net/wireless/scan.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * cfg80211 scan result handling
   4  *
   5  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2016       Intel Deutschland GmbH
   8  * Copyright (C) 2018-2020 Intel Corporation
   9  */
  10 #include <linux/kernel.h>
  11 #include <linux/slab.h>
  12 #include <linux/module.h>
  13 #include <linux/netdevice.h>
  14 #include <linux/wireless.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/etherdevice.h>
  17 #include <linux/crc32.h>
  18 #include <linux/bitfield.h>
  19 #include <net/arp.h>
  20 #include <net/cfg80211.h>
  21 #include <net/cfg80211-wext.h>
  22 #include <net/iw_handler.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "wext-compat.h"
  26 #include "rdev-ops.h"
  27
  28 /**
  29  * DOC: BSS tree/list structure
  30  *
  31  * At the top level, the BSS list is kept in both a list in each
  32  * registered device (@bss_list) as well as an RB-tree for faster
  33  * lookup. In the RB-tree, entries can be looked up using their
  34  * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
  35  * for other BSSes.
  36  *
  37  * Due to the possibility of hidden SSIDs, there's a second level
  38  * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
  39  * The hidden_list connects all BSSes belonging to a single AP
  40  * that has a hidden SSID, and connects beacon and probe response
  41  * entries. For a probe response entry for a hidden SSID, the
  42  * hidden_beacon_bss pointer points to the BSS struct holding the
  43  * beacon's information.
  44  *
  45  * Reference counting is done for all these references except for
  46  * the hidden_list, so that a beacon BSS struct that is otherwise
  47  * not referenced has one reference for being on the bss_list and
  48  * one for each probe response entry that points to it using the
  49  * hidden_beacon_bss pointer. When a BSS struct that has such a
  50  * pointer is get/put, the refcount update is also propagated to
  51  * the referenced struct, this ensure that it cannot get removed
  52  * while somebody is using the probe response version.
  53  *
  54  * Note that the hidden_beacon_bss pointer never changes, due to
  55  * the reference counting. Therefore, no locking is needed for
  56  * it.
  57  *
  58  * Also note that the hidden_beacon_bss pointer is only relevant
  59  * if the driver uses something other than the IEs, e.g. private
  60  * data stored in the BSS struct, since the beacon IEs are
  61  * also linked into the probe response struct.
  62  */
  63
  64 /*
  65  * Limit the number of BSS entries stored in mac80211. Each one is
  66  * a bit over 4k at most, so this limits to roughly 4-5M of memory.
  67  * If somebody wants to really attack this though, they'd likely
  68  * use small beacons, and only one type of frame, limiting each of
  69  * the entries to a much smaller size (in order to generate more
  70  * entries in total, so overhead is bigger.)
  71  */
  72 static int bss_entries_limit = 1000;
  73 module_param(bss_entries_limit, int, 0644);
  74 MODULE_PARM_DESC(bss_entries_limit,
  75                  "limit to number of scan BSS entries (per wiphy, default 1000)");
  76
  77 #define IEEE80211_SCAN_RESULT_EXPIRE    (30 * HZ)
  78
  79 /**
  80  * struct cfg80211_colocated_ap - colocated AP information
  81  *
  82  * @list: linked list to all colocated aPS
  83  * @bssid: BSSID of the reported AP
  84  * @ssid: SSID of the reported AP
  85  * @ssid_len: length of the ssid
  86  * @center_freq: frequency the reported AP is on
  87  * @unsolicited_probe: the reported AP is part of an ESS, where all the APs
  88  *      that operate in the same channel as the reported AP and that might be
  89  *      detected by a STA receiving this frame, are transmitting unsolicited
  90  *      Probe Response frames every 20 TUs
  91  * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP
  92  * @same_ssid: the reported AP has the same SSID as the reporting AP
  93  * @multi_bss: the reported AP is part of a multiple BSSID set
  94  * @transmitted_bssid: the reported AP is the transmitting BSSID
  95  * @colocated_ess: all the APs that share the same ESS as the reported AP are
  96  *      colocated and can be discovered via legacy bands.
  97  * @short_ssid_valid: short_ssid is valid and can be used
  98  * @short_ssid: the short SSID for this SSID
  99  */
 100 struct cfg80211_colocated_ap {
 101         struct list_head list;
 102         u8 bssid[ETH_ALEN];
 103         u8 ssid[IEEE80211_MAX_SSID_LEN];
 104         size_t ssid_len;
 105         u32 short_ssid;
 106         u32 center_freq;
 107         u8 unsolicited_probe:1,
 108            oct_recommended:1,
 109            same_ssid:1,
 110            multi_bss:1,
 111            transmitted_bssid:1,
 112            colocated_ess:1,
 113            short_ssid_valid:1;
 114 };
 115
 116 static void bss_free(struct cfg80211_internal_bss *bss)
 117 {
 118         struct cfg80211_bss_ies *ies;
 119
 120         if (WARN_ON(atomic_read(&bss->hold)))
 121                 return;
 122
 123         ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
 124         if (ies && !bss->pub.hidden_beacon_bss)
 125                 kfree_rcu(ies, rcu_head);
 126         ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
 127         if (ies)
 128                 kfree_rcu(ies, rcu_head);
 129
 130         /*
 131          * This happens when the module is removed, it doesn't
 132          * really matter any more save for completeness
 133          */
 134         if (!list_empty(&bss->hidden_list))
 135                 list_del(&bss->hidden_list);
 136
 137         kfree(bss);
 138 }
 139
 140 static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
 141                                struct cfg80211_internal_bss *bss)
 142 {
 143         lockdep_assert_held(&rdev->bss_lock);
 144
 145         bss->refcount++;
 146         if (bss->pub.hidden_beacon_bss) {
 147                 bss = container_of(bss->pub.hidden_beacon_bss,
 148                                    struct cfg80211_internal_bss,
 149                                    pub);
 150                 bss->refcount++;
 151         }
 152         if (bss->pub.transmitted_bss) {
 153                 bss = container_of(bss->pub.transmitted_bss,
 154                                    struct cfg80211_internal_bss,
 155                                    pub);
 156                 bss->refcount++;
 157         }
 158 }
 159
 160 static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
 161                                struct cfg80211_internal_bss *bss)
 162 {
 163         lockdep_assert_held(&rdev->bss_lock);
 164
 165         if (bss->pub.hidden_beacon_bss) {
 166                 struct cfg80211_internal_bss *hbss;
 167                 hbss = container_of(bss->pub.hidden_beacon_bss,
 168                                     struct cfg80211_internal_bss,
 169                                     pub);
 170                 hbss->refcount--;
 171                 if (hbss->refcount == 0)
 172                         bss_free(hbss);
 173         }
 174
 175         if (bss->pub.transmitted_bss) {
 176                 struct cfg80211_internal_bss *tbss;
 177
 178                 tbss = container_of(bss->pub.transmitted_bss,
 179                                     struct cfg80211_internal_bss,
 180                                     pub);
 181                 tbss->refcount--;
 182                 if (tbss->refcount == 0)
 183                         bss_free(tbss);
 184         }
 185
 186         bss->refcount--;
 187         if (bss->refcount == 0)
 188                 bss_free(bss);
 189 }
 190
 191 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
 192                                   struct cfg80211_internal_bss *bss)
 193 {
 194         lockdep_assert_held(&rdev->bss_lock);
 195
 196         if (!list_empty(&bss->hidden_list)) {
 197                 /*
 198                  * don't remove the beacon entry if it has
 199                  * probe responses associated with it
 200                  */
 201                 if (!bss->pub.hidden_beacon_bss)
 202                         return false;
 203                 /*
 204                  * if it's a probe response entry break its
 205                  * link to the other entries in the group
 206                  */
 207                 list_del_init(&bss->hidden_list);
 208         }
 209
 210         list_del_init(&bss->list);
 211         list_del_init(&bss->pub.nontrans_list);
 212         rb_erase(&bss->rbn, &rdev->bss_tree);
 213         rdev->bss_entries--;
 214         WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
 215                   "rdev bss entries[%d]/list[empty:%d] corruption\n",
 216                   rdev->bss_entries, list_empty(&rdev->bss_list));
 217         bss_ref_put(rdev, bss);
 218         return true;
 219 }
 220
 221 bool cfg80211_is_element_inherited(const struct element *elem,
 222                                    const struct element *non_inherit_elem)
 223 {
 224         u8 id_len, ext_id_len, i, loop_len, id;
 225         const u8 *list;
 226
 227         if (elem->id == WLAN_EID_MULTIPLE_BSSID)
 228                 return false;
 229
 230         if (!non_inherit_elem || non_inherit_elem->datalen < 2)
 231                 return true;
 232
 233         /*
 234          * non inheritance element format is:
 235          * ext ID (56) | IDs list len | list | extension IDs list len | list
 236          * Both lists are optional. Both lengths are mandatory.
 237          * This means valid length is:
 238          * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
 239          */
 240         id_len = non_inherit_elem->data[1];
 241         if (non_inherit_elem->datalen < 3 + id_len)
 242                 return true;
 243
 244         ext_id_len = non_inherit_elem->data[2 + id_len];
 245         if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
 246                 return true;
 247
 248         if (elem->id == WLAN_EID_EXTENSION) {
 249                 if (!ext_id_len)
 250                         return true;
 251                 loop_len = ext_id_len;
 252                 list = &non_inherit_elem->data[3 + id_len];
 253                 id = elem->data[0];
 254         } else {
 255                 if (!id_len)
 256                         return true;
 257                 loop_len = id_len;
 258                 list = &non_inherit_elem->data[2];
 259                 id = elem->id;
 260         }
 261
 262         for (i = 0; i < loop_len; i++) {
 263                 if (list[i] == id)
 264                         return false;
 265         }
 266
 267         return true;
 268 }
 269 EXPORT_SYMBOL(cfg80211_is_element_inherited);
 270
 271 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
 272                                   const u8 *subelement, size_t subie_len,
 273                                   u8 *new_ie, gfp_t gfp)
 274 {
 275         u8 *pos, *tmp;
 276         const u8 *tmp_old, *tmp_new;
 277         const struct element *non_inherit_elem;
 278         u8 *sub_copy;
 279
 280         /* copy subelement as we need to change its content to
 281          * mark an ie after it is processed.
 282          */
 283         sub_copy = kmemdup(subelement, subie_len, gfp);
 284         if (!sub_copy)
 285                 return 0;
 286
 287         pos = &new_ie[0];
 288
 289         /* set new ssid */
 290         tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len);
 291         if (tmp_new) {
 292                 memcpy(pos, tmp_new, tmp_new[1] + 2);
 293                 pos += (tmp_new[1] + 2);
 294         }
 295
 296         /* get non inheritance list if exists */
 297         non_inherit_elem =
 298                 cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
 299                                        sub_copy, subie_len);
 300
 301         /* go through IEs in ie (skip SSID) and subelement,
 302          * merge them into new_ie
 303          */
 304         tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
 305         tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
 306
 307         while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
 308                 if (tmp_old[0] == 0) {
 309                         tmp_old++;
 310                         continue;
 311                 }
 312
 313                 if (tmp_old[0] == WLAN_EID_EXTENSION)
 314                         tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy,
 315                                                          subie_len);
 316                 else
 317                         tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy,
 318                                                      subie_len);
 319
 320                 if (!tmp) {
 321                         const struct element *old_elem = (void *)tmp_old;
 322
 323                         /* ie in old ie but not in subelement */
 324                         if (cfg80211_is_element_inherited(old_elem,
 325                                                           non_inherit_elem)) {
 326                                 memcpy(pos, tmp_old, tmp_old[1] + 2);
 327                                 pos += tmp_old[1] + 2;
 328                         }
 329                 } else {
 330                         /* ie in transmitting ie also in subelement,
 331                          * copy from subelement and flag the ie in subelement
 332                          * as copied (by setting eid field to WLAN_EID_SSID,
 333                          * which is skipped anyway).
 334                          * For vendor ie, compare OUI + type + subType to
 335                          * determine if they are the same ie.
 336                          */
 337                         if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) {
 338                                 if (!memcmp(tmp_old + 2, tmp + 2, 5)) {
 339                                         /* same vendor ie, copy from
 340                                          * subelement
 341                                          */
 342                                         memcpy(pos, tmp, tmp[1] + 2);
 343                                         pos += tmp[1] + 2;
 344                                         tmp[0] = WLAN_EID_SSID;
 345                                 } else {
 346                                         memcpy(pos, tmp_old, tmp_old[1] + 2);
 347                                         pos += tmp_old[1] + 2;
 348                                 }
 349                         } else {
 350                                 /* copy ie from subelement into new ie */
 351                                 memcpy(pos, tmp, tmp[1] + 2);
 352                                 pos += tmp[1] + 2;
 353                                 tmp[0] = WLAN_EID_SSID;
 354                         }
 355                 }
 356
 357                 if (tmp_old + tmp_old[1] + 2 - ie == ielen)
 358                         break;
 359
 360                 tmp_old += tmp_old[1] + 2;
 361         }
 362
 363         /* go through subelement again to check if there is any ie not
 364          * copied to new ie, skip ssid, capability, bssid-index ie
 365          */
 366         tmp_new = sub_copy;
 367         while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
 368                 if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
 369                       tmp_new[0] == WLAN_EID_SSID)) {
 370                         memcpy(pos, tmp_new, tmp_new[1] + 2);
 371                         pos += tmp_new[1] + 2;
 372                 }
 373                 if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len)
 374                         break;
 375                 tmp_new += tmp_new[1] + 2;
 376         }
 377
 378         kfree(sub_copy);
 379         return pos - new_ie;
 380 }
 381
 382 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
 383                    const u8 *ssid, size_t ssid_len)
 384 {
 385         const struct cfg80211_bss_ies *ies;
 386         const u8 *ssidie;
 387
 388         if (bssid && !ether_addr_equal(a->bssid, bssid))
 389                 return false;
 390
 391         if (!ssid)
 392                 return true;
 393
 394         ies = rcu_access_pointer(a->ies);
 395         if (!ies)
 396                 return false;
 397         ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
 398         if (!ssidie)
 399                 return false;
 400         if (ssidie[1] != ssid_len)
 401                 return false;
 402         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
 403 }
 404
 405 static int
 406 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
 407                            struct cfg80211_bss *nontrans_bss)
 408 {
 409         const u8 *ssid;
 410         size_t ssid_len;
 411         struct cfg80211_bss *bss = NULL;
 412
 413         rcu_read_lock();
 414         ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
 415         if (!ssid) {
 416                 rcu_read_unlock();
 417                 return -EINVAL;
 418         }
 419         ssid_len = ssid[1];
 420         ssid = ssid + 2;
 421         rcu_read_unlock();
 422
 423         /* check if nontrans_bss is in the list */
 424         list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
 425                 if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len))
 426                         return 0;
 427         }
 428
 429         /* add to the list */
 430         list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
 431         return 0;
 432 }
 433
 434 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
 435                                   unsigned long expire_time)
 436 {
 437         struct cfg80211_internal_bss *bss, *tmp;
 438         bool expired = false;
 439
 440         lockdep_assert_held(&rdev->bss_lock);
 441
 442         list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
 443                 if (atomic_read(&bss->hold))
 444                         continue;
 445                 if (!time_after(expire_time, bss->ts))
 446                         continue;
 447
 448                 if (__cfg80211_unlink_bss(rdev, bss))
 449                         expired = true;
 450         }
 451
 452         if (expired)
 453                 rdev->bss_generation++;
 454 }
 455
 456 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
 457 {
 458         struct cfg80211_internal_bss *bss, *oldest = NULL;
 459         bool ret;
 460
 461         lockdep_assert_held(&rdev->bss_lock);
 462
 463         list_for_each_entry(bss, &rdev->bss_list, list) {
 464                 if (atomic_read(&bss->hold))
 465                         continue;
 466
 467                 if (!list_empty(&bss->hidden_list) &&
 468                     !bss->pub.hidden_beacon_bss)
 469                         continue;
 470
 471                 if (oldest && time_before(oldest->ts, bss->ts))
 472                         continue;
 473                 oldest = bss;
 474         }
 475
 476         if (WARN_ON(!oldest))
 477                 return false;
 478
 479         /*
 480          * The callers make sure to increase rdev->bss_generation if anything
 481          * gets removed (and a new entry added), so there's no need to also do
 482          * it here.
 483          */
 484
 485         ret = __cfg80211_unlink_bss(rdev, oldest);
 486         WARN_ON(!ret);
 487         return ret;
 488 }
 489
 490 static u8 cfg80211_parse_bss_param(u8 data,
 491                                    struct cfg80211_colocated_ap *coloc_ap)
 492 {
 493         coloc_ap->oct_recommended =
 494                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
 495         coloc_ap->same_ssid =
 496                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
 497         coloc_ap->multi_bss =
 498                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
 499         coloc_ap->transmitted_bssid =
 500                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
 501         coloc_ap->unsolicited_probe =
 502                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
 503         coloc_ap->colocated_ess =
 504                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
 505
 506         return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
 507 }
 508
 509 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
 510                                     const struct element **elem, u32 *s_ssid)
 511 {
 512
 513         *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
 514         if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
 515                 return -EINVAL;
 516
 517         *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen);
 518         return 0;
 519 }
 520
 521 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
 522 {
 523         struct cfg80211_colocated_ap *ap, *tmp_ap;
 524
 525         list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
 526                 list_del(&ap->list);
 527                 kfree(ap);
 528         }
 529 }
 530
 531 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
 532                                   const u8 *pos, u8 length,
 533                                   const struct element *ssid_elem,
 534                                   int s_ssid_tmp)
 535 {
 536         /* skip the TBTT offset */
 537         pos++;
 538
 539         memcpy(entry->bssid, pos, ETH_ALEN);
 540         pos += ETH_ALEN;
 541
 542         if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM) {
 543                 memcpy(&entry->short_ssid, pos,
 544                        sizeof(entry->short_ssid));
 545                 entry->short_ssid_valid = true;
 546                 pos += 4;
 547         }
 548
 549         /* skip non colocated APs */
 550         if (!cfg80211_parse_bss_param(*pos, entry))
 551                 return -EINVAL;
 552         pos++;
 553
 554         if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM) {
 555                 /*
 556                  * no information about the short ssid. Consider the entry valid
 557                  * for now. It would later be dropped in case there are explicit
 558                  * SSIDs that need to be matched
 559                  */
 560                 if (!entry->same_ssid)
 561                         return 0;
 562         }
 563
 564         if (entry->same_ssid) {
 565                 entry->short_ssid = s_ssid_tmp;
 566                 entry->short_ssid_valid = true;
 567
 568                 /*
 569                  * This is safe because we validate datalen in
 570                  * cfg80211_parse_colocated_ap(), before calling this
 571                  * function.
 572                  */
 573                 memcpy(&entry->ssid, &ssid_elem->data,
 574                        ssid_elem->datalen);
 575                 entry->ssid_len = ssid_elem->datalen;
 576         }
 577         return 0;
 578 }
 579
 580 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
 581                                        struct list_head *list)
 582 {
 583         struct ieee80211_neighbor_ap_info *ap_info;
 584         const struct element *elem, *ssid_elem;
 585         const u8 *pos, *end;
 586         u32 s_ssid_tmp;
 587         int n_coloc = 0, ret;
 588         LIST_HEAD(ap_list);
 589
 590         elem = cfg80211_find_elem(WLAN_EID_REDUCED_NEIGHBOR_REPORT, ies->data,
 591                                   ies->len);
 592         if (!elem || elem->datalen > IEEE80211_MAX_SSID_LEN)
 593                 return 0;
 594
 595         pos = elem->data;
 596         end = pos + elem->datalen;
 597
 598         ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp);
 599         if (ret)
 600                 return ret;
 601
 602         /* RNR IE may contain more than one NEIGHBOR_AP_INFO */
 603         while (pos + sizeof(*ap_info) <= end) {
 604                 enum nl80211_band band;
 605                 int freq;
 606                 u8 length, i, count;
 607
 608                 ap_info = (void *)pos;
 609                 count = u8_get_bits(ap_info->tbtt_info_hdr,
 610                                     IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
 611                 length = ap_info->tbtt_info_len;
 612
 613                 pos += sizeof(*ap_info);
 614
 615                 if (!ieee80211_operating_class_to_band(ap_info->op_class,
 616                                                        &band))
 617                         break;
 618
 619                 freq = ieee80211_channel_to_frequency(ap_info->channel, band);
 620
 621                 if (end - pos < count * ap_info->tbtt_info_len)
 622                         break;
 623
 624                 /*
 625                  * TBTT info must include bss param + BSSID +
 626                  * (short SSID or same_ssid bit to be set).
 627                  * ignore other options, and move to the
 628                  * next AP info
 629                  */
 630                 if (band != NL80211_BAND_6GHZ ||
 631                     (length != IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM &&
 632                      length < IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM)) {
 633                         pos += count * ap_info->tbtt_info_len;
 634                         continue;
 635                 }
 636
 637                 for (i = 0; i < count; i++) {
 638                         struct cfg80211_colocated_ap *entry;
 639
 640                         entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
 641                                         GFP_ATOMIC);
 642
 643                         if (!entry)
 644                                 break;
 645
 646                         entry->center_freq = freq;
 647
 648                         if (!cfg80211_parse_ap_info(entry, pos, length,
 649                                                     ssid_elem, s_ssid_tmp)) {
 650                                 n_coloc++;
 651                                 list_add_tail(&entry->list, &ap_list);
 652                         } else {
 653                                 kfree(entry);
 654                         }
 655
 656                         pos += ap_info->tbtt_info_len;
 657                 }
 658         }
 659
 660         if (pos != end) {
 661                 cfg80211_free_coloc_ap_list(&ap_list);
 662                 return 0;
 663         }
 664
 665         list_splice_tail(&ap_list, list);
 666         return n_coloc;
 667 }
 668
 669 static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
 670                                         struct ieee80211_channel *chan,
 671                                         bool add_to_6ghz)
 672 {
 673         int i;
 674         u32 n_channels = request->n_channels;
 675         struct cfg80211_scan_6ghz_params *params =
 676                 &request->scan_6ghz_params[request->n_6ghz_params];
 677
 678         for (i = 0; i < n_channels; i++) {
 679                 if (request->channels[i] == chan) {
 680                         if (add_to_6ghz)
 681                                 params->channel_idx = i;
 682                         return;
 683                 }
 684         }
 685
 686         request->channels[n_channels] = chan;
 687         if (add_to_6ghz)
 688                 request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
 689                         n_channels;
 690
 691         request->n_channels++;
 692 }
 693
 694 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
 695                                      struct cfg80211_scan_request *request)
 696 {
 697         u8 i;
 698         u32 s_ssid;
 699
 700         for (i = 0; i < request->n_ssids; i++) {
 701                 /* wildcard ssid in the scan request */
 702                 if (!request->ssids[i].ssid_len)
 703                         return true;
 704
 705                 if (ap->ssid_len &&
 706                     ap->ssid_len == request->ssids[i].ssid_len) {
 707                         if (!memcmp(request->ssids[i].ssid, ap->ssid,
 708                                     ap->ssid_len))
 709                                 return true;
 710                 } else if (ap->short_ssid_valid) {
 711                         s_ssid = ~crc32_le(~0, request->ssids[i].ssid,
 712                                            request->ssids[i].ssid_len);
 713
 714                         if (ap->short_ssid == s_ssid)
 715                                 return true;
 716                 }
 717         }
 718
 719         return false;
 720 }
 721
 722 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
 723 {
 724         u8 i;
 725         struct cfg80211_colocated_ap *ap;
 726         int n_channels, count = 0, err;
 727         struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
 728         LIST_HEAD(coloc_ap_list);
 729         bool need_scan_psc;
 730         const struct ieee80211_sband_iftype_data *iftd;
 731
 732         rdev_req->scan_6ghz = true;
 733
 734         if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
 735                 return -EOPNOTSUPP;
 736
 737         iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ],
 738                                                rdev_req->wdev->iftype);
 739         if (!iftd || !iftd->he_cap.has_he)
 740                 return -EOPNOTSUPP;
 741
 742         n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
 743
 744         if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
 745                 struct cfg80211_internal_bss *intbss;
 746
 747                 spin_lock_bh(&rdev->bss_lock);
 748                 list_for_each_entry(intbss, &rdev->bss_list, list) {
 749                         struct cfg80211_bss *res = &intbss->pub;
 750                         const struct cfg80211_bss_ies *ies;
 751
 752                         ies = rcu_access_pointer(res->ies);
 753                         count += cfg80211_parse_colocated_ap(ies,
 754                                                              &coloc_ap_list);
 755                 }
 756                 spin_unlock_bh(&rdev->bss_lock);
 757         }
 758
 759         request = kzalloc(struct_size(request, channels, n_channels) +
 760                           sizeof(*request->scan_6ghz_params) * count,
 761                           GFP_KERNEL);
 762         if (!request) {
 763                 cfg80211_free_coloc_ap_list(&coloc_ap_list);
 764                 return -ENOMEM;
 765         }
 766
 767         *request = *rdev_req;
 768         request->n_channels = 0;
 769         request->scan_6ghz_params =
 770                 (void *)&request->channels[n_channels];
 771
 772         /*
 773          * PSC channels should not be scanned if all the reported co-located APs
 774          * are indicating that all APs in the same ESS are co-located
 775          */
 776         if (count) {
 777                 need_scan_psc = false;
 778
 779                 list_for_each_entry(ap, &coloc_ap_list, list) {
 780                         if (!ap->colocated_ess) {
 781                                 need_scan_psc = true;
 782                                 break;
 783                         }
 784                 }
 785         } else {
 786                 need_scan_psc = true;
 787         }
 788
 789         /*
 790          * add to the scan request the channels that need to be scanned
 791          * regardless of the collocated APs (PSC channels or all channels
 792          * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
 793          */
 794         for (i = 0; i < rdev_req->n_channels; i++) {
 795                 if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ &&
 796                     ((need_scan_psc &&
 797                       cfg80211_channel_is_psc(rdev_req->channels[i])) ||
 798                      !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
 799                         cfg80211_scan_req_add_chan(request,
 800                                                    rdev_req->channels[i],
 801                                                    false);
 802                 }
 803         }
 804
 805         if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
 806                 goto skip;
 807
 808         list_for_each_entry(ap, &coloc_ap_list, list) {
 809                 bool found = false;
 810                 struct cfg80211_scan_6ghz_params *scan_6ghz_params =
 811                         &request->scan_6ghz_params[request->n_6ghz_params];
 812                 struct ieee80211_channel *chan =
 813                         ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
 814
 815                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 816                         continue;
 817
 818                 for (i = 0; i < rdev_req->n_channels; i++) {
 819                         if (rdev_req->channels[i] == chan)
 820                                 found = true;
 821                 }
 822
 823                 if (!found)
 824                         continue;
 825
 826                 if (request->n_ssids > 0 &&
 827                     !cfg80211_find_ssid_match(ap, request))
 828                         continue;
 829
 830                 cfg80211_scan_req_add_chan(request, chan, true);
 831                 memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
 832                 scan_6ghz_params->short_ssid = ap->short_ssid;
 833                 scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
 834                 scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
 835
 836                 /*
 837                  * If a PSC channel is added to the scan and 'need_scan_psc' is
 838                  * set to false, then all the APs that the scan logic is
 839                  * interested with on the channel are collocated and thus there
 840                  * is no need to perform the initial PSC channel listen.
 841                  */
 842                 if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
 843                         scan_6ghz_params->psc_no_listen = true;
 844
 845                 request->n_6ghz_params++;
 846         }
 847
 848 skip:
 849         cfg80211_free_coloc_ap_list(&coloc_ap_list);
 850
 851         if (request->n_channels) {
 852                 struct cfg80211_scan_request *old = rdev->int_scan_req;
 853
 854                 rdev->int_scan_req = request;
 855
 856                 /*
 857                  * If this scan follows a previous scan, save the scan start
 858                  * info from the first part of the scan
 859                  */
 860                 if (old)
 861                         rdev->int_scan_req->info = old->info;
 862
 863                 err = rdev_scan(rdev, request);
 864                 if (err) {
 865                         rdev->int_scan_req = old;
 866                         kfree(request);
 867                 } else {
 868                         kfree(old);
 869                 }
 870
 871                 return err;
 872         }
 873
 874         kfree(request);
 875         return -EINVAL;
 876 }
 877
 878 int cfg80211_scan(struct cfg80211_registered_device *rdev)
 879 {
 880         struct cfg80211_scan_request *request;
 881         struct cfg80211_scan_request *rdev_req = rdev->scan_req;
 882         u32 n_channels = 0, idx, i;
 883
 884         if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ))
 885                 return rdev_scan(rdev, rdev_req);
 886
 887         for (i = 0; i < rdev_req->n_channels; i++) {
 888                 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
 889                         n_channels++;
 890         }
 891
 892         if (!n_channels)
 893                 return cfg80211_scan_6ghz(rdev);
 894
 895         request = kzalloc(struct_size(request, channels, n_channels),
 896                           GFP_KERNEL);
 897         if (!request)
 898                 return -ENOMEM;
 899
 900         *request = *rdev_req;
 901         request->n_channels = n_channels;
 902
 903         for (i = idx = 0; i < rdev_req->n_channels; i++) {
 904                 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
 905                         request->channels[idx++] = rdev_req->channels[i];
 906         }
 907
 908         rdev_req->scan_6ghz = false;
 909         rdev->int_scan_req = request;
 910         return rdev_scan(rdev, request);
 911 }
 912
 913 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
 914                            bool send_message)
 915 {
 916         struct cfg80211_scan_request *request, *rdev_req;
 917         struct wireless_dev *wdev;
 918         struct sk_buff *msg;
 919 #ifdef CONFIG_CFG80211_WEXT
 920         union iwreq_data wrqu;
 921 #endif
 922
 923         ASSERT_RTNL();
 924
 925         if (rdev->scan_msg) {
 926                 nl80211_send_scan_msg(rdev, rdev->scan_msg);
 927                 rdev->scan_msg = NULL;
 928                 return;
 929         }
 930
 931         rdev_req = rdev->scan_req;
 932         if (!rdev_req)
 933                 return;
 934
 935         wdev = rdev_req->wdev;
 936         request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
 937
 938         if (wdev_running(wdev) &&
 939             (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
 940             !rdev_req->scan_6ghz && !request->info.aborted &&
 941             !cfg80211_scan_6ghz(rdev))
 942                 return;
 943
 944         /*
 945          * This must be before sending the other events!
 946          * Otherwise, wpa_supplicant gets completely confused with
 947          * wext events.
 948          */
 949         if (wdev->netdev)
 950                 cfg80211_sme_scan_done(wdev->netdev);
 951
 952         if (!request->info.aborted &&
 953             request->flags & NL80211_SCAN_FLAG_FLUSH) {
 954                 /* flush entries from previous scans */
 955                 spin_lock_bh(&rdev->bss_lock);
 956                 __cfg80211_bss_expire(rdev, request->scan_start);
 957                 spin_unlock_bh(&rdev->bss_lock);
 958         }
 959
 960         msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
 961
 962 #ifdef CONFIG_CFG80211_WEXT
 963         if (wdev->netdev && !request->info.aborted) {
 964                 memset(&wrqu, 0, sizeof(wrqu));
 965
 966                 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
 967         }
 968 #endif
 969
 970         if (wdev->netdev)
 971                 dev_put(wdev->netdev);
 972
 973         kfree(rdev->int_scan_req);
 974         rdev->int_scan_req = NULL;
 975
 976         kfree(rdev->scan_req);
 977         rdev->scan_req = NULL;
 978
 979         if (!send_message)
 980                 rdev->scan_msg = msg;
 981         else
 982                 nl80211_send_scan_msg(rdev, msg);
 983 }
 984
 985 void __cfg80211_scan_done(struct work_struct *wk)
 986 {
 987         struct cfg80211_registered_device *rdev;
 988
 989         rdev = container_of(wk, struct cfg80211_registered_device,
 990                             scan_done_wk);
 991
 992         rtnl_lock();
 993         ___cfg80211_scan_done(rdev, true);
 994         rtnl_unlock();
 995 }
 996
 997 void cfg80211_scan_done(struct cfg80211_scan_request *request,
 998                         struct cfg80211_scan_info *info)
 999 {
1000         struct cfg80211_scan_info old_info = request->info;
1001
1002         trace_cfg80211_scan_done(request, info);
1003         WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req &&
1004                 request != wiphy_to_rdev(request->wiphy)->int_scan_req);
1005
1006         request->info = *info;
1007
1008         /*
1009          * In case the scan is split, the scan_start_tsf and tsf_bssid should
1010          * be of the first part. In such a case old_info.scan_start_tsf should
1011          * be non zero.
1012          */
1013         if (request->scan_6ghz && old_info.scan_start_tsf) {
1014                 request->info.scan_start_tsf = old_info.scan_start_tsf;
1015                 memcpy(request->info.tsf_bssid, old_info.tsf_bssid,
1016                        sizeof(request->info.tsf_bssid));
1017         }
1018
1019         request->notified = true;
1020         queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
1021 }
1022 EXPORT_SYMBOL(cfg80211_scan_done);
1023
1024 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
1025                                  struct cfg80211_sched_scan_request *req)
1026 {
1027         ASSERT_RTNL();
1028
1029         list_add_rcu(&req->list, &rdev->sched_scan_req_list);
1030 }
1031
1032 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
1033                                         struct cfg80211_sched_scan_request *req)
1034 {
1035         ASSERT_RTNL();
1036
1037         list_del_rcu(&req->list);
1038         kfree_rcu(req, rcu_head);
1039 }
1040
1041 static struct cfg80211_sched_scan_request *
1042 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
1043 {
1044         struct cfg80211_sched_scan_request *pos;
1045
1046         list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
1047                                 lockdep_rtnl_is_held()) {
1048                 if (pos->reqid == reqid)
1049                         return pos;
1050         }
1051         return NULL;
1052 }
1053
1054 /*
1055  * Determines if a scheduled scan request can be handled. When a legacy
1056  * scheduled scan is running no other scheduled scan is allowed regardless
1057  * whether the request is for legacy or multi-support scan. When a multi-support
1058  * scheduled scan is running a request for legacy scan is not allowed. In this
1059  * case a request for multi-support scan can be handled if resources are
1060  * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
1061  */
1062 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
1063                                      bool want_multi)
1064 {
1065         struct cfg80211_sched_scan_request *pos;
1066         int i = 0;
1067
1068         list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
1069                 /* request id zero means legacy in progress */
1070                 if (!i && !pos->reqid)
1071                         return -EINPROGRESS;
1072                 i++;
1073         }
1074
1075         if (i) {
1076                 /* no legacy allowed when multi request(s) are active */
1077                 if (!want_multi)
1078                         return -EINPROGRESS;
1079
1080                 /* resource limit reached */
1081                 if (i == rdev->wiphy.max_sched_scan_reqs)
1082                         return -ENOSPC;
1083         }
1084         return 0;
1085 }
1086
1087 void cfg80211_sched_scan_results_wk(struct work_struct *work)
1088 {
1089         struct cfg80211_registered_device *rdev;
1090         struct cfg80211_sched_scan_request *req, *tmp;
1091
1092         rdev = container_of(work, struct cfg80211_registered_device,
1093                            sched_scan_res_wk);
1094
1095         rtnl_lock();
1096         list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
1097                 if (req->report_results) {
1098                         req->report_results = false;
1099                         if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
1100                                 /* flush entries from previous scans */
1101                                 spin_lock_bh(&rdev->bss_lock);
1102                                 __cfg80211_bss_expire(rdev, req->scan_start);
1103                                 spin_unlock_bh(&rdev->bss_lock);
1104                                 req->scan_start = jiffies;
1105                         }
1106                         nl80211_send_sched_scan(req,
1107                                                 NL80211_CMD_SCHED_SCAN_RESULTS);
1108                 }
1109         }
1110         rtnl_unlock();
1111 }
1112
1113 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
1114 {
1115         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1116         struct cfg80211_sched_scan_request *request;
1117
1118         trace_cfg80211_sched_scan_results(wiphy, reqid);
1119         /* ignore if we're not scanning */
1120
1121         rcu_read_lock();
1122         request = cfg80211_find_sched_scan_req(rdev, reqid);
1123         if (request) {
1124                 request->report_results = true;
1125                 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
1126         }
1127         rcu_read_unlock();
1128 }
1129 EXPORT_SYMBOL(cfg80211_sched_scan_results);
1130
1131 void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy, u64 reqid)
1132 {
1133         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1134
1135         ASSERT_RTNL();
1136
1137         trace_cfg80211_sched_scan_stopped(wiphy, reqid);
1138
1139         __cfg80211_stop_sched_scan(rdev, reqid, true);
1140 }
1141 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
1142
1143 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
1144 {
1145         rtnl_lock();
1146         cfg80211_sched_scan_stopped_rtnl(wiphy, reqid);
1147         rtnl_unlock();
1148 }
1149 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
1150
1151 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
1152                                  struct cfg80211_sched_scan_request *req,
1153                                  bool driver_initiated)
1154 {
1155         ASSERT_RTNL();
1156
1157         if (!driver_initiated) {
1158                 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
1159                 if (err)
1160                         return err;
1161         }
1162
1163         nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
1164
1165         cfg80211_del_sched_scan_req(rdev, req);
1166
1167         return 0;
1168 }
1169
1170 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
1171                                u64 reqid, bool driver_initiated)
1172 {
1173         struct cfg80211_sched_scan_request *sched_scan_req;
1174
1175         ASSERT_RTNL();
1176
1177         sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
1178         if (!sched_scan_req)
1179                 return -ENOENT;
1180
1181         return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
1182                                             driver_initiated);
1183 }
1184
1185 void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
1186                       unsigned long age_secs)
1187 {
1188         struct cfg80211_internal_bss *bss;
1189         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
1190
1191         spin_lock_bh(&rdev->bss_lock);
1192         list_for_each_entry(bss, &rdev->bss_list, list)
1193                 bss->ts -= age_jiffies;
1194         spin_unlock_bh(&rdev->bss_lock);
1195 }
1196
1197 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
1198 {
1199         __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
1200 }
1201
1202 void cfg80211_bss_flush(struct wiphy *wiphy)
1203 {
1204         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1205
1206         spin_lock_bh(&rdev->bss_lock);
1207         __cfg80211_bss_expire(rdev, jiffies);
1208         spin_unlock_bh(&rdev->bss_lock);
1209 }
1210 EXPORT_SYMBOL(cfg80211_bss_flush);
1211
1212 const struct element *
1213 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
1214                          const u8 *match, unsigned int match_len,
1215                          unsigned int match_offset)
1216 {
1217         const struct element *elem;
1218
1219         for_each_element_id(elem, eid, ies, len) {
1220                 if (elem->datalen >= match_offset + match_len &&
1221                     !memcmp(elem->data + match_offset, match, match_len))
1222                         return elem;
1223         }
1224
1225         return NULL;
1226 }
1227 EXPORT_SYMBOL(cfg80211_find_elem_match);
1228
1229 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
1230                                                 const u8 *ies,
1231                                                 unsigned int len)
1232 {
1233         const struct element *elem;
1234         u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
1235         int match_len = (oui_type < 0) ? 3 : sizeof(match);
1236
1237         if (WARN_ON(oui_type > 0xff))
1238                 return NULL;
1239
1240         elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
1241                                         match, match_len, 0);
1242
1243         if (!elem || elem->datalen < 4)
1244                 return NULL;
1245
1246         return elem;
1247 }
1248 EXPORT_SYMBOL(cfg80211_find_vendor_elem);
1249
1250 /**
1251  * enum bss_compare_mode - BSS compare mode
1252  * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
1253  * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
1254  * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
1255  */
1256 enum bss_compare_mode {
1257         BSS_CMP_REGULAR,
1258         BSS_CMP_HIDE_ZLEN,
1259         BSS_CMP_HIDE_NUL,
1260 };
1261
1262 static int cmp_bss(struct cfg80211_bss *a,
1263                    struct cfg80211_bss *b,
1264                    enum bss_compare_mode mode)
1265 {
1266         const struct cfg80211_bss_ies *a_ies, *b_ies;
1267         const u8 *ie1 = NULL;
1268         const u8 *ie2 = NULL;
1269         int i, r;
1270
1271         if (a->channel != b->channel)
1272                 return b->channel->center_freq - a->channel->center_freq;
1273
1274         a_ies = rcu_access_pointer(a->ies);
1275         if (!a_ies)
1276                 return -1;
1277         b_ies = rcu_access_pointer(b->ies);
1278         if (!b_ies)
1279                 return 1;
1280
1281         if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
1282                 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1283                                        a_ies->data, a_ies->len);
1284         if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
1285                 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1286                                        b_ies->data, b_ies->len);
1287         if (ie1 && ie2) {
1288                 int mesh_id_cmp;
1289
1290                 if (ie1[1] == ie2[1])
1291                         mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1292                 else
1293                         mesh_id_cmp = ie2[1] - ie1[1];
1294
1295                 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1296                                        a_ies->data, a_ies->len);
1297                 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1298                                        b_ies->data, b_ies->len);
1299                 if (ie1 && ie2) {
1300                         if (mesh_id_cmp)
1301                                 return mesh_id_cmp;
1302                         if (ie1[1] != ie2[1])
1303                                 return ie2[1] - ie1[1];
1304                         return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1305                 }
1306         }
1307
1308         r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
1309         if (r)
1310                 return r;
1311
1312         ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
1313         ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
1314
1315         if (!ie1 && !ie2)
1316                 return 0;
1317
1318         /*
1319          * Note that with "hide_ssid", the function returns a match if
1320          * the already-present BSS ("b") is a hidden SSID beacon for
1321          * the new BSS ("a").
1322          */
1323
1324         /* sort missing IE before (left of) present IE */
1325         if (!ie1)
1326                 return -1;
1327         if (!ie2)
1328                 return 1;
1329
1330         switch (mode) {
1331         case BSS_CMP_HIDE_ZLEN:
1332                 /*
1333                  * In ZLEN mode we assume the BSS entry we're
1334                  * looking for has a zero-length SSID. So if
1335                  * the one we're looking at right now has that,
1336                  * return 0. Otherwise, return the difference
1337                  * in length, but since we're looking for the
1338                  * 0-length it's really equivalent to returning
1339                  * the length of the one we're looking at.
1340                  *
1341                  * No content comparison is needed as we assume
1342                  * the content length is zero.
1343                  */
1344                 return ie2[1];
1345         case BSS_CMP_REGULAR:
1346         default:
1347                 /* sort by length first, then by contents */
1348                 if (ie1[1] != ie2[1])
1349                         return ie2[1] - ie1[1];
1350                 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1351         case BSS_CMP_HIDE_NUL:
1352                 if (ie1[1] != ie2[1])
1353                         return ie2[1] - ie1[1];
1354                 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
1355                 for (i = 0; i < ie2[1]; i++)
1356                         if (ie2[i + 2])
1357                                 return -1;
1358                 return 0;
1359         }
1360 }
1361
1362 static bool cfg80211_bss_type_match(u16 capability,
1363                                     enum nl80211_band band,
1364                                     enum ieee80211_bss_type bss_type)
1365 {
1366         bool ret = true;
1367         u16 mask, val;
1368
1369         if (bss_type == IEEE80211_BSS_TYPE_ANY)
1370                 return ret;
1371
1372         if (band == NL80211_BAND_60GHZ) {
1373                 mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
1374                 switch (bss_type) {
1375                 case IEEE80211_BSS_TYPE_ESS:
1376                         val = WLAN_CAPABILITY_DMG_TYPE_AP;
1377                         break;
1378                 case IEEE80211_BSS_TYPE_PBSS:
1379                         val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
1380                         break;
1381                 case IEEE80211_BSS_TYPE_IBSS:
1382                         val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
1383                         break;
1384                 default:
1385                         return false;
1386                 }
1387         } else {
1388                 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
1389                 switch (bss_type) {
1390                 case IEEE80211_BSS_TYPE_ESS:
1391                         val = WLAN_CAPABILITY_ESS;
1392                         break;
1393                 case IEEE80211_BSS_TYPE_IBSS:
1394                         val = WLAN_CAPABILITY_IBSS;
1395                         break;
1396                 case IEEE80211_BSS_TYPE_MBSS:
1397                         val = 0;
1398                         break;
1399                 default:
1400                         return false;
1401                 }
1402         }
1403
1404         ret = ((capability & mask) == val);
1405         return ret;
1406 }
1407
1408 /* Returned bss is reference counted and must be cleaned up appropriately. */
1409 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
1410                                       struct ieee80211_channel *channel,
1411                                       const u8 *bssid,
1412                                       const u8 *ssid, size_t ssid_len,
1413                                       enum ieee80211_bss_type bss_type,
1414                                       enum ieee80211_privacy privacy)
1415 {
1416         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1417         struct cfg80211_internal_bss *bss, *res = NULL;
1418         unsigned long now = jiffies;
1419         int bss_privacy;
1420
1421         trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
1422                                privacy);
1423
1424         spin_lock_bh(&rdev->bss_lock);
1425
1426         list_for_each_entry(bss, &rdev->bss_list, list) {
1427                 if (!cfg80211_bss_type_match(bss->pub.capability,
1428                                              bss->pub.channel->band, bss_type))
1429                         continue;
1430
1431                 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
1432                 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
1433                     (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
1434                         continue;
1435                 if (channel && bss->pub.channel != channel)
1436                         continue;
1437                 if (!is_valid_ether_addr(bss->pub.bssid))
1438                         continue;
1439                 /* Don't get expired BSS structs */
1440                 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
1441                     !atomic_read(&bss->hold))
1442                         continue;
1443                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
1444                         res = bss;
1445                         bss_ref_get(rdev, res);
1446                         break;
1447                 }
1448         }
1449
1450         spin_unlock_bh(&rdev->bss_lock);
1451         if (!res)
1452                 return NULL;
1453         trace_cfg80211_return_bss(&res->pub);
1454         return &res->pub;
1455 }
1456 EXPORT_SYMBOL(cfg80211_get_bss);
1457
1458 static void rb_insert_bss(struct cfg80211_registered_device *rdev,
1459                           struct cfg80211_internal_bss *bss)
1460 {
1461         struct rb_node **p = &rdev->bss_tree.rb_node;
1462         struct rb_node *parent = NULL;
1463         struct cfg80211_internal_bss *tbss;
1464         int cmp;
1465
1466         while (*p) {
1467                 parent = *p;
1468                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
1469
1470                 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
1471
1472                 if (WARN_ON(!cmp)) {
1473                         /* will sort of leak this BSS */
1474                         return;
1475                 }
1476
1477                 if (cmp < 0)
1478                         p = &(*p)->rb_left;
1479                 else
1480                         p = &(*p)->rb_right;
1481         }
1482
1483         rb_link_node(&bss->rbn, parent, p);
1484         rb_insert_color(&bss->rbn, &rdev->bss_tree);
1485 }
1486
1487 static struct cfg80211_internal_bss *
1488 rb_find_bss(struct cfg80211_registered_device *rdev,
1489             struct cfg80211_internal_bss *res,
1490             enum bss_compare_mode mode)
1491 {
1492         struct rb_node *n = rdev->bss_tree.rb_node;
1493         struct cfg80211_internal_bss *bss;
1494         int r;
1495
1496         while (n) {
1497                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
1498                 r = cmp_bss(&res->pub, &bss->pub, mode);
1499
1500                 if (r == 0)
1501                         return bss;
1502                 else if (r < 0)
1503                         n = n->rb_left;
1504                 else
1505                         n = n->rb_right;
1506         }
1507
1508         return NULL;
1509 }
1510
1511 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
1512                                    struct cfg80211_internal_bss *new)
1513 {
1514         const struct cfg80211_bss_ies *ies;
1515         struct cfg80211_internal_bss *bss;
1516         const u8 *ie;
1517         int i, ssidlen;
1518         u8 fold = 0;
1519         u32 n_entries = 0;
1520
1521         ies = rcu_access_pointer(new->pub.beacon_ies);
1522         if (WARN_ON(!ies))
1523                 return false;
1524
1525         ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1526         if (!ie) {
1527                 /* nothing to do */
1528                 return true;
1529         }
1530
1531         ssidlen = ie[1];
1532         for (i = 0; i < ssidlen; i++)
1533                 fold |= ie[2 + i];
1534
1535         if (fold) {
1536                 /* not a hidden SSID */
1537                 return true;
1538         }
1539
1540         /* This is the bad part ... */
1541
1542         list_for_each_entry(bss, &rdev->bss_list, list) {
1543                 /*
1544                  * we're iterating all the entries anyway, so take the
1545                  * opportunity to validate the list length accounting
1546                  */
1547                 n_entries++;
1548
1549                 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
1550                         continue;
1551                 if (bss->pub.channel != new->pub.channel)
1552                         continue;
1553                 if (bss->pub.scan_width != new->pub.scan_width)
1554                         continue;
1555                 if (rcu_access_pointer(bss->pub.beacon_ies))
1556                         continue;
1557                 ies = rcu_access_pointer(bss->pub.ies);
1558                 if (!ies)
1559                         continue;
1560                 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1561                 if (!ie)
1562                         continue;
1563                 if (ssidlen && ie[1] != ssidlen)
1564                         continue;
1565                 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
1566                         continue;
1567                 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
1568                         list_del(&bss->hidden_list);
1569                 /* combine them */
1570                 list_add(&bss->hidden_list, &new->hidden_list);
1571                 bss->pub.hidden_beacon_bss = &new->pub;
1572                 new->refcount += bss->refcount;
1573                 rcu_assign_pointer(bss->pub.beacon_ies,
1574                                    new->pub.beacon_ies);
1575         }
1576
1577         WARN_ONCE(n_entries != rdev->bss_entries,
1578                   "rdev bss entries[%d]/list[len:%d] corruption\n",
1579                   rdev->bss_entries, n_entries);
1580
1581         return true;
1582 }
1583
1584 struct cfg80211_non_tx_bss {
1585         struct cfg80211_bss *tx_bss;
1586         u8 max_bssid_indicator;
1587         u8 bssid_index;
1588 };
1589
1590 static bool
1591 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
1592                           struct cfg80211_internal_bss *known,
1593                           struct cfg80211_internal_bss *new,
1594                           bool signal_valid)
1595 {
1596         lockdep_assert_held(&rdev->bss_lock);
1597
1598         /* Update IEs */
1599         if (rcu_access_pointer(new->pub.proberesp_ies)) {
1600                 const struct cfg80211_bss_ies *old;
1601
1602                 old = rcu_access_pointer(known->pub.proberesp_ies);
1603
1604                 rcu_assign_pointer(known->pub.proberesp_ies,
1605                                    new->pub.proberesp_ies);
1606                 /* Override possible earlier Beacon frame IEs */
1607                 rcu_assign_pointer(known->pub.ies,
1608                                    new->pub.proberesp_ies);
1609                 if (old)
1610                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1611         } else if (rcu_access_pointer(new->pub.beacon_ies)) {
1612                 const struct cfg80211_bss_ies *old;
1613                 struct cfg80211_internal_bss *bss;
1614
1615                 if (known->pub.hidden_beacon_bss &&
1616                     !list_empty(&known->hidden_list)) {
1617                         const struct cfg80211_bss_ies *f;
1618
1619                         /* The known BSS struct is one of the probe
1620                          * response members of a group, but we're
1621                          * receiving a beacon (beacon_ies in the new
1622                          * bss is used). This can only mean that the
1623                          * AP changed its beacon from not having an
1624                          * SSID to showing it, which is confusing so
1625                          * drop this information.
1626                          */
1627
1628                         f = rcu_access_pointer(new->pub.beacon_ies);
1629                         kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
1630                         return false;
1631                 }
1632
1633                 old = rcu_access_pointer(known->pub.beacon_ies);
1634
1635                 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
1636
1637                 /* Override IEs if they were from a beacon before */
1638                 if (old == rcu_access_pointer(known->pub.ies))
1639                         rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
1640
1641                 /* Assign beacon IEs to all sub entries */
1642                 list_for_each_entry(bss, &known->hidden_list, hidden_list) {
1643                         const struct cfg80211_bss_ies *ies;
1644
1645                         ies = rcu_access_pointer(bss->pub.beacon_ies);
1646                         WARN_ON(ies != old);
1647
1648                         rcu_assign_pointer(bss->pub.beacon_ies,
1649                                            new->pub.beacon_ies);
1650                 }
1651
1652                 if (old)
1653                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1654         }
1655
1656         known->pub.beacon_interval = new->pub.beacon_interval;
1657
1658         /* don't update the signal if beacon was heard on
1659          * adjacent channel.
1660          */
1661         if (signal_valid)
1662                 known->pub.signal = new->pub.signal;
1663         known->pub.capability = new->pub.capability;
1664         known->ts = new->ts;
1665         known->ts_boottime = new->ts_boottime;
1666         known->parent_tsf = new->parent_tsf;
1667         known->pub.chains = new->pub.chains;
1668         memcpy(known->pub.chain_signal, new->pub.chain_signal,
1669                IEEE80211_MAX_CHAINS);
1670         ether_addr_copy(known->parent_bssid, new->parent_bssid);
1671         known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
1672         known->pub.bssid_index = new->pub.bssid_index;
1673
1674         return true;
1675 }
1676
1677 /* Returned bss is reference counted and must be cleaned up appropriately. */
1678 struct cfg80211_internal_bss *
1679 cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1680                     struct cfg80211_internal_bss *tmp,
1681                     bool signal_valid, unsigned long ts)
1682 {
1683         struct cfg80211_internal_bss *found = NULL;
1684
1685         if (WARN_ON(!tmp->pub.channel))
1686                 return NULL;
1687
1688         tmp->ts = ts;
1689
1690         spin_lock_bh(&rdev->bss_lock);
1691
1692         if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
1693                 spin_unlock_bh(&rdev->bss_lock);
1694                 return NULL;
1695         }
1696
1697         found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
1698
1699         if (found) {
1700                 if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid))
1701                         goto drop;
1702         } else {
1703                 struct cfg80211_internal_bss *new;
1704                 struct cfg80211_internal_bss *hidden;
1705                 struct cfg80211_bss_ies *ies;
1706
1707                 /*
1708                  * create a copy -- the "res" variable that is passed in
1709                  * is allocated on the stack since it's not needed in the
1710                  * more common case of an update
1711                  */
1712                 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
1713                               GFP_ATOMIC);
1714                 if (!new) {
1715                         ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
1716                         if (ies)
1717                                 kfree_rcu(ies, rcu_head);
1718                         ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1719                         if (ies)
1720                                 kfree_rcu(ies, rcu_head);
1721                         goto drop;
1722                 }
1723                 memcpy(new, tmp, sizeof(*new));
1724                 new->refcount = 1;
1725                 INIT_LIST_HEAD(&new->hidden_list);
1726                 INIT_LIST_HEAD(&new->pub.nontrans_list);
1727
1728                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1729                         hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1730                         if (!hidden)
1731                                 hidden = rb_find_bss(rdev, tmp,
1732                                                      BSS_CMP_HIDE_NUL);
1733                         if (hidden) {
1734                                 new->pub.hidden_beacon_bss = &hidden->pub;
1735                                 list_add(&new->hidden_list,
1736                                          &hidden->hidden_list);
1737                                 hidden->refcount++;
1738                                 rcu_assign_pointer(new->pub.beacon_ies,
1739                                                    hidden->pub.beacon_ies);
1740                         }
1741                 } else {
1742                         /*
1743                          * Ok so we found a beacon, and don't have an entry. If
1744                          * it's a beacon with hidden SSID, we might be in for an
1745                          * expensive search for any probe responses that should
1746                          * be grouped with this beacon for updates ...
1747                          */
1748                         if (!cfg80211_combine_bsses(rdev, new)) {
1749                                 kfree(new);
1750                                 goto drop;
1751                         }
1752                 }
1753
1754                 if (rdev->bss_entries >= bss_entries_limit &&
1755                     !cfg80211_bss_expire_oldest(rdev)) {
1756                         kfree(new);
1757                         goto drop;
1758                 }
1759
1760                 /* This must be before the call to bss_ref_get */
1761                 if (tmp->pub.transmitted_bss) {
1762                         struct cfg80211_internal_bss *pbss =
1763                                 container_of(tmp->pub.transmitted_bss,
1764                                              struct cfg80211_internal_bss,
1765                                              pub);
1766
1767                         new->pub.transmitted_bss = tmp->pub.transmitted_bss;
1768                         bss_ref_get(rdev, pbss);
1769                 }
1770
1771                 list_add_tail(&new->list, &rdev->bss_list);
1772                 rdev->bss_entries++;
1773                 rb_insert_bss(rdev, new);
1774                 found = new;
1775         }
1776
1777         rdev->bss_generation++;
1778         bss_ref_get(rdev, found);
1779         spin_unlock_bh(&rdev->bss_lock);
1780
1781         return found;
1782  drop:
1783         spin_unlock_bh(&rdev->bss_lock);
1784         return NULL;
1785 }
1786
1787 /*
1788  * Update RX channel information based on the available frame payload
1789  * information. This is mainly for the 2.4 GHz band where frames can be received
1790  * from neighboring channels and the Beacon frames use the DSSS Parameter Set
1791  * element to indicate the current (transmitting) channel, but this might also
1792  * be needed on other bands if RX frequency does not match with the actual
1793  * operating channel of a BSS.
1794  */
1795 static struct ieee80211_channel *
1796 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1797                          struct ieee80211_channel *channel,
1798                          enum nl80211_bss_scan_width scan_width)
1799 {
1800         const u8 *tmp;
1801         u32 freq;
1802         int channel_number = -1;
1803         struct ieee80211_channel *alt_channel;
1804
1805         if (channel->band == NL80211_BAND_S1GHZ) {
1806                 tmp = cfg80211_find_ie(WLAN_EID_S1G_OPERATION, ie, ielen);
1807                 if (tmp && tmp[1] >= sizeof(struct ieee80211_s1g_oper_ie)) {
1808                         struct ieee80211_s1g_oper_ie *s1gop = (void *)(tmp + 2);
1809
1810                         channel_number = s1gop->primary_ch;
1811                 }
1812         } else {
1813                 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
1814                 if (tmp && tmp[1] == 1) {
1815                         channel_number = tmp[2];
1816                 } else {
1817                         tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
1818                         if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
1819                                 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
1820
1821                                 channel_number = htop->primary_chan;
1822                         }
1823                 }
1824         }
1825
1826         if (channel_number < 0) {
1827                 /* No channel information in frame payload */
1828                 return channel;
1829         }
1830
1831         freq = ieee80211_channel_to_freq_khz(channel_number, channel->band);
1832         alt_channel = ieee80211_get_channel_khz(wiphy, freq);
1833         if (!alt_channel) {
1834                 if (channel->band == NL80211_BAND_2GHZ) {
1835                         /*
1836                          * Better not allow unexpected channels when that could
1837                          * be going beyond the 1-11 range (e.g., discovering
1838                          * BSS on channel 12 when radio is configured for
1839                          * channel 11.
1840                          */
1841                         return NULL;
1842                 }
1843
1844                 /* No match for the payload channel number - ignore it */
1845                 return channel;
1846         }
1847
1848         if (scan_width == NL80211_BSS_CHAN_WIDTH_10 ||
1849             scan_width == NL80211_BSS_CHAN_WIDTH_5) {
1850                 /*
1851                  * Ignore channel number in 5 and 10 MHz channels where there
1852                  * may not be an n:1 or 1:n mapping between frequencies and
1853                  * channel numbers.
1854                  */
1855                 return channel;
1856         }
1857
1858         /*
1859          * Use the channel determined through the payload channel number
1860          * instead of the RX channel reported by the driver.
1861          */
1862         if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
1863                 return NULL;
1864         return alt_channel;
1865 }
1866
1867 /* Returned bss is reference counted and must be cleaned up appropriately. */
1868 static struct cfg80211_bss *
1869 cfg80211_inform_single_bss_data(struct wiphy *wiphy,
1870                                 struct cfg80211_inform_bss *data,
1871                                 enum cfg80211_bss_frame_type ftype,
1872                                 const u8 *bssid, u64 tsf, u16 capability,
1873                                 u16 beacon_interval, const u8 *ie, size_t ielen,
1874                                 struct cfg80211_non_tx_bss *non_tx_data,
1875                                 gfp_t gfp)
1876 {
1877         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1878         struct cfg80211_bss_ies *ies;
1879         struct ieee80211_channel *channel;
1880         struct cfg80211_internal_bss tmp = {}, *res;
1881         int bss_type;
1882         bool signal_valid;
1883         unsigned long ts;
1884
1885         if (WARN_ON(!wiphy))
1886                 return NULL;
1887
1888         if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1889                     (data->signal < 0 || data->signal > 100)))
1890                 return NULL;
1891
1892         channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan,
1893                                            data->scan_width);
1894         if (!channel)
1895                 return NULL;
1896
1897         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
1898         tmp.pub.channel = channel;
1899         tmp.pub.scan_width = data->scan_width;
1900         tmp.pub.signal = data->signal;
1901         tmp.pub.beacon_interval = beacon_interval;
1902         tmp.pub.capability = capability;
1903         tmp.ts_boottime = data->boottime_ns;
1904         if (non_tx_data) {
1905                 tmp.pub.transmitted_bss = non_tx_data->tx_bss;
1906                 ts = bss_from_pub(non_tx_data->tx_bss)->ts;
1907                 tmp.pub.bssid_index = non_tx_data->bssid_index;
1908                 tmp.pub.max_bssid_indicator = non_tx_data->max_bssid_indicator;
1909         } else {
1910                 ts = jiffies;
1911         }
1912
1913         /*
1914          * If we do not know here whether the IEs are from a Beacon or Probe
1915          * Response frame, we need to pick one of the options and only use it
1916          * with the driver that does not provide the full Beacon/Probe Response
1917          * frame. Use Beacon frame pointer to avoid indicating that this should
1918          * override the IEs pointer should we have received an earlier
1919          * indication of Probe Response data.
1920          */
1921         ies = kzalloc(sizeof(*ies) + ielen, gfp);
1922         if (!ies)
1923                 return NULL;
1924         ies->len = ielen;
1925         ies->tsf = tsf;
1926         ies->from_beacon = false;
1927         memcpy(ies->data, ie, ielen);
1928
1929         switch (ftype) {
1930         case CFG80211_BSS_FTYPE_BEACON:
1931                 ies->from_beacon = true;
1932                 fallthrough;
1933         case CFG80211_BSS_FTYPE_UNKNOWN:
1934                 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1935                 break;
1936         case CFG80211_BSS_FTYPE_PRESP:
1937                 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1938                 break;
1939         }
1940         rcu_assign_pointer(tmp.pub.ies, ies);
1941
1942         signal_valid = data->chan == channel;
1943         res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, ts);
1944         if (!res)
1945                 return NULL;
1946
1947         if (channel->band == NL80211_BAND_60GHZ) {
1948                 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1949                 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1950                     bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1951                         regulatory_hint_found_beacon(wiphy, channel, gfp);
1952         } else {
1953                 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1954                         regulatory_hint_found_beacon(wiphy, channel, gfp);
1955         }
1956
1957         if (non_tx_data) {
1958                 /* this is a nontransmitting bss, we need to add it to
1959                  * transmitting bss' list if it is not there
1960                  */
1961                 if (cfg80211_add_nontrans_list(non_tx_data->tx_bss,
1962                                                &res->pub)) {
1963                         if (__cfg80211_unlink_bss(rdev, res))
1964                                 rdev->bss_generation++;
1965                 }
1966         }
1967
1968         trace_cfg80211_return_bss(&res->pub);
1969         /* cfg80211_bss_update gives us a referenced result */
1970         return &res->pub;
1971 }
1972
1973 static const struct element
1974 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
1975                                    const struct element *mbssid_elem,
1976                                    const struct element *sub_elem)
1977 {
1978         const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
1979         const struct element *next_mbssid;
1980         const struct element *next_sub;
1981
1982         next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
1983                                          mbssid_end,
1984                                          ielen - (mbssid_end - ie));
1985
1986         /*
1987          * If it is not the last subelement in current MBSSID IE or there isn't
1988          * a next MBSSID IE - profile is complete.
1989         */
1990         if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
1991             !next_mbssid)
1992                 return NULL;
1993
1994         /* For any length error, just return NULL */
1995
1996         if (next_mbssid->datalen < 4)
1997                 return NULL;
1998
1999         next_sub = (void *)&next_mbssid->data[1];
2000
2001         if (next_mbssid->data + next_mbssid->datalen <
2002             next_sub->data + next_sub->datalen)
2003                 return NULL;
2004
2005         if (next_sub->id != 0 || next_sub->datalen < 2)
2006                 return NULL;
2007
2008         /*
2009          * Check if the first element in the next sub element is a start
2010          * of a new profile
2011          */
2012         return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
2013                NULL : next_mbssid;
2014 }
2015
2016 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
2017                               const struct element *mbssid_elem,
2018                               const struct element *sub_elem,
2019                               u8 *merged_ie, size_t max_copy_len)
2020 {
2021         size_t copied_len = sub_elem->datalen;
2022         const struct element *next_mbssid;
2023
2024         if (sub_elem->datalen > max_copy_len)
2025                 return 0;
2026
2027         memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
2028
2029         while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
2030                                                                 mbssid_elem,
2031                                                                 sub_elem))) {
2032                 const struct element *next_sub = (void *)&next_mbssid->data[1];
2033
2034                 if (copied_len + next_sub->datalen > max_copy_len)
2035                         break;
2036                 memcpy(merged_ie + copied_len, next_sub->data,
2037                        next_sub->datalen);
2038                 copied_len += next_sub->datalen;
2039         }
2040
2041         return copied_len;
2042 }
2043 EXPORT_SYMBOL(cfg80211_merge_profile);
2044
2045 static void cfg80211_parse_mbssid_data(struct wiphy *wiphy,
2046                                        struct cfg80211_inform_bss *data,
2047                                        enum cfg80211_bss_frame_type ftype,
2048                                        const u8 *bssid, u64 tsf,
2049                                        u16 beacon_interval, const u8 *ie,
2050                                        size_t ielen,
2051                                        struct cfg80211_non_tx_bss *non_tx_data,
2052                                        gfp_t gfp)
2053 {
2054         const u8 *mbssid_index_ie;
2055         const struct element *elem, *sub;
2056         size_t new_ie_len;
2057         u8 new_bssid[ETH_ALEN];
2058         u8 *new_ie, *profile;
2059         u64 seen_indices = 0;
2060         u16 capability;
2061         struct cfg80211_bss *bss;
2062
2063         if (!non_tx_data)
2064                 return;
2065         if (!cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2066                 return;
2067         if (!wiphy->support_mbssid)
2068                 return;
2069         if (wiphy->support_only_he_mbssid &&
2070             !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2071                 return;
2072
2073         new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2074         if (!new_ie)
2075                 return;
2076
2077         profile = kmalloc(ielen, gfp);
2078         if (!profile)
2079                 goto out;
2080
2081         for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
2082                 if (elem->datalen < 4)
2083                         continue;
2084                 for_each_element(sub, elem->data + 1, elem->datalen - 1) {
2085                         u8 profile_len;
2086
2087                         if (sub->id != 0 || sub->datalen < 4) {
2088                                 /* not a valid BSS profile */
2089                                 continue;
2090                         }
2091
2092                         if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
2093                             sub->data[1] != 2) {
2094                                 /* The first element within the Nontransmitted
2095                                  * BSSID Profile is not the Nontransmitted
2096                                  * BSSID Capability element.
2097                                  */
2098                                 continue;
2099                         }
2100
2101                         memset(profile, 0, ielen);
2102                         profile_len = cfg80211_merge_profile(ie, ielen,
2103                                                              elem,
2104                                                              sub,
2105                                                              profile,
2106                                                              ielen);
2107
2108                         /* found a Nontransmitted BSSID Profile */
2109                         mbssid_index_ie = cfg80211_find_ie
2110                                 (WLAN_EID_MULTI_BSSID_IDX,
2111                                  profile, profile_len);
2112                         if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
2113                             mbssid_index_ie[2] == 0 ||
2114                             mbssid_index_ie[2] > 46) {
2115                                 /* No valid Multiple BSSID-Index element */
2116                                 continue;
2117                         }
2118
2119                         if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
2120                                 /* We don't support legacy split of a profile */
2121                                 net_dbg_ratelimited("Partial info for BSSID index %d\n",
2122                                                     mbssid_index_ie[2]);
2123
2124                         seen_indices |= BIT_ULL(mbssid_index_ie[2]);
2125
2126                         non_tx_data->bssid_index = mbssid_index_ie[2];
2127                         non_tx_data->max_bssid_indicator = elem->data[0];
2128
2129                         cfg80211_gen_new_bssid(bssid,
2130                                                non_tx_data->max_bssid_indicator,
2131                                                non_tx_data->bssid_index,
2132                                                new_bssid);
2133                         memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2134                         new_ie_len = cfg80211_gen_new_ie(ie, ielen,
2135                                                          profile,
2136                                                          profile_len, new_ie,
2137                                                          gfp);
2138                         if (!new_ie_len)
2139                                 continue;
2140
2141                         capability = get_unaligned_le16(profile + 2);
2142                         bss = cfg80211_inform_single_bss_data(wiphy, data,
2143                                                               ftype,
2144                                                               new_bssid, tsf,
2145                                                               capability,
2146                                                               beacon_interval,
2147                                                               new_ie,
2148                                                               new_ie_len,
2149                                                               non_tx_data,
2150                                                               gfp);
2151                         if (!bss)
2152                                 break;
2153                         cfg80211_put_bss(wiphy, bss);
2154                 }
2155         }
2156
2157 out:
2158         kfree(new_ie);
2159         kfree(profile);
2160 }
2161
2162 struct cfg80211_bss *
2163 cfg80211_inform_bss_data(struct wiphy *wiphy,
2164                          struct cfg80211_inform_bss *data,
2165                          enum cfg80211_bss_frame_type ftype,
2166                          const u8 *bssid, u64 tsf, u16 capability,
2167                          u16 beacon_interval, const u8 *ie, size_t ielen,
2168                          gfp_t gfp)
2169 {
2170         struct cfg80211_bss *res;
2171         struct cfg80211_non_tx_bss non_tx_data;
2172
2173         res = cfg80211_inform_single_bss_data(wiphy, data, ftype, bssid, tsf,
2174                                               capability, beacon_interval, ie,
2175                                               ielen, NULL, gfp);
2176         if (!res)
2177                 return NULL;
2178         non_tx_data.tx_bss = res;
2179         cfg80211_parse_mbssid_data(wiphy, data, ftype, bssid, tsf,
2180                                    beacon_interval, ie, ielen, &non_tx_data,
2181                                    gfp);
2182         return res;
2183 }
2184 EXPORT_SYMBOL(cfg80211_inform_bss_data);
2185
2186 static void
2187 cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy,
2188                                  struct cfg80211_inform_bss *data,
2189                                  struct ieee80211_mgmt *mgmt, size_t len,
2190                                  struct cfg80211_non_tx_bss *non_tx_data,
2191                                  gfp_t gfp)
2192 {
2193         enum cfg80211_bss_frame_type ftype;
2194         const u8 *ie = mgmt->u.probe_resp.variable;
2195         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2196                                       u.probe_resp.variable);
2197
2198         ftype = ieee80211_is_beacon(mgmt->frame_control) ?
2199                 CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
2200
2201         cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
2202                                    le64_to_cpu(mgmt->u.probe_resp.timestamp),
2203                                    le16_to_cpu(mgmt->u.probe_resp.beacon_int),
2204                                    ie, ielen, non_tx_data, gfp);
2205 }
2206
2207 static void
2208 cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
2209                                    struct cfg80211_bss *nontrans_bss,
2210                                    struct ieee80211_mgmt *mgmt, size_t len)
2211 {
2212         u8 *ie, *new_ie, *pos;
2213         const u8 *nontrans_ssid, *trans_ssid, *mbssid;
2214         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2215                                       u.probe_resp.variable);
2216         size_t new_ie_len;
2217         struct cfg80211_bss_ies *new_ies;
2218         const struct cfg80211_bss_ies *old;
2219         u8 cpy_len;
2220
2221         lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
2222
2223         ie = mgmt->u.probe_resp.variable;
2224
2225         new_ie_len = ielen;
2226         trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
2227         if (!trans_ssid)
2228                 return;
2229         new_ie_len -= trans_ssid[1];
2230         mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen);
2231         /*
2232          * It's not valid to have the MBSSID element before SSID
2233          * ignore if that happens - the code below assumes it is
2234          * after (while copying things inbetween).
2235          */
2236         if (!mbssid || mbssid < trans_ssid)
2237                 return;
2238         new_ie_len -= mbssid[1];
2239
2240         nontrans_ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
2241         if (!nontrans_ssid)
2242                 return;
2243
2244         new_ie_len += nontrans_ssid[1];
2245
2246         /* generate new ie for nontrans BSS
2247          * 1. replace SSID with nontrans BSS' SSID
2248          * 2. skip MBSSID IE
2249          */
2250         new_ie = kzalloc(new_ie_len, GFP_ATOMIC);
2251         if (!new_ie)
2252                 return;
2253
2254         new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC);
2255         if (!new_ies)
2256                 goto out_free;
2257
2258         pos = new_ie;
2259
2260         /* copy the nontransmitted SSID */
2261         cpy_len = nontrans_ssid[1] + 2;
2262         memcpy(pos, nontrans_ssid, cpy_len);
2263         pos += cpy_len;
2264         /* copy the IEs between SSID and MBSSID */
2265         cpy_len = trans_ssid[1] + 2;
2266         memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len)));
2267         pos += (mbssid - (trans_ssid + cpy_len));
2268         /* copy the IEs after MBSSID */
2269         cpy_len = mbssid[1] + 2;
2270         memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len)));
2271
2272         /* update ie */
2273         new_ies->len = new_ie_len;
2274         new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2275         new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
2276         memcpy(new_ies->data, new_ie, new_ie_len);
2277         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
2278                 old = rcu_access_pointer(nontrans_bss->proberesp_ies);
2279                 rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies);
2280                 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2281                 if (old)
2282                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2283         } else {
2284                 old = rcu_access_pointer(nontrans_bss->beacon_ies);
2285                 rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
2286                 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2287                 if (old)
2288                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2289         }
2290
2291 out_free:
2292         kfree(new_ie);
2293 }
2294
2295 /* cfg80211_inform_bss_width_frame helper */
2296 static struct cfg80211_bss *
2297 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
2298                                       struct cfg80211_inform_bss *data,
2299                                       struct ieee80211_mgmt *mgmt, size_t len,
2300                                       gfp_t gfp)
2301 {
2302         struct cfg80211_internal_bss tmp = {}, *res;
2303         struct cfg80211_bss_ies *ies;
2304         struct ieee80211_channel *channel;
2305         bool signal_valid;
2306         struct ieee80211_ext *ext = NULL;
2307         u8 *bssid, *variable;
2308         u16 capability, beacon_int;
2309         size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
2310                                              u.probe_resp.variable);
2311         int bss_type;
2312
2313         BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
2314                         offsetof(struct ieee80211_mgmt, u.beacon.variable));
2315
2316         trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
2317
2318         if (WARN_ON(!mgmt))
2319                 return NULL;
2320
2321         if (WARN_ON(!wiphy))
2322                 return NULL;
2323
2324         if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2325                     (data->signal < 0 || data->signal > 100)))
2326                 return NULL;
2327
2328         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2329                 ext = (void *) mgmt;
2330                 min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
2331                 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2332                         min_hdr_len = offsetof(struct ieee80211_ext,
2333                                                u.s1g_short_beacon.variable);
2334         }
2335
2336         if (WARN_ON(len < min_hdr_len))
2337                 return NULL;
2338
2339         ielen = len - min_hdr_len;
2340         variable = mgmt->u.probe_resp.variable;
2341         if (ext) {
2342                 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2343                         variable = ext->u.s1g_short_beacon.variable;
2344                 else
2345                         variable = ext->u.s1g_beacon.variable;
2346         }
2347
2348         channel = cfg80211_get_bss_channel(wiphy, variable,
2349                                            ielen, data->chan, data->scan_width);
2350         if (!channel)
2351                 return NULL;
2352
2353         if (ext) {
2354                 struct ieee80211_s1g_bcn_compat_ie *compat;
2355                 u8 *ie;
2356
2357                 ie = (void *)cfg80211_find_ie(WLAN_EID_S1G_BCN_COMPAT,
2358                                               variable, ielen);
2359                 if (!ie)
2360                         return NULL;
2361                 compat = (void *)(ie + 2);
2362                 bssid = ext->u.s1g_beacon.sa;
2363                 capability = le16_to_cpu(compat->compat_info);
2364                 beacon_int = le16_to_cpu(compat->beacon_int);
2365         } else {
2366                 bssid = mgmt->bssid;
2367                 beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2368                 capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
2369         }
2370
2371         ies = kzalloc(sizeof(*ies) + ielen, gfp);
2372         if (!ies)
2373                 return NULL;
2374         ies->len = ielen;
2375         ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2376         ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) ||
2377                            ieee80211_is_s1g_beacon(mgmt->frame_control);
2378         memcpy(ies->data, variable, ielen);
2379
2380         if (ieee80211_is_probe_resp(mgmt->frame_control))
2381                 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2382         else
2383                 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2384         rcu_assign_pointer(tmp.pub.ies, ies);
2385
2386         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
2387         tmp.pub.beacon_interval = beacon_int;
2388         tmp.pub.capability = capability;
2389         tmp.pub.channel = channel;
2390         tmp.pub.scan_width = data->scan_width;
2391         tmp.pub.signal = data->signal;
2392         tmp.ts_boottime = data->boottime_ns;
2393         tmp.parent_tsf = data->parent_tsf;
2394         tmp.pub.chains = data->chains;
2395         memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS);
2396         ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
2397
2398         signal_valid = data->chan == channel;
2399         res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid,
2400                                   jiffies);
2401         if (!res)
2402                 return NULL;
2403
2404         if (channel->band == NL80211_BAND_60GHZ) {
2405                 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
2406                 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2407                     bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2408                         regulatory_hint_found_beacon(wiphy, channel, gfp);
2409         } else {
2410                 if (res->pub.capability & WLAN_CAPABILITY_ESS)
2411                         regulatory_hint_found_beacon(wiphy, channel, gfp);
2412         }
2413
2414         trace_cfg80211_return_bss(&res->pub);
2415         /* cfg80211_bss_update gives us a referenced result */
2416         return &res->pub;
2417 }
2418
2419 struct cfg80211_bss *
2420 cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
2421                                struct cfg80211_inform_bss *data,
2422                                struct ieee80211_mgmt *mgmt, size_t len,
2423                                gfp_t gfp)
2424 {
2425         struct cfg80211_bss *res, *tmp_bss;
2426         const u8 *ie = mgmt->u.probe_resp.variable;
2427         const struct cfg80211_bss_ies *ies1, *ies2;
2428         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2429                                       u.probe_resp.variable);
2430         struct cfg80211_non_tx_bss non_tx_data;
2431
2432         res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
2433                                                     len, gfp);
2434         if (!res || !wiphy->support_mbssid ||
2435             !cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2436                 return res;
2437         if (wiphy->support_only_he_mbssid &&
2438             !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2439                 return res;
2440
2441         non_tx_data.tx_bss = res;
2442         /* process each non-transmitting bss */
2443         cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len,
2444                                          &non_tx_data, gfp);
2445
2446         spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2447
2448         /* check if the res has other nontransmitting bss which is not
2449          * in MBSSID IE
2450          */
2451         ies1 = rcu_access_pointer(res->ies);
2452
2453         /* go through nontrans_list, if the timestamp of the BSS is
2454          * earlier than the timestamp of the transmitting BSS then
2455          * update it
2456          */
2457         list_for_each_entry(tmp_bss, &res->nontrans_list,
2458                             nontrans_list) {
2459                 ies2 = rcu_access_pointer(tmp_bss->ies);
2460                 if (ies2->tsf < ies1->tsf)
2461                         cfg80211_update_notlisted_nontrans(wiphy, tmp_bss,
2462                                                            mgmt, len);
2463         }
2464         spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2465
2466         return res;
2467 }
2468 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
2469
2470 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2471 {
2472         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2473         struct cfg80211_internal_bss *bss;
2474
2475         if (!pub)
2476                 return;
2477
2478         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2479
2480         spin_lock_bh(&rdev->bss_lock);
2481         bss_ref_get(rdev, bss);
2482         spin_unlock_bh(&rdev->bss_lock);
2483 }
2484 EXPORT_SYMBOL(cfg80211_ref_bss);
2485
2486 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2487 {
2488         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2489         struct cfg80211_internal_bss *bss;
2490
2491         if (!pub)
2492                 return;
2493
2494         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2495
2496         spin_lock_bh(&rdev->bss_lock);
2497         bss_ref_put(rdev, bss);
2498         spin_unlock_bh(&rdev->bss_lock);
2499 }
2500 EXPORT_SYMBOL(cfg80211_put_bss);
2501
2502 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2503 {
2504         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2505         struct cfg80211_internal_bss *bss, *tmp1;
2506         struct cfg80211_bss *nontrans_bss, *tmp;
2507
2508         if (WARN_ON(!pub))
2509                 return;
2510
2511         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2512
2513         spin_lock_bh(&rdev->bss_lock);
2514         if (list_empty(&bss->list))
2515                 goto out;
2516
2517         list_for_each_entry_safe(nontrans_bss, tmp,
2518                                  &pub->nontrans_list,
2519                                  nontrans_list) {
2520                 tmp1 = container_of(nontrans_bss,
2521                                     struct cfg80211_internal_bss, pub);
2522                 if (__cfg80211_unlink_bss(rdev, tmp1))
2523                         rdev->bss_generation++;
2524         }
2525
2526         if (__cfg80211_unlink_bss(rdev, bss))
2527                 rdev->bss_generation++;
2528 out:
2529         spin_unlock_bh(&rdev->bss_lock);
2530 }
2531 EXPORT_SYMBOL(cfg80211_unlink_bss);
2532
2533 void cfg80211_bss_iter(struct wiphy *wiphy,
2534                        struct cfg80211_chan_def *chandef,
2535                        void (*iter)(struct wiphy *wiphy,
2536                                     struct cfg80211_bss *bss,
2537                                     void *data),
2538                        void *iter_data)
2539 {
2540         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2541         struct cfg80211_internal_bss *bss;
2542
2543         spin_lock_bh(&rdev->bss_lock);
2544
2545         list_for_each_entry(bss, &rdev->bss_list, list) {
2546                 if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel))
2547                         iter(wiphy, &bss->pub, iter_data);
2548         }
2549
2550         spin_unlock_bh(&rdev->bss_lock);
2551 }
2552 EXPORT_SYMBOL(cfg80211_bss_iter);
2553
2554 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
2555                                      struct ieee80211_channel *chan)
2556 {
2557         struct wiphy *wiphy = wdev->wiphy;
2558         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2559         struct cfg80211_internal_bss *cbss = wdev->current_bss;
2560         struct cfg80211_internal_bss *new = NULL;
2561         struct cfg80211_internal_bss *bss;
2562         struct cfg80211_bss *nontrans_bss;
2563         struct cfg80211_bss *tmp;
2564
2565         spin_lock_bh(&rdev->bss_lock);
2566
2567         /*
2568          * Some APs use CSA also for bandwidth changes, i.e., without actually
2569          * changing the control channel, so no need to update in such a case.
2570          */
2571         if (cbss->pub.channel == chan)
2572                 goto done;
2573
2574         /* use transmitting bss */
2575         if (cbss->pub.transmitted_bss)
2576                 cbss = container_of(cbss->pub.transmitted_bss,
2577                                     struct cfg80211_internal_bss,
2578                                     pub);
2579
2580         cbss->pub.channel = chan;
2581
2582         list_for_each_entry(bss, &rdev->bss_list, list) {
2583                 if (!cfg80211_bss_type_match(bss->pub.capability,
2584                                              bss->pub.channel->band,
2585                                              wdev->conn_bss_type))
2586                         continue;
2587
2588                 if (bss == cbss)
2589                         continue;
2590
2591                 if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) {
2592                         new = bss;
2593                         break;
2594                 }
2595         }
2596
2597         if (new) {
2598                 /* to save time, update IEs for transmitting bss only */
2599                 if (cfg80211_update_known_bss(rdev, cbss, new, false)) {
2600                         new->pub.proberesp_ies = NULL;
2601                         new->pub.beacon_ies = NULL;
2602                 }
2603
2604                 list_for_each_entry_safe(nontrans_bss, tmp,
2605                                          &new->pub.nontrans_list,
2606                                          nontrans_list) {
2607                         bss = container_of(nontrans_bss,
2608                                            struct cfg80211_internal_bss, pub);
2609                         if (__cfg80211_unlink_bss(rdev, bss))
2610                                 rdev->bss_generation++;
2611                 }
2612
2613                 WARN_ON(atomic_read(&new->hold));
2614                 if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
2615                         rdev->bss_generation++;
2616         }
2617
2618         rb_erase(&cbss->rbn, &rdev->bss_tree);
2619         rb_insert_bss(rdev, cbss);
2620         rdev->bss_generation++;
2621
2622         list_for_each_entry_safe(nontrans_bss, tmp,
2623                                  &cbss->pub.nontrans_list,
2624                                  nontrans_list) {
2625                 bss = container_of(nontrans_bss,
2626                                    struct cfg80211_internal_bss, pub);
2627                 bss->pub.channel = chan;
2628                 rb_erase(&bss->rbn, &rdev->bss_tree);
2629                 rb_insert_bss(rdev, bss);
2630                 rdev->bss_generation++;
2631         }
2632
2633 done:
2634         spin_unlock_bh(&rdev->bss_lock);
2635 }
2636
2637 #ifdef CONFIG_CFG80211_WEXT
2638 static struct cfg80211_registered_device *
2639 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
2640 {
2641         struct cfg80211_registered_device *rdev;
2642         struct net_device *dev;
2643
2644         ASSERT_RTNL();
2645
2646         dev = dev_get_by_index(net, ifindex);
2647         if (!dev)
2648                 return ERR_PTR(-ENODEV);
2649         if (dev->ieee80211_ptr)
2650                 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
2651         else
2652                 rdev = ERR_PTR(-ENODEV);
2653         dev_put(dev);
2654         return rdev;
2655 }
2656
2657 int cfg80211_wext_siwscan(struct net_device *dev,
2658                           struct iw_request_info *info,
2659                           union iwreq_data *wrqu, char *extra)
2660 {
2661         struct cfg80211_registered_device *rdev;
2662         struct wiphy *wiphy;
2663         struct iw_scan_req *wreq = NULL;
2664         struct cfg80211_scan_request *creq = NULL;
2665         int i, err, n_channels = 0;
2666         enum nl80211_band band;
2667
2668         if (!netif_running(dev))
2669                 return -ENETDOWN;
2670
2671         if (wrqu->data.length == sizeof(struct iw_scan_req))
2672                 wreq = (struct iw_scan_req *)extra;
2673
2674         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
2675
2676         if (IS_ERR(rdev))
2677                 return PTR_ERR(rdev);
2678
2679         if (rdev->scan_req || rdev->scan_msg) {
2680                 err = -EBUSY;
2681                 goto out;
2682         }
2683
2684         wiphy = &rdev->wiphy;
2685
2686         /* Determine number of channels, needed to allocate creq */
2687         if (wreq && wreq->num_channels)
2688                 n_channels = wreq->num_channels;
2689         else
2690                 n_channels = ieee80211_get_num_supported_channels(wiphy);
2691
2692         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
2693                        n_channels * sizeof(void *),
2694                        GFP_ATOMIC);
2695         if (!creq) {
2696                 err = -ENOMEM;
2697                 goto out;
2698         }
2699
2700         creq->wiphy = wiphy;
2701         creq->wdev = dev->ieee80211_ptr;
2702         /* SSIDs come after channels */
2703         creq->ssids = (void *)&creq->channels[n_channels];
2704         creq->n_channels = n_channels;
2705         creq->n_ssids = 1;
2706         creq->scan_start = jiffies;
2707
2708         /* translate "Scan on frequencies" request */
2709         i = 0;
2710         for (band = 0; band < NUM_NL80211_BANDS; band++) {
2711                 int j;
2712
2713                 if (!wiphy->bands[band])
2714                         continue;
2715
2716                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2717                         /* ignore disabled channels */
2718                         if (wiphy->bands[band]->channels[j].flags &
2719                                                 IEEE80211_CHAN_DISABLED)
2720                                 continue;
2721
2722                         /* If we have a wireless request structure and the
2723                          * wireless request specifies frequencies, then search
2724                          * for the matching hardware channel.
2725                          */
2726                         if (wreq && wreq->num_channels) {
2727                                 int k;
2728                                 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
2729                                 for (k = 0; k < wreq->num_channels; k++) {
2730                                         struct iw_freq *freq =
2731                                                 &wreq->channel_list[k];
2732                                         int wext_freq =
2733                                                 cfg80211_wext_freq(freq);
2734
2735                                         if (wext_freq == wiphy_freq)
2736                                                 goto wext_freq_found;
2737                                 }
2738                                 goto wext_freq_not_found;
2739                         }
2740
2741                 wext_freq_found:
2742                         creq->channels[i] = &wiphy->bands[band]->channels[j];
2743                         i++;
2744                 wext_freq_not_found: ;
2745                 }
2746         }
2747         /* No channels found? */
2748         if (!i) {
2749                 err = -EINVAL;
2750                 goto out;
2751         }
2752
2753         /* Set real number of channels specified in creq->channels[] */
2754         creq->n_channels = i;
2755
2756         /* translate "Scan for SSID" request */
2757         if (wreq) {
2758                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
2759                         if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
2760                                 err = -EINVAL;
2761                                 goto out;
2762                         }
2763                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
2764                         creq->ssids[0].ssid_len = wreq->essid_len;
2765                 }
2766                 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
2767                         creq->n_ssids = 0;
2768         }
2769
2770         for (i = 0; i < NUM_NL80211_BANDS; i++)
2771                 if (wiphy->bands[i])
2772                         creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
2773
2774         eth_broadcast_addr(creq->bssid);
2775
2776         rdev->scan_req = creq;
2777         err = rdev_scan(rdev, creq);
2778         if (err) {
2779                 rdev->scan_req = NULL;
2780                 /* creq will be freed below */
2781         } else {
2782                 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
2783                 /* creq now owned by driver */
2784                 creq = NULL;
2785                 dev_hold(dev);
2786         }
2787  out:
2788         kfree(creq);
2789         return err;
2790 }
2791 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
2792
2793 static char *ieee80211_scan_add_ies(struct iw_request_info *info,
2794                                     const struct cfg80211_bss_ies *ies,
2795                                     char *current_ev, char *end_buf)
2796 {
2797         const u8 *pos, *end, *next;
2798         struct iw_event iwe;
2799
2800         if (!ies)
2801                 return current_ev;
2802
2803         /*
2804          * If needed, fragment the IEs buffer (at IE boundaries) into short
2805          * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
2806          */
2807         pos = ies->data;
2808         end = pos + ies->len;
2809
2810         while (end - pos > IW_GENERIC_IE_MAX) {
2811                 next = pos + 2 + pos[1];
2812                 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
2813                         next = next + 2 + next[1];
2814
2815                 memset(&iwe, 0, sizeof(iwe));
2816                 iwe.cmd = IWEVGENIE;
2817                 iwe.u.data.length = next - pos;
2818                 current_ev = iwe_stream_add_point_check(info, current_ev,
2819                                                         end_buf, &iwe,
2820                                                         (void *)pos);
2821                 if (IS_ERR(current_ev))
2822                         return current_ev;
2823                 pos = next;
2824         }
2825
2826         if (end > pos) {
2827                 memset(&iwe, 0, sizeof(iwe));
2828                 iwe.cmd = IWEVGENIE;
2829                 iwe.u.data.length = end - pos;
2830                 current_ev = iwe_stream_add_point_check(info, current_ev,
2831                                                         end_buf, &iwe,
2832                                                         (void *)pos);
2833                 if (IS_ERR(current_ev))
2834                         return current_ev;
2835         }
2836
2837         return current_ev;
2838 }
2839
2840 static char *
2841 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
2842               struct cfg80211_internal_bss *bss, char *current_ev,
2843               char *end_buf)
2844 {
2845         const struct cfg80211_bss_ies *ies;
2846         struct iw_event iwe;
2847         const u8 *ie;
2848         u8 buf[50];
2849         u8 *cfg, *p, *tmp;
2850         int rem, i, sig;
2851         bool ismesh = false;
2852
2853         memset(&iwe, 0, sizeof(iwe));
2854         iwe.cmd = SIOCGIWAP;
2855         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2856         memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
2857         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2858                                                 IW_EV_ADDR_LEN);
2859         if (IS_ERR(current_ev))
2860                 return current_ev;
2861
2862         memset(&iwe, 0, sizeof(iwe));
2863         iwe.cmd = SIOCGIWFREQ;
2864         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
2865         iwe.u.freq.e = 0;
2866         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2867                                                 IW_EV_FREQ_LEN);
2868         if (IS_ERR(current_ev))
2869                 return current_ev;
2870
2871         memset(&iwe, 0, sizeof(iwe));
2872         iwe.cmd = SIOCGIWFREQ;
2873         iwe.u.freq.m = bss->pub.channel->center_freq;
2874         iwe.u.freq.e = 6;
2875         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2876                                                 IW_EV_FREQ_LEN);
2877         if (IS_ERR(current_ev))
2878                 return current_ev;
2879
2880         if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
2881                 memset(&iwe, 0, sizeof(iwe));
2882                 iwe.cmd = IWEVQUAL;
2883                 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
2884                                      IW_QUAL_NOISE_INVALID |
2885                                      IW_QUAL_QUAL_UPDATED;
2886                 switch (wiphy->signal_type) {
2887                 case CFG80211_SIGNAL_TYPE_MBM:
2888                         sig = bss->pub.signal / 100;
2889                         iwe.u.qual.level = sig;
2890                         iwe.u.qual.updated |= IW_QUAL_DBM;
2891                         if (sig < -110)         /* rather bad */
2892                                 sig = -110;
2893                         else if (sig > -40)     /* perfect */
2894                                 sig = -40;
2895                         /* will give a range of 0 .. 70 */
2896                         iwe.u.qual.qual = sig + 110;
2897                         break;
2898                 case CFG80211_SIGNAL_TYPE_UNSPEC:
2899                         iwe.u.qual.level = bss->pub.signal;
2900                         /* will give range 0 .. 100 */
2901                         iwe.u.qual.qual = bss->pub.signal;
2902                         break;
2903                 default:
2904                         /* not reached */
2905                         break;
2906                 }
2907                 current_ev = iwe_stream_add_event_check(info, current_ev,
2908                                                         end_buf, &iwe,
2909                                                         IW_EV_QUAL_LEN);
2910                 if (IS_ERR(current_ev))
2911                         return current_ev;
2912         }
2913
2914         memset(&iwe, 0, sizeof(iwe));
2915         iwe.cmd = SIOCGIWENCODE;
2916         if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
2917                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2918         else
2919                 iwe.u.data.flags = IW_ENCODE_DISABLED;
2920         iwe.u.data.length = 0;
2921         current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
2922                                                 &iwe, "");
2923         if (IS_ERR(current_ev))
2924                 return current_ev;
2925
2926         rcu_read_lock();
2927         ies = rcu_dereference(bss->pub.ies);
2928         rem = ies->len;
2929         ie = ies->data;
2930
2931         while (rem >= 2) {
2932                 /* invalid data */
2933                 if (ie[1] > rem - 2)
2934                         break;
2935
2936                 switch (ie[0]) {
2937                 case WLAN_EID_SSID:
2938                         memset(&iwe, 0, sizeof(iwe));
2939                         iwe.cmd = SIOCGIWESSID;
2940                         iwe.u.data.length = ie[1];
2941                         iwe.u.data.flags = 1;
2942                         current_ev = iwe_stream_add_point_check(info,
2943                                                                 current_ev,
2944                                                                 end_buf, &iwe,
2945                                                                 (u8 *)ie + 2);
2946                         if (IS_ERR(current_ev))
2947                                 goto unlock;
2948                         break;
2949                 case WLAN_EID_MESH_ID:
2950                         memset(&iwe, 0, sizeof(iwe));
2951                         iwe.cmd = SIOCGIWESSID;
2952                         iwe.u.data.length = ie[1];
2953                         iwe.u.data.flags = 1;
2954                         current_ev = iwe_stream_add_point_check(info,
2955                                                                 current_ev,
2956                                                                 end_buf, &iwe,
2957                                                                 (u8 *)ie + 2);
2958                         if (IS_ERR(current_ev))
2959                                 goto unlock;
2960                         break;
2961                 case WLAN_EID_MESH_CONFIG:
2962                         ismesh = true;
2963                         if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
2964                                 break;
2965                         cfg = (u8 *)ie + 2;
2966                         memset(&iwe, 0, sizeof(iwe));
2967                         iwe.cmd = IWEVCUSTOM;
2968                         sprintf(buf, "Mesh Network Path Selection Protocol ID: "
2969                                 "0x%02X", cfg[0]);
2970                         iwe.u.data.length = strlen(buf);
2971                         current_ev = iwe_stream_add_point_check(info,
2972                                                                 current_ev,
2973                                                                 end_buf,
2974                                                                 &iwe, buf);
2975                         if (IS_ERR(current_ev))
2976                                 goto unlock;
2977                         sprintf(buf, "Path Selection Metric ID: 0x%02X",
2978                                 cfg[1]);
2979                         iwe.u.data.length = strlen(buf);
2980                         current_ev = iwe_stream_add_point_check(info,
2981                                                                 current_ev,
2982                                                                 end_buf,
2983                                                                 &iwe, buf);
2984                         if (IS_ERR(current_ev))
2985                                 goto unlock;
2986                         sprintf(buf, "Congestion Control Mode ID: 0x%02X",
2987                                 cfg[2]);
2988                         iwe.u.data.length = strlen(buf);
2989                         current_ev = iwe_stream_add_point_check(info,
2990                                                                 current_ev,
2991                                                                 end_buf,
2992                                                                 &iwe, buf);
2993                         if (IS_ERR(current_ev))
2994                                 goto unlock;
2995                         sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
2996                         iwe.u.data.length = strlen(buf);
2997                         current_ev = iwe_stream_add_point_check(info,
2998                                                                 current_ev,
2999                                                                 end_buf,
3000                                                                 &iwe, buf);
3001                         if (IS_ERR(current_ev))
3002                                 goto unlock;
3003                         sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
3004                         iwe.u.data.length = strlen(buf);
3005                         current_ev = iwe_stream_add_point_check(info,
3006                                                                 current_ev,
3007                                                                 end_buf,
3008                                                                 &iwe, buf);
3009                         if (IS_ERR(current_ev))
3010                                 goto unlock;
3011                         sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
3012                         iwe.u.data.length = strlen(buf);
3013                         current_ev = iwe_stream_add_point_check(info,
3014                                                                 current_ev,
3015                                                                 end_buf,
3016                                                                 &iwe, buf);
3017                         if (IS_ERR(current_ev))
3018                                 goto unlock;
3019                         sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
3020                         iwe.u.data.length = strlen(buf);
3021                         current_ev = iwe_stream_add_point_check(info,
3022                                                                 current_ev,
3023                                                                 end_buf,
3024                                                                 &iwe, buf);
3025                         if (IS_ERR(current_ev))
3026                                 goto unlock;
3027                         break;
3028                 case WLAN_EID_SUPP_RATES:
3029                 case WLAN_EID_EXT_SUPP_RATES:
3030                         /* display all supported rates in readable format */
3031                         p = current_ev + iwe_stream_lcp_len(info);
3032
3033                         memset(&iwe, 0, sizeof(iwe));
3034                         iwe.cmd = SIOCGIWRATE;
3035                         /* Those two flags are ignored... */
3036                         iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3037
3038                         for (i = 0; i < ie[1]; i++) {
3039                                 iwe.u.bitrate.value =
3040                                         ((ie[i + 2] & 0x7f) * 500000);
3041                                 tmp = p;
3042                                 p = iwe_stream_add_value(info, current_ev, p,
3043                                                          end_buf, &iwe,
3044                                                          IW_EV_PARAM_LEN);
3045                                 if (p == tmp) {
3046                                         current_ev = ERR_PTR(-E2BIG);
3047                                         goto unlock;
3048                                 }
3049                         }
3050                         current_ev = p;
3051                         break;
3052                 }
3053                 rem -= ie[1] + 2;
3054                 ie += ie[1] + 2;
3055         }
3056
3057         if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
3058             ismesh) {
3059                 memset(&iwe, 0, sizeof(iwe));
3060                 iwe.cmd = SIOCGIWMODE;
3061                 if (ismesh)
3062                         iwe.u.mode = IW_MODE_MESH;
3063                 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
3064                         iwe.u.mode = IW_MODE_MASTER;
3065                 else
3066                         iwe.u.mode = IW_MODE_ADHOC;
3067                 current_ev = iwe_stream_add_event_check(info, current_ev,
3068                                                         end_buf, &iwe,
3069                                                         IW_EV_UINT_LEN);
3070                 if (IS_ERR(current_ev))
3071                         goto unlock;
3072         }
3073
3074         memset(&iwe, 0, sizeof(iwe));
3075         iwe.cmd = IWEVCUSTOM;
3076         sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
3077         iwe.u.data.length = strlen(buf);
3078         current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3079                                                 &iwe, buf);
3080         if (IS_ERR(current_ev))
3081                 goto unlock;
3082         memset(&iwe, 0, sizeof(iwe));
3083         iwe.cmd = IWEVCUSTOM;
3084         sprintf(buf, " Last beacon: %ums ago",
3085                 elapsed_jiffies_msecs(bss->ts));
3086         iwe.u.data.length = strlen(buf);
3087         current_ev = iwe_stream_add_point_check(info, current_ev,
3088                                                 end_buf, &iwe, buf);
3089         if (IS_ERR(current_ev))
3090                 goto unlock;
3091
3092         current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
3093
3094  unlock:
3095         rcu_read_unlock();
3096         return current_ev;
3097 }
3098
3099
3100 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
3101                                   struct iw_request_info *info,
3102                                   char *buf, size_t len)
3103 {
3104         char *current_ev = buf;
3105         char *end_buf = buf + len;
3106         struct cfg80211_internal_bss *bss;
3107         int err = 0;
3108
3109         spin_lock_bh(&rdev->bss_lock);
3110         cfg80211_bss_expire(rdev);
3111
3112         list_for_each_entry(bss, &rdev->bss_list, list) {
3113                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3114                         err = -E2BIG;
3115                         break;
3116                 }
3117                 current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
3118                                            current_ev, end_buf);
3119                 if (IS_ERR(current_ev)) {
3120                         err = PTR_ERR(current_ev);
3121                         break;
3122                 }
3123         }
3124         spin_unlock_bh(&rdev->bss_lock);
3125
3126         if (err)
3127                 return err;
3128         return current_ev - buf;
3129 }
3130
3131
3132 int cfg80211_wext_giwscan(struct net_device *dev,
3133                           struct iw_request_info *info,
3134                           struct iw_point *data, char *extra)
3135 {
3136         struct cfg80211_registered_device *rdev;
3137         int res;
3138
3139         if (!netif_running(dev))
3140                 return -ENETDOWN;
3141
3142         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3143
3144         if (IS_ERR(rdev))
3145                 return PTR_ERR(rdev);
3146
3147         if (rdev->scan_req || rdev->scan_msg)
3148                 return -EAGAIN;
3149
3150         res = ieee80211_scan_results(rdev, info, extra, data->length);
3151         data->length = 0;
3152         if (res >= 0) {
3153                 data->length = res;
3154                 res = 0;
3155         }
3156
3157         return res;
3158 }
3159 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
3160 #endif