wireless/scan.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * cfg80211 scan result handling
   4  *
   5  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2016       Intel Deutschland GmbH
   8  * Copyright (C) 2018-2021 Intel Corporation
   9  */
  10 #include <linux/kernel.h>
  11 #include <linux/slab.h>
  12 #include <linux/module.h>
  13 #include <linux/netdevice.h>
  14 #include <linux/wireless.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/etherdevice.h>
  17 #include <linux/crc32.h>
  18 #include <linux/bitfield.h>
  19 #include <net/arp.h>
  20 #include <net/cfg80211.h>
  21 #include <net/cfg80211-wext.h>
  22 #include <net/iw_handler.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "wext-compat.h"
  26 #include "rdev-ops.h"
  27
  28 /**
  29  * DOC: BSS tree/list structure
  30  *
  31  * At the top level, the BSS list is kept in both a list in each
  32  * registered device (@bss_list) as well as an RB-tree for faster
  33  * lookup. In the RB-tree, entries can be looked up using their
  34  * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
  35  * for other BSSes.
  36  *
  37  * Due to the possibility of hidden SSIDs, there's a second level
  38  * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
  39  * The hidden_list connects all BSSes belonging to a single AP
  40  * that has a hidden SSID, and connects beacon and probe response
  41  * entries. For a probe response entry for a hidden SSID, the
  42  * hidden_beacon_bss pointer points to the BSS struct holding the
  43  * beacon's information.
  44  *
  45  * Reference counting is done for all these references except for
  46  * the hidden_list, so that a beacon BSS struct that is otherwise
  47  * not referenced has one reference for being on the bss_list and
  48  * one for each probe response entry that points to it using the
  49  * hidden_beacon_bss pointer. When a BSS struct that has such a
  50  * pointer is get/put, the refcount update is also propagated to
  51  * the referenced struct, this ensure that it cannot get removed
  52  * while somebody is using the probe response version.
  53  *
  54  * Note that the hidden_beacon_bss pointer never changes, due to
  55  * the reference counting. Therefore, no locking is needed for
  56  * it.
  57  *
  58  * Also note that the hidden_beacon_bss pointer is only relevant
  59  * if the driver uses something other than the IEs, e.g. private
  60  * data stored in the BSS struct, since the beacon IEs are
  61  * also linked into the probe response struct.
  62  */
  63
  64 /*
  65  * Limit the number of BSS entries stored in mac80211. Each one is
  66  * a bit over 4k at most, so this limits to roughly 4-5M of memory.
  67  * If somebody wants to really attack this though, they'd likely
  68  * use small beacons, and only one type of frame, limiting each of
  69  * the entries to a much smaller size (in order to generate more
  70  * entries in total, so overhead is bigger.)
  71  */
  72 static int bss_entries_limit = 1000;
  73 module_param(bss_entries_limit, int, 0644);
  74 MODULE_PARM_DESC(bss_entries_limit,
  75                  "limit to number of scan BSS entries (per wiphy, default 1000)");
  76
  77 #define IEEE80211_SCAN_RESULT_EXPIRE    (30 * HZ)
  78
  79 /**
  80  * struct cfg80211_colocated_ap - colocated AP information
  81  *
  82  * @list: linked list to all colocated aPS
  83  * @bssid: BSSID of the reported AP
  84  * @ssid: SSID of the reported AP
  85  * @ssid_len: length of the ssid
  86  * @center_freq: frequency the reported AP is on
  87  * @unsolicited_probe: the reported AP is part of an ESS, where all the APs
  88  *      that operate in the same channel as the reported AP and that might be
  89  *      detected by a STA receiving this frame, are transmitting unsolicited
  90  *      Probe Response frames every 20 TUs
  91  * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP
  92  * @same_ssid: the reported AP has the same SSID as the reporting AP
  93  * @multi_bss: the reported AP is part of a multiple BSSID set
  94  * @transmitted_bssid: the reported AP is the transmitting BSSID
  95  * @colocated_ess: all the APs that share the same ESS as the reported AP are
  96  *      colocated and can be discovered via legacy bands.
  97  * @short_ssid_valid: short_ssid is valid and can be used
  98  * @short_ssid: the short SSID for this SSID
  99  */
 100 struct cfg80211_colocated_ap {
 101         struct list_head list;
 102         u8 bssid[ETH_ALEN];
 103         u8 ssid[IEEE80211_MAX_SSID_LEN];
 104         size_t ssid_len;
 105         u32 short_ssid;
 106         u32 center_freq;
 107         u8 unsolicited_probe:1,
 108            oct_recommended:1,
 109            same_ssid:1,
 110            multi_bss:1,
 111            transmitted_bssid:1,
 112            colocated_ess:1,
 113            short_ssid_valid:1;
 114 };
 115
 116 static void bss_free(struct cfg80211_internal_bss *bss)
 117 {
 118         struct cfg80211_bss_ies *ies;
 119
 120         if (WARN_ON(atomic_read(&bss->hold)))
 121                 return;
 122
 123         ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
 124         if (ies && !bss->pub.hidden_beacon_bss)
 125                 kfree_rcu(ies, rcu_head);
 126         ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
 127         if (ies)
 128                 kfree_rcu(ies, rcu_head);
 129
 130         /*
 131          * This happens when the module is removed, it doesn't
 132          * really matter any more save for completeness
 133          */
 134         if (!list_empty(&bss->hidden_list))
 135                 list_del(&bss->hidden_list);
 136
 137         kfree(bss);
 138 }
 139
 140 static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
 141                                struct cfg80211_internal_bss *bss)
 142 {
 143         lockdep_assert_held(&rdev->bss_lock);
 144
 145         bss->refcount++;
 146         if (bss->pub.hidden_beacon_bss) {
 147                 bss = container_of(bss->pub.hidden_beacon_bss,
 148                                    struct cfg80211_internal_bss,
 149                                    pub);
 150                 bss->refcount++;
 151         }
 152         if (bss->pub.transmitted_bss) {
 153                 bss = container_of(bss->pub.transmitted_bss,
 154                                    struct cfg80211_internal_bss,
 155                                    pub);
 156                 bss->refcount++;
 157         }
 158 }
 159
 160 static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
 161                                struct cfg80211_internal_bss *bss)
 162 {
 163         lockdep_assert_held(&rdev->bss_lock);
 164
 165         if (bss->pub.hidden_beacon_bss) {
 166                 struct cfg80211_internal_bss *hbss;
 167                 hbss = container_of(bss->pub.hidden_beacon_bss,
 168                                     struct cfg80211_internal_bss,
 169                                     pub);
 170                 hbss->refcount--;
 171                 if (hbss->refcount == 0)
 172                         bss_free(hbss);
 173         }
 174
 175         if (bss->pub.transmitted_bss) {
 176                 struct cfg80211_internal_bss *tbss;
 177
 178                 tbss = container_of(bss->pub.transmitted_bss,
 179                                     struct cfg80211_internal_bss,
 180                                     pub);
 181                 tbss->refcount--;
 182                 if (tbss->refcount == 0)
 183                         bss_free(tbss);
 184         }
 185
 186         bss->refcount--;
 187         if (bss->refcount == 0)
 188                 bss_free(bss);
 189 }
 190
 191 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
 192                                   struct cfg80211_internal_bss *bss)
 193 {
 194         lockdep_assert_held(&rdev->bss_lock);
 195
 196         if (!list_empty(&bss->hidden_list)) {
 197                 /*
 198                  * don't remove the beacon entry if it has
 199                  * probe responses associated with it
 200                  */
 201                 if (!bss->pub.hidden_beacon_bss)
 202                         return false;
 203                 /*
 204                  * if it's a probe response entry break its
 205                  * link to the other entries in the group
 206                  */
 207                 list_del_init(&bss->hidden_list);
 208         }
 209
 210         list_del_init(&bss->list);
 211         list_del_init(&bss->pub.nontrans_list);
 212         rb_erase(&bss->rbn, &rdev->bss_tree);
 213         rdev->bss_entries--;
 214         WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
 215                   "rdev bss entries[%d]/list[empty:%d] corruption\n",
 216                   rdev->bss_entries, list_empty(&rdev->bss_list));
 217         bss_ref_put(rdev, bss);
 218         return true;
 219 }
 220
 221 bool cfg80211_is_element_inherited(const struct element *elem,
 222                                    const struct element *non_inherit_elem)
 223 {
 224         u8 id_len, ext_id_len, i, loop_len, id;
 225         const u8 *list;
 226
 227         if (elem->id == WLAN_EID_MULTIPLE_BSSID)
 228                 return false;
 229
 230         if (!non_inherit_elem || non_inherit_elem->datalen < 2)
 231                 return true;
 232
 233         /*
 234          * non inheritance element format is:
 235          * ext ID (56) | IDs list len | list | extension IDs list len | list
 236          * Both lists are optional. Both lengths are mandatory.
 237          * This means valid length is:
 238          * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
 239          */
 240         id_len = non_inherit_elem->data[1];
 241         if (non_inherit_elem->datalen < 3 + id_len)
 242                 return true;
 243
 244         ext_id_len = non_inherit_elem->data[2 + id_len];
 245         if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
 246                 return true;
 247
 248         if (elem->id == WLAN_EID_EXTENSION) {
 249                 if (!ext_id_len)
 250                         return true;
 251                 loop_len = ext_id_len;
 252                 list = &non_inherit_elem->data[3 + id_len];
 253                 id = elem->data[0];
 254         } else {
 255                 if (!id_len)
 256                         return true;
 257                 loop_len = id_len;
 258                 list = &non_inherit_elem->data[2];
 259                 id = elem->id;
 260         }
 261
 262         for (i = 0; i < loop_len; i++) {
 263                 if (list[i] == id)
 264                         return false;
 265         }
 266
 267         return true;
 268 }
 269 EXPORT_SYMBOL(cfg80211_is_element_inherited);
 270
 271 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
 272                                   const u8 *subelement, size_t subie_len,
 273                                   u8 *new_ie, gfp_t gfp)
 274 {
 275         u8 *pos, *tmp;
 276         const u8 *tmp_old, *tmp_new;
 277         const struct element *non_inherit_elem;
 278         u8 *sub_copy;
 279
 280         /* copy subelement as we need to change its content to
 281          * mark an ie after it is processed.
 282          */
 283         sub_copy = kmemdup(subelement, subie_len, gfp);
 284         if (!sub_copy)
 285                 return 0;
 286
 287         pos = &new_ie[0];
 288
 289         /* set new ssid */
 290         tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len);
 291         if (tmp_new) {
 292                 memcpy(pos, tmp_new, tmp_new[1] + 2);
 293                 pos += (tmp_new[1] + 2);
 294         }
 295
 296         /* get non inheritance list if exists */
 297         non_inherit_elem =
 298                 cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
 299                                        sub_copy, subie_len);
 300
 301         /* go through IEs in ie (skip SSID) and subelement,
 302          * merge them into new_ie
 303          */
 304         tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
 305         tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
 306
 307         while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
 308                 if (tmp_old[0] == 0) {
 309                         tmp_old++;
 310                         continue;
 311                 }
 312
 313                 if (tmp_old[0] == WLAN_EID_EXTENSION)
 314                         tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy,
 315                                                          subie_len);
 316                 else
 317                         tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy,
 318                                                      subie_len);
 319
 320                 if (!tmp) {
 321                         const struct element *old_elem = (void *)tmp_old;
 322
 323                         /* ie in old ie but not in subelement */
 324                         if (cfg80211_is_element_inherited(old_elem,
 325                                                           non_inherit_elem)) {
 326                                 memcpy(pos, tmp_old, tmp_old[1] + 2);
 327                                 pos += tmp_old[1] + 2;
 328                         }
 329                 } else {
 330                         /* ie in transmitting ie also in subelement,
 331                          * copy from subelement and flag the ie in subelement
 332                          * as copied (by setting eid field to WLAN_EID_SSID,
 333                          * which is skipped anyway).
 334                          * For vendor ie, compare OUI + type + subType to
 335                          * determine if they are the same ie.
 336                          */
 337                         if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) {
 338                                 if (!memcmp(tmp_old + 2, tmp + 2, 5)) {
 339                                         /* same vendor ie, copy from
 340                                          * subelement
 341                                          */
 342                                         memcpy(pos, tmp, tmp[1] + 2);
 343                                         pos += tmp[1] + 2;
 344                                         tmp[0] = WLAN_EID_SSID;
 345                                 } else {
 346                                         memcpy(pos, tmp_old, tmp_old[1] + 2);
 347                                         pos += tmp_old[1] + 2;
 348                                 }
 349                         } else {
 350                                 /* copy ie from subelement into new ie */
 351                                 memcpy(pos, tmp, tmp[1] + 2);
 352                                 pos += tmp[1] + 2;
 353                                 tmp[0] = WLAN_EID_SSID;
 354                         }
 355                 }
 356
 357                 if (tmp_old + tmp_old[1] + 2 - ie == ielen)
 358                         break;
 359
 360                 tmp_old += tmp_old[1] + 2;
 361         }
 362
 363         /* go through subelement again to check if there is any ie not
 364          * copied to new ie, skip ssid, capability, bssid-index ie
 365          */
 366         tmp_new = sub_copy;
 367         while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
 368                 if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
 369                       tmp_new[0] == WLAN_EID_SSID)) {
 370                         memcpy(pos, tmp_new, tmp_new[1] + 2);
 371                         pos += tmp_new[1] + 2;
 372                 }
 373                 if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len)
 374                         break;
 375                 tmp_new += tmp_new[1] + 2;
 376         }
 377
 378         kfree(sub_copy);
 379         return pos - new_ie;
 380 }
 381
 382 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
 383                    const u8 *ssid, size_t ssid_len)
 384 {
 385         const struct cfg80211_bss_ies *ies;
 386         const u8 *ssidie;
 387
 388         if (bssid && !ether_addr_equal(a->bssid, bssid))
 389                 return false;
 390
 391         if (!ssid)
 392                 return true;
 393
 394         ies = rcu_access_pointer(a->ies);
 395         if (!ies)
 396                 return false;
 397         ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
 398         if (!ssidie)
 399                 return false;
 400         if (ssidie[1] != ssid_len)
 401                 return false;
 402         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
 403 }
 404
 405 static int
 406 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
 407                            struct cfg80211_bss *nontrans_bss)
 408 {
 409         const u8 *ssid;
 410         size_t ssid_len;
 411         struct cfg80211_bss *bss = NULL;
 412
 413         rcu_read_lock();
 414         ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
 415         if (!ssid) {
 416                 rcu_read_unlock();
 417                 return -EINVAL;
 418         }
 419         ssid_len = ssid[1];
 420         ssid = ssid + 2;
 421
 422         /* check if nontrans_bss is in the list */
 423         list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
 424                 if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) {
 425                         rcu_read_unlock();
 426                         return 0;
 427                 }
 428         }
 429
 430         rcu_read_unlock();
 431
 432         /* add to the list */
 433         list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
 434         return 0;
 435 }
 436
 437 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
 438                                   unsigned long expire_time)
 439 {
 440         struct cfg80211_internal_bss *bss, *tmp;
 441         bool expired = false;
 442
 443         lockdep_assert_held(&rdev->bss_lock);
 444
 445         list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
 446                 if (atomic_read(&bss->hold))
 447                         continue;
 448                 if (!time_after(expire_time, bss->ts))
 449                         continue;
 450
 451                 if (__cfg80211_unlink_bss(rdev, bss))
 452                         expired = true;
 453         }
 454
 455         if (expired)
 456                 rdev->bss_generation++;
 457 }
 458
 459 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
 460 {
 461         struct cfg80211_internal_bss *bss, *oldest = NULL;
 462         bool ret;
 463
 464         lockdep_assert_held(&rdev->bss_lock);
 465
 466         list_for_each_entry(bss, &rdev->bss_list, list) {
 467                 if (atomic_read(&bss->hold))
 468                         continue;
 469
 470                 if (!list_empty(&bss->hidden_list) &&
 471                     !bss->pub.hidden_beacon_bss)
 472                         continue;
 473
 474                 if (oldest && time_before(oldest->ts, bss->ts))
 475                         continue;
 476                 oldest = bss;
 477         }
 478
 479         if (WARN_ON(!oldest))
 480                 return false;
 481
 482         /*
 483          * The callers make sure to increase rdev->bss_generation if anything
 484          * gets removed (and a new entry added), so there's no need to also do
 485          * it here.
 486          */
 487
 488         ret = __cfg80211_unlink_bss(rdev, oldest);
 489         WARN_ON(!ret);
 490         return ret;
 491 }
 492
 493 static u8 cfg80211_parse_bss_param(u8 data,
 494                                    struct cfg80211_colocated_ap *coloc_ap)
 495 {
 496         coloc_ap->oct_recommended =
 497                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
 498         coloc_ap->same_ssid =
 499                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
 500         coloc_ap->multi_bss =
 501                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
 502         coloc_ap->transmitted_bssid =
 503                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
 504         coloc_ap->unsolicited_probe =
 505                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
 506         coloc_ap->colocated_ess =
 507                 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
 508
 509         return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
 510 }
 511
 512 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
 513                                     const struct element **elem, u32 *s_ssid)
 514 {
 515
 516         *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
 517         if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
 518                 return -EINVAL;
 519
 520         *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen);
 521         return 0;
 522 }
 523
 524 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
 525 {
 526         struct cfg80211_colocated_ap *ap, *tmp_ap;
 527
 528         list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
 529                 list_del(&ap->list);
 530                 kfree(ap);
 531         }
 532 }
 533
 534 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
 535                                   const u8 *pos, u8 length,
 536                                   const struct element *ssid_elem,
 537                                   int s_ssid_tmp)
 538 {
 539         /* skip the TBTT offset */
 540         pos++;
 541
 542         memcpy(entry->bssid, pos, ETH_ALEN);
 543         pos += ETH_ALEN;
 544
 545         if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM) {
 546                 memcpy(&entry->short_ssid, pos,
 547                        sizeof(entry->short_ssid));
 548                 entry->short_ssid_valid = true;
 549                 pos += 4;
 550         }
 551
 552         /* skip non colocated APs */
 553         if (!cfg80211_parse_bss_param(*pos, entry))
 554                 return -EINVAL;
 555         pos++;
 556
 557         if (length == IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM) {
 558                 /*
 559                  * no information about the short ssid. Consider the entry valid
 560                  * for now. It would later be dropped in case there are explicit
 561                  * SSIDs that need to be matched
 562                  */
 563                 if (!entry->same_ssid)
 564                         return 0;
 565         }
 566
 567         if (entry->same_ssid) {
 568                 entry->short_ssid = s_ssid_tmp;
 569                 entry->short_ssid_valid = true;
 570
 571                 /*
 572                  * This is safe because we validate datalen in
 573                  * cfg80211_parse_colocated_ap(), before calling this
 574                  * function.
 575                  */
 576                 memcpy(&entry->ssid, &ssid_elem->data,
 577                        ssid_elem->datalen);
 578                 entry->ssid_len = ssid_elem->datalen;
 579         }
 580         return 0;
 581 }
 582
 583 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
 584                                        struct list_head *list)
 585 {
 586         struct ieee80211_neighbor_ap_info *ap_info;
 587         const struct element *elem, *ssid_elem;
 588         const u8 *pos, *end;
 589         u32 s_ssid_tmp;
 590         int n_coloc = 0, ret;
 591         LIST_HEAD(ap_list);
 592
 593         elem = cfg80211_find_elem(WLAN_EID_REDUCED_NEIGHBOR_REPORT, ies->data,
 594                                   ies->len);
 595         if (!elem)
 596                 return 0;
 597
 598         pos = elem->data;
 599         end = pos + elem->datalen;
 600
 601         ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp);
 602         if (ret)
 603                 return ret;
 604
 605         /* RNR IE may contain more than one NEIGHBOR_AP_INFO */
 606         while (pos + sizeof(*ap_info) <= end) {
 607                 enum nl80211_band band;
 608                 int freq;
 609                 u8 length, i, count;
 610
 611                 ap_info = (void *)pos;
 612                 count = u8_get_bits(ap_info->tbtt_info_hdr,
 613                                     IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
 614                 length = ap_info->tbtt_info_len;
 615
 616                 pos += sizeof(*ap_info);
 617
 618                 if (!ieee80211_operating_class_to_band(ap_info->op_class,
 619                                                        &band))
 620                         break;
 621
 622                 freq = ieee80211_channel_to_frequency(ap_info->channel, band);
 623
 624                 if (end - pos < count * length)
 625                         break;
 626
 627                 /*
 628                  * TBTT info must include bss param + BSSID +
 629                  * (short SSID or same_ssid bit to be set).
 630                  * ignore other options, and move to the
 631                  * next AP info
 632                  */
 633                 if (band != NL80211_BAND_6GHZ ||
 634                     (length != IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM &&
 635                      length < IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM)) {
 636                         pos += count * length;
 637                         continue;
 638                 }
 639
 640                 for (i = 0; i < count; i++) {
 641                         struct cfg80211_colocated_ap *entry;
 642
 643                         entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
 644                                         GFP_ATOMIC);
 645
 646                         if (!entry)
 647                                 break;
 648
 649                         entry->center_freq = freq;
 650
 651                         if (!cfg80211_parse_ap_info(entry, pos, length,
 652                                                     ssid_elem, s_ssid_tmp)) {
 653                                 n_coloc++;
 654                                 list_add_tail(&entry->list, &ap_list);
 655                         } else {
 656                                 kfree(entry);
 657                         }
 658
 659                         pos += length;
 660                 }
 661         }
 662
 663         if (pos != end) {
 664                 cfg80211_free_coloc_ap_list(&ap_list);
 665                 return 0;
 666         }
 667
 668         list_splice_tail(&ap_list, list);
 669         return n_coloc;
 670 }
 671
 672 static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
 673                                         struct ieee80211_channel *chan,
 674                                         bool add_to_6ghz)
 675 {
 676         int i;
 677         u32 n_channels = request->n_channels;
 678         struct cfg80211_scan_6ghz_params *params =
 679                 &request->scan_6ghz_params[request->n_6ghz_params];
 680
 681         for (i = 0; i < n_channels; i++) {
 682                 if (request->channels[i] == chan) {
 683                         if (add_to_6ghz)
 684                                 params->channel_idx = i;
 685                         return;
 686                 }
 687         }
 688
 689         request->channels[n_channels] = chan;
 690         if (add_to_6ghz)
 691                 request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
 692                         n_channels;
 693
 694         request->n_channels++;
 695 }
 696
 697 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
 698                                      struct cfg80211_scan_request *request)
 699 {
 700         int i;
 701         u32 s_ssid;
 702
 703         for (i = 0; i < request->n_ssids; i++) {
 704                 /* wildcard ssid in the scan request */
 705                 if (!request->ssids[i].ssid_len) {
 706                         if (ap->multi_bss && !ap->transmitted_bssid)
 707                                 continue;
 708
 709                         return true;
 710                 }
 711
 712                 if (ap->ssid_len &&
 713                     ap->ssid_len == request->ssids[i].ssid_len) {
 714                         if (!memcmp(request->ssids[i].ssid, ap->ssid,
 715                                     ap->ssid_len))
 716                                 return true;
 717                 } else if (ap->short_ssid_valid) {
 718                         s_ssid = ~crc32_le(~0, request->ssids[i].ssid,
 719                                            request->ssids[i].ssid_len);
 720
 721                         if (ap->short_ssid == s_ssid)
 722                                 return true;
 723                 }
 724         }
 725
 726         return false;
 727 }
 728
 729 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
 730 {
 731         u8 i;
 732         struct cfg80211_colocated_ap *ap;
 733         int n_channels, count = 0, err;
 734         struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
 735         LIST_HEAD(coloc_ap_list);
 736         bool need_scan_psc = true;
 737         const struct ieee80211_sband_iftype_data *iftd;
 738
 739         rdev_req->scan_6ghz = true;
 740
 741         if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
 742                 return -EOPNOTSUPP;
 743
 744         iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ],
 745                                                rdev_req->wdev->iftype);
 746         if (!iftd || !iftd->he_cap.has_he)
 747                 return -EOPNOTSUPP;
 748
 749         n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
 750
 751         if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
 752                 struct cfg80211_internal_bss *intbss;
 753
 754                 spin_lock_bh(&rdev->bss_lock);
 755                 list_for_each_entry(intbss, &rdev->bss_list, list) {
 756                         struct cfg80211_bss *res = &intbss->pub;
 757                         const struct cfg80211_bss_ies *ies;
 758
 759                         ies = rcu_access_pointer(res->ies);
 760                         count += cfg80211_parse_colocated_ap(ies,
 761                                                              &coloc_ap_list);
 762                 }
 763                 spin_unlock_bh(&rdev->bss_lock);
 764         }
 765
 766         request = kzalloc(struct_size(request, channels, n_channels) +
 767                           sizeof(*request->scan_6ghz_params) * count +
 768                           sizeof(*request->ssids) * rdev_req->n_ssids,
 769                           GFP_KERNEL);
 770         if (!request) {
 771                 cfg80211_free_coloc_ap_list(&coloc_ap_list);
 772                 return -ENOMEM;
 773         }
 774
 775         *request = *rdev_req;
 776         request->n_channels = 0;
 777         request->scan_6ghz_params =
 778                 (void *)&request->channels[n_channels];
 779
 780         /*
 781          * PSC channels should not be scanned in case of direct scan with 1 SSID
 782          * and at least one of the reported co-located APs with same SSID
 783          * indicating that all APs in the same ESS are co-located
 784          */
 785         if (count && request->n_ssids == 1 && request->ssids[0].ssid_len) {
 786                 list_for_each_entry(ap, &coloc_ap_list, list) {
 787                         if (ap->colocated_ess &&
 788                             cfg80211_find_ssid_match(ap, request)) {
 789                                 need_scan_psc = false;
 790                                 break;
 791                         }
 792                 }
 793         }
 794
 795         /*
 796          * add to the scan request the channels that need to be scanned
 797          * regardless of the collocated APs (PSC channels or all channels
 798          * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
 799          */
 800         for (i = 0; i < rdev_req->n_channels; i++) {
 801                 if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ &&
 802                     ((need_scan_psc &&
 803                       cfg80211_channel_is_psc(rdev_req->channels[i])) ||
 804                      !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
 805                         cfg80211_scan_req_add_chan(request,
 806                                                    rdev_req->channels[i],
 807                                                    false);
 808                 }
 809         }
 810
 811         if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
 812                 goto skip;
 813
 814         list_for_each_entry(ap, &coloc_ap_list, list) {
 815                 bool found = false;
 816                 struct cfg80211_scan_6ghz_params *scan_6ghz_params =
 817                         &request->scan_6ghz_params[request->n_6ghz_params];
 818                 struct ieee80211_channel *chan =
 819                         ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
 820
 821                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 822                         continue;
 823
 824                 for (i = 0; i < rdev_req->n_channels; i++) {
 825                         if (rdev_req->channels[i] == chan)
 826                                 found = true;
 827                 }
 828
 829                 if (!found)
 830                         continue;
 831
 832                 if (request->n_ssids > 0 &&
 833                     !cfg80211_find_ssid_match(ap, request))
 834                         continue;
 835
 836                 if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
 837                         continue;
 838
 839                 cfg80211_scan_req_add_chan(request, chan, true);
 840                 memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
 841                 scan_6ghz_params->short_ssid = ap->short_ssid;
 842                 scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
 843                 scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
 844
 845                 /*
 846                  * If a PSC channel is added to the scan and 'need_scan_psc' is
 847                  * set to false, then all the APs that the scan logic is
 848                  * interested with on the channel are collocated and thus there
 849                  * is no need to perform the initial PSC channel listen.
 850                  */
 851                 if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
 852                         scan_6ghz_params->psc_no_listen = true;
 853
 854                 request->n_6ghz_params++;
 855         }
 856
 857 skip:
 858         cfg80211_free_coloc_ap_list(&coloc_ap_list);
 859
 860         if (request->n_channels) {
 861                 struct cfg80211_scan_request *old = rdev->int_scan_req;
 862                 rdev->int_scan_req = request;
 863
 864                 /*
 865                  * Add the ssids from the parent scan request to the new scan
 866                  * request, so the driver would be able to use them in its
 867                  * probe requests to discover hidden APs on PSC channels.
 868                  */
 869                 request->ssids = (void *)&request->channels[request->n_channels];
 870                 request->n_ssids = rdev_req->n_ssids;
 871                 memcpy(request->ssids, rdev_req->ssids, sizeof(*request->ssids) *
 872                        request->n_ssids);
 873
 874                 /*
 875                  * If this scan follows a previous scan, save the scan start
 876                  * info from the first part of the scan
 877                  */
 878                 if (old)
 879                         rdev->int_scan_req->info = old->info;
 880
 881                 err = rdev_scan(rdev, request);
 882                 if (err) {
 883                         rdev->int_scan_req = old;
 884                         kfree(request);
 885                 } else {
 886                         kfree(old);
 887                 }
 888
 889                 return err;
 890         }
 891
 892         kfree(request);
 893         return -EINVAL;
 894 }
 895
 896 int cfg80211_scan(struct cfg80211_registered_device *rdev)
 897 {
 898         struct cfg80211_scan_request *request;
 899         struct cfg80211_scan_request *rdev_req = rdev->scan_req;
 900         u32 n_channels = 0, idx, i;
 901
 902         if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ))
 903                 return rdev_scan(rdev, rdev_req);
 904
 905         for (i = 0; i < rdev_req->n_channels; i++) {
 906                 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
 907                         n_channels++;
 908         }
 909
 910         if (!n_channels)
 911                 return cfg80211_scan_6ghz(rdev);
 912
 913         request = kzalloc(struct_size(request, channels, n_channels),
 914                           GFP_KERNEL);
 915         if (!request)
 916                 return -ENOMEM;
 917
 918         *request = *rdev_req;
 919         request->n_channels = n_channels;
 920
 921         for (i = idx = 0; i < rdev_req->n_channels; i++) {
 922                 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
 923                         request->channels[idx++] = rdev_req->channels[i];
 924         }
 925
 926         rdev_req->scan_6ghz = false;
 927         rdev->int_scan_req = request;
 928         return rdev_scan(rdev, request);
 929 }
 930
 931 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
 932                            bool send_message)
 933 {
 934         struct cfg80211_scan_request *request, *rdev_req;
 935         struct wireless_dev *wdev;
 936         struct sk_buff *msg;
 937 #ifdef CONFIG_CFG80211_WEXT
 938         union iwreq_data wrqu;
 939 #endif
 940
 941         lockdep_assert_held(&rdev->wiphy.mtx);
 942
 943         if (rdev->scan_msg) {
 944                 nl80211_send_scan_msg(rdev, rdev->scan_msg);
 945                 rdev->scan_msg = NULL;
 946                 return;
 947         }
 948
 949         rdev_req = rdev->scan_req;
 950         if (!rdev_req)
 951                 return;
 952
 953         wdev = rdev_req->wdev;
 954         request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
 955
 956         if (wdev_running(wdev) &&
 957             (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
 958             !rdev_req->scan_6ghz && !request->info.aborted &&
 959             !cfg80211_scan_6ghz(rdev))
 960                 return;
 961
 962         /*
 963          * This must be before sending the other events!
 964          * Otherwise, wpa_supplicant gets completely confused with
 965          * wext events.
 966          */
 967         if (wdev->netdev)
 968                 cfg80211_sme_scan_done(wdev->netdev);
 969
 970         if (!request->info.aborted &&
 971             request->flags & NL80211_SCAN_FLAG_FLUSH) {
 972                 /* flush entries from previous scans */
 973                 spin_lock_bh(&rdev->bss_lock);
 974                 __cfg80211_bss_expire(rdev, request->scan_start);
 975                 spin_unlock_bh(&rdev->bss_lock);
 976         }
 977
 978         msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
 979
 980 #ifdef CONFIG_CFG80211_WEXT
 981         if (wdev->netdev && !request->info.aborted) {
 982                 memset(&wrqu, 0, sizeof(wrqu));
 983
 984                 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
 985         }
 986 #endif
 987
 988         dev_put(wdev->netdev);
 989
 990         kfree(rdev->int_scan_req);
 991         rdev->int_scan_req = NULL;
 992
 993         kfree(rdev->scan_req);
 994         rdev->scan_req = NULL;
 995
 996         if (!send_message)
 997                 rdev->scan_msg = msg;
 998         else
 999                 nl80211_send_scan_msg(rdev, msg);
1000 }
1001
1002 void __cfg80211_scan_done(struct work_struct *wk)
1003 {
1004         struct cfg80211_registered_device *rdev;
1005
1006         rdev = container_of(wk, struct cfg80211_registered_device,
1007                             scan_done_wk);
1008
1009         wiphy_lock(&rdev->wiphy);
1010         ___cfg80211_scan_done(rdev, true);
1011         wiphy_unlock(&rdev->wiphy);
1012 }
1013
1014 void cfg80211_scan_done(struct cfg80211_scan_request *request,
1015                         struct cfg80211_scan_info *info)
1016 {
1017         struct cfg80211_scan_info old_info = request->info;
1018
1019         trace_cfg80211_scan_done(request, info);
1020         WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req &&
1021                 request != wiphy_to_rdev(request->wiphy)->int_scan_req);
1022
1023         request->info = *info;
1024
1025         /*
1026          * In case the scan is split, the scan_start_tsf and tsf_bssid should
1027          * be of the first part. In such a case old_info.scan_start_tsf should
1028          * be non zero.
1029          */
1030         if (request->scan_6ghz && old_info.scan_start_tsf) {
1031                 request->info.scan_start_tsf = old_info.scan_start_tsf;
1032                 memcpy(request->info.tsf_bssid, old_info.tsf_bssid,
1033                        sizeof(request->info.tsf_bssid));
1034         }
1035
1036         request->notified = true;
1037         queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
1038 }
1039 EXPORT_SYMBOL(cfg80211_scan_done);
1040
1041 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
1042                                  struct cfg80211_sched_scan_request *req)
1043 {
1044         lockdep_assert_held(&rdev->wiphy.mtx);
1045
1046         list_add_rcu(&req->list, &rdev->sched_scan_req_list);
1047 }
1048
1049 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
1050                                         struct cfg80211_sched_scan_request *req)
1051 {
1052         lockdep_assert_held(&rdev->wiphy.mtx);
1053
1054         list_del_rcu(&req->list);
1055         kfree_rcu(req, rcu_head);
1056 }
1057
1058 static struct cfg80211_sched_scan_request *
1059 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
1060 {
1061         struct cfg80211_sched_scan_request *pos;
1062
1063         list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
1064                                 lockdep_is_held(&rdev->wiphy.mtx)) {
1065                 if (pos->reqid == reqid)
1066                         return pos;
1067         }
1068         return NULL;
1069 }
1070
1071 /*
1072  * Determines if a scheduled scan request can be handled. When a legacy
1073  * scheduled scan is running no other scheduled scan is allowed regardless
1074  * whether the request is for legacy or multi-support scan. When a multi-support
1075  * scheduled scan is running a request for legacy scan is not allowed. In this
1076  * case a request for multi-support scan can be handled if resources are
1077  * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
1078  */
1079 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
1080                                      bool want_multi)
1081 {
1082         struct cfg80211_sched_scan_request *pos;
1083         int i = 0;
1084
1085         list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
1086                 /* request id zero means legacy in progress */
1087                 if (!i && !pos->reqid)
1088                         return -EINPROGRESS;
1089                 i++;
1090         }
1091
1092         if (i) {
1093                 /* no legacy allowed when multi request(s) are active */
1094                 if (!want_multi)
1095                         return -EINPROGRESS;
1096
1097                 /* resource limit reached */
1098                 if (i == rdev->wiphy.max_sched_scan_reqs)
1099                         return -ENOSPC;
1100         }
1101         return 0;
1102 }
1103
1104 void cfg80211_sched_scan_results_wk(struct work_struct *work)
1105 {
1106         struct cfg80211_registered_device *rdev;
1107         struct cfg80211_sched_scan_request *req, *tmp;
1108
1109         rdev = container_of(work, struct cfg80211_registered_device,
1110                            sched_scan_res_wk);
1111
1112         wiphy_lock(&rdev->wiphy);
1113         list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
1114                 if (req->report_results) {
1115                         req->report_results = false;
1116                         if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
1117                                 /* flush entries from previous scans */
1118                                 spin_lock_bh(&rdev->bss_lock);
1119                                 __cfg80211_bss_expire(rdev, req->scan_start);
1120                                 spin_unlock_bh(&rdev->bss_lock);
1121                                 req->scan_start = jiffies;
1122                         }
1123                         nl80211_send_sched_scan(req,
1124                                                 NL80211_CMD_SCHED_SCAN_RESULTS);
1125                 }
1126         }
1127         wiphy_unlock(&rdev->wiphy);
1128 }
1129
1130 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
1131 {
1132         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1133         struct cfg80211_sched_scan_request *request;
1134
1135         trace_cfg80211_sched_scan_results(wiphy, reqid);
1136         /* ignore if we're not scanning */
1137
1138         rcu_read_lock();
1139         request = cfg80211_find_sched_scan_req(rdev, reqid);
1140         if (request) {
1141                 request->report_results = true;
1142                 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
1143         }
1144         rcu_read_unlock();
1145 }
1146 EXPORT_SYMBOL(cfg80211_sched_scan_results);
1147
1148 void cfg80211_sched_scan_stopped_locked(struct wiphy *wiphy, u64 reqid)
1149 {
1150         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1151
1152         lockdep_assert_held(&wiphy->mtx);
1153
1154         trace_cfg80211_sched_scan_stopped(wiphy, reqid);
1155
1156         __cfg80211_stop_sched_scan(rdev, reqid, true);
1157 }
1158 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_locked);
1159
1160 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
1161 {
1162         wiphy_lock(wiphy);
1163         cfg80211_sched_scan_stopped_locked(wiphy, reqid);
1164         wiphy_unlock(wiphy);
1165 }
1166 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
1167
1168 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
1169                                  struct cfg80211_sched_scan_request *req,
1170                                  bool driver_initiated)
1171 {
1172         lockdep_assert_held(&rdev->wiphy.mtx);
1173
1174         if (!driver_initiated) {
1175                 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
1176                 if (err)
1177                         return err;
1178         }
1179
1180         nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
1181
1182         cfg80211_del_sched_scan_req(rdev, req);
1183
1184         return 0;
1185 }
1186
1187 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
1188                                u64 reqid, bool driver_initiated)
1189 {
1190         struct cfg80211_sched_scan_request *sched_scan_req;
1191
1192         lockdep_assert_held(&rdev->wiphy.mtx);
1193
1194         sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
1195         if (!sched_scan_req)
1196                 return -ENOENT;
1197
1198         return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
1199                                             driver_initiated);
1200 }
1201
1202 void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
1203                       unsigned long age_secs)
1204 {
1205         struct cfg80211_internal_bss *bss;
1206         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
1207
1208         spin_lock_bh(&rdev->bss_lock);
1209         list_for_each_entry(bss, &rdev->bss_list, list)
1210                 bss->ts -= age_jiffies;
1211         spin_unlock_bh(&rdev->bss_lock);
1212 }
1213
1214 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
1215 {
1216         __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
1217 }
1218
1219 void cfg80211_bss_flush(struct wiphy *wiphy)
1220 {
1221         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1222
1223         spin_lock_bh(&rdev->bss_lock);
1224         __cfg80211_bss_expire(rdev, jiffies);
1225         spin_unlock_bh(&rdev->bss_lock);
1226 }
1227 EXPORT_SYMBOL(cfg80211_bss_flush);
1228
1229 const struct element *
1230 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
1231                          const u8 *match, unsigned int match_len,
1232                          unsigned int match_offset)
1233 {
1234         const struct element *elem;
1235
1236         for_each_element_id(elem, eid, ies, len) {
1237                 if (elem->datalen >= match_offset + match_len &&
1238                     !memcmp(elem->data + match_offset, match, match_len))
1239                         return elem;
1240         }
1241
1242         return NULL;
1243 }
1244 EXPORT_SYMBOL(cfg80211_find_elem_match);
1245
1246 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
1247                                                 const u8 *ies,
1248                                                 unsigned int len)
1249 {
1250         const struct element *elem;
1251         u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
1252         int match_len = (oui_type < 0) ? 3 : sizeof(match);
1253
1254         if (WARN_ON(oui_type > 0xff))
1255                 return NULL;
1256
1257         elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
1258                                         match, match_len, 0);
1259
1260         if (!elem || elem->datalen < 4)
1261                 return NULL;
1262
1263         return elem;
1264 }
1265 EXPORT_SYMBOL(cfg80211_find_vendor_elem);
1266
1267 /**
1268  * enum bss_compare_mode - BSS compare mode
1269  * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
1270  * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
1271  * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
1272  */
1273 enum bss_compare_mode {
1274         BSS_CMP_REGULAR,
1275         BSS_CMP_HIDE_ZLEN,
1276         BSS_CMP_HIDE_NUL,
1277 };
1278
1279 static int cmp_bss(struct cfg80211_bss *a,
1280                    struct cfg80211_bss *b,
1281                    enum bss_compare_mode mode)
1282 {
1283         const struct cfg80211_bss_ies *a_ies, *b_ies;
1284         const u8 *ie1 = NULL;
1285         const u8 *ie2 = NULL;
1286         int i, r;
1287
1288         if (a->channel != b->channel)
1289                 return b->channel->center_freq - a->channel->center_freq;
1290
1291         a_ies = rcu_access_pointer(a->ies);
1292         if (!a_ies)
1293                 return -1;
1294         b_ies = rcu_access_pointer(b->ies);
1295         if (!b_ies)
1296                 return 1;
1297
1298         if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
1299                 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1300                                        a_ies->data, a_ies->len);
1301         if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
1302                 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1303                                        b_ies->data, b_ies->len);
1304         if (ie1 && ie2) {
1305                 int mesh_id_cmp;
1306
1307                 if (ie1[1] == ie2[1])
1308                         mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1309                 else
1310                         mesh_id_cmp = ie2[1] - ie1[1];
1311
1312                 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1313                                        a_ies->data, a_ies->len);
1314                 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1315                                        b_ies->data, b_ies->len);
1316                 if (ie1 && ie2) {
1317                         if (mesh_id_cmp)
1318                                 return mesh_id_cmp;
1319                         if (ie1[1] != ie2[1])
1320                                 return ie2[1] - ie1[1];
1321                         return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1322                 }
1323         }
1324
1325         r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
1326         if (r)
1327                 return r;
1328
1329         ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
1330         ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
1331
1332         if (!ie1 && !ie2)
1333                 return 0;
1334
1335         /*
1336          * Note that with "hide_ssid", the function returns a match if
1337          * the already-present BSS ("b") is a hidden SSID beacon for
1338          * the new BSS ("a").
1339          */
1340
1341         /* sort missing IE before (left of) present IE */
1342         if (!ie1)
1343                 return -1;
1344         if (!ie2)
1345                 return 1;
1346
1347         switch (mode) {
1348         case BSS_CMP_HIDE_ZLEN:
1349                 /*
1350                  * In ZLEN mode we assume the BSS entry we're
1351                  * looking for has a zero-length SSID. So if
1352                  * the one we're looking at right now has that,
1353                  * return 0. Otherwise, return the difference
1354                  * in length, but since we're looking for the
1355                  * 0-length it's really equivalent to returning
1356                  * the length of the one we're looking at.
1357                  *
1358                  * No content comparison is needed as we assume
1359                  * the content length is zero.
1360                  */
1361                 return ie2[1];
1362         case BSS_CMP_REGULAR:
1363         default:
1364                 /* sort by length first, then by contents */
1365                 if (ie1[1] != ie2[1])
1366                         return ie2[1] - ie1[1];
1367                 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1368         case BSS_CMP_HIDE_NUL:
1369                 if (ie1[1] != ie2[1])
1370                         return ie2[1] - ie1[1];
1371                 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
1372                 for (i = 0; i < ie2[1]; i++)
1373                         if (ie2[i + 2])
1374                                 return -1;
1375                 return 0;
1376         }
1377 }
1378
1379 static bool cfg80211_bss_type_match(u16 capability,
1380                                     enum nl80211_band band,
1381                                     enum ieee80211_bss_type bss_type)
1382 {
1383         bool ret = true;
1384         u16 mask, val;
1385
1386         if (bss_type == IEEE80211_BSS_TYPE_ANY)
1387                 return ret;
1388
1389         if (band == NL80211_BAND_60GHZ) {
1390                 mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
1391                 switch (bss_type) {
1392                 case IEEE80211_BSS_TYPE_ESS:
1393                         val = WLAN_CAPABILITY_DMG_TYPE_AP;
1394                         break;
1395                 case IEEE80211_BSS_TYPE_PBSS:
1396                         val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
1397                         break;
1398                 case IEEE80211_BSS_TYPE_IBSS:
1399                         val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
1400                         break;
1401                 default:
1402                         return false;
1403                 }
1404         } else {
1405                 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
1406                 switch (bss_type) {
1407                 case IEEE80211_BSS_TYPE_ESS:
1408                         val = WLAN_CAPABILITY_ESS;
1409                         break;
1410                 case IEEE80211_BSS_TYPE_IBSS:
1411                         val = WLAN_CAPABILITY_IBSS;
1412                         break;
1413                 case IEEE80211_BSS_TYPE_MBSS:
1414                         val = 0;
1415                         break;
1416                 default:
1417                         return false;
1418                 }
1419         }
1420
1421         ret = ((capability & mask) == val);
1422         return ret;
1423 }
1424
1425 /* Returned bss is reference counted and must be cleaned up appropriately. */
1426 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
1427                                       struct ieee80211_channel *channel,
1428                                       const u8 *bssid,
1429                                       const u8 *ssid, size_t ssid_len,
1430                                       enum ieee80211_bss_type bss_type,
1431                                       enum ieee80211_privacy privacy)
1432 {
1433         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1434         struct cfg80211_internal_bss *bss, *res = NULL;
1435         unsigned long now = jiffies;
1436         int bss_privacy;
1437
1438         trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
1439                                privacy);
1440
1441         spin_lock_bh(&rdev->bss_lock);
1442
1443         list_for_each_entry(bss, &rdev->bss_list, list) {
1444                 if (!cfg80211_bss_type_match(bss->pub.capability,
1445                                              bss->pub.channel->band, bss_type))
1446                         continue;
1447
1448                 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
1449                 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
1450                     (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
1451                         continue;
1452                 if (channel && bss->pub.channel != channel)
1453                         continue;
1454                 if (!is_valid_ether_addr(bss->pub.bssid))
1455                         continue;
1456                 /* Don't get expired BSS structs */
1457                 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
1458                     !atomic_read(&bss->hold))
1459                         continue;
1460                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
1461                         res = bss;
1462                         bss_ref_get(rdev, res);
1463                         break;
1464                 }
1465         }
1466
1467         spin_unlock_bh(&rdev->bss_lock);
1468         if (!res)
1469                 return NULL;
1470         trace_cfg80211_return_bss(&res->pub);
1471         return &res->pub;
1472 }
1473 EXPORT_SYMBOL(cfg80211_get_bss);
1474
1475 static void rb_insert_bss(struct cfg80211_registered_device *rdev,
1476                           struct cfg80211_internal_bss *bss)
1477 {
1478         struct rb_node **p = &rdev->bss_tree.rb_node;
1479         struct rb_node *parent = NULL;
1480         struct cfg80211_internal_bss *tbss;
1481         int cmp;
1482
1483         while (*p) {
1484                 parent = *p;
1485                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
1486
1487                 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
1488
1489                 if (WARN_ON(!cmp)) {
1490                         /* will sort of leak this BSS */
1491                         return;
1492                 }
1493
1494                 if (cmp < 0)
1495                         p = &(*p)->rb_left;
1496                 else
1497                         p = &(*p)->rb_right;
1498         }
1499
1500         rb_link_node(&bss->rbn, parent, p);
1501         rb_insert_color(&bss->rbn, &rdev->bss_tree);
1502 }
1503
1504 static struct cfg80211_internal_bss *
1505 rb_find_bss(struct cfg80211_registered_device *rdev,
1506             struct cfg80211_internal_bss *res,
1507             enum bss_compare_mode mode)
1508 {
1509         struct rb_node *n = rdev->bss_tree.rb_node;
1510         struct cfg80211_internal_bss *bss;
1511         int r;
1512
1513         while (n) {
1514                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
1515                 r = cmp_bss(&res->pub, &bss->pub, mode);
1516
1517                 if (r == 0)
1518                         return bss;
1519                 else if (r < 0)
1520                         n = n->rb_left;
1521                 else
1522                         n = n->rb_right;
1523         }
1524
1525         return NULL;
1526 }
1527
1528 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
1529                                    struct cfg80211_internal_bss *new)
1530 {
1531         const struct cfg80211_bss_ies *ies;
1532         struct cfg80211_internal_bss *bss;
1533         const u8 *ie;
1534         int i, ssidlen;
1535         u8 fold = 0;
1536         u32 n_entries = 0;
1537
1538         ies = rcu_access_pointer(new->pub.beacon_ies);
1539         if (WARN_ON(!ies))
1540                 return false;
1541
1542         ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1543         if (!ie) {
1544                 /* nothing to do */
1545                 return true;
1546         }
1547
1548         ssidlen = ie[1];
1549         for (i = 0; i < ssidlen; i++)
1550                 fold |= ie[2 + i];
1551
1552         if (fold) {
1553                 /* not a hidden SSID */
1554                 return true;
1555         }
1556
1557         /* This is the bad part ... */
1558
1559         list_for_each_entry(bss, &rdev->bss_list, list) {
1560                 /*
1561                  * we're iterating all the entries anyway, so take the
1562                  * opportunity to validate the list length accounting
1563                  */
1564                 n_entries++;
1565
1566                 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
1567                         continue;
1568                 if (bss->pub.channel != new->pub.channel)
1569                         continue;
1570                 if (bss->pub.scan_width != new->pub.scan_width)
1571                         continue;
1572                 if (rcu_access_pointer(bss->pub.beacon_ies))
1573                         continue;
1574                 ies = rcu_access_pointer(bss->pub.ies);
1575                 if (!ies)
1576                         continue;
1577                 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1578                 if (!ie)
1579                         continue;
1580                 if (ssidlen && ie[1] != ssidlen)
1581                         continue;
1582                 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
1583                         continue;
1584                 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
1585                         list_del(&bss->hidden_list);
1586                 /* combine them */
1587                 list_add(&bss->hidden_list, &new->hidden_list);
1588                 bss->pub.hidden_beacon_bss = &new->pub;
1589                 new->refcount += bss->refcount;
1590                 rcu_assign_pointer(bss->pub.beacon_ies,
1591                                    new->pub.beacon_ies);
1592         }
1593
1594         WARN_ONCE(n_entries != rdev->bss_entries,
1595                   "rdev bss entries[%d]/list[len:%d] corruption\n",
1596                   rdev->bss_entries, n_entries);
1597
1598         return true;
1599 }
1600
1601 struct cfg80211_non_tx_bss {
1602         struct cfg80211_bss *tx_bss;
1603         u8 max_bssid_indicator;
1604         u8 bssid_index;
1605 };
1606
1607 static bool
1608 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
1609                           struct cfg80211_internal_bss *known,
1610                           struct cfg80211_internal_bss *new,
1611                           bool signal_valid)
1612 {
1613         lockdep_assert_held(&rdev->bss_lock);
1614
1615         /* Update IEs */
1616         if (rcu_access_pointer(new->pub.proberesp_ies)) {
1617                 const struct cfg80211_bss_ies *old;
1618
1619                 old = rcu_access_pointer(known->pub.proberesp_ies);
1620
1621                 rcu_assign_pointer(known->pub.proberesp_ies,
1622                                    new->pub.proberesp_ies);
1623                 /* Override possible earlier Beacon frame IEs */
1624                 rcu_assign_pointer(known->pub.ies,
1625                                    new->pub.proberesp_ies);
1626                 if (old)
1627                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1628         } else if (rcu_access_pointer(new->pub.beacon_ies)) {
1629                 const struct cfg80211_bss_ies *old;
1630                 struct cfg80211_internal_bss *bss;
1631
1632                 if (known->pub.hidden_beacon_bss &&
1633                     !list_empty(&known->hidden_list)) {
1634                         const struct cfg80211_bss_ies *f;
1635
1636                         /* The known BSS struct is one of the probe
1637                          * response members of a group, but we're
1638                          * receiving a beacon (beacon_ies in the new
1639                          * bss is used). This can only mean that the
1640                          * AP changed its beacon from not having an
1641                          * SSID to showing it, which is confusing so
1642                          * drop this information.
1643                          */
1644
1645                         f = rcu_access_pointer(new->pub.beacon_ies);
1646                         kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
1647                         return false;
1648                 }
1649
1650                 old = rcu_access_pointer(known->pub.beacon_ies);
1651
1652                 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
1653
1654                 /* Override IEs if they were from a beacon before */
1655                 if (old == rcu_access_pointer(known->pub.ies))
1656                         rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
1657
1658                 /* Assign beacon IEs to all sub entries */
1659                 list_for_each_entry(bss, &known->hidden_list, hidden_list) {
1660                         const struct cfg80211_bss_ies *ies;
1661
1662                         ies = rcu_access_pointer(bss->pub.beacon_ies);
1663                         WARN_ON(ies != old);
1664
1665                         rcu_assign_pointer(bss->pub.beacon_ies,
1666                                            new->pub.beacon_ies);
1667                 }
1668
1669                 if (old)
1670                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1671         }
1672
1673         known->pub.beacon_interval = new->pub.beacon_interval;
1674
1675         /* don't update the signal if beacon was heard on
1676          * adjacent channel.
1677          */
1678         if (signal_valid)
1679                 known->pub.signal = new->pub.signal;
1680         known->pub.capability = new->pub.capability;
1681         known->ts = new->ts;
1682         known->ts_boottime = new->ts_boottime;
1683         known->parent_tsf = new->parent_tsf;
1684         known->pub.chains = new->pub.chains;
1685         memcpy(known->pub.chain_signal, new->pub.chain_signal,
1686                IEEE80211_MAX_CHAINS);
1687         ether_addr_copy(known->parent_bssid, new->parent_bssid);
1688         known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
1689         known->pub.bssid_index = new->pub.bssid_index;
1690
1691         return true;
1692 }
1693
1694 /* Returned bss is reference counted and must be cleaned up appropriately. */
1695 struct cfg80211_internal_bss *
1696 cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1697                     struct cfg80211_internal_bss *tmp,
1698                     bool signal_valid, unsigned long ts)
1699 {
1700         struct cfg80211_internal_bss *found = NULL;
1701
1702         if (WARN_ON(!tmp->pub.channel))
1703                 return NULL;
1704
1705         tmp->ts = ts;
1706
1707         spin_lock_bh(&rdev->bss_lock);
1708
1709         if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
1710                 spin_unlock_bh(&rdev->bss_lock);
1711                 return NULL;
1712         }
1713
1714         found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
1715
1716         if (found) {
1717                 if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid))
1718                         goto drop;
1719         } else {
1720                 struct cfg80211_internal_bss *new;
1721                 struct cfg80211_internal_bss *hidden;
1722                 struct cfg80211_bss_ies *ies;
1723
1724                 /*
1725                  * create a copy -- the "res" variable that is passed in
1726                  * is allocated on the stack since it's not needed in the
1727                  * more common case of an update
1728                  */
1729                 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
1730                               GFP_ATOMIC);
1731                 if (!new) {
1732                         ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
1733                         if (ies)
1734                                 kfree_rcu(ies, rcu_head);
1735                         ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1736                         if (ies)
1737                                 kfree_rcu(ies, rcu_head);
1738                         goto drop;
1739                 }
1740                 memcpy(new, tmp, sizeof(*new));
1741                 new->refcount = 1;
1742                 INIT_LIST_HEAD(&new->hidden_list);
1743                 INIT_LIST_HEAD(&new->pub.nontrans_list);
1744
1745                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1746                         hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1747                         if (!hidden)
1748                                 hidden = rb_find_bss(rdev, tmp,
1749                                                      BSS_CMP_HIDE_NUL);
1750                         if (hidden) {
1751                                 new->pub.hidden_beacon_bss = &hidden->pub;
1752                                 list_add(&new->hidden_list,
1753                                          &hidden->hidden_list);
1754                                 hidden->refcount++;
1755                                 rcu_assign_pointer(new->pub.beacon_ies,
1756                                                    hidden->pub.beacon_ies);
1757                         }
1758                 } else {
1759                         /*
1760                          * Ok so we found a beacon, and don't have an entry. If
1761                          * it's a beacon with hidden SSID, we might be in for an
1762                          * expensive search for any probe responses that should
1763                          * be grouped with this beacon for updates ...
1764                          */
1765                         if (!cfg80211_combine_bsses(rdev, new)) {
1766                                 bss_ref_put(rdev, new);
1767                                 goto drop;
1768                         }
1769                 }
1770
1771                 if (rdev->bss_entries >= bss_entries_limit &&
1772                     !cfg80211_bss_expire_oldest(rdev)) {
1773                         bss_ref_put(rdev, new);
1774                         goto drop;
1775                 }
1776
1777                 /* This must be before the call to bss_ref_get */
1778                 if (tmp->pub.transmitted_bss) {
1779                         struct cfg80211_internal_bss *pbss =
1780                                 container_of(tmp->pub.transmitted_bss,
1781                                              struct cfg80211_internal_bss,
1782                                              pub);
1783
1784                         new->pub.transmitted_bss = tmp->pub.transmitted_bss;
1785                         bss_ref_get(rdev, pbss);
1786                 }
1787
1788                 list_add_tail(&new->list, &rdev->bss_list);
1789                 rdev->bss_entries++;
1790                 rb_insert_bss(rdev, new);
1791                 found = new;
1792         }
1793
1794         rdev->bss_generation++;
1795         bss_ref_get(rdev, found);
1796         spin_unlock_bh(&rdev->bss_lock);
1797
1798         return found;
1799  drop:
1800         spin_unlock_bh(&rdev->bss_lock);
1801         return NULL;
1802 }
1803
1804 /*
1805  * Update RX channel information based on the available frame payload
1806  * information. This is mainly for the 2.4 GHz band where frames can be received
1807  * from neighboring channels and the Beacon frames use the DSSS Parameter Set
1808  * element to indicate the current (transmitting) channel, but this might also
1809  * be needed on other bands if RX frequency does not match with the actual
1810  * operating channel of a BSS.
1811  */
1812 static struct ieee80211_channel *
1813 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1814                          struct ieee80211_channel *channel,
1815                          enum nl80211_bss_scan_width scan_width)
1816 {
1817         const u8 *tmp;
1818         u32 freq;
1819         int channel_number = -1;
1820         struct ieee80211_channel *alt_channel;
1821
1822         if (channel->band == NL80211_BAND_S1GHZ) {
1823                 tmp = cfg80211_find_ie(WLAN_EID_S1G_OPERATION, ie, ielen);
1824                 if (tmp && tmp[1] >= sizeof(struct ieee80211_s1g_oper_ie)) {
1825                         struct ieee80211_s1g_oper_ie *s1gop = (void *)(tmp + 2);
1826
1827                         channel_number = s1gop->primary_ch;
1828                 }
1829         } else {
1830                 tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
1831                 if (tmp && tmp[1] == 1) {
1832                         channel_number = tmp[2];
1833                 } else {
1834                         tmp = cfg80211_find_ie(WLAN_EID_HT_OPERATION, ie, ielen);
1835                         if (tmp && tmp[1] >= sizeof(struct ieee80211_ht_operation)) {
1836                                 struct ieee80211_ht_operation *htop = (void *)(tmp + 2);
1837
1838                                 channel_number = htop->primary_chan;
1839                         }
1840                 }
1841         }
1842
1843         if (channel_number < 0) {
1844                 /* No channel information in frame payload */
1845                 return channel;
1846         }
1847
1848         freq = ieee80211_channel_to_freq_khz(channel_number, channel->band);
1849         alt_channel = ieee80211_get_channel_khz(wiphy, freq);
1850         if (!alt_channel) {
1851                 if (channel->band == NL80211_BAND_2GHZ) {
1852                         /*
1853                          * Better not allow unexpected channels when that could
1854                          * be going beyond the 1-11 range (e.g., discovering
1855                          * BSS on channel 12 when radio is configured for
1856                          * channel 11.
1857                          */
1858                         return NULL;
1859                 }
1860
1861                 /* No match for the payload channel number - ignore it */
1862                 return channel;
1863         }
1864
1865         if (scan_width == NL80211_BSS_CHAN_WIDTH_10 ||
1866             scan_width == NL80211_BSS_CHAN_WIDTH_5) {
1867                 /*
1868                  * Ignore channel number in 5 and 10 MHz channels where there
1869                  * may not be an n:1 or 1:n mapping between frequencies and
1870                  * channel numbers.
1871                  */
1872                 return channel;
1873         }
1874
1875         /*
1876          * Use the channel determined through the payload channel number
1877          * instead of the RX channel reported by the driver.
1878          */
1879         if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
1880                 return NULL;
1881         return alt_channel;
1882 }
1883
1884 /* Returned bss is reference counted and must be cleaned up appropriately. */
1885 static struct cfg80211_bss *
1886 cfg80211_inform_single_bss_data(struct wiphy *wiphy,
1887                                 struct cfg80211_inform_bss *data,
1888                                 enum cfg80211_bss_frame_type ftype,
1889                                 const u8 *bssid, u64 tsf, u16 capability,
1890                                 u16 beacon_interval, const u8 *ie, size_t ielen,
1891                                 struct cfg80211_non_tx_bss *non_tx_data,
1892                                 gfp_t gfp)
1893 {
1894         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1895         struct cfg80211_bss_ies *ies;
1896         struct ieee80211_channel *channel;
1897         struct cfg80211_internal_bss tmp = {}, *res;
1898         int bss_type;
1899         bool signal_valid;
1900         unsigned long ts;
1901
1902         if (WARN_ON(!wiphy))
1903                 return NULL;
1904
1905         if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
1906                     (data->signal < 0 || data->signal > 100)))
1907                 return NULL;
1908
1909         channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan,
1910                                            data->scan_width);
1911         if (!channel)
1912                 return NULL;
1913
1914         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
1915         tmp.pub.channel = channel;
1916         tmp.pub.scan_width = data->scan_width;
1917         tmp.pub.signal = data->signal;
1918         tmp.pub.beacon_interval = beacon_interval;
1919         tmp.pub.capability = capability;
1920         tmp.ts_boottime = data->boottime_ns;
1921         tmp.parent_tsf = data->parent_tsf;
1922         ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
1923
1924         if (non_tx_data) {
1925                 tmp.pub.transmitted_bss = non_tx_data->tx_bss;
1926                 ts = bss_from_pub(non_tx_data->tx_bss)->ts;
1927                 tmp.pub.bssid_index = non_tx_data->bssid_index;
1928                 tmp.pub.max_bssid_indicator = non_tx_data->max_bssid_indicator;
1929         } else {
1930                 ts = jiffies;
1931         }
1932
1933         /*
1934          * If we do not know here whether the IEs are from a Beacon or Probe
1935          * Response frame, we need to pick one of the options and only use it
1936          * with the driver that does not provide the full Beacon/Probe Response
1937          * frame. Use Beacon frame pointer to avoid indicating that this should
1938          * override the IEs pointer should we have received an earlier
1939          * indication of Probe Response data.
1940          */
1941         ies = kzalloc(sizeof(*ies) + ielen, gfp);
1942         if (!ies)
1943                 return NULL;
1944         ies->len = ielen;
1945         ies->tsf = tsf;
1946         ies->from_beacon = false;
1947         memcpy(ies->data, ie, ielen);
1948
1949         switch (ftype) {
1950         case CFG80211_BSS_FTYPE_BEACON:
1951                 ies->from_beacon = true;
1952                 fallthrough;
1953         case CFG80211_BSS_FTYPE_UNKNOWN:
1954                 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
1955                 break;
1956         case CFG80211_BSS_FTYPE_PRESP:
1957                 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
1958                 break;
1959         }
1960         rcu_assign_pointer(tmp.pub.ies, ies);
1961
1962         signal_valid = data->chan == channel;
1963         res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid, ts);
1964         if (!res)
1965                 return NULL;
1966
1967         if (channel->band == NL80211_BAND_60GHZ) {
1968                 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
1969                 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
1970                     bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
1971                         regulatory_hint_found_beacon(wiphy, channel, gfp);
1972         } else {
1973                 if (res->pub.capability & WLAN_CAPABILITY_ESS)
1974                         regulatory_hint_found_beacon(wiphy, channel, gfp);
1975         }
1976
1977         if (non_tx_data) {
1978                 /* this is a nontransmitting bss, we need to add it to
1979                  * transmitting bss' list if it is not there
1980                  */
1981                 spin_lock_bh(&rdev->bss_lock);
1982                 if (cfg80211_add_nontrans_list(non_tx_data->tx_bss,
1983                                                &res->pub)) {
1984                         if (__cfg80211_unlink_bss(rdev, res))
1985                                 rdev->bss_generation++;
1986                 }
1987                 spin_unlock_bh(&rdev->bss_lock);
1988         }
1989
1990         trace_cfg80211_return_bss(&res->pub);
1991         /* cfg80211_bss_update gives us a referenced result */
1992         return &res->pub;
1993 }
1994
1995 static const struct element
1996 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
1997                                    const struct element *mbssid_elem,
1998                                    const struct element *sub_elem)
1999 {
2000         const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
2001         const struct element *next_mbssid;
2002         const struct element *next_sub;
2003
2004         next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
2005                                          mbssid_end,
2006                                          ielen - (mbssid_end - ie));
2007
2008         /*
2009          * If it is not the last subelement in current MBSSID IE or there isn't
2010          * a next MBSSID IE - profile is complete.
2011         */
2012         if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
2013             !next_mbssid)
2014                 return NULL;
2015
2016         /* For any length error, just return NULL */
2017
2018         if (next_mbssid->datalen < 4)
2019                 return NULL;
2020
2021         next_sub = (void *)&next_mbssid->data[1];
2022
2023         if (next_mbssid->data + next_mbssid->datalen <
2024             next_sub->data + next_sub->datalen)
2025                 return NULL;
2026
2027         if (next_sub->id != 0 || next_sub->datalen < 2)
2028                 return NULL;
2029
2030         /*
2031          * Check if the first element in the next sub element is a start
2032          * of a new profile
2033          */
2034         return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
2035                NULL : next_mbssid;
2036 }
2037
2038 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
2039                               const struct element *mbssid_elem,
2040                               const struct element *sub_elem,
2041                               u8 *merged_ie, size_t max_copy_len)
2042 {
2043         size_t copied_len = sub_elem->datalen;
2044         const struct element *next_mbssid;
2045
2046         if (sub_elem->datalen > max_copy_len)
2047                 return 0;
2048
2049         memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
2050
2051         while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
2052                                                                 mbssid_elem,
2053                                                                 sub_elem))) {
2054                 const struct element *next_sub = (void *)&next_mbssid->data[1];
2055
2056                 if (copied_len + next_sub->datalen > max_copy_len)
2057                         break;
2058                 memcpy(merged_ie + copied_len, next_sub->data,
2059                        next_sub->datalen);
2060                 copied_len += next_sub->datalen;
2061         }
2062
2063         return copied_len;
2064 }
2065 EXPORT_SYMBOL(cfg80211_merge_profile);
2066
2067 static void cfg80211_parse_mbssid_data(struct wiphy *wiphy,
2068                                        struct cfg80211_inform_bss *data,
2069                                        enum cfg80211_bss_frame_type ftype,
2070                                        const u8 *bssid, u64 tsf,
2071                                        u16 beacon_interval, const u8 *ie,
2072                                        size_t ielen,
2073                                        struct cfg80211_non_tx_bss *non_tx_data,
2074                                        gfp_t gfp)
2075 {
2076         const u8 *mbssid_index_ie;
2077         const struct element *elem, *sub;
2078         size_t new_ie_len;
2079         u8 new_bssid[ETH_ALEN];
2080         u8 *new_ie, *profile;
2081         u64 seen_indices = 0;
2082         u16 capability;
2083         struct cfg80211_bss *bss;
2084
2085         if (!non_tx_data)
2086                 return;
2087         if (!cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2088                 return;
2089         if (!wiphy->support_mbssid)
2090                 return;
2091         if (wiphy->support_only_he_mbssid &&
2092             !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2093                 return;
2094
2095         new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2096         if (!new_ie)
2097                 return;
2098
2099         profile = kmalloc(ielen, gfp);
2100         if (!profile)
2101                 goto out;
2102
2103         for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
2104                 if (elem->datalen < 4)
2105                         continue;
2106                 for_each_element(sub, elem->data + 1, elem->datalen - 1) {
2107                         u8 profile_len;
2108
2109                         if (sub->id != 0 || sub->datalen < 4) {
2110                                 /* not a valid BSS profile */
2111                                 continue;
2112                         }
2113
2114                         if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
2115                             sub->data[1] != 2) {
2116                                 /* The first element within the Nontransmitted
2117                                  * BSSID Profile is not the Nontransmitted
2118                                  * BSSID Capability element.
2119                                  */
2120                                 continue;
2121                         }
2122
2123                         memset(profile, 0, ielen);
2124                         profile_len = cfg80211_merge_profile(ie, ielen,
2125                                                              elem,
2126                                                              sub,
2127                                                              profile,
2128                                                              ielen);
2129
2130                         /* found a Nontransmitted BSSID Profile */
2131                         mbssid_index_ie = cfg80211_find_ie
2132                                 (WLAN_EID_MULTI_BSSID_IDX,
2133                                  profile, profile_len);
2134                         if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
2135                             mbssid_index_ie[2] == 0 ||
2136                             mbssid_index_ie[2] > 46) {
2137                                 /* No valid Multiple BSSID-Index element */
2138                                 continue;
2139                         }
2140
2141                         if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
2142                                 /* We don't support legacy split of a profile */
2143                                 net_dbg_ratelimited("Partial info for BSSID index %d\n",
2144                                                     mbssid_index_ie[2]);
2145
2146                         seen_indices |= BIT_ULL(mbssid_index_ie[2]);
2147
2148                         non_tx_data->bssid_index = mbssid_index_ie[2];
2149                         non_tx_data->max_bssid_indicator = elem->data[0];
2150
2151                         cfg80211_gen_new_bssid(bssid,
2152                                                non_tx_data->max_bssid_indicator,
2153                                                non_tx_data->bssid_index,
2154                                                new_bssid);
2155                         memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2156                         new_ie_len = cfg80211_gen_new_ie(ie, ielen,
2157                                                          profile,
2158                                                          profile_len, new_ie,
2159                                                          gfp);
2160                         if (!new_ie_len)
2161                                 continue;
2162
2163                         capability = get_unaligned_le16(profile + 2);
2164                         bss = cfg80211_inform_single_bss_data(wiphy, data,
2165                                                               ftype,
2166                                                               new_bssid, tsf,
2167                                                               capability,
2168                                                               beacon_interval,
2169                                                               new_ie,
2170                                                               new_ie_len,
2171                                                               non_tx_data,
2172                                                               gfp);
2173                         if (!bss)
2174                                 break;
2175                         cfg80211_put_bss(wiphy, bss);
2176                 }
2177         }
2178
2179 out:
2180         kfree(new_ie);
2181         kfree(profile);
2182 }
2183
2184 struct cfg80211_bss *
2185 cfg80211_inform_bss_data(struct wiphy *wiphy,
2186                          struct cfg80211_inform_bss *data,
2187                          enum cfg80211_bss_frame_type ftype,
2188                          const u8 *bssid, u64 tsf, u16 capability,
2189                          u16 beacon_interval, const u8 *ie, size_t ielen,
2190                          gfp_t gfp)
2191 {
2192         struct cfg80211_bss *res;
2193         struct cfg80211_non_tx_bss non_tx_data;
2194
2195         res = cfg80211_inform_single_bss_data(wiphy, data, ftype, bssid, tsf,
2196                                               capability, beacon_interval, ie,
2197                                               ielen, NULL, gfp);
2198         if (!res)
2199                 return NULL;
2200         non_tx_data.tx_bss = res;
2201         cfg80211_parse_mbssid_data(wiphy, data, ftype, bssid, tsf,
2202                                    beacon_interval, ie, ielen, &non_tx_data,
2203                                    gfp);
2204         return res;
2205 }
2206 EXPORT_SYMBOL(cfg80211_inform_bss_data);
2207
2208 static void
2209 cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy,
2210                                  struct cfg80211_inform_bss *data,
2211                                  struct ieee80211_mgmt *mgmt, size_t len,
2212                                  struct cfg80211_non_tx_bss *non_tx_data,
2213                                  gfp_t gfp)
2214 {
2215         enum cfg80211_bss_frame_type ftype;
2216         const u8 *ie = mgmt->u.probe_resp.variable;
2217         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2218                                       u.probe_resp.variable);
2219
2220         ftype = ieee80211_is_beacon(mgmt->frame_control) ?
2221                 CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
2222
2223         cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
2224                                    le64_to_cpu(mgmt->u.probe_resp.timestamp),
2225                                    le16_to_cpu(mgmt->u.probe_resp.beacon_int),
2226                                    ie, ielen, non_tx_data, gfp);
2227 }
2228
2229 static void
2230 cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
2231                                    struct cfg80211_bss *nontrans_bss,
2232                                    struct ieee80211_mgmt *mgmt, size_t len)
2233 {
2234         u8 *ie, *new_ie, *pos;
2235         const u8 *nontrans_ssid, *trans_ssid, *mbssid;
2236         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2237                                       u.probe_resp.variable);
2238         size_t new_ie_len;
2239         struct cfg80211_bss_ies *new_ies;
2240         const struct cfg80211_bss_ies *old;
2241         u8 cpy_len;
2242
2243         lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
2244
2245         ie = mgmt->u.probe_resp.variable;
2246
2247         new_ie_len = ielen;
2248         trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
2249         if (!trans_ssid)
2250                 return;
2251         new_ie_len -= trans_ssid[1];
2252         mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen);
2253         /*
2254          * It's not valid to have the MBSSID element before SSID
2255          * ignore if that happens - the code below assumes it is
2256          * after (while copying things inbetween).
2257          */
2258         if (!mbssid || mbssid < trans_ssid)
2259                 return;
2260         new_ie_len -= mbssid[1];
2261
2262         nontrans_ssid = ieee80211_bss_get_ie(nontrans_bss, WLAN_EID_SSID);
2263         if (!nontrans_ssid)
2264                 return;
2265
2266         new_ie_len += nontrans_ssid[1];
2267
2268         /* generate new ie for nontrans BSS
2269          * 1. replace SSID with nontrans BSS' SSID
2270          * 2. skip MBSSID IE
2271          */
2272         new_ie = kzalloc(new_ie_len, GFP_ATOMIC);
2273         if (!new_ie)
2274                 return;
2275
2276         new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC);
2277         if (!new_ies)
2278                 goto out_free;
2279
2280         pos = new_ie;
2281
2282         /* copy the nontransmitted SSID */
2283         cpy_len = nontrans_ssid[1] + 2;
2284         memcpy(pos, nontrans_ssid, cpy_len);
2285         pos += cpy_len;
2286         /* copy the IEs between SSID and MBSSID */
2287         cpy_len = trans_ssid[1] + 2;
2288         memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len)));
2289         pos += (mbssid - (trans_ssid + cpy_len));
2290         /* copy the IEs after MBSSID */
2291         cpy_len = mbssid[1] + 2;
2292         memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len)));
2293
2294         /* update ie */
2295         new_ies->len = new_ie_len;
2296         new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2297         new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
2298         memcpy(new_ies->data, new_ie, new_ie_len);
2299         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
2300                 old = rcu_access_pointer(nontrans_bss->proberesp_ies);
2301                 rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies);
2302                 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2303                 if (old)
2304                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2305         } else {
2306                 old = rcu_access_pointer(nontrans_bss->beacon_ies);
2307                 rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
2308                 rcu_assign_pointer(nontrans_bss->ies, new_ies);
2309                 if (old)
2310                         kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
2311         }
2312
2313 out_free:
2314         kfree(new_ie);
2315 }
2316
2317 /* cfg80211_inform_bss_width_frame helper */
2318 static struct cfg80211_bss *
2319 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
2320                                       struct cfg80211_inform_bss *data,
2321                                       struct ieee80211_mgmt *mgmt, size_t len,
2322                                       gfp_t gfp)
2323 {
2324         struct cfg80211_internal_bss tmp = {}, *res;
2325         struct cfg80211_bss_ies *ies;
2326         struct ieee80211_channel *channel;
2327         bool signal_valid;
2328         struct ieee80211_ext *ext = NULL;
2329         u8 *bssid, *variable;
2330         u16 capability, beacon_int;
2331         size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
2332                                              u.probe_resp.variable);
2333         int bss_type;
2334
2335         BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
2336                         offsetof(struct ieee80211_mgmt, u.beacon.variable));
2337
2338         trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
2339
2340         if (WARN_ON(!mgmt))
2341                 return NULL;
2342
2343         if (WARN_ON(!wiphy))
2344                 return NULL;
2345
2346         if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2347                     (data->signal < 0 || data->signal > 100)))
2348                 return NULL;
2349
2350         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2351                 ext = (void *) mgmt;
2352                 min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
2353                 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2354                         min_hdr_len = offsetof(struct ieee80211_ext,
2355                                                u.s1g_short_beacon.variable);
2356         }
2357
2358         if (WARN_ON(len < min_hdr_len))
2359                 return NULL;
2360
2361         ielen = len - min_hdr_len;
2362         variable = mgmt->u.probe_resp.variable;
2363         if (ext) {
2364                 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2365                         variable = ext->u.s1g_short_beacon.variable;
2366                 else
2367                         variable = ext->u.s1g_beacon.variable;
2368         }
2369
2370         channel = cfg80211_get_bss_channel(wiphy, variable,
2371                                            ielen, data->chan, data->scan_width);
2372         if (!channel)
2373                 return NULL;
2374
2375         if (ext) {
2376                 const struct ieee80211_s1g_bcn_compat_ie *compat;
2377                 const struct element *elem;
2378
2379                 elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT,
2380                                           variable, ielen);
2381                 if (!elem)
2382                         return NULL;
2383                 if (elem->datalen < sizeof(*compat))
2384                         return NULL;
2385                 compat = (void *)elem->data;
2386                 bssid = ext->u.s1g_beacon.sa;
2387                 capability = le16_to_cpu(compat->compat_info);
2388                 beacon_int = le16_to_cpu(compat->beacon_int);
2389         } else {
2390                 bssid = mgmt->bssid;
2391                 beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2392                 capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
2393         }
2394
2395         ies = kzalloc(sizeof(*ies) + ielen, gfp);
2396         if (!ies)
2397                 return NULL;
2398         ies->len = ielen;
2399         ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2400         ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) ||
2401                            ieee80211_is_s1g_beacon(mgmt->frame_control);
2402         memcpy(ies->data, variable, ielen);
2403
2404         if (ieee80211_is_probe_resp(mgmt->frame_control))
2405                 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2406         else
2407                 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2408         rcu_assign_pointer(tmp.pub.ies, ies);
2409
2410         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
2411         tmp.pub.beacon_interval = beacon_int;
2412         tmp.pub.capability = capability;
2413         tmp.pub.channel = channel;
2414         tmp.pub.scan_width = data->scan_width;
2415         tmp.pub.signal = data->signal;
2416         tmp.ts_boottime = data->boottime_ns;
2417         tmp.parent_tsf = data->parent_tsf;
2418         tmp.pub.chains = data->chains;
2419         memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS);
2420         ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
2421
2422         signal_valid = data->chan == channel;
2423         res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid,
2424                                   jiffies);
2425         if (!res)
2426                 return NULL;
2427
2428         if (channel->band == NL80211_BAND_60GHZ) {
2429                 bss_type = res->pub.capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
2430                 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2431                     bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2432                         regulatory_hint_found_beacon(wiphy, channel, gfp);
2433         } else {
2434                 if (res->pub.capability & WLAN_CAPABILITY_ESS)
2435                         regulatory_hint_found_beacon(wiphy, channel, gfp);
2436         }
2437
2438         trace_cfg80211_return_bss(&res->pub);
2439         /* cfg80211_bss_update gives us a referenced result */
2440         return &res->pub;
2441 }
2442
2443 struct cfg80211_bss *
2444 cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
2445                                struct cfg80211_inform_bss *data,
2446                                struct ieee80211_mgmt *mgmt, size_t len,
2447                                gfp_t gfp)
2448 {
2449         struct cfg80211_bss *res, *tmp_bss;
2450         const u8 *ie = mgmt->u.probe_resp.variable;
2451         const struct cfg80211_bss_ies *ies1, *ies2;
2452         size_t ielen = len - offsetof(struct ieee80211_mgmt,
2453                                       u.probe_resp.variable);
2454         struct cfg80211_non_tx_bss non_tx_data;
2455
2456         res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
2457                                                     len, gfp);
2458         if (!res || !wiphy->support_mbssid ||
2459             !cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
2460                 return res;
2461         if (wiphy->support_only_he_mbssid &&
2462             !cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
2463                 return res;
2464
2465         non_tx_data.tx_bss = res;
2466         /* process each non-transmitting bss */
2467         cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len,
2468                                          &non_tx_data, gfp);
2469
2470         spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2471
2472         /* check if the res has other nontransmitting bss which is not
2473          * in MBSSID IE
2474          */
2475         ies1 = rcu_access_pointer(res->ies);
2476
2477         /* go through nontrans_list, if the timestamp of the BSS is
2478          * earlier than the timestamp of the transmitting BSS then
2479          * update it
2480          */
2481         list_for_each_entry(tmp_bss, &res->nontrans_list,
2482                             nontrans_list) {
2483                 ies2 = rcu_access_pointer(tmp_bss->ies);
2484                 if (ies2->tsf < ies1->tsf)
2485                         cfg80211_update_notlisted_nontrans(wiphy, tmp_bss,
2486                                                            mgmt, len);
2487         }
2488         spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
2489
2490         return res;
2491 }
2492 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
2493
2494 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2495 {
2496         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2497         struct cfg80211_internal_bss *bss;
2498
2499         if (!pub)
2500                 return;
2501
2502         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2503
2504         spin_lock_bh(&rdev->bss_lock);
2505         bss_ref_get(rdev, bss);
2506         spin_unlock_bh(&rdev->bss_lock);
2507 }
2508 EXPORT_SYMBOL(cfg80211_ref_bss);
2509
2510 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2511 {
2512         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2513         struct cfg80211_internal_bss *bss;
2514
2515         if (!pub)
2516                 return;
2517
2518         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2519
2520         spin_lock_bh(&rdev->bss_lock);
2521         bss_ref_put(rdev, bss);
2522         spin_unlock_bh(&rdev->bss_lock);
2523 }
2524 EXPORT_SYMBOL(cfg80211_put_bss);
2525
2526 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2527 {
2528         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2529         struct cfg80211_internal_bss *bss, *tmp1;
2530         struct cfg80211_bss *nontrans_bss, *tmp;
2531
2532         if (WARN_ON(!pub))
2533                 return;
2534
2535         bss = container_of(pub, struct cfg80211_internal_bss, pub);
2536
2537         spin_lock_bh(&rdev->bss_lock);
2538         if (list_empty(&bss->list))
2539                 goto out;
2540
2541         list_for_each_entry_safe(nontrans_bss, tmp,
2542                                  &pub->nontrans_list,
2543                                  nontrans_list) {
2544                 tmp1 = container_of(nontrans_bss,
2545                                     struct cfg80211_internal_bss, pub);
2546                 if (__cfg80211_unlink_bss(rdev, tmp1))
2547                         rdev->bss_generation++;
2548         }
2549
2550         if (__cfg80211_unlink_bss(rdev, bss))
2551                 rdev->bss_generation++;
2552 out:
2553         spin_unlock_bh(&rdev->bss_lock);
2554 }
2555 EXPORT_SYMBOL(cfg80211_unlink_bss);
2556
2557 void cfg80211_bss_iter(struct wiphy *wiphy,
2558                        struct cfg80211_chan_def *chandef,
2559                        void (*iter)(struct wiphy *wiphy,
2560                                     struct cfg80211_bss *bss,
2561                                     void *data),
2562                        void *iter_data)
2563 {
2564         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2565         struct cfg80211_internal_bss *bss;
2566
2567         spin_lock_bh(&rdev->bss_lock);
2568
2569         list_for_each_entry(bss, &rdev->bss_list, list) {
2570                 if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel))
2571                         iter(wiphy, &bss->pub, iter_data);
2572         }
2573
2574         spin_unlock_bh(&rdev->bss_lock);
2575 }
2576 EXPORT_SYMBOL(cfg80211_bss_iter);
2577
2578 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
2579                                      struct ieee80211_channel *chan)
2580 {
2581         struct wiphy *wiphy = wdev->wiphy;
2582         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2583         struct cfg80211_internal_bss *cbss = wdev->current_bss;
2584         struct cfg80211_internal_bss *new = NULL;
2585         struct cfg80211_internal_bss *bss;
2586         struct cfg80211_bss *nontrans_bss;
2587         struct cfg80211_bss *tmp;
2588
2589         spin_lock_bh(&rdev->bss_lock);
2590
2591         /*
2592          * Some APs use CSA also for bandwidth changes, i.e., without actually
2593          * changing the control channel, so no need to update in such a case.
2594          */
2595         if (cbss->pub.channel == chan)
2596                 goto done;
2597
2598         /* use transmitting bss */
2599         if (cbss->pub.transmitted_bss)
2600                 cbss = container_of(cbss->pub.transmitted_bss,
2601                                     struct cfg80211_internal_bss,
2602                                     pub);
2603
2604         cbss->pub.channel = chan;
2605
2606         list_for_each_entry(bss, &rdev->bss_list, list) {
2607                 if (!cfg80211_bss_type_match(bss->pub.capability,
2608                                              bss->pub.channel->band,
2609                                              wdev->conn_bss_type))
2610                         continue;
2611
2612                 if (bss == cbss)
2613                         continue;
2614
2615                 if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) {
2616                         new = bss;
2617                         break;
2618                 }
2619         }
2620
2621         if (new) {
2622                 /* to save time, update IEs for transmitting bss only */
2623                 if (cfg80211_update_known_bss(rdev, cbss, new, false)) {
2624                         new->pub.proberesp_ies = NULL;
2625                         new->pub.beacon_ies = NULL;
2626                 }
2627
2628                 list_for_each_entry_safe(nontrans_bss, tmp,
2629                                          &new->pub.nontrans_list,
2630                                          nontrans_list) {
2631                         bss = container_of(nontrans_bss,
2632                                            struct cfg80211_internal_bss, pub);
2633                         if (__cfg80211_unlink_bss(rdev, bss))
2634                                 rdev->bss_generation++;
2635                 }
2636
2637                 WARN_ON(atomic_read(&new->hold));
2638                 if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
2639                         rdev->bss_generation++;
2640         }
2641
2642         rb_erase(&cbss->rbn, &rdev->bss_tree);
2643         rb_insert_bss(rdev, cbss);
2644         rdev->bss_generation++;
2645
2646         list_for_each_entry_safe(nontrans_bss, tmp,
2647                                  &cbss->pub.nontrans_list,
2648                                  nontrans_list) {
2649                 bss = container_of(nontrans_bss,
2650                                    struct cfg80211_internal_bss, pub);
2651                 bss->pub.channel = chan;
2652                 rb_erase(&bss->rbn, &rdev->bss_tree);
2653                 rb_insert_bss(rdev, bss);
2654                 rdev->bss_generation++;
2655         }
2656
2657 done:
2658         spin_unlock_bh(&rdev->bss_lock);
2659 }
2660
2661 #ifdef CONFIG_CFG80211_WEXT
2662 static struct cfg80211_registered_device *
2663 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
2664 {
2665         struct cfg80211_registered_device *rdev;
2666         struct net_device *dev;
2667
2668         ASSERT_RTNL();
2669
2670         dev = dev_get_by_index(net, ifindex);
2671         if (!dev)
2672                 return ERR_PTR(-ENODEV);
2673         if (dev->ieee80211_ptr)
2674                 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
2675         else
2676                 rdev = ERR_PTR(-ENODEV);
2677         dev_put(dev);
2678         return rdev;
2679 }
2680
2681 int cfg80211_wext_siwscan(struct net_device *dev,
2682                           struct iw_request_info *info,
2683                           union iwreq_data *wrqu, char *extra)
2684 {
2685         struct cfg80211_registered_device *rdev;
2686         struct wiphy *wiphy;
2687         struct iw_scan_req *wreq = NULL;
2688         struct cfg80211_scan_request *creq = NULL;
2689         int i, err, n_channels = 0;
2690         enum nl80211_band band;
2691
2692         if (!netif_running(dev))
2693                 return -ENETDOWN;
2694
2695         if (wrqu->data.length == sizeof(struct iw_scan_req))
2696                 wreq = (struct iw_scan_req *)extra;
2697
2698         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
2699
2700         if (IS_ERR(rdev))
2701                 return PTR_ERR(rdev);
2702
2703         if (rdev->scan_req || rdev->scan_msg) {
2704                 err = -EBUSY;
2705                 goto out;
2706         }
2707
2708         wiphy = &rdev->wiphy;
2709
2710         /* Determine number of channels, needed to allocate creq */
2711         if (wreq && wreq->num_channels)
2712                 n_channels = wreq->num_channels;
2713         else
2714                 n_channels = ieee80211_get_num_supported_channels(wiphy);
2715
2716         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
2717                        n_channels * sizeof(void *),
2718                        GFP_ATOMIC);
2719         if (!creq) {
2720                 err = -ENOMEM;
2721                 goto out;
2722         }
2723
2724         creq->wiphy = wiphy;
2725         creq->wdev = dev->ieee80211_ptr;
2726         /* SSIDs come after channels */
2727         creq->ssids = (void *)&creq->channels[n_channels];
2728         creq->n_channels = n_channels;
2729         creq->n_ssids = 1;
2730         creq->scan_start = jiffies;
2731
2732         /* translate "Scan on frequencies" request */
2733         i = 0;
2734         for (band = 0; band < NUM_NL80211_BANDS; band++) {
2735                 int j;
2736
2737                 if (!wiphy->bands[band])
2738                         continue;
2739
2740                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2741                         /* ignore disabled channels */
2742                         if (wiphy->bands[band]->channels[j].flags &
2743                                                 IEEE80211_CHAN_DISABLED)
2744                                 continue;
2745
2746                         /* If we have a wireless request structure and the
2747                          * wireless request specifies frequencies, then search
2748                          * for the matching hardware channel.
2749                          */
2750                         if (wreq && wreq->num_channels) {
2751                                 int k;
2752                                 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
2753                                 for (k = 0; k < wreq->num_channels; k++) {
2754                                         struct iw_freq *freq =
2755                                                 &wreq->channel_list[k];
2756                                         int wext_freq =
2757                                                 cfg80211_wext_freq(freq);
2758
2759                                         if (wext_freq == wiphy_freq)
2760                                                 goto wext_freq_found;
2761                                 }
2762                                 goto wext_freq_not_found;
2763                         }
2764
2765                 wext_freq_found:
2766                         creq->channels[i] = &wiphy->bands[band]->channels[j];
2767                         i++;
2768                 wext_freq_not_found: ;
2769                 }
2770         }
2771         /* No channels found? */
2772         if (!i) {
2773                 err = -EINVAL;
2774                 goto out;
2775         }
2776
2777         /* Set real number of channels specified in creq->channels[] */
2778         creq->n_channels = i;
2779
2780         /* translate "Scan for SSID" request */
2781         if (wreq) {
2782                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
2783                         if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
2784                                 err = -EINVAL;
2785                                 goto out;
2786                         }
2787                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
2788                         creq->ssids[0].ssid_len = wreq->essid_len;
2789                 }
2790                 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
2791                         creq->n_ssids = 0;
2792         }
2793
2794         for (i = 0; i < NUM_NL80211_BANDS; i++)
2795                 if (wiphy->bands[i])
2796                         creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
2797
2798         eth_broadcast_addr(creq->bssid);
2799
2800         wiphy_lock(&rdev->wiphy);
2801
2802         rdev->scan_req = creq;
2803         err = rdev_scan(rdev, creq);
2804         if (err) {
2805                 rdev->scan_req = NULL;
2806                 /* creq will be freed below */
2807         } else {
2808                 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
2809                 /* creq now owned by driver */
2810                 creq = NULL;
2811                 dev_hold(dev);
2812         }
2813         wiphy_unlock(&rdev->wiphy);
2814  out:
2815         kfree(creq);
2816         return err;
2817 }
2818 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
2819
2820 static char *ieee80211_scan_add_ies(struct iw_request_info *info,
2821                                     const struct cfg80211_bss_ies *ies,
2822                                     char *current_ev, char *end_buf)
2823 {
2824         const u8 *pos, *end, *next;
2825         struct iw_event iwe;
2826
2827         if (!ies)
2828                 return current_ev;
2829
2830         /*
2831          * If needed, fragment the IEs buffer (at IE boundaries) into short
2832          * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
2833          */
2834         pos = ies->data;
2835         end = pos + ies->len;
2836
2837         while (end - pos > IW_GENERIC_IE_MAX) {
2838                 next = pos + 2 + pos[1];
2839                 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
2840                         next = next + 2 + next[1];
2841
2842                 memset(&iwe, 0, sizeof(iwe));
2843                 iwe.cmd = IWEVGENIE;
2844                 iwe.u.data.length = next - pos;
2845                 current_ev = iwe_stream_add_point_check(info, current_ev,
2846                                                         end_buf, &iwe,
2847                                                         (void *)pos);
2848                 if (IS_ERR(current_ev))
2849                         return current_ev;
2850                 pos = next;
2851         }
2852
2853         if (end > pos) {
2854                 memset(&iwe, 0, sizeof(iwe));
2855                 iwe.cmd = IWEVGENIE;
2856                 iwe.u.data.length = end - pos;
2857                 current_ev = iwe_stream_add_point_check(info, current_ev,
2858                                                         end_buf, &iwe,
2859                                                         (void *)pos);
2860                 if (IS_ERR(current_ev))
2861                         return current_ev;
2862         }
2863
2864         return current_ev;
2865 }
2866
2867 static char *
2868 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
2869               struct cfg80211_internal_bss *bss, char *current_ev,
2870               char *end_buf)
2871 {
2872         const struct cfg80211_bss_ies *ies;
2873         struct iw_event iwe;
2874         const u8 *ie;
2875         u8 buf[50];
2876         u8 *cfg, *p, *tmp;
2877         int rem, i, sig;
2878         bool ismesh = false;
2879
2880         memset(&iwe, 0, sizeof(iwe));
2881         iwe.cmd = SIOCGIWAP;
2882         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2883         memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
2884         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2885                                                 IW_EV_ADDR_LEN);
2886         if (IS_ERR(current_ev))
2887                 return current_ev;
2888
2889         memset(&iwe, 0, sizeof(iwe));
2890         iwe.cmd = SIOCGIWFREQ;
2891         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
2892         iwe.u.freq.e = 0;
2893         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2894                                                 IW_EV_FREQ_LEN);
2895         if (IS_ERR(current_ev))
2896                 return current_ev;
2897
2898         memset(&iwe, 0, sizeof(iwe));
2899         iwe.cmd = SIOCGIWFREQ;
2900         iwe.u.freq.m = bss->pub.channel->center_freq;
2901         iwe.u.freq.e = 6;
2902         current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
2903                                                 IW_EV_FREQ_LEN);
2904         if (IS_ERR(current_ev))
2905                 return current_ev;
2906
2907         if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
2908                 memset(&iwe, 0, sizeof(iwe));
2909                 iwe.cmd = IWEVQUAL;
2910                 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
2911                                      IW_QUAL_NOISE_INVALID |
2912                                      IW_QUAL_QUAL_UPDATED;
2913                 switch (wiphy->signal_type) {
2914                 case CFG80211_SIGNAL_TYPE_MBM:
2915                         sig = bss->pub.signal / 100;
2916                         iwe.u.qual.level = sig;
2917                         iwe.u.qual.updated |= IW_QUAL_DBM;
2918                         if (sig < -110)         /* rather bad */
2919                                 sig = -110;
2920                         else if (sig > -40)     /* perfect */
2921                                 sig = -40;
2922                         /* will give a range of 0 .. 70 */
2923                         iwe.u.qual.qual = sig + 110;
2924                         break;
2925                 case CFG80211_SIGNAL_TYPE_UNSPEC:
2926                         iwe.u.qual.level = bss->pub.signal;
2927                         /* will give range 0 .. 100 */
2928                         iwe.u.qual.qual = bss->pub.signal;
2929                         break;
2930                 default:
2931                         /* not reached */
2932                         break;
2933                 }
2934                 current_ev = iwe_stream_add_event_check(info, current_ev,
2935                                                         end_buf, &iwe,
2936                                                         IW_EV_QUAL_LEN);
2937                 if (IS_ERR(current_ev))
2938                         return current_ev;
2939         }
2940
2941         memset(&iwe, 0, sizeof(iwe));
2942         iwe.cmd = SIOCGIWENCODE;
2943         if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
2944                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2945         else
2946                 iwe.u.data.flags = IW_ENCODE_DISABLED;
2947         iwe.u.data.length = 0;
2948         current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
2949                                                 &iwe, "");
2950         if (IS_ERR(current_ev))
2951                 return current_ev;
2952
2953         rcu_read_lock();
2954         ies = rcu_dereference(bss->pub.ies);
2955         rem = ies->len;
2956         ie = ies->data;
2957
2958         while (rem >= 2) {
2959                 /* invalid data */
2960                 if (ie[1] > rem - 2)
2961                         break;
2962
2963                 switch (ie[0]) {
2964                 case WLAN_EID_SSID:
2965                         memset(&iwe, 0, sizeof(iwe));
2966                         iwe.cmd = SIOCGIWESSID;
2967                         iwe.u.data.length = ie[1];
2968                         iwe.u.data.flags = 1;
2969                         current_ev = iwe_stream_add_point_check(info,
2970                                                                 current_ev,
2971                                                                 end_buf, &iwe,
2972                                                                 (u8 *)ie + 2);
2973                         if (IS_ERR(current_ev))
2974                                 goto unlock;
2975                         break;
2976                 case WLAN_EID_MESH_ID:
2977                         memset(&iwe, 0, sizeof(iwe));
2978                         iwe.cmd = SIOCGIWESSID;
2979                         iwe.u.data.length = ie[1];
2980                         iwe.u.data.flags = 1;
2981                         current_ev = iwe_stream_add_point_check(info,
2982                                                                 current_ev,
2983                                                                 end_buf, &iwe,
2984                                                                 (u8 *)ie + 2);
2985                         if (IS_ERR(current_ev))
2986                                 goto unlock;
2987                         break;
2988                 case WLAN_EID_MESH_CONFIG:
2989                         ismesh = true;
2990                         if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
2991                                 break;
2992                         cfg = (u8 *)ie + 2;
2993                         memset(&iwe, 0, sizeof(iwe));
2994                         iwe.cmd = IWEVCUSTOM;
2995                         sprintf(buf, "Mesh Network Path Selection Protocol ID: "
2996                                 "0x%02X", cfg[0]);
2997                         iwe.u.data.length = strlen(buf);
2998                         current_ev = iwe_stream_add_point_check(info,
2999                                                                 current_ev,
3000                                                                 end_buf,
3001                                                                 &iwe, buf);
3002                         if (IS_ERR(current_ev))
3003                                 goto unlock;
3004                         sprintf(buf, "Path Selection Metric ID: 0x%02X",
3005                                 cfg[1]);
3006                         iwe.u.data.length = strlen(buf);
3007                         current_ev = iwe_stream_add_point_check(info,
3008                                                                 current_ev,
3009                                                                 end_buf,
3010                                                                 &iwe, buf);
3011                         if (IS_ERR(current_ev))
3012                                 goto unlock;
3013                         sprintf(buf, "Congestion Control Mode ID: 0x%02X",
3014                                 cfg[2]);
3015                         iwe.u.data.length = strlen(buf);
3016                         current_ev = iwe_stream_add_point_check(info,
3017                                                                 current_ev,
3018                                                                 end_buf,
3019                                                                 &iwe, buf);
3020                         if (IS_ERR(current_ev))
3021                                 goto unlock;
3022                         sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
3023                         iwe.u.data.length = strlen(buf);
3024                         current_ev = iwe_stream_add_point_check(info,
3025                                                                 current_ev,
3026                                                                 end_buf,
3027                                                                 &iwe, buf);
3028                         if (IS_ERR(current_ev))
3029                                 goto unlock;
3030                         sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
3031                         iwe.u.data.length = strlen(buf);
3032                         current_ev = iwe_stream_add_point_check(info,
3033                                                                 current_ev,
3034                                                                 end_buf,
3035                                                                 &iwe, buf);
3036                         if (IS_ERR(current_ev))
3037                                 goto unlock;
3038                         sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
3039                         iwe.u.data.length = strlen(buf);
3040                         current_ev = iwe_stream_add_point_check(info,
3041                                                                 current_ev,
3042                                                                 end_buf,
3043                                                                 &iwe, buf);
3044                         if (IS_ERR(current_ev))
3045                                 goto unlock;
3046                         sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
3047                         iwe.u.data.length = strlen(buf);
3048                         current_ev = iwe_stream_add_point_check(info,
3049                                                                 current_ev,
3050                                                                 end_buf,
3051                                                                 &iwe, buf);
3052                         if (IS_ERR(current_ev))
3053                                 goto unlock;
3054                         break;
3055                 case WLAN_EID_SUPP_RATES:
3056                 case WLAN_EID_EXT_SUPP_RATES:
3057                         /* display all supported rates in readable format */
3058                         p = current_ev + iwe_stream_lcp_len(info);
3059
3060                         memset(&iwe, 0, sizeof(iwe));
3061                         iwe.cmd = SIOCGIWRATE;
3062                         /* Those two flags are ignored... */
3063                         iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3064
3065                         for (i = 0; i < ie[1]; i++) {
3066                                 iwe.u.bitrate.value =
3067                                         ((ie[i + 2] & 0x7f) * 500000);
3068                                 tmp = p;
3069                                 p = iwe_stream_add_value(info, current_ev, p,
3070                                                          end_buf, &iwe,
3071                                                          IW_EV_PARAM_LEN);
3072                                 if (p == tmp) {
3073                                         current_ev = ERR_PTR(-E2BIG);
3074                                         goto unlock;
3075                                 }
3076                         }
3077                         current_ev = p;
3078                         break;
3079                 }
3080                 rem -= ie[1] + 2;
3081                 ie += ie[1] + 2;
3082         }
3083
3084         if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
3085             ismesh) {
3086                 memset(&iwe, 0, sizeof(iwe));
3087                 iwe.cmd = SIOCGIWMODE;
3088                 if (ismesh)
3089                         iwe.u.mode = IW_MODE_MESH;
3090                 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
3091                         iwe.u.mode = IW_MODE_MASTER;
3092                 else
3093                         iwe.u.mode = IW_MODE_ADHOC;
3094                 current_ev = iwe_stream_add_event_check(info, current_ev,
3095                                                         end_buf, &iwe,
3096                                                         IW_EV_UINT_LEN);
3097                 if (IS_ERR(current_ev))
3098                         goto unlock;
3099         }
3100
3101         memset(&iwe, 0, sizeof(iwe));
3102         iwe.cmd = IWEVCUSTOM;
3103         sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
3104         iwe.u.data.length = strlen(buf);
3105         current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3106                                                 &iwe, buf);
3107         if (IS_ERR(current_ev))
3108                 goto unlock;
3109         memset(&iwe, 0, sizeof(iwe));
3110         iwe.cmd = IWEVCUSTOM;
3111         sprintf(buf, " Last beacon: %ums ago",
3112                 elapsed_jiffies_msecs(bss->ts));
3113         iwe.u.data.length = strlen(buf);
3114         current_ev = iwe_stream_add_point_check(info, current_ev,
3115                                                 end_buf, &iwe, buf);
3116         if (IS_ERR(current_ev))
3117                 goto unlock;
3118
3119         current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
3120
3121  unlock:
3122         rcu_read_unlock();
3123         return current_ev;
3124 }
3125
3126
3127 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
3128                                   struct iw_request_info *info,
3129                                   char *buf, size_t len)
3130 {
3131         char *current_ev = buf;
3132         char *end_buf = buf + len;
3133         struct cfg80211_internal_bss *bss;
3134         int err = 0;
3135
3136         spin_lock_bh(&rdev->bss_lock);
3137         cfg80211_bss_expire(rdev);
3138
3139         list_for_each_entry(bss, &rdev->bss_list, list) {
3140                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3141                         err = -E2BIG;
3142                         break;
3143                 }
3144                 current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
3145                                            current_ev, end_buf);
3146                 if (IS_ERR(current_ev)) {
3147                         err = PTR_ERR(current_ev);
3148                         break;
3149                 }
3150         }
3151         spin_unlock_bh(&rdev->bss_lock);
3152
3153         if (err)
3154                 return err;
3155         return current_ev - buf;
3156 }
3157
3158
3159 int cfg80211_wext_giwscan(struct net_device *dev,
3160                           struct iw_request_info *info,
3161                           struct iw_point *data, char *extra)
3162 {
3163         struct cfg80211_registered_device *rdev;
3164         int res;
3165
3166         if (!netif_running(dev))
3167                 return -ENETDOWN;
3168
3169         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3170
3171         if (IS_ERR(rdev))
3172                 return PTR_ERR(rdev);
3173
3174         if (rdev->scan_req || rdev->scan_msg)
3175                 return -EAGAIN;
3176
3177         res = ieee80211_scan_results(rdev, info, extra, data->length);
3178         data->length = 0;
3179         if (res >= 0) {
3180                 data->length = res;
3181                 res = 0;
3182         }
3183
3184         return res;
3185 }
3186 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
3187 #endif