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
|
| 205 | return true;
|
| 206 |
|
| 207 | if (elem->id == WLAN_EID_EXTENSION) {
|
| 208 | if (!ext_id_len || !elem->datalen)
|
| 209 | return true;
|
| 210 | loop_len = ext_id_len;
|
| 211 | list = &non_inherit_elem->data[3 + id_len];
|
| 212 | id = elem->data[0];
|
| 213 | } else {
|
| 214 | if (!id_len)
|
| 215 | return true;
|
| 216 | loop_len = id_len;
|
| 217 | list = &non_inherit_elem->data[2];
|
| 218 | id = elem->id;
|
| 219 | }
|
| 220 |
|
| 221 | for (i = 0; i < loop_len; i++) {
|
| 222 | if (list[i] == id)
|
| 223 | return false;
|
| 224 | }
|
| 225 |
|
| 226 | return true;
|
| 227 | }
|
| 228 | EXPORT_SYMBOL(cfg80211_is_element_inherited);
|
| 229 |
|
| 230 | static size_t cfg80211_copy_elem_with_frags(const struct element *elem,
|
| 231 | const u8 *ie, size_t ie_len,
|
| 232 | u8 **pos, u8 *buf, size_t buf_len)
|
| 233 | {
|
| 234 | if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len ||
|
| 235 | elem->data + elem->datalen > ie + ie_len))
|
| 236 | return 0;
|
| 237 |
|
| 238 | if (elem->datalen + 2 > buf + buf_len - *pos)
|
| 239 | return 0;
|
| 240 |
|
| 241 | memcpy(*pos, elem, elem->datalen + 2);
|
| 242 | *pos += elem->datalen + 2;
|
| 243 |
|
| 244 |
|
| 245 | if (elem->datalen != 255)
|
| 246 | return *pos - buf;
|
| 247 |
|
| 248 | ie_len = ie + ie_len - elem->data - elem->datalen;
|
| 249 | ie = (const u8 *)elem->data + elem->datalen;
|
| 250 |
|
| 251 | for_each_element(elem, ie, ie_len) {
|
| 252 | if (elem->id != WLAN_EID_FRAGMENT)
|
| 253 | break;
|
| 254 |
|
| 255 | if (elem->datalen + 2 > buf + buf_len - *pos)
|
| 256 | return 0;
|
| 257 |
|
| 258 | memcpy(*pos, elem, elem->datalen + 2);
|
| 259 | *pos += elem->datalen + 2;
|
| 260 |
|
| 261 | if (elem->datalen != 255)
|
| 262 | break;
|
| 263 | }
|
| 264 |
|
| 265 | return *pos - buf;
|
| 266 | }
|
| 267 |
|
| 268 | VISIBLE_IF_CFG80211_KUNIT size_t
|
| 269 | cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
|
| 270 | const u8 *subie, size_t subie_len,
|
| 271 | u8 *new_ie, size_t new_ie_len)
|
| 272 | {
|
| 273 | const struct element *non_inherit_elem, *parent, *sub;
|
| 274 | u8 *pos = new_ie;
|
| 275 | const u8 *mbssid_index_ie;
|
| 276 | u8 id, ext_id, bssid_index = 255;
|
| 277 | unsigned int match_len;
|
| 278 |
|
| 279 | non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
|
| 280 | subie, subie_len);
|
| 281 |
|
| 282 | mbssid_index_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, subie,
|
| 283 | subie_len);
|
| 284 | if (mbssid_index_ie && mbssid_index_ie[1] > 0 &&
|
| 285 | mbssid_index_ie[2] > 0 && mbssid_index_ie[2] <= 46)
|
| 286 | bssid_index = mbssid_index_ie[2];
|
| 287 |
|
| 288 | |
| 289 | * elements.
|
| 290 | * If they are not inherited (included in subie or in the non
|
| 291 | * inheritance element), then we copy all occurrences the first time
|
| 292 | * we see this element type.
|
| 293 |
|
| 294 | for_each_element(parent, ie, ielen) {
|
| 295 | if (parent->id == WLAN_EID_FRAGMENT)
|
| 296 | continue;
|
| 297 |
|
| 298 | if (parent->id == WLAN_EID_EXTENSION) {
|
| 299 | if (parent->datalen < 1)
|
| 300 | continue;
|
| 301 |
|
| 302 | id = WLAN_EID_EXTENSION;
|
| 303 | ext_id = parent->data[0];
|
| 304 | match_len = 1;
|
| 305 | } else {
|
| 306 | id = parent->id;
|
| 307 | match_len = 0;
|
| 308 | }
|
| 309 |
|
| 310 |
|
| 311 | sub = cfg80211_find_elem_match(id, subie, subie_len,
|
| 312 | &ext_id, match_len, 0);
|
| 313 |
|
| 314 |
|
| 315 | if (!sub &&
|
| 316 | cfg80211_is_element_inherited(parent, non_inherit_elem)) {
|
| 317 | if (!cfg80211_copy_elem_with_frags(parent,
|
| 318 | ie, ielen,
|
| 319 | &pos, new_ie,
|
| 320 | new_ie_len))
|
| 321 | return 0;
|
| 322 |
|
| 323 | continue;
|
| 324 | }
|
| 325 |
|
| 326 | |
| 327 | * MLD id being 'bssid_index'
|
| 328 |
|
| 329 | if (parent->id == WLAN_EID_EXTENSION &&
|
| 330 | parent->data[0] == WLAN_EID_EXT_EHT_MULTI_LINK &&
|
| 331 | ieee80211_mle_type_ok(parent->data + 1,
|
| 332 | IEEE80211_ML_CONTROL_TYPE_BASIC,
|
| 333 | parent->datalen - 1) &&
|
| 334 | bssid_index == ieee80211_mle_get_mld_id(parent->data + 1)) {
|
| 335 | if (!cfg80211_copy_elem_with_frags(parent,
|
| 336 | ie, ielen,
|
| 337 | &pos, new_ie,
|
| 338 | new_ie_len))
|
| 339 | return 0;
|
| 340 |
|
| 341 | |
| 342 | * sub-element, which AP MLD should not carry
|
| 343 |
|
| 344 | continue;
|
| 345 | }
|
| 346 |
|
| 347 |
|
| 348 | if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie,
|
| 349 | &ext_id, match_len, 0))
|
| 350 | continue;
|
| 351 |
|
| 352 |
|
| 353 | while (sub) {
|
| 354 | if (!cfg80211_copy_elem_with_frags(sub,
|
| 355 | subie, subie_len,
|
| 356 | &pos, new_ie,
|
| 357 | new_ie_len))
|
| 358 | return 0;
|
| 359 |
|
| 360 | sub = cfg80211_find_elem_match(id,
|
| 361 | sub->data + sub->datalen,
|
| 362 | subie_len + subie -
|
| 363 | (sub->data +
|
| 364 | sub->datalen),
|
| 365 | &ext_id, match_len, 0);
|
| 366 | }
|
| 367 | }
|
| 368 |
|
| 369 | |
| 370 | * parent, so do a pass over subie and append those.
|
| 371 | * Skip the non-tx BSSID caps and non-inheritance element.
|
| 372 |
|
| 373 | for_each_element(sub, subie, subie_len) {
|
| 374 | if (sub->id == WLAN_EID_NON_TX_BSSID_CAP)
|
| 375 | continue;
|
| 376 |
|
| 377 | if (sub->id == WLAN_EID_FRAGMENT)
|
| 378 | continue;
|
| 379 |
|
| 380 | if (sub->id == WLAN_EID_EXTENSION) {
|
| 381 | if (sub->datalen < 1)
|
| 382 | continue;
|
| 383 |
|
| 384 | id = WLAN_EID_EXTENSION;
|
| 385 | ext_id = sub->data[0];
|
| 386 | match_len = 1;
|
| 387 |
|
| 388 | if (ext_id == WLAN_EID_EXT_NON_INHERITANCE)
|
| 389 | continue;
|
| 390 | } else {
|
| 391 | id = sub->id;
|
| 392 | match_len = 0;
|
| 393 | }
|
| 394 |
|
| 395 |
|
| 396 | if (cfg80211_find_elem_match(id, ie, ielen,
|
| 397 | &ext_id, match_len, 0))
|
| 398 | continue;
|
| 399 |
|
| 400 | if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len,
|
| 401 | &pos, new_ie, new_ie_len))
|
| 402 | return 0;
|
| 403 | }
|
| 404 |
|
| 405 | return pos - new_ie;
|
| 406 | }
|
| 407 | EXPORT_SYMBOL_IF_CFG80211_KUNIT(cfg80211_gen_new_ie);
|
| 408 |
|
| 409 | static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
|
| 410 | const u8 *ssid, size_t ssid_len)
|
| 411 | {
|
| 412 | const struct cfg80211_bss_ies *ies;
|
| 413 | const struct element *ssid_elem;
|
| 414 |
|
| 415 | if (bssid && !ether_addr_equal(a->bssid, bssid))
|
| 416 | return false;
|
| 417 |
|
| 418 | if (!ssid)
|
| 419 | return true;
|
| 420 |
|
| 421 | ies = rcu_access_pointer(a->ies);
|
| 422 | if (!ies)
|
| 423 | return false;
|
| 424 | ssid_elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
|
| 425 | if (!ssid_elem)
|
| 426 | return false;
|
| 427 | if (ssid_elem->datalen != ssid_len)
|
| 428 | return false;
|
| 429 | return memcmp(ssid_elem->data, ssid, ssid_len) == 0;
|
| 430 | }
|
| 431 |
|
| 432 | static int
|
| 433 | cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
|
| 434 | struct cfg80211_bss *nontrans_bss)
|
| 435 | {
|
| 436 | const struct element *ssid_elem;
|
| 437 | struct cfg80211_bss *bss = NULL;
|
| 438 |
|
| 439 | rcu_read_lock();
|
| 440 | ssid_elem = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID);
|
| 441 | if (!ssid_elem) {
|
| 442 | rcu_read_unlock();
|
| 443 | return -EINVAL;
|
| 444 | }
|
| 445 |
|
| 446 |
|
| 447 | list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
|
| 448 | if (is_bss(bss, nontrans_bss->bssid, ssid_elem->data,
|
| 449 | ssid_elem->datalen)) {
|
| 450 | rcu_read_unlock();
|
| 451 | return 0;
|
| 452 | }
|
| 453 | }
|
| 454 |
|
| 455 | rcu_read_unlock();
|
| 456 |
|
| 457 | |
| 458 | * This is a bit weird - it's not on the list, but already on another
|
| 459 | * one! The only way that could happen is if there's some BSSID/SSID
|
| 460 | * shared by multiple APs in their multi-BSSID profiles, potentially
|
| 461 | * with hidden SSID mixed in ... ignore it.
|
| 462 |
|
| 463 | if (!list_empty(&nontrans_bss->nontrans_list))
|
| 464 | return -EINVAL;
|
| 465 |
|
| 466 |
|
| 467 | list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
|
| 468 | return 0;
|
| 469 | }
|
| 470 |
|
| 471 | static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
|
| 472 | unsigned long expire_time)
|
| 473 | {
|
| 474 | struct cfg80211_internal_bss *bss, *tmp;
|
| 475 | bool expired = false;
|
| 476 |
|
| 477 | lockdep_assert_held(&rdev->bss_lock);
|
| 478 |
|
| 479 | list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
|
| 480 | if (atomic_read(&bss->hold))
|
| 481 | continue;
|
| 482 | if (!time_after(expire_time, bss->ts))
|
| 483 | continue;
|
| 484 |
|
| 485 | if (__cfg80211_unlink_bss(rdev, bss))
|
| 486 | expired = true;
|
| 487 | }
|
| 488 |
|
| 489 | if (expired)
|
| 490 | rdev->bss_generation++;
|
| 491 | }
|
| 492 |
|
| 493 | static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
|
| 494 | {
|
| 495 | struct cfg80211_internal_bss *bss, *oldest = NULL;
|
| 496 | bool ret;
|
| 497 |
|
| 498 | lockdep_assert_held(&rdev->bss_lock);
|
| 499 |
|
| 500 | list_for_each_entry(bss, &rdev->bss_list, list) {
|
| 501 | if (atomic_read(&bss->hold))
|
| 502 | continue;
|
| 503 |
|
| 504 | if (!list_empty(&bss->hidden_list) &&
|
| 505 | !bss->pub.hidden_beacon_bss)
|
| 506 | continue;
|
| 507 |
|
| 508 | if (oldest && time_before(oldest->ts, bss->ts))
|
| 509 | continue;
|
| 510 | oldest = bss;
|
| 511 | }
|
| 512 |
|
| 513 | if (WARN_ON(!oldest))
|
| 514 | return false;
|
| 515 |
|
| 516 | |
| 517 | * The callers make sure to increase rdev->bss_generation if anything
|
| 518 | * gets removed (and a new entry added), so there's no need to also do
|
| 519 | * it here.
|
| 520 |
|
| 521 |
|
| 522 | ret = __cfg80211_unlink_bss(rdev, oldest);
|
| 523 | WARN_ON(!ret);
|
| 524 | return ret;
|
| 525 | }
|
| 526 |
|
| 527 | static u8 cfg80211_parse_bss_param(u8 data,
|
| 528 | struct cfg80211_colocated_ap *coloc_ap)
|
| 529 | {
|
| 530 | coloc_ap->oct_recommended =
|
| 531 | u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
|
| 532 | coloc_ap->same_ssid =
|
| 533 | u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
|
| 534 | coloc_ap->multi_bss =
|
| 535 | u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
|
| 536 | coloc_ap->transmitted_bssid =
|
| 537 | u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
|
| 538 | coloc_ap->unsolicited_probe =
|
| 539 | u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
|
| 540 | coloc_ap->colocated_ess =
|
| 541 | u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
|
| 542 |
|
| 543 | return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
|
| 544 | }
|
| 545 |
|
| 546 | static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
|
| 547 | const struct element **elem, u32 *s_ssid)
|
| 548 | {
|
| 549 |
|
| 550 | *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
|
| 551 | if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
|
| 552 | return -EINVAL;
|
| 553 |
|
| 554 | *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen);
|
| 555 | return 0;
|
| 556 | }
|
| 557 |
|
| 558 | VISIBLE_IF_CFG80211_KUNIT void
|
| 559 | cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
|
| 560 | {
|
| 561 | struct cfg80211_colocated_ap *ap, *tmp_ap;
|
| 562 |
|
| 563 | list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
|
| 564 | list_del(&ap->list);
|
| 565 | kfree(ap);
|
| 566 | }
|
| 567 | }
|
| 568 | EXPORT_SYMBOL_IF_CFG80211_KUNIT(cfg80211_free_coloc_ap_list);
|
| 569 |
|
| 570 | static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
|
| 571 | const u8 *pos, u8 length,
|
| 572 | const struct element *ssid_elem,
|
| 573 | u32 s_ssid_tmp)
|
| 574 | {
|
| 575 | u8 bss_params;
|
| 576 |
|
| 577 | entry->psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
|
| 578 |
|
| 579 |
|
| 580 | if (length > sizeof(struct ieee80211_tbtt_info_7_8_9)) {
|
| 581 | struct ieee80211_tbtt_info_ge_11 *tbtt_info = (void *)pos;
|
| 582 |
|
| 583 | memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
|
| 584 | entry->short_ssid = le32_to_cpu(tbtt_info->short_ssid);
|
| 585 | entry->short_ssid_valid = true;
|
| 586 |
|
| 587 | bss_params = tbtt_info->bss_params;
|
| 588 |
|
| 589 |
|
| 590 | if (length >= offsetofend(typeof(*tbtt_info), mld_params)) {
|
| 591 | if (le16_get_bits(tbtt_info->mld_params.params,
|
| 592 | IEEE80211_RNR_MLD_PARAMS_DISABLED_LINK))
|
| 593 | return -EINVAL;
|
| 594 | }
|
| 595 |
|
| 596 | if (length >= offsetofend(struct ieee80211_tbtt_info_ge_11,
|
| 597 | psd_20))
|
| 598 | entry->psd_20 = tbtt_info->psd_20;
|
| 599 | } else {
|
| 600 | struct ieee80211_tbtt_info_7_8_9 *tbtt_info = (void *)pos;
|
| 601 |
|
| 602 | memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
|
| 603 |
|
| 604 | bss_params = tbtt_info->bss_params;
|
| 605 |
|
| 606 | if (length == offsetofend(struct ieee80211_tbtt_info_7_8_9,
|
| 607 | psd_20))
|
| 608 | entry->psd_20 = tbtt_info->psd_20;
|
| 609 | }
|
| 610 |
|
| 611 |
|
| 612 | if (!is_valid_ether_addr(entry->bssid))
|
| 613 | return -EINVAL;
|
| 614 |
|
| 615 |
|
| 616 | if (!cfg80211_parse_bss_param(bss_params, entry))
|
| 617 | return -EINVAL;
|
| 618 |
|
| 619 | |
| 620 | * for now. It would later be dropped in case there are explicit
|
| 621 | * SSIDs that need to be matched
|
| 622 |
|
| 623 | if (!entry->same_ssid && !entry->short_ssid_valid)
|
| 624 | return 0;
|
| 625 |
|
| 626 | if (entry->same_ssid) {
|
| 627 | entry->short_ssid = s_ssid_tmp;
|
| 628 | entry->short_ssid_valid = true;
|
| 629 |
|
| 630 | |
| 631 | * This is safe because we validate datalen in
|
| 632 | * cfg80211_parse_colocated_ap(), before calling this
|
| 633 | * function.
|
| 634 |
|
| 635 | memcpy(&entry->ssid, &ssid_elem->data, ssid_elem->datalen);
|
| 636 | entry->ssid_len = ssid_elem->datalen;
|
| 637 | }
|
| 638 |
|
| 639 | return 0;
|
| 640 | }
|
| 641 |
|
| 642 | bool cfg80211_iter_rnr(const u8 *elems, size_t elems_len,
|
| 643 | enum cfg80211_rnr_iter_ret
|
| 644 | (*iter)(void *data, u8 type,
|
| 645 | const struct ieee80211_neighbor_ap_info *info,
|
| 646 | const u8 *tbtt_info, u8 tbtt_info_len),
|
| 647 | void *iter_data)
|
| 648 | {
|
| 649 | const struct element *rnr;
|
| 650 | const u8 *pos, *end;
|
| 651 |
|
| 652 | for_each_element_id(rnr, WLAN_EID_REDUCED_NEIGHBOR_REPORT,
|
| 653 | elems, elems_len) {
|
| 654 | const struct ieee80211_neighbor_ap_info *info;
|
| 655 |
|
| 656 | pos = rnr->data;
|
| 657 | end = rnr->data + rnr->datalen;
|
| 658 |
|
| 659 |
|
| 660 | while (sizeof(*info) <= end - pos) {
|
| 661 | u8 length, i, count;
|
| 662 | u8 type;
|
| 663 |
|
| 664 | info = (void *)pos;
|
| 665 | count = u8_get_bits(info->tbtt_info_hdr,
|
| 666 | IEEE80211_AP_INFO_TBTT_HDR_COUNT) +
|
| 667 | 1;
|
| 668 | length = info->tbtt_info_len;
|
| 669 |
|
| 670 | pos += sizeof(*info);
|
| 671 |
|
| 672 | if (count * length > end - pos)
|
| 673 | return false;
|
| 674 |
|
| 675 | type = u8_get_bits(info->tbtt_info_hdr,
|
| 676 | IEEE80211_AP_INFO_TBTT_HDR_TYPE);
|
| 677 |
|
| 678 | for (i = 0; i < count; i++) {
|
| 679 | switch (iter(iter_data, type, info,
|
| 680 | pos, length)) {
|
| 681 | case RNR_ITER_CONTINUE:
|
| 682 | break;
|
| 683 | case RNR_ITER_BREAK:
|
| 684 | return true;
|
| 685 | case RNR_ITER_ERROR:
|
| 686 | return false;
|
| 687 | }
|
| 688 |
|
| 689 | pos += length;
|
| 690 | }
|
| 691 | }
|
| 692 |
|
| 693 | if (pos != end)
|
| 694 | return false;
|
| 695 | }
|
| 696 |
|
| 697 | return true;
|
| 698 | }
|
| 699 | EXPORT_SYMBOL_GPL(cfg80211_iter_rnr);
|
| 700 |
|
| 701 | struct colocated_ap_data {
|
| 702 | const struct element *ssid_elem;
|
| 703 | struct list_head ap_list;
|
| 704 | u32 s_ssid_tmp;
|
| 705 | int n_coloc;
|
| 706 | };
|
| 707 |
|
| 708 | static enum cfg80211_rnr_iter_ret
|
| 709 | cfg80211_parse_colocated_ap_iter(void *_data, u8 type,
|
| 710 | const struct ieee80211_neighbor_ap_info *info,
|
| 711 | const u8 *tbtt_info, u8 tbtt_info_len)
|
| 712 | {
|
| 713 | struct colocated_ap_data *data = _data;
|
| 714 | struct cfg80211_colocated_ap *entry;
|
| 715 | enum nl80211_band band;
|
| 716 |
|
| 717 | if (type != IEEE80211_TBTT_INFO_TYPE_TBTT)
|
| 718 | return RNR_ITER_CONTINUE;
|
| 719 |
|
| 720 | if (!ieee80211_operating_class_to_band(info->op_class, &band))
|
| 721 | return RNR_ITER_CONTINUE;
|
| 722 |
|
| 723 | |
| 724 | * same_ssid bit to be set). Ignore other options, and move to
|
| 725 | * the next AP info
|
| 726 |
|
| 727 | if (band != NL80211_BAND_6GHZ ||
|
| 728 | !(tbtt_info_len == offsetofend(struct ieee80211_tbtt_info_7_8_9,
|
| 729 | bss_params) ||
|
| 730 | tbtt_info_len == sizeof(struct ieee80211_tbtt_info_7_8_9) ||
|
| 731 | tbtt_info_len >= offsetofend(struct ieee80211_tbtt_info_ge_11,
|
| 732 | bss_params)))
|
| 733 | return RNR_ITER_CONTINUE;
|
| 734 |
|
| 735 | entry = kzalloc_obj(*entry, GFP_ATOMIC);
|
| 736 | if (!entry)
|
| 737 | return RNR_ITER_ERROR;
|
| 738 |
|
| 739 | entry->center_freq =
|
| 740 | ieee80211_channel_to_frequency(info->channel, band);
|
| 741 |
|
| 742 | if (!cfg80211_parse_ap_info(entry, tbtt_info, tbtt_info_len,
|
| 743 | data->ssid_elem, data->s_ssid_tmp)) {
|
| 744 | struct cfg80211_colocated_ap *tmp;
|
| 745 |
|
| 746 |
|
| 747 | list_for_each_entry(tmp, &data->ap_list, list) {
|
| 748 | if (ether_addr_equal(tmp->bssid, entry->bssid) &&
|
| 749 | tmp->center_freq == entry->center_freq) {
|
| 750 | kfree(entry);
|
| 751 | return RNR_ITER_CONTINUE;
|
| 752 | }
|
| 753 | }
|
| 754 |
|
| 755 | data->n_coloc++;
|
| 756 | list_add_tail(&entry->list, &data->ap_list);
|
| 757 | } else {
|
| 758 | kfree(entry);
|
| 759 | }
|
| 760 |
|
| 761 | return RNR_ITER_CONTINUE;
|
| 762 | }
|
| 763 |
|
| 764 | VISIBLE_IF_CFG80211_KUNIT int
|
| 765 | cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
|
| 766 | struct list_head *list)
|
| 767 | {
|
| 768 | struct colocated_ap_data data = {};
|
| 769 | int ret;
|
| 770 |
|
| 771 | INIT_LIST_HEAD(&data.ap_list);
|
| 772 |
|
| 773 | ret = cfg80211_calc_short_ssid(ies, &data.ssid_elem, &data.s_ssid_tmp);
|
| 774 | if (ret)
|
| 775 | return 0;
|
| 776 |
|
| 777 | if (!cfg80211_iter_rnr(ies->data, ies->len,
|
| 778 | cfg80211_parse_colocated_ap_iter, &data)) {
|
| 779 | cfg80211_free_coloc_ap_list(&data.ap_list);
|
| 780 | return 0;
|
| 781 | }
|
| 782 |
|
| 783 | list_splice_tail(&data.ap_list, list);
|
| 784 | return data.n_coloc;
|
| 785 | }
|
| 786 | EXPORT_SYMBOL_IF_CFG80211_KUNIT(cfg80211_parse_colocated_ap);
|
| 787 |
|
| 788 | static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
|
| 789 | struct ieee80211_channel *chan,
|
| 790 | bool add_to_6ghz)
|
| 791 | {
|
| 792 | int i;
|
| 793 | u32 n_channels = request->n_channels;
|
| 794 | struct cfg80211_scan_6ghz_params *params =
|
| 795 | &request->scan_6ghz_params[request->n_6ghz_params];
|
| 796 |
|
| 797 | for (i = 0; i < n_channels; i++) {
|
| 798 | if (request->channels[i] == chan) {
|
| 799 | if (add_to_6ghz)
|
| 800 | params->channel_idx = i;
|
| 801 | return;
|
| 802 | }
|
| 803 | }
|
| 804 |
|
| 805 | request->n_channels++;
|
| 806 | request->channels[n_channels] = chan;
|
| 807 | if (add_to_6ghz)
|
| 808 | request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
|
| 809 | n_channels;
|
| 810 | }
|
| 811 |
|
| 812 | static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
|
| 813 | struct cfg80211_scan_request *request)
|
| 814 | {
|
| 815 | int i;
|
| 816 | u32 s_ssid;
|
| 817 |
|
| 818 | for (i = 0; i < request->n_ssids; i++) {
|
| 819 |
|
| 820 | if (!request->ssids[i].ssid_len) {
|
| 821 | if (ap->multi_bss && !ap->transmitted_bssid)
|
| 822 | continue;
|
| 823 |
|
| 824 | return true;
|
| 825 | }
|
| 826 |
|
| 827 | if (ap->ssid_len &&
|
| 828 | ap->ssid_len == request->ssids[i].ssid_len) {
|
| 829 | if (!memcmp(request->ssids[i].ssid, ap->ssid,
|
| 830 | ap->ssid_len))
|
| 831 | return true;
|
| 832 | } else if (ap->short_ssid_valid) {
|
| 833 | s_ssid = ~crc32_le(~0, request->ssids[i].ssid,
|
| 834 | request->ssids[i].ssid_len);
|
| 835 |
|
| 836 | if (ap->short_ssid == s_ssid)
|
| 837 | return true;
|
| 838 | }
|
| 839 | }
|
| 840 |
|
| 841 | return false;
|
| 842 | }
|
| 843 |
|
| 844 | static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev,
|
| 845 | bool first_part)
|
| 846 | {
|
| 847 | u8 i;
|
| 848 | struct cfg80211_colocated_ap *ap;
|
| 849 | int n_channels, count = 0, err;
|
| 850 | struct cfg80211_scan_request_int *request, *rdev_req = rdev->scan_req;
|
| 851 | LIST_HEAD(coloc_ap_list);
|
| 852 | bool need_scan_psc = true;
|
| 853 | const struct ieee80211_sband_iftype_data *iftd;
|
| 854 | size_t size, offs_ssids, offs_6ghz_params, offs_ies;
|
| 855 |
|
| 856 | rdev_req->req.scan_6ghz = true;
|
| 857 | rdev_req->req.first_part = first_part;
|
| 858 |
|
| 859 | if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
|
| 860 | return -EOPNOTSUPP;
|
| 861 |
|
| 862 | iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ],
|
| 863 | rdev_req->req.wdev->iftype);
|
| 864 | if (!iftd || !iftd->he_cap.has_he)
|
| 865 | return -EOPNOTSUPP;
|
| 866 |
|
| 867 | n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
|
| 868 |
|
| 869 | if (rdev_req->req.flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
|
| 870 | struct cfg80211_internal_bss *intbss;
|
| 871 |
|
| 872 | spin_lock_bh(&rdev->bss_lock);
|
| 873 | list_for_each_entry(intbss, &rdev->bss_list, list) {
|
| 874 | struct cfg80211_bss *res = &intbss->pub;
|
| 875 | const struct cfg80211_bss_ies *ies;
|
| 876 | const struct element *ssid_elem;
|
| 877 | struct cfg80211_colocated_ap *entry;
|
| 878 | u32 s_ssid_tmp;
|
| 879 | int ret;
|
| 880 |
|
| 881 | ies = rcu_access_pointer(res->ies);
|
| 882 | count += cfg80211_parse_colocated_ap(ies,
|
| 883 | &coloc_ap_list);
|
| 884 |
|
| 885 | |
| 886 | * and the BSS is found and operating on 6GHz band then
|
| 887 | * add this AP to the collocated APs list.
|
| 888 | * This is relevant for ML probe requests when the lower
|
| 889 | * band APs have not been discovered.
|
| 890 |
|
| 891 | if (is_broadcast_ether_addr(rdev_req->req.bssid) ||
|
| 892 | !ether_addr_equal(rdev_req->req.bssid, res->bssid) ||
|
| 893 | res->channel->band != NL80211_BAND_6GHZ)
|
| 894 | continue;
|
| 895 |
|
| 896 | ret = cfg80211_calc_short_ssid(ies, &ssid_elem,
|
| 897 | &s_ssid_tmp);
|
| 898 | if (ret)
|
| 899 | continue;
|
| 900 |
|
| 901 | entry = kzalloc_obj(*entry, GFP_ATOMIC);
|
| 902 | if (!entry)
|
| 903 | continue;
|
| 904 |
|
| 905 | memcpy(entry->bssid, res->bssid, ETH_ALEN);
|
| 906 | entry->short_ssid = s_ssid_tmp;
|
| 907 | memcpy(entry->ssid, ssid_elem->data,
|
| 908 | ssid_elem->datalen);
|
| 909 | entry->ssid_len = ssid_elem->datalen;
|
| 910 | entry->short_ssid_valid = true;
|
| 911 | entry->center_freq = res->channel->center_freq;
|
| 912 |
|
| 913 | list_add_tail(&entry->list, &coloc_ap_list);
|
| 914 | count++;
|
| 915 | }
|
| 916 | spin_unlock_bh(&rdev->bss_lock);
|
| 917 | }
|
| 918 |
|
| 919 | size = struct_size(request, req.channels, n_channels);
|
| 920 | offs_ssids = size;
|
| 921 | size += sizeof(*request->req.ssids) * rdev_req->req.n_ssids;
|
| 922 | offs_6ghz_params = size;
|
| 923 | size += sizeof(*request->req.scan_6ghz_params) * count;
|
| 924 | offs_ies = size;
|
| 925 | size += rdev_req->req.ie_len;
|
| 926 |
|
| 927 | request = kzalloc(size, GFP_KERNEL);
|
| 928 | if (!request) {
|
| 929 | cfg80211_free_coloc_ap_list(&coloc_ap_list);
|
| 930 | return -ENOMEM;
|
| 931 | }
|
| 932 |
|
| 933 | *request = *rdev_req;
|
| 934 | request->req.n_channels = 0;
|
| 935 | request->req.n_6ghz_params = 0;
|
| 936 | if (rdev_req->req.n_ssids) {
|
| 937 | |
| 938 | * Add the ssids from the parent scan request to the new
|
| 939 | * scan request, so the driver would be able to use them
|
| 940 | * in its probe requests to discover hidden APs on PSC
|
| 941 | * channels.
|
| 942 |
|
| 943 | request->req.ssids = (void *)request + offs_ssids;
|
| 944 | memcpy(request->req.ssids, rdev_req->req.ssids,
|
| 945 | sizeof(*request->req.ssids) * request->req.n_ssids);
|
| 946 | }
|
| 947 | request->req.scan_6ghz_params = (void *)request + offs_6ghz_params;
|
| 948 |
|
| 949 | if (rdev_req->req.ie_len) {
|
| 950 | void *ie = (void *)request + offs_ies;
|
| 951 |
|
| 952 | memcpy(ie, rdev_req->req.ie, rdev_req->req.ie_len);
|
| 953 | request->req.ie = ie;
|
| 954 | }
|
| 955 |
|
| 956 | |
| 957 | * PSC channels should not be scanned in case of direct scan with 1 SSID
|
| 958 | * and at least one of the reported co-located APs with same SSID
|
| 959 | * indicating that all APs in the same ESS are co-located
|
| 960 |
|
| 961 | if (count &&
|
| 962 | request->req.n_ssids == 1 &&
|
| 963 | request->req.ssids[0].ssid_len) {
|
| 964 | list_for_each_entry(ap, &coloc_ap_list, list) {
|
| 965 | if (ap->colocated_ess &&
|
| 966 | cfg80211_find_ssid_match(ap, &request->req)) {
|
| 967 | need_scan_psc = false;
|
| 968 | break;
|
| 969 | }
|
| 970 | }
|
| 971 | }
|
| 972 |
|
| 973 | |
| 974 | * add to the scan request the channels that need to be scanned
|
| 975 | * regardless of the collocated APs (PSC channels or all channels
|
| 976 | * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
|
| 977 |
|
| 978 | for (i = 0; i < rdev_req->req.n_channels; i++) {
|
| 979 | if (rdev_req->req.channels[i]->band == NL80211_BAND_6GHZ &&
|
| 980 | ((need_scan_psc &&
|
| 981 | cfg80211_channel_is_psc(rdev_req->req.channels[i])) ||
|
| 982 | !(rdev_req->req.flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
|
| 983 | cfg80211_scan_req_add_chan(&request->req,
|
| 984 | rdev_req->req.channels[i],
|
| 985 | false);
|
| 986 | }
|
| 987 | }
|
| 988 |
|
| 989 | if (!(rdev_req->req.flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
|
| 990 | goto skip;
|
| 991 |
|
| 992 | list_for_each_entry(ap, &coloc_ap_list, list) {
|
| 993 | bool found = false;
|
| 994 | struct cfg80211_scan_6ghz_params *scan_6ghz_params =
|
| 995 | &request->req.scan_6ghz_params[request->req.n_6ghz_params];
|
| 996 | struct ieee80211_channel *chan =
|
| 997 | ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
|
| 998 |
|
| 999 | if (!chan || chan->flags & IEEE80211_CHAN_DISABLED ||
|
| 1000 | !cfg80211_wdev_channel_allowed(rdev_req->req.wdev, chan))
|
| 1001 | continue;
|
| 1002 |
|
| 1003 | for (i = 0; i < rdev_req->req.n_channels; i++) {
|
| 1004 | if (rdev_req->req.channels[i] == chan)
|
| 1005 | found = true;
|
| 1006 | }
|
| 1007 |
|
| 1008 | if (!found)
|
| 1009 | continue;
|
| 1010 |
|
| 1011 | if (request->req.n_ssids > 0 &&
|
| 1012 | !cfg80211_find_ssid_match(ap, &request->req))
|
| 1013 | continue;
|
| 1014 |
|
| 1015 | if (!is_broadcast_ether_addr(request->req.bssid) &&
|
| 1016 | !ether_addr_equal(request->req.bssid, ap->bssid))
|
| 1017 | continue;
|
| 1018 |
|
| 1019 | if (!request->req.n_ssids && ap->multi_bss &&
|
| 1020 | !ap->transmitted_bssid)
|
| 1021 | continue;
|
| 1022 |
|
| 1023 | cfg80211_scan_req_add_chan(&request->req, chan, true);
|
| 1024 | memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
|
| 1025 | scan_6ghz_params->short_ssid = ap->short_ssid;
|
| 1026 | scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
|
| 1027 | scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
|
| 1028 | scan_6ghz_params->psd_20 = ap->psd_20;
|
| 1029 |
|
| 1030 | |
| 1031 | * If a PSC channel is added to the scan and 'need_scan_psc' is
|
| 1032 | * set to false, then all the APs that the scan logic is
|
| 1033 | * interested with on the channel are collocated and thus there
|
| 1034 | * is no need to perform the initial PSC channel listen.
|
| 1035 |
|
| 1036 | if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
|
| 1037 | scan_6ghz_params->psc_no_listen = true;
|
| 1038 |
|
| 1039 | request->req.n_6ghz_params++;
|
| 1040 | }
|
| 1041 |
|
| 1042 | skip:
|
| 1043 | cfg80211_free_coloc_ap_list(&coloc_ap_list);
|
| 1044 |
|
| 1045 | if (request->req.n_channels) {
|
| 1046 | struct cfg80211_scan_request_int *old = rdev->int_scan_req;
|
| 1047 |
|
| 1048 | rdev->int_scan_req = request;
|
| 1049 |
|
| 1050 | |
| 1051 | * If this scan follows a previous scan, save the scan start
|
| 1052 | * info from the first part of the scan
|
| 1053 |
|
| 1054 | if (!first_part && !WARN_ON(!old))
|
| 1055 | rdev->int_scan_req->info = old->info;
|
| 1056 |
|
| 1057 | err = rdev_scan(rdev, request);
|
| 1058 | if (err) {
|
| 1059 | rdev->int_scan_req = old;
|
| 1060 | kfree(request);
|
| 1061 | } else {
|
| 1062 | kfree(old);
|
| 1063 | }
|
| 1064 |
|
| 1065 | return err;
|
| 1066 | }
|
| 1067 |
|
| 1068 | kfree(request);
|
| 1069 | return -EINVAL;
|
| 1070 | }
|
| 1071 |
|
| 1072 | int cfg80211_scan(struct cfg80211_registered_device *rdev)
|
| 1073 | {
|
| 1074 | struct cfg80211_scan_request_int *request;
|
| 1075 | struct cfg80211_scan_request_int *rdev_req = rdev->scan_req;
|
| 1076 | u32 n_channels = 0, idx, i;
|
| 1077 | int err;
|
| 1078 |
|
| 1079 | if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ)) {
|
| 1080 | rdev_req->req.first_part = true;
|
| 1081 | return rdev_scan(rdev, rdev_req);
|
| 1082 | }
|
| 1083 |
|
| 1084 | for (i = 0; i < rdev_req->req.n_channels; i++) {
|
| 1085 | if (rdev_req->req.channels[i]->band != NL80211_BAND_6GHZ)
|
| 1086 | n_channels++;
|
| 1087 | }
|
| 1088 |
|
| 1089 | if (!n_channels)
|
| 1090 | return cfg80211_scan_6ghz(rdev, true);
|
| 1091 |
|
| 1092 | request = kzalloc_flex(*request, req.channels, n_channels);
|
| 1093 | if (!request)
|
| 1094 | return -ENOMEM;
|
| 1095 |
|
| 1096 | *request = *rdev_req;
|
| 1097 | request->req.n_channels = n_channels;
|
| 1098 |
|
| 1099 | for (i = idx = 0; i < rdev_req->req.n_channels; i++) {
|
| 1100 | if (rdev_req->req.channels[i]->band != NL80211_BAND_6GHZ)
|
| 1101 | request->req.channels[idx++] =
|
| 1102 | rdev_req->req.channels[i];
|
| 1103 | }
|
| 1104 |
|
| 1105 | rdev_req->req.scan_6ghz = false;
|
| 1106 | rdev_req->req.first_part = true;
|
| 1107 | err = rdev_scan(rdev, request);
|
| 1108 | if (err) {
|
| 1109 | kfree(request);
|
| 1110 | return err;
|
| 1111 | }
|
| 1112 |
|
| 1113 | rdev->int_scan_req = request;
|
| 1114 | return 0;
|
| 1115 | }
|
| 1116 |
|
| 1117 | |
| 1118 | * Release the scan request, but free it only if the driver is also done,
|
| 1119 | * e.g. mac80211 may cancel it asynchronously and still use it.
|
| 1120 |
|
| 1121 | static void cfg80211_put_scan_req(struct cfg80211_scan_request_int *req)
|
| 1122 | {
|
| 1123 | if (!req)
|
| 1124 | return;
|
| 1125 |
|
| 1126 | if (req->driver_owns)
|
| 1127 | req->stale = true;
|
| 1128 | else
|
| 1129 | kfree(req);
|
| 1130 | }
|
| 1131 |
|
| 1132 | void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
|
| 1133 | bool send_message)
|
| 1134 | {
|
| 1135 | struct cfg80211_scan_request_int *request, *rdev_req;
|
| 1136 | struct wireless_dev *wdev;
|
| 1137 | struct sk_buff *msg;
|
| 1138 | #ifdef CONFIG_CFG80211_WEXT
|
| 1139 | union iwreq_data wrqu;
|
| 1140 | #endif
|
| 1141 |
|
| 1142 | lockdep_assert_held(&rdev->wiphy.mtx);
|
| 1143 |
|
| 1144 | if (rdev->scan_msg) {
|
| 1145 | nl80211_send_scan_msg(rdev, rdev->scan_msg);
|
| 1146 | rdev->scan_msg = NULL;
|
| 1147 | return;
|
| 1148 | }
|
| 1149 |
|
| 1150 | rdev_req = rdev->scan_req;
|
| 1151 | if (!rdev_req)
|
| 1152 | return;
|
| 1153 |
|
| 1154 | wdev = rdev_req->req.wdev;
|
| 1155 | request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
|
| 1156 |
|
| 1157 | if (wdev_running(wdev) &&
|
| 1158 | (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
|
| 1159 | !rdev_req->req.scan_6ghz && !request->info.aborted &&
|
| 1160 | !cfg80211_scan_6ghz(rdev, false))
|
| 1161 | return;
|
| 1162 |
|
| 1163 | |
| 1164 | * This must be before sending the other events!
|
| 1165 | * Otherwise, wpa_supplicant gets completely confused with
|
| 1166 | * wext events.
|
| 1167 |
|
| 1168 | if (wdev->netdev)
|
| 1169 | cfg80211_sme_scan_done(wdev->netdev);
|
| 1170 |
|
| 1171 | if (!request->info.aborted &&
|
| 1172 | request->req.flags & NL80211_SCAN_FLAG_FLUSH) {
|
| 1173 |
|
| 1174 | spin_lock_bh(&rdev->bss_lock);
|
| 1175 | __cfg80211_bss_expire(rdev, request->req.scan_start);
|
| 1176 | spin_unlock_bh(&rdev->bss_lock);
|
| 1177 | }
|
| 1178 |
|
| 1179 | msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
|
| 1180 |
|
| 1181 | #ifdef CONFIG_CFG80211_WEXT
|
| 1182 | if (wdev->netdev && !request->info.aborted) {
|
| 1183 | memset(&wrqu, 0, sizeof(wrqu));
|
| 1184 |
|
| 1185 | wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
|
| 1186 | }
|
| 1187 | #endif
|
| 1188 |
|
| 1189 | dev_put(wdev->netdev);
|
| 1190 |
|
| 1191 | cfg80211_put_scan_req(rdev->int_scan_req);
|
| 1192 | rdev->int_scan_req = NULL;
|
| 1193 |
|
| 1194 | cfg80211_put_scan_req(rdev->scan_req);
|
| 1195 | rdev->scan_req = NULL;
|
| 1196 |
|
| 1197 | if (!send_message)
|
| 1198 | rdev->scan_msg = msg;
|
| 1199 | else
|
| 1200 | nl80211_send_scan_msg(rdev, msg);
|
| 1201 | }
|
| 1202 |
|
| 1203 | void __cfg80211_scan_done(struct wiphy *wiphy, struct wiphy_work *wk)
|
| 1204 | {
|
| 1205 | ___cfg80211_scan_done(wiphy_to_rdev(wiphy), true);
|
| 1206 | }
|
| 1207 |
|
| 1208 | void cfg80211_scan_done(struct cfg80211_scan_request *request,
|
| 1209 | struct cfg80211_scan_info *info)
|
| 1210 | {
|
| 1211 | struct cfg80211_scan_request_int *intreq =
|
| 1212 | container_of(request, struct cfg80211_scan_request_int, req);
|
| 1213 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(request->wiphy);
|
| 1214 | struct cfg80211_scan_info old_info = intreq->info;
|
| 1215 |
|
| 1216 | trace_cfg80211_scan_done(intreq, info);
|
| 1217 |
|
| 1218 | intreq->driver_owns = false;
|
| 1219 |
|
| 1220 | if (intreq->stale) {
|
| 1221 | |
| 1222 | * The scan is already completed as far as we're concerned,
|
| 1223 | * it was just kept around for the driver - done now, free it.
|
| 1224 |
|
| 1225 | kfree(intreq);
|
| 1226 | return;
|
| 1227 | }
|
| 1228 |
|
| 1229 | WARN_ON(intreq != rdev->scan_req &&
|
| 1230 | intreq != rdev->int_scan_req);
|
| 1231 |
|
| 1232 | intreq->info = *info;
|
| 1233 |
|
| 1234 | |
| 1235 | * In case the scan is split, the scan_start_tsf and tsf_bssid should
|
| 1236 | * be of the first part. In such a case old_info.scan_start_tsf should
|
| 1237 | * be non zero.
|
| 1238 |
|
| 1239 | if (request->scan_6ghz && old_info.scan_start_tsf) {
|
| 1240 | intreq->info.scan_start_tsf = old_info.scan_start_tsf;
|
| 1241 | memcpy(intreq->info.tsf_bssid, old_info.tsf_bssid,
|
| 1242 | sizeof(intreq->info.tsf_bssid));
|
| 1243 | }
|
| 1244 |
|
| 1245 | intreq->notified = true;
|
| 1246 | wiphy_work_queue(request->wiphy, &rdev->scan_done_wk);
|
| 1247 | }
|
| 1248 | EXPORT_SYMBOL(cfg80211_scan_done);
|
| 1249 |
|
| 1250 | void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
|
| 1251 | struct cfg80211_sched_scan_request *req)
|
| 1252 | {
|
| 1253 | lockdep_assert_held(&rdev->wiphy.mtx);
|
| 1254 |
|
| 1255 | list_add_rcu(&req->list, &rdev->sched_scan_req_list);
|
| 1256 | }
|
| 1257 |
|
| 1258 | static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
|
| 1259 | struct cfg80211_sched_scan_request *req)
|
| 1260 | {
|
| 1261 | lockdep_assert_held(&rdev->wiphy.mtx);
|
| 1262 |
|
| 1263 | list_del_rcu(&req->list);
|
| 1264 | kfree_rcu(req, rcu_head);
|
| 1265 | }
|
| 1266 |
|
| 1267 | static struct cfg80211_sched_scan_request *
|
| 1268 | cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
|
| 1269 | {
|
| 1270 | struct cfg80211_sched_scan_request *pos;
|
| 1271 |
|
| 1272 | list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
|
| 1273 | lockdep_is_held(&rdev->wiphy.mtx)) {
|
| 1274 | if (pos->reqid == reqid)
|
| 1275 | return pos;
|
| 1276 | }
|
| 1277 | return NULL;
|
| 1278 | }
|
| 1279 |
|
| 1280 | |
| 1281 | * Determines if a scheduled scan request can be handled. When a legacy
|
| 1282 | * scheduled scan is running no other scheduled scan is allowed regardless
|
| 1283 | * whether the request is for legacy or multi-support scan. When a multi-support
|
| 1284 | * scheduled scan is running a request for legacy scan is not allowed. In this
|
| 1285 | * case a request for multi-support scan can be handled if resources are
|
| 1286 | * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
|
| 1287 |
|
| 1288 | int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
|
| 1289 | bool want_multi)
|
| 1290 | {
|
| 1291 | struct cfg80211_sched_scan_request *pos;
|
| 1292 | int i = 0;
|
| 1293 |
|
| 1294 | list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
|
| 1295 |
|
| 1296 | if (!i && !pos->reqid)
|
| 1297 | return -EINPROGRESS;
|
| 1298 | i++;
|
| 1299 | }
|
| 1300 |
|
| 1301 | if (i) {
|
| 1302 |
|
| 1303 | if (!want_multi)
|
| 1304 | return -EINPROGRESS;
|
| 1305 |
|
| 1306 |
|
| 1307 | if (i == rdev->wiphy.max_sched_scan_reqs)
|
| 1308 | return -ENOSPC;
|
| 1309 | }
|
| 1310 | return 0;
|
| 1311 | }
|
| 1312 |
|
| 1313 | void cfg80211_sched_scan_results_wk(struct work_struct *work)
|
| 1314 | {
|
| 1315 | struct cfg80211_registered_device *rdev;
|
| 1316 | struct cfg80211_sched_scan_request *req, *tmp;
|
| 1317 |
|
| 1318 | rdev = container_of(work, struct cfg80211_registered_device,
|
| 1319 | sched_scan_res_wk);
|
| 1320 |
|
| 1321 | guard(wiphy)(&rdev->wiphy);
|
| 1322 |
|
| 1323 | list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
|
| 1324 | if (req->report_results) {
|
| 1325 | req->report_results = false;
|
| 1326 | if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
|
| 1327 |
|
| 1328 | spin_lock_bh(&rdev->bss_lock);
|
| 1329 | __cfg80211_bss_expire(rdev, req->scan_start);
|
| 1330 | spin_unlock_bh(&rdev->bss_lock);
|
| 1331 | req->scan_start = jiffies;
|
| 1332 | }
|
| 1333 | nl80211_send_sched_scan(req,
|
| 1334 | NL80211_CMD_SCHED_SCAN_RESULTS);
|
| 1335 | }
|
| 1336 | }
|
| 1337 | }
|
| 1338 |
|
| 1339 | void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
|
| 1340 | {
|
| 1341 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 1342 | struct cfg80211_sched_scan_request *request;
|
| 1343 |
|
| 1344 | trace_cfg80211_sched_scan_results(wiphy, reqid);
|
| 1345 |
|
| 1346 |
|
| 1347 | rcu_read_lock();
|
| 1348 | request = cfg80211_find_sched_scan_req(rdev, reqid);
|
| 1349 | if (request) {
|
| 1350 | request->report_results = true;
|
| 1351 | queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
|
| 1352 | }
|
| 1353 | rcu_read_unlock();
|
| 1354 | }
|
| 1355 | EXPORT_SYMBOL(cfg80211_sched_scan_results);
|
| 1356 |
|
| 1357 | void cfg80211_sched_scan_stopped_locked(struct wiphy *wiphy, u64 reqid)
|
| 1358 | {
|
| 1359 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 1360 |
|
| 1361 | lockdep_assert_held(&wiphy->mtx);
|
| 1362 |
|
| 1363 | trace_cfg80211_sched_scan_stopped(wiphy, reqid);
|
| 1364 |
|
| 1365 | __cfg80211_stop_sched_scan(rdev, reqid, true);
|
| 1366 | }
|
| 1367 | EXPORT_SYMBOL(cfg80211_sched_scan_stopped_locked);
|
| 1368 |
|
| 1369 | void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
|
| 1370 | {
|
| 1371 | guard(wiphy)(wiphy);
|
| 1372 |
|
| 1373 | cfg80211_sched_scan_stopped_locked(wiphy, reqid);
|
| 1374 | }
|
| 1375 | EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
|
| 1376 |
|
| 1377 | int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
|
| 1378 | struct cfg80211_sched_scan_request *req,
|
| 1379 | bool driver_initiated)
|
| 1380 | {
|
| 1381 | lockdep_assert_held(&rdev->wiphy.mtx);
|
| 1382 |
|
| 1383 | if (!driver_initiated) {
|
| 1384 | int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
|
| 1385 | if (err)
|
| 1386 | return err;
|
| 1387 | }
|
| 1388 |
|
| 1389 | nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
|
| 1390 |
|
| 1391 | cfg80211_del_sched_scan_req(rdev, req);
|
| 1392 |
|
| 1393 | return 0;
|
| 1394 | }
|
| 1395 |
|
| 1396 | int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
|
| 1397 | u64 reqid, bool driver_initiated)
|
| 1398 | {
|
| 1399 | struct cfg80211_sched_scan_request *sched_scan_req;
|
| 1400 |
|
| 1401 | lockdep_assert_held(&rdev->wiphy.mtx);
|
| 1402 |
|
| 1403 | sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
|
| 1404 | if (!sched_scan_req)
|
| 1405 | return -ENOENT;
|
| 1406 |
|
| 1407 | return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
|
| 1408 | driver_initiated);
|
| 1409 | }
|
| 1410 |
|
| 1411 | void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
|
| 1412 | unsigned long age_secs)
|
| 1413 | {
|
| 1414 | struct cfg80211_internal_bss *bss;
|
| 1415 | unsigned long age_jiffies = secs_to_jiffies(age_secs);
|
| 1416 |
|
| 1417 | spin_lock_bh(&rdev->bss_lock);
|
| 1418 | list_for_each_entry(bss, &rdev->bss_list, list)
|
| 1419 | bss->ts -= age_jiffies;
|
| 1420 | spin_unlock_bh(&rdev->bss_lock);
|
| 1421 | }
|
| 1422 |
|
| 1423 | void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
|
| 1424 | {
|
| 1425 | __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
|
| 1426 | }
|
| 1427 |
|
| 1428 | void cfg80211_bss_flush(struct wiphy *wiphy)
|
| 1429 | {
|
| 1430 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 1431 |
|
| 1432 | spin_lock_bh(&rdev->bss_lock);
|
| 1433 | __cfg80211_bss_expire(rdev, jiffies);
|
| 1434 | spin_unlock_bh(&rdev->bss_lock);
|
| 1435 | }
|
| 1436 | EXPORT_SYMBOL(cfg80211_bss_flush);
|
| 1437 |
|
| 1438 | const struct element *
|
| 1439 | cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
|
| 1440 | const u8 *match, unsigned int match_len,
|
| 1441 | unsigned int match_offset)
|
| 1442 | {
|
| 1443 | const struct element *elem;
|
| 1444 |
|
| 1445 | for_each_element_id(elem, eid, ies, len) {
|
| 1446 | if (elem->datalen >= match_offset + match_len &&
|
| 1447 | !memcmp(elem->data + match_offset, match, match_len))
|
| 1448 | return elem;
|
| 1449 | }
|
| 1450 |
|
| 1451 | return NULL;
|
| 1452 | }
|
| 1453 | EXPORT_SYMBOL(cfg80211_find_elem_match);
|
| 1454 |
|
| 1455 | const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
|
| 1456 | const u8 *ies,
|
| 1457 | unsigned int len)
|
| 1458 | {
|
| 1459 | const struct element *elem;
|
| 1460 | u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
|
| 1461 | int match_len = (oui_type < 0) ? 3 : sizeof(match);
|
| 1462 |
|
| 1463 | if (WARN_ON(oui_type > 0xff))
|
| 1464 | return NULL;
|
| 1465 |
|
| 1466 | elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
|
| 1467 | match, match_len, 0);
|
| 1468 |
|
| 1469 | if (!elem || elem->datalen < 4)
|
| 1470 | return NULL;
|
| 1471 |
|
| 1472 | return elem;
|
| 1473 | }
|
| 1474 | EXPORT_SYMBOL(cfg80211_find_vendor_elem);
|
| 1475 |
|
| 1476 | |
| 1477 | * enum bss_compare_mode - BSS compare mode
|
| 1478 | * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
|
| 1479 | * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
|
| 1480 | * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
|
| 1481 |
|
| 1482 | enum bss_compare_mode {
|
| 1483 | BSS_CMP_REGULAR,
|
| 1484 | BSS_CMP_HIDE_ZLEN,
|
| 1485 | BSS_CMP_HIDE_NUL,
|
| 1486 | };
|
| 1487 |
|
| 1488 | static int cmp_bss(struct cfg80211_bss *a,
|
| 1489 | struct cfg80211_bss *b,
|
| 1490 | enum bss_compare_mode mode)
|
| 1491 | {
|
| 1492 | const struct cfg80211_bss_ies *a_ies, *b_ies;
|
| 1493 | const u8 *ie1 = NULL;
|
| 1494 | const u8 *ie2 = NULL;
|
| 1495 | int i, r;
|
| 1496 |
|
| 1497 | if (a->channel != b->channel)
|
| 1498 | return (b->channel->center_freq * 1000 + b->channel->freq_offset) -
|
| 1499 | (a->channel->center_freq * 1000 + a->channel->freq_offset);
|
| 1500 |
|
| 1501 | a_ies = rcu_access_pointer(a->ies);
|
| 1502 | if (!a_ies)
|
| 1503 | return -1;
|
| 1504 | b_ies = rcu_access_pointer(b->ies);
|
| 1505 | if (!b_ies)
|
| 1506 | return 1;
|
| 1507 |
|
| 1508 | if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
|
| 1509 | ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
|
| 1510 | a_ies->data, a_ies->len);
|
| 1511 | if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
|
| 1512 | ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
|
| 1513 | b_ies->data, b_ies->len);
|
| 1514 | if (ie1 && ie2) {
|
| 1515 | int mesh_id_cmp;
|
| 1516 |
|
| 1517 | if (ie1[1] == ie2[1])
|
| 1518 | mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
|
| 1519 | else
|
| 1520 | mesh_id_cmp = ie2[1] - ie1[1];
|
| 1521 |
|
| 1522 | ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
|
| 1523 | a_ies->data, a_ies->len);
|
| 1524 | ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
|
| 1525 | b_ies->data, b_ies->len);
|
| 1526 | if (ie1 && ie2) {
|
| 1527 | if (mesh_id_cmp)
|
| 1528 | return mesh_id_cmp;
|
| 1529 | if (ie1[1] != ie2[1])
|
| 1530 | return ie2[1] - ie1[1];
|
| 1531 | return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
|
| 1532 | }
|
| 1533 | }
|
| 1534 |
|
| 1535 | r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
|
| 1536 | if (r)
|
| 1537 | return r;
|
| 1538 |
|
| 1539 | ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
|
| 1540 | ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
|
| 1541 |
|
| 1542 | if (!ie1 && !ie2)
|
| 1543 | return 0;
|
| 1544 |
|
| 1545 | |
| 1546 | * Note that with "hide_ssid", the function returns a match if
|
| 1547 | * the already-present BSS ("b") is a hidden SSID beacon for
|
| 1548 | * the new BSS ("a").
|
| 1549 |
|
| 1550 |
|
| 1551 |
|
| 1552 | if (!ie1)
|
| 1553 | return -1;
|
| 1554 | if (!ie2)
|
| 1555 | return 1;
|
| 1556 |
|
| 1557 | switch (mode) {
|
| 1558 | case BSS_CMP_HIDE_ZLEN:
|
| 1559 | |
| 1560 | * In ZLEN mode we assume the BSS entry we're
|
| 1561 | * looking for has a zero-length SSID. So if
|
| 1562 | * the one we're looking at right now has that,
|
| 1563 | * return 0. Otherwise, return the difference
|
| 1564 | * in length, but since we're looking for the
|
| 1565 | * 0-length it's really equivalent to returning
|
| 1566 | * the length of the one we're looking at.
|
| 1567 | *
|
| 1568 | * No content comparison is needed as we assume
|
| 1569 | * the content length is zero.
|
| 1570 |
|
| 1571 | return ie2[1];
|
| 1572 | case BSS_CMP_REGULAR:
|
| 1573 | default:
|
| 1574 |
|
| 1575 | if (ie1[1] != ie2[1])
|
| 1576 | return ie2[1] - ie1[1];
|
| 1577 | return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
|
| 1578 | case BSS_CMP_HIDE_NUL:
|
| 1579 | if (ie1[1] != ie2[1])
|
| 1580 | return ie2[1] - ie1[1];
|
| 1581 |
|
| 1582 | for (i = 0; i < ie2[1]; i++)
|
| 1583 | if (ie2[i + 2])
|
| 1584 | return -1;
|
| 1585 | return 0;
|
| 1586 | }
|
| 1587 | }
|
| 1588 |
|
| 1589 | static bool cfg80211_bss_type_match(u16 capability,
|
| 1590 | enum nl80211_band band,
|
| 1591 | enum ieee80211_bss_type bss_type)
|
| 1592 | {
|
| 1593 | bool ret = true;
|
| 1594 | u16 mask, val;
|
| 1595 |
|
| 1596 | if (bss_type == IEEE80211_BSS_TYPE_ANY)
|
| 1597 | return ret;
|
| 1598 |
|
| 1599 | if (band == NL80211_BAND_60GHZ) {
|
| 1600 | mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
|
| 1601 | switch (bss_type) {
|
| 1602 | case IEEE80211_BSS_TYPE_ESS:
|
| 1603 | val = WLAN_CAPABILITY_DMG_TYPE_AP;
|
| 1604 | break;
|
| 1605 | case IEEE80211_BSS_TYPE_PBSS:
|
| 1606 | val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
|
| 1607 | break;
|
| 1608 | case IEEE80211_BSS_TYPE_IBSS:
|
| 1609 | val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
|
| 1610 | break;
|
| 1611 | default:
|
| 1612 | return false;
|
| 1613 | }
|
| 1614 | } else {
|
| 1615 | mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
|
| 1616 | switch (bss_type) {
|
| 1617 | case IEEE80211_BSS_TYPE_ESS:
|
| 1618 | val = WLAN_CAPABILITY_ESS;
|
| 1619 | break;
|
| 1620 | case IEEE80211_BSS_TYPE_IBSS:
|
| 1621 | val = WLAN_CAPABILITY_IBSS;
|
| 1622 | break;
|
| 1623 | case IEEE80211_BSS_TYPE_MBSS:
|
| 1624 | val = 0;
|
| 1625 | break;
|
| 1626 | default:
|
| 1627 | return false;
|
| 1628 | }
|
| 1629 | }
|
| 1630 |
|
| 1631 | ret = ((capability & mask) == val);
|
| 1632 | return ret;
|
| 1633 | }
|
| 1634 |
|
| 1635 |
|
| 1636 | struct cfg80211_bss *__cfg80211_get_bss(struct wiphy *wiphy,
|
| 1637 | struct ieee80211_channel *channel,
|
| 1638 | const u8 *bssid,
|
| 1639 | const u8 *ssid, size_t ssid_len,
|
| 1640 | enum ieee80211_bss_type bss_type,
|
| 1641 | enum ieee80211_privacy privacy,
|
| 1642 | u32 use_for,
|
| 1643 | struct netlink_ext_ack *extack)
|
| 1644 | {
|
| 1645 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 1646 | struct cfg80211_internal_bss *bss, *res = NULL;
|
| 1647 | bool expired = false, unusable = false;
|
| 1648 | unsigned long now = jiffies;
|
| 1649 | int bss_privacy;
|
| 1650 |
|
| 1651 | trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
|
| 1652 | privacy);
|
| 1653 |
|
| 1654 | spin_lock_bh(&rdev->bss_lock);
|
| 1655 |
|
| 1656 | list_for_each_entry(bss, &rdev->bss_list, list) {
|
| 1657 | if (!cfg80211_bss_type_match(bss->pub.capability,
|
| 1658 | bss->pub.channel->band, bss_type))
|
| 1659 | continue;
|
| 1660 |
|
| 1661 | bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
|
| 1662 | if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
|
| 1663 | (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
|
| 1664 | continue;
|
| 1665 | if (channel && bss->pub.channel != channel)
|
| 1666 | continue;
|
| 1667 | if (!is_valid_ether_addr(bss->pub.bssid))
|
| 1668 | continue;
|
| 1669 | if (!is_bss(&bss->pub, bssid, ssid, ssid_len))
|
| 1670 | continue;
|
| 1671 |
|
| 1672 | |
| 1673 | * The identity checks above must all come first so that
|
| 1674 | * the expired/unusable classification below only ever
|
| 1675 | * applies to entries that actually match the request.
|
| 1676 |
|
| 1677 |
|
| 1678 |
|
| 1679 | if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
|
| 1680 | !atomic_read(&bss->hold)) {
|
| 1681 | expired = true;
|
| 1682 | continue;
|
| 1683 | }
|
| 1684 |
|
| 1685 | if ((bss->pub.use_for & use_for) != use_for) {
|
| 1686 | unusable = true;
|
| 1687 | continue;
|
| 1688 | }
|
| 1689 |
|
| 1690 | res = bss;
|
| 1691 | bss_ref_get(rdev, res);
|
| 1692 | break;
|
| 1693 | }
|
| 1694 |
|
| 1695 | spin_unlock_bh(&rdev->bss_lock);
|
| 1696 | if (!res) {
|
| 1697 | if (expired && unusable)
|
| 1698 | NL_SET_ERR_MSG(extack,
|
| 1699 | "BSS entries are expired or cannot be used for the requested operation");
|
| 1700 | else if (unusable)
|
| 1701 | NL_SET_ERR_MSG(extack,
|
| 1702 | "BSS cannot be used for the requested operation");
|
| 1703 | else if (expired)
|
| 1704 | NL_SET_ERR_MSG(extack,
|
| 1705 | "BSS entry in scan results is expired");
|
| 1706 | else
|
| 1707 | NL_SET_ERR_MSG(extack,
|
| 1708 | "BSS not found in scan results");
|
| 1709 | return NULL;
|
| 1710 | }
|
| 1711 | trace_cfg80211_return_bss(&res->pub);
|
| 1712 | return &res->pub;
|
| 1713 | }
|
| 1714 | EXPORT_SYMBOL(__cfg80211_get_bss);
|
| 1715 |
|
| 1716 | static bool rb_insert_bss(struct cfg80211_registered_device *rdev,
|
| 1717 | struct cfg80211_internal_bss *bss)
|
| 1718 | {
|
| 1719 | struct rb_node **p = &rdev->bss_tree.rb_node;
|
| 1720 | struct rb_node *parent = NULL;
|
| 1721 | struct cfg80211_internal_bss *tbss;
|
| 1722 | int cmp;
|
| 1723 |
|
| 1724 | while (*p) {
|
| 1725 | parent = *p;
|
| 1726 | tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
|
| 1727 |
|
| 1728 | cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
|
| 1729 |
|
| 1730 | if (WARN_ON(!cmp)) {
|
| 1731 |
|
| 1732 | return false;
|
| 1733 | }
|
| 1734 |
|
| 1735 | if (cmp < 0)
|
| 1736 | p = &(*p)->rb_left;
|
| 1737 | else
|
| 1738 | p = &(*p)->rb_right;
|
| 1739 | }
|
| 1740 |
|
| 1741 | rb_link_node(&bss->rbn, parent, p);
|
| 1742 | rb_insert_color(&bss->rbn, &rdev->bss_tree);
|
| 1743 | return true;
|
| 1744 | }
|
| 1745 |
|
| 1746 | static struct cfg80211_internal_bss *
|
| 1747 | rb_find_bss(struct cfg80211_registered_device *rdev,
|
| 1748 | struct cfg80211_internal_bss *res,
|
| 1749 | enum bss_compare_mode mode)
|
| 1750 | {
|
| 1751 | struct rb_node *n = rdev->bss_tree.rb_node;
|
| 1752 | struct cfg80211_internal_bss *bss;
|
| 1753 | int r;
|
| 1754 |
|
| 1755 | while (n) {
|
| 1756 | bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
|
| 1757 | r = cmp_bss(&res->pub, &bss->pub, mode);
|
| 1758 |
|
| 1759 | if (r == 0)
|
| 1760 | return bss;
|
| 1761 | else if (r < 0)
|
| 1762 | n = n->rb_left;
|
| 1763 | else
|
| 1764 | n = n->rb_right;
|
| 1765 | }
|
| 1766 |
|
| 1767 | return NULL;
|
| 1768 | }
|
| 1769 |
|
| 1770 | static void cfg80211_insert_bss(struct cfg80211_registered_device *rdev,
|
| 1771 | struct cfg80211_internal_bss *bss)
|
| 1772 | {
|
| 1773 | lockdep_assert_held(&rdev->bss_lock);
|
| 1774 |
|
| 1775 | if (!rb_insert_bss(rdev, bss))
|
| 1776 | return;
|
| 1777 | list_add_tail(&bss->list, &rdev->bss_list);
|
| 1778 | rdev->bss_entries++;
|
| 1779 | }
|
| 1780 |
|
| 1781 | static void cfg80211_rehash_bss(struct cfg80211_registered_device *rdev,
|
| 1782 | struct cfg80211_internal_bss *bss)
|
| 1783 | {
|
| 1784 | lockdep_assert_held(&rdev->bss_lock);
|
| 1785 |
|
| 1786 | rb_erase(&bss->rbn, &rdev->bss_tree);
|
| 1787 | if (!rb_insert_bss(rdev, bss)) {
|
| 1788 | list_del(&bss->list);
|
| 1789 | if (!list_empty(&bss->hidden_list))
|
| 1790 | list_del_init(&bss->hidden_list);
|
| 1791 | if (!list_empty(&bss->pub.nontrans_list))
|
| 1792 | list_del_init(&bss->pub.nontrans_list);
|
| 1793 | rdev->bss_entries--;
|
| 1794 | }
|
| 1795 | rdev->bss_generation++;
|
| 1796 | }
|
| 1797 |
|
| 1798 | static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
|
| 1799 | struct cfg80211_internal_bss *new)
|
| 1800 | {
|
| 1801 | const struct cfg80211_bss_ies *ies;
|
| 1802 | struct cfg80211_internal_bss *bss;
|
| 1803 | const u8 *ie;
|
| 1804 | int i, ssidlen;
|
| 1805 | u8 fold = 0;
|
| 1806 | u32 n_entries = 0;
|
| 1807 |
|
| 1808 | ies = rcu_access_pointer(new->pub.beacon_ies);
|
| 1809 | if (WARN_ON(!ies))
|
| 1810 | return false;
|
| 1811 |
|
| 1812 | ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
|
| 1813 | if (!ie) {
|
| 1814 |
|
| 1815 | return true;
|
| 1816 | }
|
| 1817 |
|
| 1818 | ssidlen = ie[1];
|
| 1819 | for (i = 0; i < ssidlen; i++)
|
| 1820 | fold |= ie[2 + i];
|
| 1821 |
|
| 1822 | if (fold) {
|
| 1823 |
|
| 1824 | return true;
|
| 1825 | }
|
| 1826 |
|
| 1827 |
|
| 1828 |
|
| 1829 | list_for_each_entry(bss, &rdev->bss_list, list) {
|
| 1830 | |
| 1831 | * we're iterating all the entries anyway, so take the
|
| 1832 | * opportunity to validate the list length accounting
|
| 1833 |
|
| 1834 | n_entries++;
|
| 1835 |
|
| 1836 | if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
|
| 1837 | continue;
|
| 1838 | if (bss->pub.channel != new->pub.channel)
|
| 1839 | continue;
|
| 1840 | if (rcu_access_pointer(bss->pub.beacon_ies))
|
| 1841 | continue;
|
| 1842 | ies = rcu_access_pointer(bss->pub.ies);
|
| 1843 | if (!ies)
|
| 1844 | continue;
|
| 1845 | ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
|
| 1846 | if (!ie)
|
| 1847 | continue;
|
| 1848 | if (ssidlen && ie[1] != ssidlen)
|
| 1849 | continue;
|
| 1850 | if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
|
| 1851 | continue;
|
| 1852 | if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
|
| 1853 | list_del(&bss->hidden_list);
|
| 1854 |
|
| 1855 | list_add(&bss->hidden_list, &new->hidden_list);
|
| 1856 | bss->pub.hidden_beacon_bss = &new->pub;
|
| 1857 | new->refcount += bss->refcount;
|
| 1858 | rcu_assign_pointer(bss->pub.beacon_ies,
|
| 1859 | new->pub.beacon_ies);
|
| 1860 | }
|
| 1861 |
|
| 1862 | WARN_ONCE(n_entries != rdev->bss_entries,
|
| 1863 | "rdev bss entries[%d]/list[len:%d] corruption\n",
|
| 1864 | rdev->bss_entries, n_entries);
|
| 1865 |
|
| 1866 | return true;
|
| 1867 | }
|
| 1868 |
|
| 1869 | static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
|
| 1870 | const struct cfg80211_bss_ies *new_ies,
|
| 1871 | const struct cfg80211_bss_ies *old_ies)
|
| 1872 | {
|
| 1873 | struct cfg80211_internal_bss *bss;
|
| 1874 |
|
| 1875 |
|
| 1876 | list_for_each_entry(bss, &known->hidden_list, hidden_list) {
|
| 1877 | const struct cfg80211_bss_ies *ies;
|
| 1878 |
|
| 1879 | ies = rcu_access_pointer(bss->pub.beacon_ies);
|
| 1880 | WARN_ON(ies != old_ies);
|
| 1881 |
|
| 1882 | rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
|
| 1883 |
|
| 1884 | bss->ts = known->ts;
|
| 1885 | bss->pub.ts_boottime = known->pub.ts_boottime;
|
| 1886 | }
|
| 1887 | }
|
| 1888 |
|
| 1889 | static void cfg80211_check_stuck_ecsa(struct cfg80211_registered_device *rdev,
|
| 1890 | struct cfg80211_internal_bss *known,
|
| 1891 | const struct cfg80211_bss_ies *old)
|
| 1892 | {
|
| 1893 | const struct ieee80211_ext_chansw_ie *ecsa;
|
| 1894 | const struct element *elem_new, *elem_old;
|
| 1895 | const struct cfg80211_bss_ies *new, *bcn;
|
| 1896 |
|
| 1897 | if (known->pub.proberesp_ecsa_stuck)
|
| 1898 | return;
|
| 1899 |
|
| 1900 | new = rcu_dereference_protected(known->pub.proberesp_ies,
|
| 1901 | lockdep_is_held(&rdev->bss_lock));
|
| 1902 | if (WARN_ON(!new))
|
| 1903 | return;
|
| 1904 |
|
| 1905 | if (new->tsf - old->tsf < USEC_PER_SEC)
|
| 1906 | return;
|
| 1907 |
|
| 1908 | elem_old = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN,
|
| 1909 | old->data, old->len);
|
| 1910 | if (!elem_old)
|
| 1911 | return;
|
| 1912 |
|
| 1913 | elem_new = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN,
|
| 1914 | new->data, new->len);
|
| 1915 | if (!elem_new)
|
| 1916 | return;
|
| 1917 |
|
| 1918 | bcn = rcu_dereference_protected(known->pub.beacon_ies,
|
| 1919 | lockdep_is_held(&rdev->bss_lock));
|
| 1920 | if (bcn &&
|
| 1921 | cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN,
|
| 1922 | bcn->data, bcn->len))
|
| 1923 | return;
|
| 1924 |
|
| 1925 | if (elem_new->datalen != elem_old->datalen)
|
| 1926 | return;
|
| 1927 | if (elem_new->datalen < sizeof(struct ieee80211_ext_chansw_ie))
|
| 1928 | return;
|
| 1929 | if (memcmp(elem_new->data, elem_old->data, elem_new->datalen))
|
| 1930 | return;
|
| 1931 |
|
| 1932 | ecsa = (void *)elem_new->data;
|
| 1933 |
|
| 1934 | if (!ecsa->mode)
|
| 1935 | return;
|
| 1936 |
|
| 1937 | if (ecsa->new_ch_num !=
|
| 1938 | ieee80211_frequency_to_channel(known->pub.channel->center_freq))
|
| 1939 | return;
|
| 1940 |
|
| 1941 | known->pub.proberesp_ecsa_stuck = 1;
|
| 1942 | }
|
| 1943 |
|
| 1944 | static bool
|
| 1945 | cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
|
| 1946 | struct cfg80211_internal_bss *known,
|
| 1947 | struct cfg80211_internal_bss *new,
|
| 1948 | bool signal_valid)
|
| 1949 | {
|
| 1950 | lockdep_assert_held(&rdev->bss_lock);
|
| 1951 |
|
| 1952 |
|
| 1953 | known->ts = new->ts;
|
| 1954 | known->pub.ts_boottime = new->pub.ts_boottime;
|
| 1955 |
|
| 1956 |
|
| 1957 | if (rcu_access_pointer(new->pub.proberesp_ies)) {
|
| 1958 | const struct cfg80211_bss_ies *old;
|
| 1959 |
|
| 1960 | old = rcu_access_pointer(known->pub.proberesp_ies);
|
| 1961 |
|
| 1962 | rcu_assign_pointer(known->pub.proberesp_ies,
|
| 1963 | new->pub.proberesp_ies);
|
| 1964 |
|
| 1965 | rcu_assign_pointer(known->pub.ies,
|
| 1966 | new->pub.proberesp_ies);
|
| 1967 | if (old) {
|
| 1968 | cfg80211_check_stuck_ecsa(rdev, known, old);
|
| 1969 | kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
|
| 1970 | }
|
| 1971 | }
|
| 1972 |
|
| 1973 | if (rcu_access_pointer(new->pub.beacon_ies)) {
|
| 1974 | const struct cfg80211_bss_ies *old;
|
| 1975 |
|
| 1976 | if (known->pub.hidden_beacon_bss &&
|
| 1977 | !list_empty(&known->hidden_list)) {
|
| 1978 | const struct cfg80211_bss_ies *f;
|
| 1979 |
|
| 1980 | |
| 1981 | * response members of a group, but we're
|
| 1982 | * receiving a beacon (beacon_ies in the new
|
| 1983 | * bss is used). This can only mean that the
|
| 1984 | * AP changed its beacon from not having an
|
| 1985 | * SSID to showing it, which is confusing so
|
| 1986 | * drop this information.
|
| 1987 |
|
| 1988 |
|
| 1989 | f = rcu_access_pointer(new->pub.beacon_ies);
|
| 1990 | if (!new->pub.hidden_beacon_bss)
|
| 1991 | kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
|
| 1992 | return false;
|
| 1993 | }
|
| 1994 |
|
| 1995 | if (!new->pub.hidden_beacon_bss) {
|
| 1996 | old = rcu_access_pointer(known->pub.beacon_ies);
|
| 1997 |
|
| 1998 | rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
|
| 1999 |
|
| 2000 |
|
| 2001 | if (old == rcu_access_pointer(known->pub.ies))
|
| 2002 | rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
|
| 2003 |
|
| 2004 | cfg80211_update_hidden_bsses(known,
|
| 2005 | rcu_access_pointer(new->pub.beacon_ies),
|
| 2006 | old);
|
| 2007 |
|
| 2008 | if (old)
|
| 2009 | kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
|
| 2010 | }
|
| 2011 | }
|
| 2012 |
|
| 2013 | known->pub.beacon_interval = new->pub.beacon_interval;
|
| 2014 |
|
| 2015 | |
| 2016 | * adjacent channel.
|
| 2017 |
|
| 2018 | if (signal_valid)
|
| 2019 | known->pub.signal = new->pub.signal;
|
| 2020 | known->pub.capability = new->pub.capability;
|
| 2021 | known->parent_tsf = new->parent_tsf;
|
| 2022 | known->pub.chains = new->pub.chains;
|
| 2023 | memcpy(known->pub.chain_signal, new->pub.chain_signal,
|
| 2024 | IEEE80211_MAX_CHAINS);
|
| 2025 | ether_addr_copy(known->parent_bssid, new->parent_bssid);
|
| 2026 | known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
|
| 2027 | known->pub.bssid_index = new->pub.bssid_index;
|
| 2028 | known->pub.use_for = new->pub.use_for;
|
| 2029 | known->pub.cannot_use_reasons = new->pub.cannot_use_reasons;
|
| 2030 | known->bss_source = new->bss_source;
|
| 2031 |
|
| 2032 | return true;
|
| 2033 | }
|
| 2034 |
|
| 2035 |
|
| 2036 | static struct cfg80211_internal_bss *
|
| 2037 | __cfg80211_bss_update(struct cfg80211_registered_device *rdev,
|
| 2038 | struct cfg80211_internal_bss *tmp,
|
| 2039 | bool signal_valid, unsigned long ts)
|
| 2040 | {
|
| 2041 | struct cfg80211_internal_bss *found = NULL;
|
| 2042 | struct cfg80211_bss_ies *ies;
|
| 2043 |
|
| 2044 | if (WARN_ON(!tmp->pub.channel))
|
| 2045 | goto free_ies;
|
| 2046 |
|
| 2047 | tmp->ts = ts;
|
| 2048 |
|
| 2049 | if (WARN_ON(!rcu_access_pointer(tmp->pub.ies)))
|
| 2050 | goto free_ies;
|
| 2051 |
|
| 2052 | found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
|
| 2053 |
|
| 2054 | if (found) {
|
| 2055 | if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid))
|
| 2056 | return NULL;
|
| 2057 | } else {
|
| 2058 | struct cfg80211_internal_bss *new;
|
| 2059 | struct cfg80211_internal_bss *hidden;
|
| 2060 |
|
| 2061 | |
| 2062 | * create a copy -- the "res" variable that is passed in
|
| 2063 | * is allocated on the stack since it's not needed in the
|
| 2064 | * more common case of an update
|
| 2065 |
|
| 2066 | new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
|
| 2067 | GFP_ATOMIC);
|
| 2068 | if (!new)
|
| 2069 | goto free_ies;
|
| 2070 | memcpy(new, tmp, sizeof(*new));
|
| 2071 | new->refcount = 1;
|
| 2072 | INIT_LIST_HEAD(&new->hidden_list);
|
| 2073 | INIT_LIST_HEAD(&new->pub.nontrans_list);
|
| 2074 |
|
| 2075 | new->pub.transmitted_bss = NULL;
|
| 2076 |
|
| 2077 | if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
|
| 2078 | hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
|
| 2079 | if (!hidden)
|
| 2080 | hidden = rb_find_bss(rdev, tmp,
|
| 2081 | BSS_CMP_HIDE_NUL);
|
| 2082 | |
| 2083 | * Only group with an entry with beacon data, otherwise
|
| 2084 | * beacon data can never be filled/updated.
|
| 2085 |
|
| 2086 | if (hidden &&
|
| 2087 | !rcu_access_pointer(hidden->pub.beacon_ies))
|
| 2088 | hidden = NULL;
|
| 2089 | if (hidden) {
|
| 2090 | new->pub.hidden_beacon_bss = &hidden->pub;
|
| 2091 | list_add(&new->hidden_list,
|
| 2092 | &hidden->hidden_list);
|
| 2093 | hidden->refcount++;
|
| 2094 |
|
| 2095 | ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
|
| 2096 | rcu_assign_pointer(new->pub.beacon_ies,
|
| 2097 | hidden->pub.beacon_ies);
|
| 2098 | if (ies)
|
| 2099 | kfree_rcu(ies, rcu_head);
|
| 2100 | }
|
| 2101 | } else {
|
| 2102 | |
| 2103 | * Ok so we found a beacon, and don't have an entry. If
|
| 2104 | * it's a beacon with hidden SSID, we might be in for an
|
| 2105 | * expensive search for any probe responses that should
|
| 2106 | * be grouped with this beacon for updates ...
|
| 2107 |
|
| 2108 | if (!cfg80211_combine_bsses(rdev, new)) {
|
| 2109 | bss_ref_put(rdev, new);
|
| 2110 | return NULL;
|
| 2111 | }
|
| 2112 | }
|
| 2113 |
|
| 2114 | if (rdev->bss_entries >= bss_entries_limit &&
|
| 2115 | !cfg80211_bss_expire_oldest(rdev)) {
|
| 2116 | bss_ref_put(rdev, new);
|
| 2117 | return NULL;
|
| 2118 | }
|
| 2119 |
|
| 2120 |
|
| 2121 | if (tmp->pub.transmitted_bss) {
|
| 2122 | new->pub.transmitted_bss = tmp->pub.transmitted_bss;
|
| 2123 | bss_ref_get(rdev, bss_from_pub(tmp->pub.transmitted_bss));
|
| 2124 | }
|
| 2125 |
|
| 2126 | cfg80211_insert_bss(rdev, new);
|
| 2127 | found = new;
|
| 2128 | }
|
| 2129 |
|
| 2130 | rdev->bss_generation++;
|
| 2131 | bss_ref_get(rdev, found);
|
| 2132 |
|
| 2133 | return found;
|
| 2134 |
|
| 2135 | free_ies:
|
| 2136 | ies = (void *)rcu_access_pointer(tmp->pub.beacon_ies);
|
| 2137 | if (ies)
|
| 2138 | kfree_rcu(ies, rcu_head);
|
| 2139 | ies = (void *)rcu_access_pointer(tmp->pub.proberesp_ies);
|
| 2140 | if (ies)
|
| 2141 | kfree_rcu(ies, rcu_head);
|
| 2142 |
|
| 2143 | return NULL;
|
| 2144 | }
|
| 2145 |
|
| 2146 | struct cfg80211_internal_bss *
|
| 2147 | cfg80211_bss_update(struct cfg80211_registered_device *rdev,
|
| 2148 | struct cfg80211_internal_bss *tmp,
|
| 2149 | bool signal_valid, unsigned long ts)
|
| 2150 | {
|
| 2151 | struct cfg80211_internal_bss *res;
|
| 2152 |
|
| 2153 | spin_lock_bh(&rdev->bss_lock);
|
| 2154 | res = __cfg80211_bss_update(rdev, tmp, signal_valid, ts);
|
| 2155 | spin_unlock_bh(&rdev->bss_lock);
|
| 2156 |
|
| 2157 | return res;
|
| 2158 | }
|
| 2159 |
|
| 2160 | int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen,
|
| 2161 | enum nl80211_band band)
|
| 2162 | {
|
| 2163 | const struct element *tmp;
|
| 2164 |
|
| 2165 | if (band == NL80211_BAND_6GHZ) {
|
| 2166 | struct ieee80211_he_operation *he_oper;
|
| 2167 |
|
| 2168 | tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie,
|
| 2169 | ielen);
|
| 2170 | if (tmp && tmp->datalen >= sizeof(*he_oper) &&
|
| 2171 | tmp->datalen >= ieee80211_he_oper_size(&tmp->data[1])) {
|
| 2172 | const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
|
| 2173 |
|
| 2174 | he_oper = (void *)&tmp->data[1];
|
| 2175 |
|
| 2176 | he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
|
| 2177 | if (!he_6ghz_oper)
|
| 2178 | return -1;
|
| 2179 |
|
| 2180 | return he_6ghz_oper->primary;
|
| 2181 | }
|
| 2182 | } else if (band == NL80211_BAND_S1GHZ) {
|
| 2183 | tmp = cfg80211_find_elem(WLAN_EID_S1G_OPERATION, ie, ielen);
|
| 2184 | if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) {
|
| 2185 | struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data;
|
| 2186 |
|
| 2187 | return s1gop->oper_ch;
|
| 2188 | }
|
| 2189 | } else {
|
| 2190 | tmp = cfg80211_find_elem(WLAN_EID_DS_PARAMS, ie, ielen);
|
| 2191 | if (tmp && tmp->datalen == 1)
|
| 2192 | return tmp->data[0];
|
| 2193 |
|
| 2194 | tmp = cfg80211_find_elem(WLAN_EID_HT_OPERATION, ie, ielen);
|
| 2195 | if (tmp &&
|
| 2196 | tmp->datalen >= sizeof(struct ieee80211_ht_operation)) {
|
| 2197 | struct ieee80211_ht_operation *htop = (void *)tmp->data;
|
| 2198 |
|
| 2199 | return htop->primary_chan;
|
| 2200 | }
|
| 2201 | }
|
| 2202 |
|
| 2203 | return -1;
|
| 2204 | }
|
| 2205 | EXPORT_SYMBOL(cfg80211_get_ies_channel_number);
|
| 2206 |
|
| 2207 | |
| 2208 | * Update RX channel information based on the available frame payload
|
| 2209 | * information. This is mainly for the 2.4 GHz band where frames can be received
|
| 2210 | * from neighboring channels and the Beacon frames use the DSSS Parameter Set
|
| 2211 | * element to indicate the current (transmitting) channel, but this might also
|
| 2212 | * be needed on other bands if RX frequency does not match with the actual
|
| 2213 | * operating channel of a BSS, or if the AP reports a different primary channel.
|
| 2214 |
|
| 2215 | static struct ieee80211_channel *
|
| 2216 | cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
|
| 2217 | struct ieee80211_channel *channel)
|
| 2218 | {
|
| 2219 | u32 freq;
|
| 2220 | int channel_number;
|
| 2221 | struct ieee80211_channel *alt_channel;
|
| 2222 |
|
| 2223 | channel_number = cfg80211_get_ies_channel_number(ie, ielen,
|
| 2224 | channel->band);
|
| 2225 |
|
| 2226 | if (channel_number < 0) {
|
| 2227 |
|
| 2228 | return channel;
|
| 2229 | }
|
| 2230 |
|
| 2231 | freq = ieee80211_channel_to_freq_khz(channel_number, channel->band);
|
| 2232 |
|
| 2233 | |
| 2234 | * Frame info (beacon/prob res) is the same as received channel,
|
| 2235 | * no need for further processing.
|
| 2236 |
|
| 2237 | if (freq == ieee80211_channel_to_khz(channel))
|
| 2238 | return channel;
|
| 2239 |
|
| 2240 | alt_channel = ieee80211_get_channel_khz(wiphy, freq);
|
| 2241 | if (!alt_channel) {
|
| 2242 | if (channel->band == NL80211_BAND_2GHZ ||
|
| 2243 | channel->band == NL80211_BAND_6GHZ) {
|
| 2244 | |
| 2245 | * Better not allow unexpected channels when that could
|
| 2246 | * be going beyond the 1-11 range (e.g., discovering
|
| 2247 | * BSS on channel 12 when radio is configured for
|
| 2248 | * channel 11) or beyond the 6 GHz channel range.
|
| 2249 |
|
| 2250 | return NULL;
|
| 2251 | }
|
| 2252 |
|
| 2253 |
|
| 2254 | return channel;
|
| 2255 | }
|
| 2256 |
|
| 2257 | |
| 2258 | * Use the channel determined through the payload channel number
|
| 2259 | * instead of the RX channel reported by the driver.
|
| 2260 |
|
| 2261 | if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
|
| 2262 | return NULL;
|
| 2263 | return alt_channel;
|
| 2264 | }
|
| 2265 |
|
| 2266 | struct cfg80211_inform_single_bss_data {
|
| 2267 | struct cfg80211_inform_bss *drv_data;
|
| 2268 | enum cfg80211_bss_frame_type ftype;
|
| 2269 | struct ieee80211_channel *channel;
|
| 2270 | u8 bssid[ETH_ALEN];
|
| 2271 | u64 tsf;
|
| 2272 | u16 capability;
|
| 2273 | u16 beacon_interval;
|
| 2274 | const u8 *ie;
|
| 2275 | size_t ielen;
|
| 2276 |
|
| 2277 | enum bss_source_type bss_source;
|
| 2278 |
|
| 2279 | struct cfg80211_bss *source_bss;
|
| 2280 | u8 max_bssid_indicator;
|
| 2281 | u8 bssid_index;
|
| 2282 |
|
| 2283 | u8 use_for;
|
| 2284 | u64 cannot_use_reasons;
|
| 2285 | };
|
| 2286 |
|
| 2287 | enum ieee80211_ap_reg_power
|
| 2288 | cfg80211_get_6ghz_power_type(const u8 *elems, size_t elems_len,
|
| 2289 | u32 client_flags)
|
| 2290 | {
|
| 2291 | const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
|
| 2292 | struct ieee80211_he_operation *he_oper;
|
| 2293 | const struct element *tmp;
|
| 2294 |
|
| 2295 | tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
|
| 2296 | elems, elems_len);
|
| 2297 | if (!tmp || tmp->datalen < sizeof(*he_oper) + 1 ||
|
| 2298 | tmp->datalen < ieee80211_he_oper_size(tmp->data + 1))
|
| 2299 | return IEEE80211_REG_UNSET_AP;
|
| 2300 |
|
| 2301 | he_oper = (void *)&tmp->data[1];
|
| 2302 | he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
|
| 2303 |
|
| 2304 | if (!he_6ghz_oper)
|
| 2305 | return IEEE80211_REG_UNSET_AP;
|
| 2306 |
|
| 2307 | return cfg80211_6ghz_power_type(he_6ghz_oper->control, client_flags);
|
| 2308 | }
|
| 2309 |
|
| 2310 | static bool cfg80211_6ghz_power_type_valid(const u8 *elems, size_t elems_len,
|
| 2311 | const u32 flags)
|
| 2312 | {
|
| 2313 | switch (cfg80211_get_6ghz_power_type(elems, elems_len, flags)) {
|
| 2314 | case IEEE80211_REG_LPI_AP:
|
| 2315 | return true;
|
| 2316 | case IEEE80211_REG_SP_AP:
|
| 2317 | return !(flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT);
|
| 2318 | case IEEE80211_REG_VLP_AP:
|
| 2319 | return !(flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT);
|
| 2320 | default:
|
| 2321 | return false;
|
| 2322 | }
|
| 2323 | }
|
| 2324 |
|
| 2325 |
|
| 2326 | static struct cfg80211_bss *
|
| 2327 | cfg80211_inform_single_bss_data(struct wiphy *wiphy,
|
| 2328 | struct cfg80211_inform_single_bss_data *data,
|
| 2329 | gfp_t gfp)
|
| 2330 | {
|
| 2331 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 2332 | struct cfg80211_inform_bss *drv_data = data->drv_data;
|
| 2333 | struct cfg80211_bss_ies *ies;
|
| 2334 | struct ieee80211_channel *channel;
|
| 2335 | struct cfg80211_internal_bss tmp = {}, *res;
|
| 2336 | int bss_type;
|
| 2337 | bool signal_valid;
|
| 2338 | unsigned long ts;
|
| 2339 |
|
| 2340 | if (WARN_ON(!wiphy))
|
| 2341 | return NULL;
|
| 2342 |
|
| 2343 | if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
|
| 2344 | (drv_data->signal < 0 || drv_data->signal > 100)))
|
| 2345 | return NULL;
|
| 2346 |
|
| 2347 | if (WARN_ON(data->bss_source != BSS_SOURCE_DIRECT && !data->source_bss))
|
| 2348 | return NULL;
|
| 2349 |
|
| 2350 | channel = data->channel;
|
| 2351 | if (!channel)
|
| 2352 | channel = cfg80211_get_bss_channel(wiphy, data->ie, data->ielen,
|
| 2353 | drv_data->chan);
|
| 2354 | if (!channel)
|
| 2355 | return NULL;
|
| 2356 |
|
| 2357 | if (channel->band == NL80211_BAND_6GHZ &&
|
| 2358 | !cfg80211_6ghz_power_type_valid(data->ie, data->ielen,
|
| 2359 | channel->flags)) {
|
| 2360 | data->use_for = 0;
|
| 2361 | data->cannot_use_reasons =
|
| 2362 | NL80211_BSS_CANNOT_USE_6GHZ_PWR_MISMATCH;
|
| 2363 | }
|
| 2364 |
|
| 2365 | memcpy(tmp.pub.bssid, data->bssid, ETH_ALEN);
|
| 2366 | tmp.pub.channel = channel;
|
| 2367 | if (data->bss_source != BSS_SOURCE_STA_PROFILE)
|
| 2368 | tmp.pub.signal = drv_data->signal;
|
| 2369 | else
|
| 2370 | tmp.pub.signal = 0;
|
| 2371 | tmp.pub.beacon_interval = data->beacon_interval;
|
| 2372 | tmp.pub.capability = data->capability;
|
| 2373 | tmp.pub.ts_boottime = drv_data->boottime_ns;
|
| 2374 | tmp.parent_tsf = drv_data->parent_tsf;
|
| 2375 | ether_addr_copy(tmp.parent_bssid, drv_data->parent_bssid);
|
| 2376 | tmp.pub.chains = drv_data->chains;
|
| 2377 | memcpy(tmp.pub.chain_signal, drv_data->chain_signal,
|
| 2378 | IEEE80211_MAX_CHAINS);
|
| 2379 | tmp.pub.use_for = data->use_for;
|
| 2380 | tmp.pub.cannot_use_reasons = data->cannot_use_reasons;
|
| 2381 | tmp.bss_source = data->bss_source;
|
| 2382 |
|
| 2383 | switch (data->bss_source) {
|
| 2384 | case BSS_SOURCE_MBSSID:
|
| 2385 | tmp.pub.transmitted_bss = data->source_bss;
|
| 2386 | fallthrough;
|
| 2387 | case BSS_SOURCE_STA_PROFILE:
|
| 2388 | ts = bss_from_pub(data->source_bss)->ts;
|
| 2389 | tmp.pub.bssid_index = data->bssid_index;
|
| 2390 | tmp.pub.max_bssid_indicator = data->max_bssid_indicator;
|
| 2391 | break;
|
| 2392 | case BSS_SOURCE_DIRECT:
|
| 2393 | ts = jiffies;
|
| 2394 |
|
| 2395 | if (channel->band == NL80211_BAND_60GHZ) {
|
| 2396 | bss_type = data->capability &
|
| 2397 | WLAN_CAPABILITY_DMG_TYPE_MASK;
|
| 2398 | if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
|
| 2399 | bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
|
| 2400 | regulatory_hint_found_beacon(wiphy, channel,
|
| 2401 | gfp);
|
| 2402 | } else {
|
| 2403 | if (data->capability & WLAN_CAPABILITY_ESS)
|
| 2404 | regulatory_hint_found_beacon(wiphy, channel,
|
| 2405 | gfp);
|
| 2406 | }
|
| 2407 | break;
|
| 2408 | }
|
| 2409 |
|
| 2410 | |
| 2411 | * If we do not know here whether the IEs are from a Beacon or Probe
|
| 2412 | * Response frame, we need to pick one of the options and only use it
|
| 2413 | * with the driver that does not provide the full Beacon/Probe Response
|
| 2414 | * frame. Use Beacon frame pointer to avoid indicating that this should
|
| 2415 | * override the IEs pointer should we have received an earlier
|
| 2416 | * indication of Probe Response data.
|
| 2417 |
|
| 2418 | ies = kzalloc(sizeof(*ies) + data->ielen, gfp);
|
| 2419 | if (!ies)
|
| 2420 | return NULL;
|
| 2421 | ies->len = data->ielen;
|
| 2422 | ies->tsf = data->tsf;
|
| 2423 | ies->from_beacon = false;
|
| 2424 | memcpy(ies->data, data->ie, data->ielen);
|
| 2425 |
|
| 2426 | switch (data->ftype) {
|
| 2427 | case CFG80211_BSS_FTYPE_BEACON:
|
| 2428 | case CFG80211_BSS_FTYPE_S1G_BEACON:
|
| 2429 | ies->from_beacon = true;
|
| 2430 | fallthrough;
|
| 2431 | case CFG80211_BSS_FTYPE_UNKNOWN:
|
| 2432 | rcu_assign_pointer(tmp.pub.beacon_ies, ies);
|
| 2433 | break;
|
| 2434 | case CFG80211_BSS_FTYPE_PRESP:
|
| 2435 | rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
|
| 2436 | break;
|
| 2437 | }
|
| 2438 | rcu_assign_pointer(tmp.pub.ies, ies);
|
| 2439 |
|
| 2440 | signal_valid = drv_data->chan == channel;
|
| 2441 | spin_lock_bh(&rdev->bss_lock);
|
| 2442 | res = __cfg80211_bss_update(rdev, &tmp, signal_valid, ts);
|
| 2443 | if (!res)
|
| 2444 | goto drop;
|
| 2445 |
|
| 2446 | rdev_inform_bss(rdev, &res->pub, ies, drv_data->drv_data);
|
| 2447 |
|
| 2448 | if (data->bss_source == BSS_SOURCE_MBSSID) {
|
| 2449 | |
| 2450 | * transmitting bss' list if it is not there
|
| 2451 |
|
| 2452 | if (cfg80211_add_nontrans_list(data->source_bss, &res->pub)) {
|
| 2453 | if (__cfg80211_unlink_bss(rdev, res)) {
|
| 2454 | rdev->bss_generation++;
|
| 2455 | res = NULL;
|
| 2456 | }
|
| 2457 | }
|
| 2458 |
|
| 2459 | if (!res)
|
| 2460 | goto drop;
|
| 2461 | }
|
| 2462 | spin_unlock_bh(&rdev->bss_lock);
|
| 2463 |
|
| 2464 | trace_cfg80211_return_bss(&res->pub);
|
| 2465 |
|
| 2466 | return &res->pub;
|
| 2467 |
|
| 2468 | drop:
|
| 2469 | spin_unlock_bh(&rdev->bss_lock);
|
| 2470 | return NULL;
|
| 2471 | }
|
| 2472 |
|
| 2473 | static bool cfg80211_iter_profile_continuation(const u8 *ie, size_t ielen,
|
| 2474 | const struct element **mbssid,
|
| 2475 | const struct element **sub_elem)
|
| 2476 | {
|
| 2477 | const u8 *mbssid_end = (*mbssid)->data + (*mbssid)->datalen;
|
| 2478 | const struct element *next_mbssid;
|
| 2479 | const struct element *next_sub;
|
| 2480 |
|
| 2481 | next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
|
| 2482 | mbssid_end,
|
| 2483 | ielen - (mbssid_end - ie));
|
| 2484 |
|
| 2485 | |
| 2486 | * If it is not the last subelement in current MBSSID IE or there isn't
|
| 2487 | * a next MBSSID IE - profile is complete.
|
| 2488 |
|
| 2489 | if (((*sub_elem)->data + (*sub_elem)->datalen < mbssid_end - 1) ||
|
| 2490 | !next_mbssid)
|
| 2491 | return false;
|
| 2492 |
|
| 2493 |
|
| 2494 |
|
| 2495 | if (next_mbssid->datalen < 4)
|
| 2496 | return false;
|
| 2497 |
|
| 2498 | next_sub = (void *)&next_mbssid->data[1];
|
| 2499 |
|
| 2500 | if (next_mbssid->data + next_mbssid->datalen <
|
| 2501 | next_sub->data + next_sub->datalen)
|
| 2502 | return false;
|
| 2503 |
|
| 2504 | if (next_sub->id != 0 || next_sub->datalen < 2)
|
| 2505 | return false;
|
| 2506 |
|
| 2507 | |
| 2508 | * Check if the first element in the next sub element is a start
|
| 2509 | * of a new profile
|
| 2510 |
|
| 2511 | if (next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP)
|
| 2512 | return false;
|
| 2513 |
|
| 2514 | *mbssid = next_mbssid;
|
| 2515 | *sub_elem = next_sub;
|
| 2516 | return true;
|
| 2517 | }
|
| 2518 |
|
| 2519 | size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
|
| 2520 | const struct element *mbssid_elem,
|
| 2521 | const struct element *sub_elem,
|
| 2522 | u8 *merged_ie, size_t max_copy_len)
|
| 2523 | {
|
| 2524 | size_t copied_len = sub_elem->datalen;
|
| 2525 |
|
| 2526 | if (sub_elem->datalen > max_copy_len)
|
| 2527 | return 0;
|
| 2528 |
|
| 2529 | memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
|
| 2530 |
|
| 2531 | while (cfg80211_iter_profile_continuation(ie, ielen,
|
| 2532 | &mbssid_elem,
|
| 2533 | &sub_elem)) {
|
| 2534 | if (copied_len + sub_elem->datalen > max_copy_len)
|
| 2535 | break;
|
| 2536 | memcpy(merged_ie + copied_len, sub_elem->data,
|
| 2537 | sub_elem->datalen);
|
| 2538 | copied_len += sub_elem->datalen;
|
| 2539 | }
|
| 2540 |
|
| 2541 | return copied_len;
|
| 2542 | }
|
| 2543 | EXPORT_SYMBOL(cfg80211_merge_profile);
|
| 2544 |
|
| 2545 | static void
|
| 2546 | cfg80211_parse_mbssid_data(struct wiphy *wiphy,
|
| 2547 | struct cfg80211_inform_single_bss_data *tx_data,
|
| 2548 | struct cfg80211_bss *source_bss,
|
| 2549 | gfp_t gfp)
|
| 2550 | {
|
| 2551 | struct cfg80211_inform_single_bss_data data = {
|
| 2552 | .drv_data = tx_data->drv_data,
|
| 2553 | .ftype = tx_data->ftype,
|
| 2554 | .tsf = tx_data->tsf,
|
| 2555 | .beacon_interval = tx_data->beacon_interval,
|
| 2556 | .source_bss = source_bss,
|
| 2557 | .bss_source = BSS_SOURCE_MBSSID,
|
| 2558 | .use_for = tx_data->use_for,
|
| 2559 | .cannot_use_reasons = tx_data->cannot_use_reasons,
|
| 2560 | };
|
| 2561 | const u8 *mbssid_index_ie;
|
| 2562 | const struct element *elem, *sub;
|
| 2563 | u8 *new_ie, *profile;
|
| 2564 | u64 seen_indices = 0;
|
| 2565 | struct cfg80211_bss *bss;
|
| 2566 |
|
| 2567 | if (!source_bss)
|
| 2568 | return;
|
| 2569 | if (!cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
|
| 2570 | tx_data->ie, tx_data->ielen))
|
| 2571 | return;
|
| 2572 | if (!wiphy->support_mbssid)
|
| 2573 | return;
|
| 2574 | if (wiphy->support_only_he_mbssid &&
|
| 2575 | !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
|
| 2576 | tx_data->ie, tx_data->ielen))
|
| 2577 | return;
|
| 2578 |
|
| 2579 | new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
|
| 2580 | if (!new_ie)
|
| 2581 | return;
|
| 2582 |
|
| 2583 | profile = kmalloc(tx_data->ielen, gfp);
|
| 2584 | if (!profile)
|
| 2585 | goto out;
|
| 2586 |
|
| 2587 | for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
|
| 2588 | tx_data->ie, tx_data->ielen) {
|
| 2589 | if (elem->datalen < 4)
|
| 2590 | continue;
|
| 2591 | if (elem->data[0] < 1 || (int)elem->data[0] > 8)
|
| 2592 | continue;
|
| 2593 | for_each_element(sub, elem->data + 1, elem->datalen - 1) {
|
| 2594 | u8 profile_len;
|
| 2595 |
|
| 2596 | if (sub->id != 0 || sub->datalen < 4) {
|
| 2597 |
|
| 2598 | continue;
|
| 2599 | }
|
| 2600 |
|
| 2601 | if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
|
| 2602 | sub->data[1] != 2) {
|
| 2603 | |
| 2604 | * BSSID Profile is not the Nontransmitted
|
| 2605 | * BSSID Capability element.
|
| 2606 |
|
| 2607 | continue;
|
| 2608 | }
|
| 2609 |
|
| 2610 | memset(profile, 0, tx_data->ielen);
|
| 2611 | profile_len = cfg80211_merge_profile(tx_data->ie,
|
| 2612 | tx_data->ielen,
|
| 2613 | elem,
|
| 2614 | sub,
|
| 2615 | profile,
|
| 2616 | tx_data->ielen);
|
| 2617 |
|
| 2618 |
|
| 2619 | mbssid_index_ie = cfg80211_find_ie
|
| 2620 | (WLAN_EID_MULTI_BSSID_IDX,
|
| 2621 | profile, profile_len);
|
| 2622 | if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
|
| 2623 | mbssid_index_ie[2] == 0 ||
|
| 2624 | mbssid_index_ie[2] > 46 ||
|
| 2625 | mbssid_index_ie[2] >= (1 << elem->data[0])) {
|
| 2626 |
|
| 2627 | continue;
|
| 2628 | }
|
| 2629 |
|
| 2630 | if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
|
| 2631 |
|
| 2632 | net_dbg_ratelimited("Partial info for BSSID index %d\n",
|
| 2633 | mbssid_index_ie[2]);
|
| 2634 |
|
| 2635 | seen_indices |= BIT_ULL(mbssid_index_ie[2]);
|
| 2636 |
|
| 2637 | data.bssid_index = mbssid_index_ie[2];
|
| 2638 | data.max_bssid_indicator = elem->data[0];
|
| 2639 |
|
| 2640 | cfg80211_gen_new_bssid(tx_data->bssid,
|
| 2641 | data.max_bssid_indicator,
|
| 2642 | data.bssid_index,
|
| 2643 | data.bssid);
|
| 2644 |
|
| 2645 | memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
|
| 2646 | data.ie = new_ie;
|
| 2647 | data.ielen = cfg80211_gen_new_ie(tx_data->ie,
|
| 2648 | tx_data->ielen,
|
| 2649 | profile,
|
| 2650 | profile_len,
|
| 2651 | new_ie,
|
| 2652 | IEEE80211_MAX_DATA_LEN);
|
| 2653 | if (!data.ielen)
|
| 2654 | continue;
|
| 2655 |
|
| 2656 | data.capability = get_unaligned_le16(profile + 2);
|
| 2657 | bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
|
| 2658 | if (!bss)
|
| 2659 | break;
|
| 2660 | cfg80211_put_bss(wiphy, bss);
|
| 2661 | }
|
| 2662 | }
|
| 2663 |
|
| 2664 | out:
|
| 2665 | kfree(new_ie);
|
| 2666 | kfree(profile);
|
| 2667 | }
|
| 2668 |
|
| 2669 | ssize_t cfg80211_defragment_element(const struct element *elem, const u8 *ies,
|
| 2670 | size_t ieslen, u8 *data, size_t data_len,
|
| 2671 | u8 frag_id)
|
| 2672 | {
|
| 2673 | const struct element *next;
|
| 2674 | ssize_t copied;
|
| 2675 | u8 elem_datalen;
|
| 2676 |
|
| 2677 | if (!elem || (const u8 *)elem < ies ||
|
| 2678 | (const u8 *)elem + sizeof(*elem) > ies + ieslen ||
|
| 2679 | (const u8 *)elem + sizeof(*elem) + elem->datalen > ies + ieslen)
|
| 2680 | return -EINVAL;
|
| 2681 |
|
| 2682 |
|
| 2683 | next = (void *)(elem->data + elem->datalen);
|
| 2684 | elem_datalen = elem->datalen;
|
| 2685 |
|
| 2686 | if (elem->id == WLAN_EID_EXTENSION) {
|
| 2687 | copied = elem->datalen - 1;
|
| 2688 |
|
| 2689 | if (data) {
|
| 2690 | if (copied > data_len)
|
| 2691 | return -ENOSPC;
|
| 2692 |
|
| 2693 | memmove(data, elem->data + 1, copied);
|
| 2694 | }
|
| 2695 | } else {
|
| 2696 | copied = elem->datalen;
|
| 2697 |
|
| 2698 | if (data) {
|
| 2699 | if (copied > data_len)
|
| 2700 | return -ENOSPC;
|
| 2701 |
|
| 2702 | memmove(data, elem->data, copied);
|
| 2703 | }
|
| 2704 | }
|
| 2705 |
|
| 2706 |
|
| 2707 | if (elem_datalen < 255)
|
| 2708 | return copied;
|
| 2709 |
|
| 2710 | for (elem = next;
|
| 2711 | elem->data < ies + ieslen &&
|
| 2712 | elem->data + elem->datalen <= ies + ieslen;
|
| 2713 | elem = next) {
|
| 2714 |
|
| 2715 | next = (void *)(elem->data + elem->datalen);
|
| 2716 |
|
| 2717 | if (elem->id != frag_id)
|
| 2718 | break;
|
| 2719 |
|
| 2720 | elem_datalen = elem->datalen;
|
| 2721 |
|
| 2722 | if (data) {
|
| 2723 | if (copied + elem_datalen > data_len)
|
| 2724 | return -ENOSPC;
|
| 2725 |
|
| 2726 | memmove(data + copied, elem->data, elem_datalen);
|
| 2727 | }
|
| 2728 |
|
| 2729 | copied += elem_datalen;
|
| 2730 |
|
| 2731 |
|
| 2732 | if (elem_datalen != 255)
|
| 2733 | break;
|
| 2734 | }
|
| 2735 |
|
| 2736 | return copied;
|
| 2737 | }
|
| 2738 | EXPORT_SYMBOL(cfg80211_defragment_element);
|
| 2739 |
|
| 2740 | struct cfg80211_mle {
|
| 2741 | struct ieee80211_multi_link_elem *mle;
|
| 2742 | struct ieee80211_mle_per_sta_profile
|
| 2743 | *sta_prof[IEEE80211_MLD_MAX_NUM_LINKS];
|
| 2744 | ssize_t sta_prof_len[IEEE80211_MLD_MAX_NUM_LINKS];
|
| 2745 |
|
| 2746 | u8 data[];
|
| 2747 | };
|
| 2748 |
|
| 2749 | static struct cfg80211_mle *
|
| 2750 | cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen,
|
| 2751 | gfp_t gfp)
|
| 2752 | {
|
| 2753 | const struct element *elem;
|
| 2754 | struct cfg80211_mle *res;
|
| 2755 | size_t buf_len;
|
| 2756 | ssize_t mle_len;
|
| 2757 | u8 common_size, idx;
|
| 2758 |
|
| 2759 | if (!mle || !ieee80211_mle_size_ok(mle->data + 1, mle->datalen - 1))
|
| 2760 | return NULL;
|
| 2761 |
|
| 2762 |
|
| 2763 | buf_len = mle->datalen - 1;
|
| 2764 | for_each_element(elem, mle->data + mle->datalen,
|
| 2765 | ie + ielen - mle->data - mle->datalen) {
|
| 2766 | if (elem->id != WLAN_EID_FRAGMENT)
|
| 2767 | break;
|
| 2768 |
|
| 2769 | buf_len += elem->datalen;
|
| 2770 | }
|
| 2771 |
|
| 2772 | res = kzalloc_flex(*res, data, buf_len, gfp);
|
| 2773 | if (!res)
|
| 2774 | return NULL;
|
| 2775 |
|
| 2776 | mle_len = cfg80211_defragment_element(mle, ie, ielen,
|
| 2777 | res->data, buf_len,
|
| 2778 | WLAN_EID_FRAGMENT);
|
| 2779 | if (mle_len < 0)
|
| 2780 | goto error;
|
| 2781 |
|
| 2782 | res->mle = (void *)res->data;
|
| 2783 |
|
| 2784 |
|
| 2785 | common_size = ieee80211_mle_common_size((u8 *)res->mle);
|
| 2786 | ie = res->data + common_size;
|
| 2787 | ielen = mle_len - common_size;
|
| 2788 |
|
| 2789 | idx = 0;
|
| 2790 | for_each_element_id(elem, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE,
|
| 2791 | ie, ielen) {
|
| 2792 | res->sta_prof[idx] = (void *)elem->data;
|
| 2793 | res->sta_prof_len[idx] = elem->datalen;
|
| 2794 |
|
| 2795 | idx++;
|
| 2796 | if (idx >= IEEE80211_MLD_MAX_NUM_LINKS)
|
| 2797 | break;
|
| 2798 | }
|
| 2799 | if (!for_each_element_completed(elem, ie, ielen))
|
| 2800 | goto error;
|
| 2801 |
|
| 2802 |
|
| 2803 | for (idx = 0; idx < IEEE80211_MLD_MAX_NUM_LINKS && res->sta_prof[idx];
|
| 2804 | idx++) {
|
| 2805 | if (res->sta_prof_len[idx] < 255)
|
| 2806 | continue;
|
| 2807 |
|
| 2808 | elem = (void *)res->sta_prof[idx] - 2;
|
| 2809 |
|
| 2810 | if (idx + 1 < ARRAY_SIZE(res->sta_prof) &&
|
| 2811 | res->sta_prof[idx + 1])
|
| 2812 | buf_len = (u8 *)res->sta_prof[idx + 1] -
|
| 2813 | (u8 *)res->sta_prof[idx];
|
| 2814 | else
|
| 2815 | buf_len = ielen + ie - (u8 *)elem;
|
| 2816 |
|
| 2817 | res->sta_prof_len[idx] =
|
| 2818 | cfg80211_defragment_element(elem,
|
| 2819 | (u8 *)elem, buf_len,
|
| 2820 | (u8 *)res->sta_prof[idx],
|
| 2821 | buf_len,
|
| 2822 | IEEE80211_MLE_SUBELEM_FRAGMENT);
|
| 2823 | if (res->sta_prof_len[idx] < 0)
|
| 2824 | goto error;
|
| 2825 | }
|
| 2826 |
|
| 2827 | return res;
|
| 2828 |
|
| 2829 | error:
|
| 2830 | kfree(res);
|
| 2831 | return NULL;
|
| 2832 | }
|
| 2833 |
|
| 2834 | struct tbtt_info_iter_data {
|
| 2835 | const struct ieee80211_neighbor_ap_info *ap_info;
|
| 2836 | u8 param_ch_count;
|
| 2837 | u32 use_for;
|
| 2838 | u8 mld_id, link_id;
|
| 2839 | bool non_tx;
|
| 2840 | };
|
| 2841 |
|
| 2842 | static enum cfg80211_rnr_iter_ret
|
| 2843 | cfg802121_mld_ap_rnr_iter(void *_data, u8 type,
|
| 2844 | const struct ieee80211_neighbor_ap_info *info,
|
| 2845 | const u8 *tbtt_info, u8 tbtt_info_len)
|
| 2846 | {
|
| 2847 | const struct ieee80211_rnr_mld_params *mld_params;
|
| 2848 | struct tbtt_info_iter_data *data = _data;
|
| 2849 | u8 link_id;
|
| 2850 | bool non_tx = false;
|
| 2851 |
|
| 2852 | if (type == IEEE80211_TBTT_INFO_TYPE_TBTT &&
|
| 2853 | tbtt_info_len >= offsetofend(struct ieee80211_tbtt_info_ge_11,
|
| 2854 | mld_params)) {
|
| 2855 | const struct ieee80211_tbtt_info_ge_11 *tbtt_info_ge_11 =
|
| 2856 | (void *)tbtt_info;
|
| 2857 |
|
| 2858 | non_tx = (tbtt_info_ge_11->bss_params &
|
| 2859 | (IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID |
|
| 2860 | IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID)) ==
|
| 2861 | IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID;
|
| 2862 | mld_params = &tbtt_info_ge_11->mld_params;
|
| 2863 | } else if (type == IEEE80211_TBTT_INFO_TYPE_MLD &&
|
| 2864 | tbtt_info_len >= sizeof(struct ieee80211_rnr_mld_params))
|
| 2865 | mld_params = (void *)tbtt_info;
|
| 2866 | else
|
| 2867 | return RNR_ITER_CONTINUE;
|
| 2868 |
|
| 2869 | link_id = le16_get_bits(mld_params->params,
|
| 2870 | IEEE80211_RNR_MLD_PARAMS_LINK_ID);
|
| 2871 |
|
| 2872 | if (data->mld_id != mld_params->mld_id)
|
| 2873 | return RNR_ITER_CONTINUE;
|
| 2874 |
|
| 2875 | if (data->link_id != link_id)
|
| 2876 | return RNR_ITER_CONTINUE;
|
| 2877 |
|
| 2878 | data->ap_info = info;
|
| 2879 | data->param_ch_count =
|
| 2880 | le16_get_bits(mld_params->params,
|
| 2881 | IEEE80211_RNR_MLD_PARAMS_BSS_CHANGE_COUNT);
|
| 2882 | data->non_tx = non_tx;
|
| 2883 |
|
| 2884 | if (type == IEEE80211_TBTT_INFO_TYPE_TBTT)
|
| 2885 | data->use_for = NL80211_BSS_USE_FOR_ALL;
|
| 2886 | else
|
| 2887 | data->use_for = NL80211_BSS_USE_FOR_MLD_LINK;
|
| 2888 | return RNR_ITER_BREAK;
|
| 2889 | }
|
| 2890 |
|
| 2891 | static u8
|
| 2892 | cfg80211_rnr_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
|
| 2893 | const struct ieee80211_neighbor_ap_info **ap_info,
|
| 2894 | u8 *param_ch_count, bool *non_tx)
|
| 2895 | {
|
| 2896 | struct tbtt_info_iter_data data = {
|
| 2897 | .mld_id = mld_id,
|
| 2898 | .link_id = link_id,
|
| 2899 | };
|
| 2900 |
|
| 2901 | cfg80211_iter_rnr(ie, ielen, cfg802121_mld_ap_rnr_iter, &data);
|
| 2902 |
|
| 2903 | *ap_info = data.ap_info;
|
| 2904 | *param_ch_count = data.param_ch_count;
|
| 2905 | *non_tx = data.non_tx;
|
| 2906 |
|
| 2907 | return data.use_for;
|
| 2908 | }
|
| 2909 |
|
| 2910 | static struct element *
|
| 2911 | cfg80211_gen_reporter_rnr(struct cfg80211_bss *source_bss, bool is_mbssid,
|
| 2912 | bool same_mld, u8 link_id, u8 bss_change_count,
|
| 2913 | gfp_t gfp)
|
| 2914 | {
|
| 2915 | const struct cfg80211_bss_ies *ies;
|
| 2916 | struct ieee80211_neighbor_ap_info ap_info;
|
| 2917 | struct ieee80211_tbtt_info_ge_11 tbtt_info;
|
| 2918 | u32 short_ssid;
|
| 2919 | const struct element *elem;
|
| 2920 | struct element *res;
|
| 2921 |
|
| 2922 | |
| 2923 | * We only generate the RNR to permit ML lookups. For that we do not
|
| 2924 | * need an entry for the corresponding transmitting BSS, lets just skip
|
| 2925 | * it even though it would be easy to add.
|
| 2926 |
|
| 2927 | if (!same_mld)
|
| 2928 | return NULL;
|
| 2929 |
|
| 2930 |
|
| 2931 | rcu_read_lock();
|
| 2932 | ies = rcu_dereference(source_bss->ies);
|
| 2933 |
|
| 2934 | ap_info.tbtt_info_len = offsetofend(typeof(tbtt_info), mld_params);
|
| 2935 | ap_info.tbtt_info_hdr =
|
| 2936 | u8_encode_bits(IEEE80211_TBTT_INFO_TYPE_TBTT,
|
| 2937 | IEEE80211_AP_INFO_TBTT_HDR_TYPE) |
|
| 2938 | u8_encode_bits(0, IEEE80211_AP_INFO_TBTT_HDR_COUNT);
|
| 2939 |
|
| 2940 | ap_info.channel = ieee80211_frequency_to_channel(source_bss->channel->center_freq);
|
| 2941 |
|
| 2942 |
|
| 2943 | elem = cfg80211_find_elem(WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
|
| 2944 | ies->data, ies->len);
|
| 2945 | if (elem && elem->datalen >= 1) {
|
| 2946 | ap_info.op_class = elem->data[0];
|
| 2947 | } else {
|
| 2948 | struct cfg80211_chan_def chandef;
|
| 2949 |
|
| 2950 | |
| 2951 | * make up a somewhat reasonable operating class, but don't
|
| 2952 | * bother with it too much as no one will ever use the
|
| 2953 | * information.
|
| 2954 |
|
| 2955 | cfg80211_chandef_create(&chandef, source_bss->channel,
|
| 2956 | NL80211_CHAN_NO_HT);
|
| 2957 |
|
| 2958 | if (!ieee80211_chandef_to_operating_class(&chandef,
|
| 2959 | &ap_info.op_class))
|
| 2960 | goto out_unlock;
|
| 2961 | }
|
| 2962 |
|
| 2963 |
|
| 2964 | tbtt_info.tbtt_offset = 255;
|
| 2965 | tbtt_info.psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
|
| 2966 |
|
| 2967 | memcpy(tbtt_info.bssid, source_bss->bssid, ETH_ALEN);
|
| 2968 | if (cfg80211_calc_short_ssid(ies, &elem, &short_ssid))
|
| 2969 | goto out_unlock;
|
| 2970 |
|
| 2971 | rcu_read_unlock();
|
| 2972 |
|
| 2973 | tbtt_info.short_ssid = cpu_to_le32(short_ssid);
|
| 2974 |
|
| 2975 | tbtt_info.bss_params = IEEE80211_RNR_TBTT_PARAMS_SAME_SSID;
|
| 2976 |
|
| 2977 | if (is_mbssid) {
|
| 2978 | tbtt_info.bss_params |= IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID;
|
| 2979 | tbtt_info.bss_params |= IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID;
|
| 2980 | }
|
| 2981 |
|
| 2982 | tbtt_info.mld_params.mld_id = 0;
|
| 2983 | tbtt_info.mld_params.params =
|
| 2984 | le16_encode_bits(link_id, IEEE80211_RNR_MLD_PARAMS_LINK_ID) |
|
| 2985 | le16_encode_bits(bss_change_count,
|
| 2986 | IEEE80211_RNR_MLD_PARAMS_BSS_CHANGE_COUNT);
|
| 2987 |
|
| 2988 | res = kzalloc_flex(*res, data, sizeof(ap_info) + ap_info.tbtt_info_len,
|
| 2989 | gfp);
|
| 2990 | if (!res)
|
| 2991 | return NULL;
|
| 2992 |
|
| 2993 |
|
| 2994 | res->id = WLAN_EID_REDUCED_NEIGHBOR_REPORT;
|
| 2995 | res->datalen = sizeof(ap_info) + ap_info.tbtt_info_len;
|
| 2996 | memcpy(res->data, &ap_info, sizeof(ap_info));
|
| 2997 | memcpy(res->data + sizeof(ap_info), &tbtt_info, ap_info.tbtt_info_len);
|
| 2998 |
|
| 2999 | return res;
|
| 3000 |
|
| 3001 | out_unlock:
|
| 3002 | rcu_read_unlock();
|
| 3003 | return NULL;
|
| 3004 | }
|
| 3005 |
|
| 3006 | static void
|
| 3007 | cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
|
| 3008 | struct cfg80211_inform_single_bss_data *tx_data,
|
| 3009 | struct cfg80211_bss *source_bss,
|
| 3010 | const struct element *elem,
|
| 3011 | gfp_t gfp)
|
| 3012 | {
|
| 3013 | struct cfg80211_inform_single_bss_data data = {
|
| 3014 | .drv_data = tx_data->drv_data,
|
| 3015 | .ftype = tx_data->ftype,
|
| 3016 | .source_bss = source_bss,
|
| 3017 | .bss_source = BSS_SOURCE_STA_PROFILE,
|
| 3018 | };
|
| 3019 | struct element *reporter_rnr = NULL;
|
| 3020 | struct ieee80211_multi_link_elem *ml_elem;
|
| 3021 | struct cfg80211_mle *mle;
|
| 3022 | const struct element *ssid_elem;
|
| 3023 | const u8 *ssid = NULL;
|
| 3024 | size_t ssid_len = 0;
|
| 3025 | u16 control;
|
| 3026 | u8 ml_common_len;
|
| 3027 | u8 *new_ie = NULL;
|
| 3028 | struct cfg80211_bss *bss;
|
| 3029 | u8 mld_id, reporter_link_id, bss_change_count;
|
| 3030 | u16 seen_links = 0;
|
| 3031 | u8 i;
|
| 3032 |
|
| 3033 | if (!ieee80211_mle_type_ok(elem->data + 1,
|
| 3034 | IEEE80211_ML_CONTROL_TYPE_BASIC,
|
| 3035 | elem->datalen - 1))
|
| 3036 | return;
|
| 3037 |
|
| 3038 | ml_elem = (void *)(elem->data + 1);
|
| 3039 | control = le16_to_cpu(ml_elem->control);
|
| 3040 | ml_common_len = ml_elem->variable[0];
|
| 3041 |
|
| 3042 |
|
| 3043 | if (!(control & IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT) ||
|
| 3044 | !(control & IEEE80211_MLC_BASIC_PRES_LINK_ID) ||
|
| 3045 | !(control & IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP))
|
| 3046 | return;
|
| 3047 |
|
| 3048 | reporter_link_id = ieee80211_mle_get_link_id(elem->data + 1);
|
| 3049 | bss_change_count = ieee80211_mle_get_bss_param_ch_cnt(elem->data + 1);
|
| 3050 |
|
| 3051 | |
| 3052 | * The MLD ID of the reporting AP is always zero. It is set if the AP
|
| 3053 | * is part of an MBSSID set and will be non-zero for ML Elements
|
| 3054 | * relating to a nontransmitted BSS (matching the Multi-BSSID Index,
|
| 3055 | * Draft P802.11be_D3.2, 35.3.4.2)
|
| 3056 |
|
| 3057 | mld_id = ieee80211_mle_get_mld_id(elem->data + 1);
|
| 3058 |
|
| 3059 |
|
| 3060 | mle = cfg80211_defrag_mle(elem, tx_data->ie, tx_data->ielen, gfp);
|
| 3061 | if (!mle)
|
| 3062 | return;
|
| 3063 |
|
| 3064 |
|
| 3065 | if (!mle->sta_prof[0])
|
| 3066 | goto out;
|
| 3067 |
|
| 3068 | new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
|
| 3069 | if (!new_ie)
|
| 3070 | goto out;
|
| 3071 |
|
| 3072 | reporter_rnr = cfg80211_gen_reporter_rnr(source_bss,
|
| 3073 | u16_get_bits(control,
|
| 3074 | IEEE80211_MLC_BASIC_PRES_MLD_ID),
|
| 3075 | mld_id == 0, reporter_link_id,
|
| 3076 | bss_change_count,
|
| 3077 | gfp);
|
| 3078 |
|
| 3079 | ssid_elem = cfg80211_find_elem(WLAN_EID_SSID, tx_data->ie,
|
| 3080 | tx_data->ielen);
|
| 3081 | if (ssid_elem) {
|
| 3082 | ssid = ssid_elem->data;
|
| 3083 | ssid_len = ssid_elem->datalen;
|
| 3084 | }
|
| 3085 |
|
| 3086 | for (i = 0; i < ARRAY_SIZE(mle->sta_prof) && mle->sta_prof[i]; i++) {
|
| 3087 | const struct ieee80211_neighbor_ap_info *ap_info;
|
| 3088 | enum nl80211_band band;
|
| 3089 | u32 freq;
|
| 3090 | const u8 *profile;
|
| 3091 | ssize_t profile_len;
|
| 3092 | u8 param_ch_count;
|
| 3093 | u8 link_id, use_for;
|
| 3094 | bool non_tx;
|
| 3095 |
|
| 3096 | if (!ieee80211_mle_basic_sta_prof_size_ok((u8 *)mle->sta_prof[i],
|
| 3097 | mle->sta_prof_len[i]))
|
| 3098 | continue;
|
| 3099 |
|
| 3100 | control = le16_to_cpu(mle->sta_prof[i]->control);
|
| 3101 |
|
| 3102 | if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
|
| 3103 | continue;
|
| 3104 |
|
| 3105 | link_id = u16_get_bits(control,
|
| 3106 | IEEE80211_MLE_STA_CONTROL_LINK_ID);
|
| 3107 | if (seen_links & BIT(link_id))
|
| 3108 | break;
|
| 3109 | seen_links |= BIT(link_id);
|
| 3110 |
|
| 3111 | if (!(control & IEEE80211_MLE_STA_CONTROL_BEACON_INT_PRESENT) ||
|
| 3112 | !(control & IEEE80211_MLE_STA_CONTROL_TSF_OFFS_PRESENT) ||
|
| 3113 | !(control & IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT))
|
| 3114 | continue;
|
| 3115 |
|
| 3116 | memcpy(data.bssid, mle->sta_prof[i]->variable, ETH_ALEN);
|
| 3117 | data.beacon_interval =
|
| 3118 | get_unaligned_le16(mle->sta_prof[i]->variable + 6);
|
| 3119 | data.tsf = tx_data->tsf +
|
| 3120 | get_unaligned_le64(mle->sta_prof[i]->variable + 8);
|
| 3121 |
|
| 3122 |
|
| 3123 | profile = mle->sta_prof[i]->variable +
|
| 3124 | mle->sta_prof[i]->sta_info_len - 1;
|
| 3125 | profile_len = (u8 *)mle->sta_prof[i] + mle->sta_prof_len[i] -
|
| 3126 | profile;
|
| 3127 |
|
| 3128 | if (profile_len < 2)
|
| 3129 | continue;
|
| 3130 |
|
| 3131 | data.capability = get_unaligned_le16(profile);
|
| 3132 | profile += 2;
|
| 3133 | profile_len -= 2;
|
| 3134 |
|
| 3135 |
|
| 3136 | use_for = cfg80211_rnr_info_for_mld_ap(tx_data->ie,
|
| 3137 | tx_data->ielen,
|
| 3138 | mld_id, link_id,
|
| 3139 | &ap_info,
|
| 3140 | ¶m_ch_count,
|
| 3141 | &non_tx);
|
| 3142 | if (!use_for)
|
| 3143 | continue;
|
| 3144 |
|
| 3145 | |
| 3146 | * As of 802.11be_D5.0, the specification does not give us any
|
| 3147 | * way of discovering both the MaxBSSID and the Multiple-BSSID
|
| 3148 | * Index. It does seem like the Multiple-BSSID Index element
|
| 3149 | * may be provided, but section 9.4.2.45 explicitly forbids
|
| 3150 | * including a Multiple-BSSID Element (in this case without any
|
| 3151 | * subelements).
|
| 3152 | * Without both pieces of information we cannot calculate the
|
| 3153 | * reference BSSID, so simply ignore the BSS.
|
| 3154 |
|
| 3155 | if (non_tx)
|
| 3156 | continue;
|
| 3157 |
|
| 3158 |
|
| 3159 |
|
| 3160 | if (!ieee80211_operating_class_to_band(ap_info->op_class,
|
| 3161 | &band))
|
| 3162 | continue;
|
| 3163 |
|
| 3164 | freq = ieee80211_channel_to_freq_khz(ap_info->channel, band);
|
| 3165 | data.channel = ieee80211_get_channel_khz(wiphy, freq);
|
| 3166 |
|
| 3167 |
|
| 3168 | if (!data.channel)
|
| 3169 | continue;
|
| 3170 |
|
| 3171 | |
| 3172 | * frame data available already.
|
| 3173 |
|
| 3174 | bss = cfg80211_get_bss(wiphy, data.channel, data.bssid, ssid,
|
| 3175 | ssid_len, IEEE80211_BSS_TYPE_ANY,
|
| 3176 | IEEE80211_PRIVACY_ANY);
|
| 3177 | if (bss) {
|
| 3178 | struct cfg80211_internal_bss *ibss = bss_from_pub(bss);
|
| 3179 |
|
| 3180 | if (data.capability == bss->capability &&
|
| 3181 | ibss->bss_source != BSS_SOURCE_STA_PROFILE) {
|
| 3182 | cfg80211_put_bss(wiphy, bss);
|
| 3183 | continue;
|
| 3184 | }
|
| 3185 | cfg80211_put_bss(wiphy, bss);
|
| 3186 | }
|
| 3187 |
|
| 3188 | if (use_for == NL80211_BSS_USE_FOR_MLD_LINK &&
|
| 3189 | !(wiphy->flags & WIPHY_FLAG_SUPPORTS_NSTR_NONPRIMARY)) {
|
| 3190 | use_for = 0;
|
| 3191 | data.cannot_use_reasons =
|
| 3192 | NL80211_BSS_CANNOT_USE_NSTR_NONPRIMARY;
|
| 3193 | }
|
| 3194 | data.use_for = use_for;
|
| 3195 |
|
| 3196 |
|
| 3197 | memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
|
| 3198 | data.ie = new_ie;
|
| 3199 | data.ielen = cfg80211_gen_new_ie(tx_data->ie, tx_data->ielen,
|
| 3200 | profile, profile_len,
|
| 3201 | new_ie,
|
| 3202 | IEEE80211_MAX_DATA_LEN);
|
| 3203 | if (!data.ielen)
|
| 3204 | continue;
|
| 3205 |
|
| 3206 | |
| 3207 | * - Basic ML element
|
| 3208 | * - A TBTT entry in the RNR for the transmitting AP
|
| 3209 | *
|
| 3210 | * This information is needed both internally and in userspace
|
| 3211 | * as such, we should append it here.
|
| 3212 |
|
| 3213 | if (data.ielen + 3 + sizeof(*ml_elem) + ml_common_len >
|
| 3214 | IEEE80211_MAX_DATA_LEN)
|
| 3215 | continue;
|
| 3216 |
|
| 3217 | |
| 3218 | * information, and then fix up the link ID and BSS param
|
| 3219 | * change count.
|
| 3220 | * Note that the ML element length has been verified and we
|
| 3221 | * also checked that it contains the link ID.
|
| 3222 |
|
| 3223 | new_ie[data.ielen++] = WLAN_EID_EXTENSION;
|
| 3224 | new_ie[data.ielen++] = 1 + sizeof(*ml_elem) + ml_common_len;
|
| 3225 | new_ie[data.ielen++] = WLAN_EID_EXT_EHT_MULTI_LINK;
|
| 3226 | memcpy(new_ie + data.ielen, ml_elem,
|
| 3227 | sizeof(*ml_elem) + ml_common_len);
|
| 3228 |
|
| 3229 | new_ie[data.ielen + sizeof(*ml_elem) + 1 + ETH_ALEN] = link_id;
|
| 3230 | new_ie[data.ielen + sizeof(*ml_elem) + 1 + ETH_ALEN + 1] =
|
| 3231 | param_ch_count;
|
| 3232 |
|
| 3233 | data.ielen += sizeof(*ml_elem) + ml_common_len;
|
| 3234 |
|
| 3235 | if (reporter_rnr && (use_for & NL80211_BSS_USE_FOR_NORMAL)) {
|
| 3236 | if (data.ielen + sizeof(struct element) +
|
| 3237 | reporter_rnr->datalen > IEEE80211_MAX_DATA_LEN)
|
| 3238 | continue;
|
| 3239 |
|
| 3240 | memcpy(new_ie + data.ielen, reporter_rnr,
|
| 3241 | sizeof(struct element) + reporter_rnr->datalen);
|
| 3242 | data.ielen += sizeof(struct element) +
|
| 3243 | reporter_rnr->datalen;
|
| 3244 | }
|
| 3245 |
|
| 3246 | bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
|
| 3247 | if (!bss)
|
| 3248 | break;
|
| 3249 | cfg80211_put_bss(wiphy, bss);
|
| 3250 | }
|
| 3251 |
|
| 3252 | out:
|
| 3253 | kfree(reporter_rnr);
|
| 3254 | kfree(new_ie);
|
| 3255 | kfree(mle);
|
| 3256 | }
|
| 3257 |
|
| 3258 | static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
|
| 3259 | struct cfg80211_inform_single_bss_data *tx_data,
|
| 3260 | struct cfg80211_bss *source_bss,
|
| 3261 | gfp_t gfp)
|
| 3262 | {
|
| 3263 | const struct element *elem;
|
| 3264 |
|
| 3265 | if (!source_bss)
|
| 3266 | return;
|
| 3267 |
|
| 3268 | if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP)
|
| 3269 | return;
|
| 3270 |
|
| 3271 | for_each_element_extid(elem, WLAN_EID_EXT_EHT_MULTI_LINK,
|
| 3272 | tx_data->ie, tx_data->ielen)
|
| 3273 | cfg80211_parse_ml_elem_sta_data(wiphy, tx_data, source_bss,
|
| 3274 | elem, gfp);
|
| 3275 | }
|
| 3276 |
|
| 3277 | struct cfg80211_bss *
|
| 3278 | cfg80211_inform_bss_data(struct wiphy *wiphy,
|
| 3279 | struct cfg80211_inform_bss *data,
|
| 3280 | enum cfg80211_bss_frame_type ftype,
|
| 3281 | const u8 *bssid, u64 tsf, u16 capability,
|
| 3282 | u16 beacon_interval, const u8 *ie, size_t ielen,
|
| 3283 | gfp_t gfp)
|
| 3284 | {
|
| 3285 | struct cfg80211_inform_single_bss_data inform_data = {
|
| 3286 | .drv_data = data,
|
| 3287 | .ftype = ftype,
|
| 3288 | .tsf = tsf,
|
| 3289 | .capability = capability,
|
| 3290 | .beacon_interval = beacon_interval,
|
| 3291 | .ie = ie,
|
| 3292 | .ielen = ielen,
|
| 3293 | .use_for = data->restrict_use ?
|
| 3294 | data->use_for :
|
| 3295 | NL80211_BSS_USE_FOR_ALL,
|
| 3296 | .cannot_use_reasons = data->cannot_use_reasons,
|
| 3297 | };
|
| 3298 | struct cfg80211_bss *res;
|
| 3299 |
|
| 3300 | memcpy(inform_data.bssid, bssid, ETH_ALEN);
|
| 3301 |
|
| 3302 | res = cfg80211_inform_single_bss_data(wiphy, &inform_data, gfp);
|
| 3303 | if (!res)
|
| 3304 | return NULL;
|
| 3305 |
|
| 3306 |
|
| 3307 | if (ftype == CFG80211_BSS_FTYPE_S1G_BEACON)
|
| 3308 | return res;
|
| 3309 |
|
| 3310 | cfg80211_parse_mbssid_data(wiphy, &inform_data, res, gfp);
|
| 3311 |
|
| 3312 | cfg80211_parse_ml_sta_data(wiphy, &inform_data, res, gfp);
|
| 3313 |
|
| 3314 | return res;
|
| 3315 | }
|
| 3316 | EXPORT_SYMBOL(cfg80211_inform_bss_data);
|
| 3317 |
|
| 3318 | struct cfg80211_bss *
|
| 3319 | cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
|
| 3320 | struct cfg80211_inform_bss *data,
|
| 3321 | struct ieee80211_mgmt *mgmt, size_t len,
|
| 3322 | gfp_t gfp)
|
| 3323 | {
|
| 3324 | size_t min_hdr_len;
|
| 3325 | struct ieee80211_ext *ext = NULL;
|
| 3326 | enum cfg80211_bss_frame_type ftype;
|
| 3327 | u16 beacon_interval;
|
| 3328 | const u8 *bssid;
|
| 3329 | u16 capability;
|
| 3330 | const u8 *ie;
|
| 3331 | size_t ielen;
|
| 3332 | u64 tsf;
|
| 3333 | size_t s1g_optional_len;
|
| 3334 |
|
| 3335 | if (WARN_ON(!mgmt))
|
| 3336 | return NULL;
|
| 3337 |
|
| 3338 | if (WARN_ON(!wiphy))
|
| 3339 | return NULL;
|
| 3340 |
|
| 3341 | BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
|
| 3342 | offsetof(struct ieee80211_mgmt, u.beacon.variable));
|
| 3343 |
|
| 3344 | trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
|
| 3345 |
|
| 3346 | if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
|
| 3347 | ext = (void *) mgmt;
|
| 3348 | s1g_optional_len =
|
| 3349 | ieee80211_s1g_optional_len(ext->frame_control);
|
| 3350 | min_hdr_len =
|
| 3351 | offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
|
| 3352 | s1g_optional_len;
|
| 3353 | } else {
|
| 3354 |
|
| 3355 | min_hdr_len = offsetof(struct ieee80211_mgmt,
|
| 3356 | u.probe_resp.variable);
|
| 3357 | }
|
| 3358 |
|
| 3359 | if (WARN_ON(len < min_hdr_len))
|
| 3360 | return NULL;
|
| 3361 |
|
| 3362 | ielen = len - min_hdr_len;
|
| 3363 | ie = mgmt->u.probe_resp.variable;
|
| 3364 | if (ext) {
|
| 3365 | const struct ieee80211_s1g_bcn_compat_ie *compat;
|
| 3366 | const struct element *elem;
|
| 3367 |
|
| 3368 | ie = ext->u.s1g_beacon.variable + s1g_optional_len;
|
| 3369 | elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT, ie, ielen);
|
| 3370 | if (!elem)
|
| 3371 | return NULL;
|
| 3372 | if (elem->datalen < sizeof(*compat))
|
| 3373 | return NULL;
|
| 3374 | compat = (void *)elem->data;
|
| 3375 | bssid = ext->u.s1g_beacon.sa;
|
| 3376 | capability = le16_to_cpu(compat->compat_info);
|
| 3377 | beacon_interval = le16_to_cpu(compat->beacon_int);
|
| 3378 | tsf = le32_to_cpu(ext->u.s1g_beacon.timestamp);
|
| 3379 | tsf |= (u64)le32_to_cpu(compat->tsf_completion) << 32;
|
| 3380 | } else {
|
| 3381 | bssid = mgmt->bssid;
|
| 3382 | beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
|
| 3383 | capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
|
| 3384 | tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
|
| 3385 | }
|
| 3386 |
|
| 3387 | if (ieee80211_is_probe_resp(mgmt->frame_control))
|
| 3388 | ftype = CFG80211_BSS_FTYPE_PRESP;
|
| 3389 | else if (ext)
|
| 3390 | ftype = CFG80211_BSS_FTYPE_S1G_BEACON;
|
| 3391 | else
|
| 3392 | ftype = CFG80211_BSS_FTYPE_BEACON;
|
| 3393 |
|
| 3394 | return cfg80211_inform_bss_data(wiphy, data, ftype,
|
| 3395 | bssid, tsf, capability,
|
| 3396 | beacon_interval, ie, ielen,
|
| 3397 | gfp);
|
| 3398 | }
|
| 3399 | EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
|
| 3400 |
|
| 3401 | void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
|
| 3402 | {
|
| 3403 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 3404 |
|
| 3405 | if (!pub)
|
| 3406 | return;
|
| 3407 |
|
| 3408 | spin_lock_bh(&rdev->bss_lock);
|
| 3409 | bss_ref_get(rdev, bss_from_pub(pub));
|
| 3410 | spin_unlock_bh(&rdev->bss_lock);
|
| 3411 | }
|
| 3412 | EXPORT_SYMBOL(cfg80211_ref_bss);
|
| 3413 |
|
| 3414 | void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
|
| 3415 | {
|
| 3416 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 3417 |
|
| 3418 | if (!pub)
|
| 3419 | return;
|
| 3420 |
|
| 3421 | spin_lock_bh(&rdev->bss_lock);
|
| 3422 | bss_ref_put(rdev, bss_from_pub(pub));
|
| 3423 | spin_unlock_bh(&rdev->bss_lock);
|
| 3424 | }
|
| 3425 | EXPORT_SYMBOL(cfg80211_put_bss);
|
| 3426 |
|
| 3427 | void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
|
| 3428 | {
|
| 3429 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 3430 | struct cfg80211_internal_bss *bss, *tmp1;
|
| 3431 | struct cfg80211_bss *nontrans_bss, *tmp;
|
| 3432 |
|
| 3433 | if (WARN_ON(!pub))
|
| 3434 | return;
|
| 3435 |
|
| 3436 | bss = bss_from_pub(pub);
|
| 3437 |
|
| 3438 | spin_lock_bh(&rdev->bss_lock);
|
| 3439 | if (list_empty(&bss->list))
|
| 3440 | goto out;
|
| 3441 |
|
| 3442 | list_for_each_entry_safe(nontrans_bss, tmp,
|
| 3443 | &pub->nontrans_list,
|
| 3444 | nontrans_list) {
|
| 3445 | tmp1 = bss_from_pub(nontrans_bss);
|
| 3446 | if (__cfg80211_unlink_bss(rdev, tmp1))
|
| 3447 | rdev->bss_generation++;
|
| 3448 | }
|
| 3449 |
|
| 3450 | if (__cfg80211_unlink_bss(rdev, bss))
|
| 3451 | rdev->bss_generation++;
|
| 3452 | out:
|
| 3453 | spin_unlock_bh(&rdev->bss_lock);
|
| 3454 | }
|
| 3455 | EXPORT_SYMBOL(cfg80211_unlink_bss);
|
| 3456 |
|
| 3457 | void cfg80211_bss_iter(struct wiphy *wiphy,
|
| 3458 | struct cfg80211_chan_def *chandef,
|
| 3459 | void (*iter)(struct wiphy *wiphy,
|
| 3460 | struct cfg80211_bss *bss,
|
| 3461 | void *data),
|
| 3462 | void *iter_data)
|
| 3463 | {
|
| 3464 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 3465 | struct cfg80211_internal_bss *bss;
|
| 3466 |
|
| 3467 | spin_lock_bh(&rdev->bss_lock);
|
| 3468 |
|
| 3469 | list_for_each_entry(bss, &rdev->bss_list, list) {
|
| 3470 | if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel,
|
| 3471 | false))
|
| 3472 | iter(wiphy, &bss->pub, iter_data);
|
| 3473 | }
|
| 3474 |
|
| 3475 | spin_unlock_bh(&rdev->bss_lock);
|
| 3476 | }
|
| 3477 | EXPORT_SYMBOL(cfg80211_bss_iter);
|
| 3478 |
|
| 3479 | void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
|
| 3480 | unsigned int link_id,
|
| 3481 | struct ieee80211_channel *chan)
|
| 3482 | {
|
| 3483 | struct wiphy *wiphy = wdev->wiphy;
|
| 3484 | struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
|
| 3485 | struct cfg80211_internal_bss *cbss = wdev->links[link_id].client.current_bss;
|
| 3486 | struct cfg80211_internal_bss *new = NULL;
|
| 3487 | struct cfg80211_internal_bss *bss;
|
| 3488 | struct cfg80211_bss *nontrans_bss;
|
| 3489 | struct cfg80211_bss *tmp;
|
| 3490 |
|
| 3491 | spin_lock_bh(&rdev->bss_lock);
|
| 3492 |
|
| 3493 | |
| 3494 | * Some APs use CSA also for bandwidth changes, i.e., without actually
|
| 3495 | * changing the control channel, so no need to update in such a case.
|
| 3496 |
|
| 3497 | if (cbss->pub.channel == chan)
|
| 3498 | goto done;
|
| 3499 |
|
| 3500 |
|
| 3501 | if (cbss->pub.transmitted_bss)
|
| 3502 | cbss = bss_from_pub(cbss->pub.transmitted_bss);
|
| 3503 |
|
| 3504 | cbss->pub.channel = chan;
|
| 3505 |
|
| 3506 | list_for_each_entry(bss, &rdev->bss_list, list) {
|
| 3507 | if (bss == cbss)
|
| 3508 | continue;
|
| 3509 |
|
| 3510 | if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) {
|
| 3511 | new = bss;
|
| 3512 | break;
|
| 3513 | }
|
| 3514 | }
|
| 3515 |
|
| 3516 | if (new) {
|
| 3517 |
|
| 3518 | cfg80211_update_known_bss(rdev, cbss, new, false);
|
| 3519 | new->pub.proberesp_ies = NULL;
|
| 3520 | new->pub.beacon_ies = NULL;
|
| 3521 |
|
| 3522 | list_for_each_entry_safe(nontrans_bss, tmp,
|
| 3523 | &new->pub.nontrans_list,
|
| 3524 | nontrans_list) {
|
| 3525 | bss = bss_from_pub(nontrans_bss);
|
| 3526 | if (__cfg80211_unlink_bss(rdev, bss))
|
| 3527 | rdev->bss_generation++;
|
| 3528 | }
|
| 3529 |
|
| 3530 | WARN_ON(atomic_read(&new->hold));
|
| 3531 | if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
|
| 3532 | rdev->bss_generation++;
|
| 3533 | }
|
| 3534 | cfg80211_rehash_bss(rdev, cbss);
|
| 3535 |
|
| 3536 | list_for_each_entry_safe(nontrans_bss, tmp,
|
| 3537 | &cbss->pub.nontrans_list,
|
| 3538 | nontrans_list) {
|
| 3539 | bss = bss_from_pub(nontrans_bss);
|
| 3540 | bss->pub.channel = chan;
|
| 3541 | cfg80211_rehash_bss(rdev, bss);
|
| 3542 | }
|
| 3543 |
|
| 3544 | done:
|
| 3545 | spin_unlock_bh(&rdev->bss_lock);
|
| 3546 | }
|
| 3547 |
|
| 3548 | #ifdef CONFIG_CFG80211_WEXT
|
| 3549 | static struct cfg80211_registered_device *
|
| 3550 | cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
|
| 3551 | {
|
| 3552 | struct cfg80211_registered_device *rdev;
|
| 3553 | struct net_device *dev;
|
| 3554 |
|
| 3555 | ASSERT_RTNL();
|
| 3556 |
|
| 3557 | dev = dev_get_by_index(net, ifindex);
|
| 3558 | if (!dev)
|
| 3559 | return ERR_PTR(-ENODEV);
|
| 3560 | if (dev->ieee80211_ptr)
|
| 3561 | rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
|
| 3562 | else
|
| 3563 | rdev = ERR_PTR(-ENODEV);
|
| 3564 | dev_put(dev);
|
| 3565 | return rdev;
|
| 3566 | }
|
| 3567 |
|
| 3568 | int cfg80211_wext_siwscan(struct net_device *dev,
|
| 3569 | struct iw_request_info *info,
|
| 3570 | union iwreq_data *wrqu, char *extra)
|
| 3571 | {
|
| 3572 | struct cfg80211_registered_device *rdev;
|
| 3573 | struct wiphy *wiphy;
|
| 3574 | struct iw_scan_req *wreq = NULL;
|
| 3575 | struct cfg80211_scan_request_int *creq;
|
| 3576 | int i, err, n_channels = 0;
|
| 3577 | enum nl80211_band band;
|
| 3578 |
|
| 3579 | if (!netif_running(dev))
|
| 3580 | return -ENETDOWN;
|
| 3581 |
|
| 3582 | if (wrqu->data.length == sizeof(struct iw_scan_req))
|
| 3583 | wreq = (struct iw_scan_req *)extra;
|
| 3584 |
|
| 3585 | rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
|
| 3586 |
|
| 3587 | if (IS_ERR(rdev))
|
| 3588 | return PTR_ERR(rdev);
|
| 3589 |
|
| 3590 | if (rdev->scan_req || rdev->scan_msg)
|
| 3591 | return -EBUSY;
|
| 3592 |
|
| 3593 | wiphy = &rdev->wiphy;
|
| 3594 |
|
| 3595 |
|
| 3596 | if (wreq && wreq->num_channels) {
|
| 3597 |
|
| 3598 | if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES))
|
| 3599 | return -EINVAL;
|
| 3600 | n_channels = wreq->num_channels;
|
| 3601 | } else {
|
| 3602 | n_channels = ieee80211_get_num_supported_channels(wiphy);
|
| 3603 | }
|
| 3604 |
|
| 3605 | creq = kzalloc(struct_size(creq, req.channels, n_channels) +
|
| 3606 | sizeof(struct cfg80211_ssid),
|
| 3607 | GFP_ATOMIC);
|
| 3608 | if (!creq)
|
| 3609 | return -ENOMEM;
|
| 3610 |
|
| 3611 | creq->req.wiphy = wiphy;
|
| 3612 | creq->req.wdev = dev->ieee80211_ptr;
|
| 3613 |
|
| 3614 | creq->req.ssids = (void *)creq +
|
| 3615 | struct_size(creq, req.channels, n_channels);
|
| 3616 | creq->req.n_channels = n_channels;
|
| 3617 | creq->req.n_ssids = 1;
|
| 3618 | creq->req.scan_start = jiffies;
|
| 3619 |
|
| 3620 |
|
| 3621 | i = 0;
|
| 3622 | for (band = 0; band < NUM_NL80211_BANDS; band++) {
|
| 3623 | int j;
|
| 3624 |
|
| 3625 | if (!wiphy->bands[band])
|
| 3626 | continue;
|
| 3627 |
|
| 3628 | for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
|
| 3629 | struct ieee80211_channel *chan;
|
| 3630 |
|
| 3631 |
|
| 3632 | chan = &wiphy->bands[band]->channels[j];
|
| 3633 | if (chan->flags & IEEE80211_CHAN_DISABLED ||
|
| 3634 | !cfg80211_wdev_channel_allowed(creq->req.wdev, chan))
|
| 3635 | continue;
|
| 3636 |
|
| 3637 | |
| 3638 | * wireless request specifies frequencies, then search
|
| 3639 | * for the matching hardware channel.
|
| 3640 |
|
| 3641 | if (wreq && wreq->num_channels) {
|
| 3642 | int k;
|
| 3643 | int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
|
| 3644 | for (k = 0; k < wreq->num_channels; k++) {
|
| 3645 | struct iw_freq *freq =
|
| 3646 | &wreq->channel_list[k];
|
| 3647 | int wext_freq =
|
| 3648 | cfg80211_wext_freq(freq);
|
| 3649 |
|
| 3650 | if (wext_freq == wiphy_freq)
|
| 3651 | goto wext_freq_found;
|
| 3652 | }
|
| 3653 | goto wext_freq_not_found;
|
| 3654 | }
|
| 3655 |
|
| 3656 | wext_freq_found:
|
| 3657 | creq->req.channels[i] =
|
| 3658 | &wiphy->bands[band]->channels[j];
|
| 3659 | i++;
|
| 3660 | wext_freq_not_found: ;
|
| 3661 | }
|
| 3662 | }
|
| 3663 |
|
| 3664 | if (!i) {
|
| 3665 | err = -EINVAL;
|
| 3666 | goto out;
|
| 3667 | }
|
| 3668 |
|
| 3669 |
|
| 3670 | creq->req.n_channels = i;
|
| 3671 |
|
| 3672 |
|
| 3673 | if (wreq) {
|
| 3674 | if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
|
| 3675 | if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
|
| 3676 | err = -EINVAL;
|
| 3677 | goto out;
|
| 3678 | }
|
| 3679 | memcpy(creq->req.ssids[0].ssid, wreq->essid,
|
| 3680 | wreq->essid_len);
|
| 3681 | creq->req.ssids[0].ssid_len = wreq->essid_len;
|
| 3682 | }
|
| 3683 | if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE) {
|
| 3684 | creq->req.ssids = NULL;
|
| 3685 | creq->req.n_ssids = 0;
|
| 3686 | }
|
| 3687 | }
|
| 3688 |
|
| 3689 | for (i = 0; i < NUM_NL80211_BANDS; i++)
|
| 3690 | if (wiphy->bands[i])
|
| 3691 | creq->req.rates[i] =
|
| 3692 | (1 << wiphy->bands[i]->n_bitrates) - 1;
|
| 3693 |
|
| 3694 | eth_broadcast_addr(creq->req.bssid);
|
| 3695 |
|
| 3696 | scoped_guard(wiphy, &rdev->wiphy) {
|
| 3697 | rdev->scan_req = creq;
|
| 3698 | err = rdev_scan(rdev, creq);
|
| 3699 | if (err) {
|
| 3700 | rdev->scan_req = NULL;
|
| 3701 |
|
| 3702 | } else {
|
| 3703 | nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
|
| 3704 |
|
| 3705 | creq = NULL;
|
| 3706 | dev_hold(dev);
|
| 3707 | }
|
| 3708 | }
|
| 3709 |
|
| 3710 | out:
|
| 3711 | kfree(creq);
|
| 3712 | return err;
|
| 3713 | }
|
| 3714 |
|
| 3715 | static char *ieee80211_scan_add_ies(struct iw_request_info *info,
|
| 3716 | const struct cfg80211_bss_ies *ies,
|
| 3717 | char *current_ev, char *end_buf)
|
| 3718 | {
|
| 3719 | const u8 *pos, *end, *next;
|
| 3720 | struct iw_event iwe;
|
| 3721 |
|
| 3722 | if (!ies)
|
| 3723 | return current_ev;
|
| 3724 |
|
| 3725 | |
| 3726 | * If needed, fragment the IEs buffer (at IE boundaries) into short
|
| 3727 | * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
|
| 3728 |
|
| 3729 | pos = ies->data;
|
| 3730 | end = pos + ies->len;
|
| 3731 |
|
| 3732 | while (end - pos > IW_GENERIC_IE_MAX) {
|
| 3733 | next = pos + 2 + pos[1];
|
| 3734 | while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
|
| 3735 | next = next + 2 + next[1];
|
| 3736 |
|
| 3737 | memset(&iwe, 0, sizeof(iwe));
|
| 3738 | iwe.cmd = IWEVGENIE;
|
| 3739 | iwe.u.data.length = next - pos;
|
| 3740 | current_ev = iwe_stream_add_point_check(info, current_ev,
|
| 3741 | end_buf, &iwe,
|
| 3742 | (void *)pos);
|
| 3743 | if (IS_ERR(current_ev))
|
| 3744 | return current_ev;
|
| 3745 | pos = next;
|
| 3746 | }
|
| 3747 |
|
| 3748 | if (end > pos) {
|
| 3749 | memset(&iwe, 0, sizeof(iwe));
|
| 3750 | iwe.cmd = IWEVGENIE;
|
| 3751 | iwe.u.data.length = end - pos;
|
| 3752 | current_ev = iwe_stream_add_point_check(info, current_ev,
|
| 3753 | end_buf, &iwe,
|
| 3754 | (void *)pos);
|
| 3755 | if (IS_ERR(current_ev))
|
| 3756 | return current_ev;
|
| 3757 | }
|
| 3758 |
|
| 3759 | return current_ev;
|
| 3760 | }
|
| 3761 |
|
| 3762 | static char *
|
| 3763 | ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
|
| 3764 | struct cfg80211_internal_bss *bss, char *current_ev,
|
| 3765 | char *end_buf)
|
| 3766 | {
|
| 3767 | const struct cfg80211_bss_ies *ies;
|
| 3768 | struct iw_event iwe;
|
| 3769 | const u8 *ie;
|
| 3770 | u8 buf[50];
|
| 3771 | u8 *cfg, *p, *tmp;
|
| 3772 | int rem, i, sig;
|
| 3773 | bool ismesh = false;
|
| 3774 |
|
| 3775 | memset(&iwe, 0, sizeof(iwe));
|
| 3776 | iwe.cmd = SIOCGIWAP;
|
| 3777 | iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
|
| 3778 | memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
|
| 3779 | current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
|
| 3780 | IW_EV_ADDR_LEN);
|
| 3781 | if (IS_ERR(current_ev))
|
| 3782 | return current_ev;
|
| 3783 |
|
| 3784 | memset(&iwe, 0, sizeof(iwe));
|
| 3785 | iwe.cmd = SIOCGIWFREQ;
|
| 3786 | iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
|
| 3787 | iwe.u.freq.e = 0;
|
| 3788 | current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
|
| 3789 | IW_EV_FREQ_LEN);
|
| 3790 | if (IS_ERR(current_ev))
|
| 3791 | return current_ev;
|
| 3792 |
|
| 3793 | memset(&iwe, 0, sizeof(iwe));
|
| 3794 | iwe.cmd = SIOCGIWFREQ;
|
| 3795 | iwe.u.freq.m = bss->pub.channel->center_freq;
|
| 3796 | iwe.u.freq.e = 6;
|
| 3797 | current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
|
| 3798 | IW_EV_FREQ_LEN);
|
| 3799 | if (IS_ERR(current_ev))
|
| 3800 | return current_ev;
|
| 3801 |
|
| 3802 | if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
|
| 3803 | memset(&iwe, 0, sizeof(iwe));
|
| 3804 | iwe.cmd = IWEVQUAL;
|
| 3805 | iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
|
| 3806 | IW_QUAL_NOISE_INVALID |
|
| 3807 | IW_QUAL_QUAL_UPDATED;
|
| 3808 | switch (wiphy->signal_type) {
|
| 3809 | case CFG80211_SIGNAL_TYPE_MBM:
|
| 3810 | sig = bss->pub.signal / 100;
|
| 3811 | iwe.u.qual.level = sig;
|
| 3812 | iwe.u.qual.updated |= IW_QUAL_DBM;
|
| 3813 | if (sig < -110)
|
| 3814 | sig = -110;
|
| 3815 | else if (sig > -40)
|
| 3816 | sig = -40;
|
| 3817 |
|
| 3818 | iwe.u.qual.qual = sig + 110;
|
| 3819 | break;
|
| 3820 | case CFG80211_SIGNAL_TYPE_UNSPEC:
|
| 3821 | iwe.u.qual.level = bss->pub.signal;
|
| 3822 |
|
| 3823 | iwe.u.qual.qual = bss->pub.signal;
|
| 3824 | break;
|
| 3825 | default:
|
| 3826 |
|
| 3827 | break;
|
| 3828 | }
|
| 3829 | current_ev = iwe_stream_add_event_check(info, current_ev,
|
| 3830 | end_buf, &iwe,
|
| 3831 | IW_EV_QUAL_LEN);
|
| 3832 | if (IS_ERR(current_ev))
|
| 3833 | return current_ev;
|
| 3834 | }
|
| 3835 |
|
| 3836 | memset(&iwe, 0, sizeof(iwe));
|
| 3837 | iwe.cmd = SIOCGIWENCODE;
|
| 3838 | if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
|
| 3839 | iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
|
| 3840 | else
|
| 3841 | iwe.u.data.flags = IW_ENCODE_DISABLED;
|
| 3842 | iwe.u.data.length = 0;
|
| 3843 | current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
|
| 3844 | &iwe, "");
|
| 3845 | if (IS_ERR(current_ev))
|
| 3846 | return current_ev;
|
| 3847 |
|
| 3848 | rcu_read_lock();
|
| 3849 | ies = rcu_dereference(bss->pub.ies);
|
| 3850 | rem = ies->len;
|
| 3851 | ie = ies->data;
|
| 3852 |
|
| 3853 | while (rem >= 2) {
|
| 3854 |
|
| 3855 | if (ie[1] > rem - 2)
|
| 3856 | break;
|
| 3857 |
|
| 3858 | switch (ie[0]) {
|
| 3859 | case WLAN_EID_SSID:
|
| 3860 | memset(&iwe, 0, sizeof(iwe));
|
| 3861 | iwe.cmd = SIOCGIWESSID;
|
| 3862 | iwe.u.data.length = ie[1];
|
| 3863 | iwe.u.data.flags = 1;
|
| 3864 | current_ev = iwe_stream_add_point_check(info,
|
| 3865 | current_ev,
|
| 3866 | end_buf, &iwe,
|
| 3867 | (u8 *)ie + 2);
|
| 3868 | if (IS_ERR(current_ev))
|
| 3869 | goto unlock;
|
| 3870 | break;
|
| 3871 | case WLAN_EID_MESH_ID:
|
| 3872 | memset(&iwe, 0, sizeof(iwe));
|
| 3873 | iwe.cmd = SIOCGIWESSID;
|
| 3874 | iwe.u.data.length = ie[1];
|
| 3875 | iwe.u.data.flags = 1;
|
| 3876 | current_ev = iwe_stream_add_point_check(info,
|
| 3877 | current_ev,
|
| 3878 | end_buf, &iwe,
|
| 3879 | (u8 *)ie + 2);
|
| 3880 | if (IS_ERR(current_ev))
|
| 3881 | goto unlock;
|
| 3882 | break;
|
| 3883 | case WLAN_EID_MESH_CONFIG:
|
| 3884 | ismesh = true;
|
| 3885 | if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
|
| 3886 | break;
|
| 3887 | cfg = (u8 *)ie + 2;
|
| 3888 | memset(&iwe, 0, sizeof(iwe));
|
| 3889 | iwe.cmd = IWEVCUSTOM;
|
| 3890 | iwe.u.data.length = sprintf(buf,
|
| 3891 | "Mesh Network Path Selection Protocol ID: 0x%02X",
|
| 3892 | cfg[0]);
|
| 3893 | current_ev = iwe_stream_add_point_check(info,
|
| 3894 | current_ev,
|
| 3895 | end_buf,
|
| 3896 | &iwe, buf);
|
| 3897 | if (IS_ERR(current_ev))
|
| 3898 | goto unlock;
|
| 3899 | iwe.u.data.length = sprintf(buf,
|
| 3900 | "Path Selection Metric ID: 0x%02X",
|
| 3901 | cfg[1]);
|
| 3902 | current_ev = iwe_stream_add_point_check(info,
|
| 3903 | current_ev,
|
| 3904 | end_buf,
|
| 3905 | &iwe, buf);
|
| 3906 | if (IS_ERR(current_ev))
|
| 3907 | goto unlock;
|
| 3908 | iwe.u.data.length = sprintf(buf,
|
| 3909 | "Congestion Control Mode ID: 0x%02X",
|
| 3910 | cfg[2]);
|
| 3911 | current_ev = iwe_stream_add_point_check(info,
|
| 3912 | current_ev,
|
| 3913 | end_buf,
|
| 3914 | &iwe, buf);
|
| 3915 | if (IS_ERR(current_ev))
|
| 3916 | goto unlock;
|
| 3917 | iwe.u.data.length = sprintf(buf,
|
| 3918 | "Synchronization ID: 0x%02X",
|
| 3919 | cfg[3]);
|
| 3920 | current_ev = iwe_stream_add_point_check(info,
|
| 3921 | current_ev,
|
| 3922 | end_buf,
|
| 3923 | &iwe, buf);
|
| 3924 | if (IS_ERR(current_ev))
|
| 3925 | goto unlock;
|
| 3926 | iwe.u.data.length = sprintf(buf,
|
| 3927 | "Authentication ID: 0x%02X",
|
| 3928 | cfg[4]);
|
| 3929 | current_ev = iwe_stream_add_point_check(info,
|
| 3930 | current_ev,
|
| 3931 | end_buf,
|
| 3932 | &iwe, buf);
|
| 3933 | if (IS_ERR(current_ev))
|
| 3934 | goto unlock;
|
| 3935 | iwe.u.data.length = sprintf(buf,
|
| 3936 | "Formation Info: 0x%02X",
|
| 3937 | cfg[5]);
|
| 3938 | current_ev = iwe_stream_add_point_check(info,
|
| 3939 | current_ev,
|
| 3940 | end_buf,
|
| 3941 | &iwe, buf);
|
| 3942 | if (IS_ERR(current_ev))
|
| 3943 | goto unlock;
|
| 3944 | iwe.u.data.length = sprintf(buf,
|
| 3945 | "Capabilities: 0x%02X",
|
| 3946 | cfg[6]);
|
| 3947 | current_ev = iwe_stream_add_point_check(info,
|
| 3948 | current_ev,
|
| 3949 | end_buf,
|
| 3950 | &iwe, buf);
|
| 3951 | if (IS_ERR(current_ev))
|
| 3952 | goto unlock;
|
| 3953 | break;
|
| 3954 | case WLAN_EID_SUPP_RATES:
|
| 3955 | case WLAN_EID_EXT_SUPP_RATES:
|
| 3956 |
|
| 3957 | p = current_ev + iwe_stream_lcp_len(info);
|
| 3958 |
|
| 3959 | memset(&iwe, 0, sizeof(iwe));
|
| 3960 | iwe.cmd = SIOCGIWRATE;
|
| 3961 |
|
| 3962 | iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
|
| 3963 |
|
| 3964 | for (i = 0; i < ie[1]; i++) {
|
| 3965 | iwe.u.bitrate.value =
|
| 3966 | ((ie[i + 2] & 0x7f) * 500000);
|
| 3967 | tmp = p;
|
| 3968 | p = iwe_stream_add_value(info, current_ev, p,
|
| 3969 | end_buf, &iwe,
|
| 3970 | IW_EV_PARAM_LEN);
|
| 3971 | if (p == tmp) {
|
| 3972 | current_ev = ERR_PTR(-E2BIG);
|
| 3973 | goto unlock;
|
| 3974 | }
|
| 3975 | }
|
| 3976 | current_ev = p;
|
| 3977 | break;
|
| 3978 | }
|
| 3979 | rem -= ie[1] + 2;
|
| 3980 | ie += ie[1] + 2;
|
| 3981 | }
|
| 3982 |
|
| 3983 | if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
|
| 3984 | ismesh) {
|
| 3985 | memset(&iwe, 0, sizeof(iwe));
|
| 3986 | iwe.cmd = SIOCGIWMODE;
|
| 3987 | if (ismesh)
|
| 3988 | iwe.u.mode = IW_MODE_MESH;
|
| 3989 | else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
|
| 3990 | iwe.u.mode = IW_MODE_MASTER;
|
| 3991 | else
|
| 3992 | iwe.u.mode = IW_MODE_ADHOC;
|
| 3993 | current_ev = iwe_stream_add_event_check(info, current_ev,
|
| 3994 | end_buf, &iwe,
|
| 3995 | IW_EV_UINT_LEN);
|
| 3996 | if (IS_ERR(current_ev))
|
| 3997 | goto unlock;
|
| 3998 | }
|
| 3999 |
|
| 4000 | memset(&iwe, 0, sizeof(iwe));
|
| 4001 | iwe.cmd = IWEVCUSTOM;
|
| 4002 | iwe.u.data.length = sprintf(buf, "tsf=%016llx",
|
| 4003 | (unsigned long long)(ies->tsf));
|
| 4004 | current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
|
| 4005 | &iwe, buf);
|
| 4006 | if (IS_ERR(current_ev))
|
| 4007 | goto unlock;
|
| 4008 | memset(&iwe, 0, sizeof(iwe));
|
| 4009 | iwe.cmd = IWEVCUSTOM;
|
| 4010 | iwe.u.data.length = sprintf(buf, " Last beacon: %ums ago",
|
| 4011 | elapsed_jiffies_msecs(bss->ts));
|
| 4012 | current_ev = iwe_stream_add_point_check(info, current_ev,
|
| 4013 | end_buf, &iwe, buf);
|
| 4014 | if (IS_ERR(current_ev))
|
| 4015 | goto unlock;
|
| 4016 |
|
| 4017 | current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
|
| 4018 |
|
| 4019 | unlock:
|
| 4020 | rcu_read_unlock();
|
| 4021 | return current_ev;
|
| 4022 | }
|
| 4023 |
|
| 4024 |
|
| 4025 | static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
|
| 4026 | struct iw_request_info *info,
|
| 4027 | char *buf, size_t len)
|
| 4028 | {
|
| 4029 | char *current_ev = buf;
|
| 4030 | char *end_buf = buf + len;
|
| 4031 | struct cfg80211_internal_bss *bss;
|
| 4032 | int err = 0;
|
| 4033 |
|
| 4034 | spin_lock_bh(&rdev->bss_lock);
|
| 4035 | cfg80211_bss_expire(rdev);
|
| 4036 |
|
| 4037 | list_for_each_entry(bss, &rdev->bss_list, list) {
|
| 4038 | if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
|
| 4039 | err = -E2BIG;
|
| 4040 | break;
|
| 4041 | }
|
| 4042 | current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
|
| 4043 | current_ev, end_buf);
|
| 4044 | if (IS_ERR(current_ev)) {
|
| 4045 | err = PTR_ERR(current_ev);
|
| 4046 | break;
|
| 4047 | }
|
| 4048 | }
|
| 4049 | spin_unlock_bh(&rdev->bss_lock);
|
| 4050 |
|
| 4051 | if (err)
|
| 4052 | return err;
|
| 4053 | return current_ev - buf;
|
| 4054 | }
|
| 4055 |
|
| 4056 |
|
| 4057 | int cfg80211_wext_giwscan(struct net_device *dev,
|
| 4058 | struct iw_request_info *info,
|
| 4059 | union iwreq_data *wrqu, char *extra)
|
| 4060 | {
|
| 4061 | struct iw_point *data = &wrqu->data;
|
| 4062 | struct cfg80211_registered_device *rdev;
|
| 4063 | int res;
|
| 4064 |
|
| 4065 | if (!netif_running(dev))
|
| 4066 | return -ENETDOWN;
|
| 4067 |
|
| 4068 | rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
|
| 4069 |
|
| 4070 | if (IS_ERR(rdev))
|
| 4071 | return PTR_ERR(rdev);
|
| 4072 |
|
| 4073 | if (rdev->scan_req || rdev->scan_msg)
|
| 4074 | return -EAGAIN;
|
| 4075 |
|
| 4076 | res = ieee80211_scan_results(rdev, info, extra, data->length);
|
| 4077 | data->length = 0;
|
| 4078 | if (res >= 0) {
|
| 4079 | data->length = res;
|
| 4080 | res = 0;
|
| 4081 | }
|
| 4082 |
|
| 4083 | return res;
|
| 4084 | }
|
| 4085 | #endif
|