1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* cfg80211 scan result handling
4	*
5	* Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
6	* Copyright 2013-2014 Intel Mobile Communications GmbH
7	* Copyright 2016 Intel Deutschland GmbH
8	* Copyright (C) 2018-2023 Intel Corporation
9	*/
10	#include <linux/kernel.h>
11	#include <linux/slab.h>
12	#include <linux/module.h>
13	#include <linux/netdevice.h>
14	#include <linux/wireless.h>
15	#include <linux/nl80211.h>
16	#include <linux/etherdevice.h>
17	#include <linux/crc32.h>
18	#include <linux/bitfield.h>
19	#include <net/arp.h>
20	#include <net/cfg80211.h>
21	#include <net/cfg80211-wext.h>
22	#include <net/iw_handler.h>
23	#include "core.h"
24	#include "nl80211.h"
25	#include "wext-compat.h"
26	#include "rdev-ops.h"
27
28	/**
29	* DOC: BSS tree/list structure
30	*
31	* At the top level, the BSS list is kept in both a list in each
32	* registered device (@bss_list) as well as an RB-tree for faster
33	* lookup. In the RB-tree, entries can be looked up using their
34	* channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
35	* for other BSSes.
36	*
37	* Due to the possibility of hidden SSIDs, there's a second level
38	* structure, the "hidden_list" and "hidden_beacon_bss" pointer.
39	* The hidden_list connects all BSSes belonging to a single AP
40	* that has a hidden SSID, and connects beacon and probe response
41	* entries. For a probe response entry for a hidden SSID, the
42	* hidden_beacon_bss pointer points to the BSS struct holding the
43	* beacon's information.
44	*
45	* Reference counting is done for all these references except for
46	* the hidden_list, so that a beacon BSS struct that is otherwise
47	* not referenced has one reference for being on the bss_list and
48	* one for each probe response entry that points to it using the
49	* hidden_beacon_bss pointer. When a BSS struct that has such a
50	* pointer is get/put, the refcount update is also propagated to
51	* the referenced struct, this ensure that it cannot get removed
52	* while somebody is using the probe response version.
53	*
54	* Note that the hidden_beacon_bss pointer never changes, due to
55	* the reference counting. Therefore, no locking is needed for
56	* it.
57	*
58	* Also note that the hidden_beacon_bss pointer is only relevant
59	* if the driver uses something other than the IEs, e.g. private
60	* data stored in the BSS struct, since the beacon IEs are
61	* also linked into the probe response struct.
62	*/
63
64	/*
65	* Limit the number of BSS entries stored in mac80211. Each one is
66	* a bit over 4k at most, so this limits to roughly 4-5M of memory.
67	* If somebody wants to really attack this though, they'd likely
68	* use small beacons, and only one type of frame, limiting each of
69	* the entries to a much smaller size (in order to generate more
70	* entries in total, so overhead is bigger.)
71	*/
72	static int bss_entries_limit = 1000;
73	module_param(bss_entries_limit, int, 0644);
74	MODULE_PARM_DESC(bss_entries_limit,
75	"limit to number of scan BSS entries (per wiphy, default 1000)");
76
77	#define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
78
79	/**
80	* struct cfg80211_colocated_ap - colocated AP information
81	*
82	* @list: linked list to all colocated aPS
83	* @bssid: BSSID of the reported AP
84	* @ssid: SSID of the reported AP
85	* @ssid_len: length of the ssid
86	* @center_freq: frequency the reported AP is on
87	* @unsolicited_probe: the reported AP is part of an ESS, where all the APs
88	* that operate in the same channel as the reported AP and that might be
89	* detected by a STA receiving this frame, are transmitting unsolicited
90	* Probe Response frames every 20 TUs
91	* @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP
92	* @same_ssid: the reported AP has the same SSID as the reporting AP
93	* @multi_bss: the reported AP is part of a multiple BSSID set
94	* @transmitted_bssid: the reported AP is the transmitting BSSID
95	* @colocated_ess: all the APs that share the same ESS as the reported AP are
96	* colocated and can be discovered via legacy bands.
97	* @short_ssid_valid: short_ssid is valid and can be used
98	* @short_ssid: the short SSID for this SSID
99	* @psd_20: The 20MHz PSD EIRP of the primary 20MHz channel for the reported AP
100	*/
101	struct cfg80211_colocated_ap {
102	struct list_head list;
103	u8 bssid[ETH_ALEN];
104	u8 ssid[IEEE80211_MAX_SSID_LEN];
105	size_t ssid_len;
106	u32 short_ssid;
107	u32 center_freq;
108	u8 unsolicited_probe:1,
109	oct_recommended:1,
110	same_ssid:1,
111	multi_bss:1,
112	transmitted_bssid:1,
113	colocated_ess:1,
114	short_ssid_valid:1;
115	s8 psd_20;
116	};
117
118	static void bss_free(struct cfg80211_internal_bss *bss)
119	{
120	struct cfg80211_bss_ies *ies;
121
122	if (WARN_ON(atomic_read(&bss->hold)))
123	return;
124
125	ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
126	if (ies && !bss->pub.hidden_beacon_bss)
127	kfree_rcu(ies, rcu_head);
128	ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
129	if (ies)
130	kfree_rcu(ies, rcu_head);
131
132	/*
133	* This happens when the module is removed, it doesn't
134	* really matter any more save for completeness
135	*/
136	if (!list_empty(head: &bss->hidden_list))
137	list_del(entry: &bss->hidden_list);
138
139	kfree(objp: bss);
140	}
141
142	static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
143	struct cfg80211_internal_bss *bss)
144	{
145	lockdep_assert_held(&rdev->bss_lock);
146
147	bss->refcount++;
148
149	if (bss->pub.hidden_beacon_bss)
150	bss_from_pub(pub: bss->pub.hidden_beacon_bss)->refcount++;
151
152	if (bss->pub.transmitted_bss)
153	bss_from_pub(pub: bss->pub.transmitted_bss)->refcount++;
154	}
155
156	static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
157	struct cfg80211_internal_bss *bss)
158	{
159	lockdep_assert_held(&rdev->bss_lock);
160
161	if (bss->pub.hidden_beacon_bss) {
162	struct cfg80211_internal_bss *hbss;
163
164	hbss = bss_from_pub(pub: bss->pub.hidden_beacon_bss);
165	hbss->refcount--;
166	if (hbss->refcount == 0)
167	bss_free(bss: hbss);
168	}
169
170	if (bss->pub.transmitted_bss) {
171	struct cfg80211_internal_bss *tbss;
172
173	tbss = bss_from_pub(pub: bss->pub.transmitted_bss);
174	tbss->refcount--;
175	if (tbss->refcount == 0)
176	bss_free(bss: tbss);
177	}
178
179	bss->refcount--;
180	if (bss->refcount == 0)
181	bss_free(bss);
182	}
183
184	static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
185	struct cfg80211_internal_bss *bss)
186	{
187	lockdep_assert_held(&rdev->bss_lock);
188
189	if (!list_empty(head: &bss->hidden_list)) {
190	/*
191	* don't remove the beacon entry if it has
192	* probe responses associated with it
193	*/
194	if (!bss->pub.hidden_beacon_bss)
195	return false;
196	/*
197	* if it's a probe response entry break its
198	* link to the other entries in the group
199	*/
200	list_del_init(entry: &bss->hidden_list);
201	}
202
203	list_del_init(entry: &bss->list);
204	list_del_init(entry: &bss->pub.nontrans_list);
205	rb_erase(&bss->rbn, &rdev->bss_tree);
206	rdev->bss_entries--;
207	WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
208	"rdev bss entries[%d]/list[empty:%d] corruption\n",
209	rdev->bss_entries, list_empty(&rdev->bss_list));
210	bss_ref_put(rdev, bss);
211	return true;
212	}
213
214	bool cfg80211_is_element_inherited(const struct element *elem,
215	const struct element *non_inherit_elem)
216	{
217	u8 id_len, ext_id_len, i, loop_len, id;
218	const u8 *list;
219
220	if (elem->id == WLAN_EID_MULTIPLE_BSSID)
221	return false;
222
223	if (elem->id == WLAN_EID_EXTENSION && elem->datalen > 1 &&
224	elem->data[0] == WLAN_EID_EXT_EHT_MULTI_LINK)
225	return false;
226
227	if (!non_inherit_elem || non_inherit_elem->datalen < 2)
228	return true;
229
230	/*
231	* non inheritance element format is:
232	* ext ID (56) | IDs list len | list | extension IDs list len | list
233	* Both lists are optional. Both lengths are mandatory.
234	* This means valid length is:
235	* elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
236	*/
237	id_len = non_inherit_elem->data[1];
238	if (non_inherit_elem->datalen < 3 + id_len)
239	return true;
240
241	ext_id_len = non_inherit_elem->data[2 + id_len];
242	if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
243	return true;
244
245	if (elem->id == WLAN_EID_EXTENSION) {
246	if (!ext_id_len)
247	return true;
248	loop_len = ext_id_len;
249	list = &non_inherit_elem->data[3 + id_len];
250	id = elem->data[0];
251	} else {
252	if (!id_len)
253	return true;
254	loop_len = id_len;
255	list = &non_inherit_elem->data[2];
256	id = elem->id;
257	}
258
259	for (i = 0; i < loop_len; i++) {
260	if (list[i] == id)
261	return false;
262	}
263
264	return true;
265	}
266	EXPORT_SYMBOL(cfg80211_is_element_inherited);
267
268	static size_t cfg80211_copy_elem_with_frags(const struct element *elem,
269	const u8 *ie, size_t ie_len,
270	u8 **pos, u8 *buf, size_t buf_len)
271	{
272	if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len ||
273	elem->data + elem->datalen > ie + ie_len))
274	return 0;
275
276	if (elem->datalen + 2 > buf + buf_len - *pos)
277	return 0;
278
279	memcpy(*pos, elem, elem->datalen + 2);
280	*pos += elem->datalen + 2;
281
282	/* Finish if it is not fragmented */
283	if (elem->datalen != 255)
284	return *pos - buf;
285
286	ie_len = ie + ie_len - elem->data - elem->datalen;
287	ie = (const u8 *)elem->data + elem->datalen;
288
289	for_each_element(elem, ie, ie_len) {
290	if (elem->id != WLAN_EID_FRAGMENT)
291	break;
292
293	if (elem->datalen + 2 > buf + buf_len - *pos)
294	return 0;
295
296	memcpy(*pos, elem, elem->datalen + 2);
297	*pos += elem->datalen + 2;
298
299	if (elem->datalen != 255)
300	break;
301	}
302
303	return *pos - buf;
304	}
305
306	static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
307	const u8 *subie, size_t subie_len,
308	u8 *new_ie, size_t new_ie_len)
309	{
310	const struct element *non_inherit_elem, *parent, *sub;
311	u8 *pos = new_ie;
312	u8 id, ext_id;
313	unsigned int match_len;
314
315	non_inherit_elem = cfg80211_find_ext_elem(ext_eid: WLAN_EID_EXT_NON_INHERITANCE,
316	ies: subie, len: subie_len);
317
318	/* We copy the elements one by one from the parent to the generated
319	* elements.
320	* If they are not inherited (included in subie or in the non
321	* inheritance element), then we copy all occurrences the first time
322	* we see this element type.
323	*/
324	for_each_element(parent, ie, ielen) {
325	if (parent->id == WLAN_EID_FRAGMENT)
326	continue;
327
328	if (parent->id == WLAN_EID_EXTENSION) {
329	if (parent->datalen < 1)
330	continue;
331
332	id = WLAN_EID_EXTENSION;
333	ext_id = parent->data[0];
334	match_len = 1;
335	} else {
336	id = parent->id;
337	match_len = 0;
338	}
339
340	/* Find first occurrence in subie */
341	sub = cfg80211_find_elem_match(eid: id, ies: subie, len: subie_len,
342	match: &ext_id, match_len, match_offset: 0);
343
344	/* Copy from parent if not in subie and inherited */
345	if (!sub &&
346	cfg80211_is_element_inherited(parent, non_inherit_elem)) {
347	if (!cfg80211_copy_elem_with_frags(elem: parent,
348	ie, ie_len: ielen,
349	pos: &pos, buf: new_ie,
350	buf_len: new_ie_len))
351	return 0;
352
353	continue;
354	}
355
356	/* Already copied if an earlier element had the same type */
357	if (cfg80211_find_elem_match(eid: id, ies: ie, len: (u8 *)parent - ie,
358	match: &ext_id, match_len, match_offset: 0))
359	continue;
360
361	/* Not inheriting, copy all similar elements from subie */
362	while (sub) {
363	if (!cfg80211_copy_elem_with_frags(elem: sub,
364	ie: subie, ie_len: subie_len,
365	pos: &pos, buf: new_ie,
366	buf_len: new_ie_len))
367	return 0;
368
369	sub = cfg80211_find_elem_match(eid: id,
370	ies: sub->data + sub->datalen,
371	len: subie_len + subie -
372	(sub->data +
373	sub->datalen),
374	match: &ext_id, match_len, match_offset: 0);
375	}
376	}
377
378	/* The above misses elements that are included in subie but not in the
379	* parent, so do a pass over subie and append those.
380	* Skip the non-tx BSSID caps and non-inheritance element.
381	*/
382	for_each_element(sub, subie, subie_len) {
383	if (sub->id == WLAN_EID_NON_TX_BSSID_CAP)
384	continue;
385
386	if (sub->id == WLAN_EID_FRAGMENT)
387	continue;
388
389	if (sub->id == WLAN_EID_EXTENSION) {
390	if (sub->datalen < 1)
391	continue;
392
393	id = WLAN_EID_EXTENSION;
394	ext_id = sub->data[0];
395	match_len = 1;
396
397	if (ext_id == WLAN_EID_EXT_NON_INHERITANCE)
398	continue;
399	} else {
400	id = sub->id;
401	match_len = 0;
402	}
403
404	/* Processed if one was included in the parent */
405	if (cfg80211_find_elem_match(eid: id, ies: ie, len: ielen,
406	match: &ext_id, match_len, match_offset: 0))
407	continue;
408
409	if (!cfg80211_copy_elem_with_frags(elem: sub, ie: subie, ie_len: subie_len,
410	pos: &pos, buf: new_ie, buf_len: new_ie_len))
411	return 0;
412	}
413
414	return pos - new_ie;
415	}
416
417	static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
418	const u8 *ssid, size_t ssid_len)
419	{
420	const struct cfg80211_bss_ies *ies;
421	const struct element *ssid_elem;
422
423	if (bssid && !ether_addr_equal(addr1: a->bssid, addr2: bssid))
424	return false;
425
426	if (!ssid)
427	return true;
428
429	ies = rcu_access_pointer(a->ies);
430	if (!ies)
431	return false;
432	ssid_elem = cfg80211_find_elem(eid: WLAN_EID_SSID, ies: ies->data, len: ies->len);
433	if (!ssid_elem)
434	return false;
435	if (ssid_elem->datalen != ssid_len)
436	return false;
437	return memcmp(p: ssid_elem->data, q: ssid, size: ssid_len) == 0;
438	}
439
440	static int
441	cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
442	struct cfg80211_bss *nontrans_bss)
443	{
444	const struct element *ssid_elem;
445	struct cfg80211_bss *bss = NULL;
446
447	rcu_read_lock();
448	ssid_elem = ieee80211_bss_get_elem(bss: nontrans_bss, id: WLAN_EID_SSID);
449	if (!ssid_elem) {
450	rcu_read_unlock();
451	return -EINVAL;
452	}
453
454	/* check if nontrans_bss is in the list */
455	list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
456	if (is_bss(a: bss, bssid: nontrans_bss->bssid, ssid: ssid_elem->data,
457	ssid_len: ssid_elem->datalen)) {
458	rcu_read_unlock();
459	return 0;
460	}
461	}
462
463	rcu_read_unlock();
464
465	/*
466	* This is a bit weird - it's not on the list, but already on another
467	* one! The only way that could happen is if there's some BSSID/SSID
468	* shared by multiple APs in their multi-BSSID profiles, potentially
469	* with hidden SSID mixed in ... ignore it.
470	*/
471	if (!list_empty(head: &nontrans_bss->nontrans_list))
472	return -EINVAL;
473
474	/* add to the list */
475	list_add_tail(new: &nontrans_bss->nontrans_list, head: &trans_bss->nontrans_list);
476	return 0;
477	}
478
479	static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
480	unsigned long expire_time)
481	{
482	struct cfg80211_internal_bss *bss, *tmp;
483	bool expired = false;
484
485	lockdep_assert_held(&rdev->bss_lock);
486
487	list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
488	if (atomic_read(v: &bss->hold))
489	continue;
490	if (!time_after(expire_time, bss->ts))
491	continue;
492
493	if (__cfg80211_unlink_bss(rdev, bss))
494	expired = true;
495	}
496
497	if (expired)
498	rdev->bss_generation++;
499	}
500
501	static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
502	{
503	struct cfg80211_internal_bss *bss, *oldest = NULL;
504	bool ret;
505
506	lockdep_assert_held(&rdev->bss_lock);
507
508	list_for_each_entry(bss, &rdev->bss_list, list) {
509	if (atomic_read(v: &bss->hold))
510	continue;
511
512	if (!list_empty(head: &bss->hidden_list) &&
513	!bss->pub.hidden_beacon_bss)
514	continue;
515
516	if (oldest && time_before(oldest->ts, bss->ts))
517	continue;
518	oldest = bss;
519	}
520
521	if (WARN_ON(!oldest))
522	return false;
523
524	/*
525	* The callers make sure to increase rdev->bss_generation if anything
526	* gets removed (and a new entry added), so there's no need to also do
527	* it here.
528	*/
529
530	ret = __cfg80211_unlink_bss(rdev, bss: oldest);
531	WARN_ON(!ret);
532	return ret;
533	}
534
535	static u8 cfg80211_parse_bss_param(u8 data,
536	struct cfg80211_colocated_ap *coloc_ap)
537	{
538	coloc_ap->oct_recommended =
539	u8_get_bits(v: data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
540	coloc_ap->same_ssid =
541	u8_get_bits(v: data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
542	coloc_ap->multi_bss =
543	u8_get_bits(v: data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
544	coloc_ap->transmitted_bssid =
545	u8_get_bits(v: data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
546	coloc_ap->unsolicited_probe =
547	u8_get_bits(v: data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
548	coloc_ap->colocated_ess =
549	u8_get_bits(v: data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
550
551	return u8_get_bits(v: data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
552	}
553
554	static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
555	const struct element **elem, u32 *s_ssid)
556	{
557
558	*elem = cfg80211_find_elem(eid: WLAN_EID_SSID, ies: ies->data, len: ies->len);
559	if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
560	return -EINVAL;
561
562	*s_ssid = ~crc32_le(crc: ~0, p: (*elem)->data, len: (*elem)->datalen);
563	return 0;
564	}
565
566	static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
567	{
568	struct cfg80211_colocated_ap *ap, *tmp_ap;
569
570	list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
571	list_del(entry: &ap->list);
572	kfree(objp: ap);
573	}
574	}
575
576	static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
577	const u8 *pos, u8 length,
578	const struct element *ssid_elem,
579	u32 s_ssid_tmp)
580	{
581	u8 bss_params;
582
583	entry->psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
584
585	/* The length is already verified by the caller to contain bss_params */
586	if (length > sizeof(struct ieee80211_tbtt_info_7_8_9)) {
587	struct ieee80211_tbtt_info_ge_11 *tbtt_info = (void *)pos;
588
589	memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
590	entry->short_ssid = le32_to_cpu(tbtt_info->short_ssid);
591	entry->short_ssid_valid = true;
592
593	bss_params = tbtt_info->bss_params;
594
595	/* Ignore disabled links */
596	if (length >= offsetofend(typeof(*tbtt_info), mld_params)) {
597	if (le16_get_bits(v: tbtt_info->mld_params.params,
598	IEEE80211_RNR_MLD_PARAMS_DISABLED_LINK))
599	return -EINVAL;
600	}
601
602	if (length >= offsetofend(struct ieee80211_tbtt_info_ge_11,
603	psd_20))
604	entry->psd_20 = tbtt_info->psd_20;
605	} else {
606	struct ieee80211_tbtt_info_7_8_9 *tbtt_info = (void *)pos;
607
608	memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
609
610	bss_params = tbtt_info->bss_params;
611
612	if (length == offsetofend(struct ieee80211_tbtt_info_7_8_9,
613	psd_20))
614	entry->psd_20 = tbtt_info->psd_20;
615	}
616
617	/* ignore entries with invalid BSSID */
618	if (!is_valid_ether_addr(addr: entry->bssid))
619	return -EINVAL;
620
621	/* skip non colocated APs */
622	if (!cfg80211_parse_bss_param(data: bss_params, coloc_ap: entry))
623	return -EINVAL;
624
625	/* no information about the short ssid. Consider the entry valid
626	* for now. It would later be dropped in case there are explicit
627	* SSIDs that need to be matched
628	*/
629	if (!entry->same_ssid && !entry->short_ssid_valid)
630	return 0;
631
632	if (entry->same_ssid) {
633	entry->short_ssid = s_ssid_tmp;
634	entry->short_ssid_valid = true;
635
636	/*
637	* This is safe because we validate datalen in
638	* cfg80211_parse_colocated_ap(), before calling this
639	* function.
640	*/
641	memcpy(&entry->ssid, &ssid_elem->data, ssid_elem->datalen);
642	entry->ssid_len = ssid_elem->datalen;
643	}
644
645	return 0;
646	}
647
648	static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
649	struct list_head *list)
650	{
651	struct ieee80211_neighbor_ap_info *ap_info;
652	const struct element *elem, *ssid_elem;
653	const u8 *pos, *end;
654	u32 s_ssid_tmp;
655	int n_coloc = 0, ret;
656	LIST_HEAD(ap_list);
657
658	ret = cfg80211_calc_short_ssid(ies, elem: &ssid_elem, s_ssid: &s_ssid_tmp);
659	if (ret)
660	return 0;
661
662	for_each_element_id(elem, WLAN_EID_REDUCED_NEIGHBOR_REPORT,
663	ies->data, ies->len) {
664	pos = elem->data;
665	end = elem->data + elem->datalen;
666
667	/* RNR IE may contain more than one NEIGHBOR_AP_INFO */
668	while (pos + sizeof(*ap_info) <= end) {
669	enum nl80211_band band;
670	int freq;
671	u8 length, i, count;
672
673	ap_info = (void *)pos;
674	count = u8_get_bits(v: ap_info->tbtt_info_hdr,
675	IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
676	length = ap_info->tbtt_info_len;
677
678	pos += sizeof(*ap_info);
679
680	if (!ieee80211_operating_class_to_band(operating_class: ap_info->op_class,
681	band: &band))
682	break;
683
684	freq = ieee80211_channel_to_frequency(chan: ap_info->channel,
685	band);
686
687	if (end - pos < count * length)
688	break;
689
690	if (u8_get_bits(v: ap_info->tbtt_info_hdr,
691	IEEE80211_AP_INFO_TBTT_HDR_TYPE) !=
692	IEEE80211_TBTT_INFO_TYPE_TBTT) {
693	pos += count * length;
694	continue;
695	}
696
697	/* TBTT info must include bss param + BSSID +
698	* (short SSID or same_ssid bit to be set).
699	* ignore other options, and move to the
700	* next AP info
701	*/
702	if (band != NL80211_BAND_6GHZ ||
703	!(length == offsetofend(struct ieee80211_tbtt_info_7_8_9,
704	bss_params) ||
705	length == sizeof(struct ieee80211_tbtt_info_7_8_9) ||
706	length >= offsetofend(struct ieee80211_tbtt_info_ge_11,
707	bss_params))) {
708	pos += count * length;
709	continue;
710	}
711
712	for (i = 0; i < count; i++) {
713	struct cfg80211_colocated_ap *entry;
714
715	entry = kzalloc(size: sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
716	GFP_ATOMIC);
717
718	if (!entry)
719	goto error;
720
721	entry->center_freq = freq;
722
723	if (!cfg80211_parse_ap_info(entry, pos, length,
724	ssid_elem,
725	s_ssid_tmp)) {
726	n_coloc++;
727	list_add_tail(new: &entry->list, head: &ap_list);
728	} else {
729	kfree(objp: entry);
730	}
731
732	pos += length;
733	}
734	}
735
736	error:
737	if (pos != end) {
738	cfg80211_free_coloc_ap_list(coloc_ap_list: &ap_list);
739	return 0;
740	}
741	}
742
743	list_splice_tail(list: &ap_list, head: list);
744	return n_coloc;
745	}
746
747	static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
748	struct ieee80211_channel *chan,
749	bool add_to_6ghz)
750	{
751	int i;
752	u32 n_channels = request->n_channels;
753	struct cfg80211_scan_6ghz_params *params =
754	&request->scan_6ghz_params[request->n_6ghz_params];
755
756	for (i = 0; i < n_channels; i++) {
757	if (request->channels[i] == chan) {
758	if (add_to_6ghz)
759	params->channel_idx = i;
760	return;
761	}
762	}
763
764	request->channels[n_channels] = chan;
765	if (add_to_6ghz)
766	request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
767	n_channels;
768
769	request->n_channels++;
770	}
771
772	static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
773	struct cfg80211_scan_request *request)
774	{
775	int i;
776	u32 s_ssid;
777
778	for (i = 0; i < request->n_ssids; i++) {
779	/* wildcard ssid in the scan request */
780	if (!request->ssids[i].ssid_len) {
781	if (ap->multi_bss && !ap->transmitted_bssid)
782	continue;
783
784	return true;
785	}
786
787	if (ap->ssid_len &&
788	ap->ssid_len == request->ssids[i].ssid_len) {
789	if (!memcmp(p: request->ssids[i].ssid, q: ap->ssid,
790	size: ap->ssid_len))
791	return true;
792	} else if (ap->short_ssid_valid) {
793	s_ssid = ~crc32_le(crc: ~0, p: request->ssids[i].ssid,
794	len: request->ssids[i].ssid_len);
795
796	if (ap->short_ssid == s_ssid)
797	return true;
798	}
799	}
800
801	return false;
802	}
803
804	static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
805	{
806	u8 i;
807	struct cfg80211_colocated_ap *ap;
808	int n_channels, count = 0, err;
809	struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
810	LIST_HEAD(coloc_ap_list);
811	bool need_scan_psc = true;
812	const struct ieee80211_sband_iftype_data *iftd;
813
814	rdev_req->scan_6ghz = true;
815
816	if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
817	return -EOPNOTSUPP;
818
819	iftd = ieee80211_get_sband_iftype_data(sband: rdev->wiphy.bands[NL80211_BAND_6GHZ],
820	iftype: rdev_req->wdev->iftype);
821	if (!iftd || !iftd->he_cap.has_he)
822	return -EOPNOTSUPP;
823
824	n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
825
826	if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
827	struct cfg80211_internal_bss *intbss;
828
829	spin_lock_bh(lock: &rdev->bss_lock);
830	list_for_each_entry(intbss, &rdev->bss_list, list) {
831	struct cfg80211_bss *res = &intbss->pub;
832	const struct cfg80211_bss_ies *ies;
833	const struct element *ssid_elem;
834	struct cfg80211_colocated_ap *entry;
835	u32 s_ssid_tmp;
836	int ret;
837
838	ies = rcu_access_pointer(res->ies);
839	count += cfg80211_parse_colocated_ap(ies,
840	list: &coloc_ap_list);
841
842	/* In case the scan request specified a specific BSSID
843	* and the BSS is found and operating on 6GHz band then
844	* add this AP to the collocated APs list.
845	* This is relevant for ML probe requests when the lower
846	* band APs have not been discovered.
847	*/
848	if (is_broadcast_ether_addr(addr: rdev_req->bssid) ||
849	!ether_addr_equal(addr1: rdev_req->bssid, addr2: res->bssid) ||
850	res->channel->band != NL80211_BAND_6GHZ)
851	continue;
852
853	ret = cfg80211_calc_short_ssid(ies, elem: &ssid_elem,
854	s_ssid: &s_ssid_tmp);
855	if (ret)
856	continue;
857
858	entry = kzalloc(size: sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
859	GFP_ATOMIC);
860
861	if (!entry)
862	continue;
863
864	memcpy(entry->bssid, res->bssid, ETH_ALEN);
865	entry->short_ssid = s_ssid_tmp;
866	memcpy(entry->ssid, ssid_elem->data,
867	ssid_elem->datalen);
868	entry->ssid_len = ssid_elem->datalen;
869	entry->short_ssid_valid = true;
870	entry->center_freq = res->channel->center_freq;
871
872	list_add_tail(new: &entry->list, head: &coloc_ap_list);
873	count++;
874	}
875	spin_unlock_bh(lock: &rdev->bss_lock);
876	}
877
878	request = kzalloc(struct_size(request, channels, n_channels) +
879	sizeof(*request->scan_6ghz_params) * count +
880	sizeof(*request->ssids) * rdev_req->n_ssids,
881	GFP_KERNEL);
882	if (!request) {
883	cfg80211_free_coloc_ap_list(coloc_ap_list: &coloc_ap_list);
884	return -ENOMEM;
885	}
886
887	*request = *rdev_req;
888	request->n_channels = 0;
889	request->scan_6ghz_params =
890	(void *)&request->channels[n_channels];
891
892	/*
893	* PSC channels should not be scanned in case of direct scan with 1 SSID
894	* and at least one of the reported co-located APs with same SSID
895	* indicating that all APs in the same ESS are co-located
896	*/
897	if (count && request->n_ssids == 1 && request->ssids[0].ssid_len) {
898	list_for_each_entry(ap, &coloc_ap_list, list) {
899	if (ap->colocated_ess &&
900	cfg80211_find_ssid_match(ap, request)) {
901	need_scan_psc = false;
902	break;
903	}
904	}
905	}
906
907	/*
908	* add to the scan request the channels that need to be scanned
909	* regardless of the collocated APs (PSC channels or all channels
910	* in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
911	*/
912	for (i = 0; i < rdev_req->n_channels; i++) {
913	if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ &&
914	((need_scan_psc &&
915	cfg80211_channel_is_psc(chan: rdev_req->channels[i])) ||
916	!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
917	cfg80211_scan_req_add_chan(request,
918	chan: rdev_req->channels[i],
919	add_to_6ghz: false);
920	}
921	}
922
923	if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
924	goto skip;
925
926	list_for_each_entry(ap, &coloc_ap_list, list) {
927	bool found = false;
928	struct cfg80211_scan_6ghz_params *scan_6ghz_params =
929	&request->scan_6ghz_params[request->n_6ghz_params];
930	struct ieee80211_channel *chan =
931	ieee80211_get_channel(wiphy: &rdev->wiphy, freq: ap->center_freq);
932
933	if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
934	continue;
935
936	for (i = 0; i < rdev_req->n_channels; i++) {
937	if (rdev_req->channels[i] == chan)
938	found = true;
939	}
940
941	if (!found)
942	continue;
943
944	if (request->n_ssids > 0 &&
945	!cfg80211_find_ssid_match(ap, request))
946	continue;
947
948	if (!is_broadcast_ether_addr(addr: request->bssid) &&
949	!ether_addr_equal(addr1: request->bssid, addr2: ap->bssid))
950	continue;
951
952	if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
953	continue;
954
955	cfg80211_scan_req_add_chan(request, chan, add_to_6ghz: true);
956	memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
957	scan_6ghz_params->short_ssid = ap->short_ssid;
958	scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
959	scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
960	scan_6ghz_params->psd_20 = ap->psd_20;
961
962	/*
963	* If a PSC channel is added to the scan and 'need_scan_psc' is
964	* set to false, then all the APs that the scan logic is
965	* interested with on the channel are collocated and thus there
966	* is no need to perform the initial PSC channel listen.
967	*/
968	if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
969	scan_6ghz_params->psc_no_listen = true;
970
971	request->n_6ghz_params++;
972	}
973
974	skip:
975	cfg80211_free_coloc_ap_list(coloc_ap_list: &coloc_ap_list);
976
977	if (request->n_channels) {
978	struct cfg80211_scan_request *old = rdev->int_scan_req;
979	rdev->int_scan_req = request;
980
981	/*
982	* Add the ssids from the parent scan request to the new scan
983	* request, so the driver would be able to use them in its
984	* probe requests to discover hidden APs on PSC channels.
985	*/
986	request->ssids = (void *)&request->channels[request->n_channels];
987	request->n_ssids = rdev_req->n_ssids;
988	memcpy(request->ssids, rdev_req->ssids, sizeof(*request->ssids) *
989	request->n_ssids);
990
991	/*
992	* If this scan follows a previous scan, save the scan start
993	* info from the first part of the scan
994	*/
995	if (old)
996	rdev->int_scan_req->info = old->info;
997
998	err = rdev_scan(rdev, request);
999	if (err) {
1000	rdev->int_scan_req = old;
1001	kfree(objp: request);
1002	} else {
1003	kfree(objp: old);
1004	}
1005
1006	return err;
1007	}
1008
1009	kfree(objp: request);
1010	return -EINVAL;
1011	}
1012
1013	int cfg80211_scan(struct cfg80211_registered_device *rdev)
1014	{
1015	struct cfg80211_scan_request *request;
1016	struct cfg80211_scan_request *rdev_req = rdev->scan_req;
1017	u32 n_channels = 0, idx, i;
1018
1019	if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ))
1020	return rdev_scan(rdev, request: rdev_req);
1021
1022	for (i = 0; i < rdev_req->n_channels; i++) {
1023	if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
1024	n_channels++;
1025	}
1026
1027	if (!n_channels)
1028	return cfg80211_scan_6ghz(rdev);
1029
1030	request = kzalloc(struct_size(request, channels, n_channels),
1031	GFP_KERNEL);
1032	if (!request)
1033	return -ENOMEM;
1034
1035	*request = *rdev_req;
1036	request->n_channels = n_channels;
1037
1038	for (i = idx = 0; i < rdev_req->n_channels; i++) {
1039	if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
1040	request->channels[idx++] = rdev_req->channels[i];
1041	}
1042
1043	rdev_req->scan_6ghz = false;
1044	rdev->int_scan_req = request;
1045	return rdev_scan(rdev, request);
1046	}
1047
1048	void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
1049	bool send_message)
1050	{
1051	struct cfg80211_scan_request *request, *rdev_req;
1052	struct wireless_dev *wdev;
1053	struct sk_buff *msg;
1054	#ifdef CONFIG_CFG80211_WEXT
1055	union iwreq_data wrqu;
1056	#endif
1057
1058	lockdep_assert_held(&rdev->wiphy.mtx);
1059
1060	if (rdev->scan_msg) {
1061	nl80211_send_scan_msg(rdev, msg: rdev->scan_msg);
1062	rdev->scan_msg = NULL;
1063	return;
1064	}
1065
1066	rdev_req = rdev->scan_req;
1067	if (!rdev_req)
1068	return;
1069
1070	wdev = rdev_req->wdev;
1071	request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
1072
1073	if (wdev_running(wdev) &&
1074	(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
1075	!rdev_req->scan_6ghz && !request->info.aborted &&
1076	!cfg80211_scan_6ghz(rdev))
1077	return;
1078
1079	/*
1080	* This must be before sending the other events!
1081	* Otherwise, wpa_supplicant gets completely confused with
1082	* wext events.
1083	*/
1084	if (wdev->netdev)
1085	cfg80211_sme_scan_done(dev: wdev->netdev);
1086
1087	if (!request->info.aborted &&
1088	request->flags & NL80211_SCAN_FLAG_FLUSH) {
1089	/* flush entries from previous scans */
1090	spin_lock_bh(lock: &rdev->bss_lock);
1091	__cfg80211_bss_expire(rdev, expire_time: request->scan_start);
1092	spin_unlock_bh(lock: &rdev->bss_lock);
1093	}
1094
1095	msg = nl80211_build_scan_msg(rdev, wdev, aborted: request->info.aborted);
1096
1097	#ifdef CONFIG_CFG80211_WEXT
1098	if (wdev->netdev && !request->info.aborted) {
1099	memset(&wrqu, 0, sizeof(wrqu));
1100
1101	wireless_send_event(dev: wdev->netdev, SIOCGIWSCAN, wrqu: &wrqu, NULL);
1102	}
1103	#endif
1104
1105	dev_put(dev: wdev->netdev);
1106
1107	kfree(objp: rdev->int_scan_req);
1108	rdev->int_scan_req = NULL;
1109
1110	kfree(objp: rdev->scan_req);
1111	rdev->scan_req = NULL;
1112
1113	if (!send_message)
1114	rdev->scan_msg = msg;
1115	else
1116	nl80211_send_scan_msg(rdev, msg);
1117	}
1118
1119	void __cfg80211_scan_done(struct wiphy *wiphy, struct wiphy_work *wk)
1120	{
1121	___cfg80211_scan_done(rdev: wiphy_to_rdev(wiphy), send_message: true);
1122	}
1123
1124	void cfg80211_scan_done(struct cfg80211_scan_request *request,
1125	struct cfg80211_scan_info *info)
1126	{
1127	struct cfg80211_scan_info old_info = request->info;
1128
1129	trace_cfg80211_scan_done(request, info);
1130	WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req &&
1131	request != wiphy_to_rdev(request->wiphy)->int_scan_req);
1132
1133	request->info = *info;
1134
1135	/*
1136	* In case the scan is split, the scan_start_tsf and tsf_bssid should
1137	* be of the first part. In such a case old_info.scan_start_tsf should
1138	* be non zero.
1139	*/
1140	if (request->scan_6ghz && old_info.scan_start_tsf) {
1141	request->info.scan_start_tsf = old_info.scan_start_tsf;
1142	memcpy(request->info.tsf_bssid, old_info.tsf_bssid,
1143	sizeof(request->info.tsf_bssid));
1144	}
1145
1146	request->notified = true;
1147	wiphy_work_queue(wiphy: request->wiphy,
1148	work: &wiphy_to_rdev(wiphy: request->wiphy)->scan_done_wk);
1149	}
1150	EXPORT_SYMBOL(cfg80211_scan_done);
1151
1152	void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
1153	struct cfg80211_sched_scan_request *req)
1154	{
1155	lockdep_assert_held(&rdev->wiphy.mtx);
1156
1157	list_add_rcu(new: &req->list, head: &rdev->sched_scan_req_list);
1158	}
1159
1160	static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
1161	struct cfg80211_sched_scan_request *req)
1162	{
1163	lockdep_assert_held(&rdev->wiphy.mtx);
1164
1165	list_del_rcu(entry: &req->list);
1166	kfree_rcu(req, rcu_head);
1167	}
1168
1169	static struct cfg80211_sched_scan_request *
1170	cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
1171	{
1172	struct cfg80211_sched_scan_request *pos;
1173
1174	list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
1175	lockdep_is_held(&rdev->wiphy.mtx)) {
1176	if (pos->reqid == reqid)
1177	return pos;
1178	}
1179	return NULL;
1180	}
1181
1182	/*
1183	* Determines if a scheduled scan request can be handled. When a legacy
1184	* scheduled scan is running no other scheduled scan is allowed regardless
1185	* whether the request is for legacy or multi-support scan. When a multi-support
1186	* scheduled scan is running a request for legacy scan is not allowed. In this
1187	* case a request for multi-support scan can be handled if resources are
1188	* available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
1189	*/
1190	int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
1191	bool want_multi)
1192	{
1193	struct cfg80211_sched_scan_request *pos;
1194	int i = 0;
1195
1196	list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
1197	/* request id zero means legacy in progress */
1198	if (!i && !pos->reqid)
1199	return -EINPROGRESS;
1200	i++;
1201	}
1202
1203	if (i) {
1204	/* no legacy allowed when multi request(s) are active */
1205	if (!want_multi)
1206	return -EINPROGRESS;
1207
1208	/* resource limit reached */
1209	if (i == rdev->wiphy.max_sched_scan_reqs)
1210	return -ENOSPC;
1211	}
1212	return 0;
1213	}
1214
1215	void cfg80211_sched_scan_results_wk(struct work_struct *work)
1216	{
1217	struct cfg80211_registered_device *rdev;
1218	struct cfg80211_sched_scan_request *req, *tmp;
1219
1220	rdev = container_of(work, struct cfg80211_registered_device,
1221	sched_scan_res_wk);
1222
1223	wiphy_lock(wiphy: &rdev->wiphy);
1224	list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
1225	if (req->report_results) {
1226	req->report_results = false;
1227	if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
1228	/* flush entries from previous scans */
1229	spin_lock_bh(lock: &rdev->bss_lock);
1230	__cfg80211_bss_expire(rdev, expire_time: req->scan_start);
1231	spin_unlock_bh(lock: &rdev->bss_lock);
1232	req->scan_start = jiffies;
1233	}
1234	nl80211_send_sched_scan(req,
1235	cmd: NL80211_CMD_SCHED_SCAN_RESULTS);
1236	}
1237	}
1238	wiphy_unlock(wiphy: &rdev->wiphy);
1239	}
1240
1241	void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
1242	{
1243	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1244	struct cfg80211_sched_scan_request *request;
1245
1246	trace_cfg80211_sched_scan_results(wiphy, id: reqid);
1247	/* ignore if we're not scanning */
1248
1249	rcu_read_lock();
1250	request = cfg80211_find_sched_scan_req(rdev, reqid);
1251	if (request) {
1252	request->report_results = true;
1253	queue_work(wq: cfg80211_wq, work: &rdev->sched_scan_res_wk);
1254	}
1255	rcu_read_unlock();
1256	}
1257	EXPORT_SYMBOL(cfg80211_sched_scan_results);
1258
1259	void cfg80211_sched_scan_stopped_locked(struct wiphy *wiphy, u64 reqid)
1260	{
1261	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1262
1263	lockdep_assert_held(&wiphy->mtx);
1264
1265	trace_cfg80211_sched_scan_stopped(wiphy, id: reqid);
1266
1267	__cfg80211_stop_sched_scan(rdev, reqid, driver_initiated: true);
1268	}
1269	EXPORT_SYMBOL(cfg80211_sched_scan_stopped_locked);
1270
1271	void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
1272	{
1273	wiphy_lock(wiphy);
1274	cfg80211_sched_scan_stopped_locked(wiphy, reqid);
1275	wiphy_unlock(wiphy);
1276	}
1277	EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
1278
1279	int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
1280	struct cfg80211_sched_scan_request *req,
1281	bool driver_initiated)
1282	{
1283	lockdep_assert_held(&rdev->wiphy.mtx);
1284
1285	if (!driver_initiated) {
1286	int err = rdev_sched_scan_stop(rdev, dev: req->dev, reqid: req->reqid);
1287	if (err)
1288	return err;
1289	}
1290
1291	nl80211_send_sched_scan(req, cmd: NL80211_CMD_SCHED_SCAN_STOPPED);
1292
1293	cfg80211_del_sched_scan_req(rdev, req);
1294
1295	return 0;
1296	}
1297
1298	int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
1299	u64 reqid, bool driver_initiated)
1300	{
1301	struct cfg80211_sched_scan_request *sched_scan_req;
1302
1303	lockdep_assert_held(&rdev->wiphy.mtx);
1304
1305	sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
1306	if (!sched_scan_req)
1307	return -ENOENT;
1308
1309	return cfg80211_stop_sched_scan_req(rdev, req: sched_scan_req,
1310	driver_initiated);
1311	}
1312
1313	void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
1314	unsigned long age_secs)
1315	{
1316	struct cfg80211_internal_bss *bss;
1317	unsigned long age_jiffies = msecs_to_jiffies(m: age_secs * MSEC_PER_SEC);
1318
1319	spin_lock_bh(lock: &rdev->bss_lock);
1320	list_for_each_entry(bss, &rdev->bss_list, list)
1321	bss->ts -= age_jiffies;
1322	spin_unlock_bh(lock: &rdev->bss_lock);
1323	}
1324
1325	void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
1326	{
1327	__cfg80211_bss_expire(rdev, expire_time: jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
1328	}
1329
1330	void cfg80211_bss_flush(struct wiphy *wiphy)
1331	{
1332	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1333
1334	spin_lock_bh(lock: &rdev->bss_lock);
1335	__cfg80211_bss_expire(rdev, expire_time: jiffies);
1336	spin_unlock_bh(lock: &rdev->bss_lock);
1337	}
1338	EXPORT_SYMBOL(cfg80211_bss_flush);
1339
1340	const struct element *
1341	cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
1342	const u8 *match, unsigned int match_len,
1343	unsigned int match_offset)
1344	{
1345	const struct element *elem;
1346
1347	for_each_element_id(elem, eid, ies, len) {
1348	if (elem->datalen >= match_offset + match_len &&
1349	!memcmp(p: elem->data + match_offset, q: match, size: match_len))
1350	return elem;
1351	}
1352
1353	return NULL;
1354	}
1355	EXPORT_SYMBOL(cfg80211_find_elem_match);
1356
1357	const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
1358	const u8 *ies,
1359	unsigned int len)
1360	{
1361	const struct element *elem;
1362	u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
1363	int match_len = (oui_type < 0) ? 3 : sizeof(match);
1364
1365	if (WARN_ON(oui_type > 0xff))
1366	return NULL;
1367
1368	elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
1369	match, match_len, 0);
1370
1371	if (!elem || elem->datalen < 4)
1372	return NULL;
1373
1374	return elem;
1375	}
1376	EXPORT_SYMBOL(cfg80211_find_vendor_elem);
1377
1378	/**
1379	* enum bss_compare_mode - BSS compare mode
1380	* @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
1381	* @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
1382	* @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
1383	*/
1384	enum bss_compare_mode {
1385	BSS_CMP_REGULAR,
1386	BSS_CMP_HIDE_ZLEN,
1387	BSS_CMP_HIDE_NUL,
1388	};
1389
1390	static int cmp_bss(struct cfg80211_bss *a,
1391	struct cfg80211_bss *b,
1392	enum bss_compare_mode mode)
1393	{
1394	const struct cfg80211_bss_ies *a_ies, *b_ies;
1395	const u8 *ie1 = NULL;
1396	const u8 *ie2 = NULL;
1397	int i, r;
1398
1399	if (a->channel != b->channel)
1400	return (b->channel->center_freq * 1000 + b->channel->freq_offset) -
1401	(a->channel->center_freq * 1000 + a->channel->freq_offset);
1402
1403	a_ies = rcu_access_pointer(a->ies);
1404	if (!a_ies)
1405	return -1;
1406	b_ies = rcu_access_pointer(b->ies);
1407	if (!b_ies)
1408	return 1;
1409
1410	if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
1411	ie1 = cfg80211_find_ie(eid: WLAN_EID_MESH_ID,
1412	ies: a_ies->data, len: a_ies->len);
1413	if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
1414	ie2 = cfg80211_find_ie(eid: WLAN_EID_MESH_ID,
1415	ies: b_ies->data, len: b_ies->len);
1416	if (ie1 && ie2) {
1417	int mesh_id_cmp;
1418
1419	if (ie1[1] == ie2[1])
1420	mesh_id_cmp = memcmp(p: ie1 + 2, q: ie2 + 2, size: ie1[1]);
1421	else
1422	mesh_id_cmp = ie2[1] - ie1[1];
1423
1424	ie1 = cfg80211_find_ie(eid: WLAN_EID_MESH_CONFIG,
1425	ies: a_ies->data, len: a_ies->len);
1426	ie2 = cfg80211_find_ie(eid: WLAN_EID_MESH_CONFIG,
1427	ies: b_ies->data, len: b_ies->len);
1428	if (ie1 && ie2) {
1429	if (mesh_id_cmp)
1430	return mesh_id_cmp;
1431	if (ie1[1] != ie2[1])
1432	return ie2[1] - ie1[1];
1433	return memcmp(p: ie1 + 2, q: ie2 + 2, size: ie1[1]);
1434	}
1435	}
1436
1437	r = memcmp(p: a->bssid, q: b->bssid, size: sizeof(a->bssid));
1438	if (r)
1439	return r;
1440
1441	ie1 = cfg80211_find_ie(eid: WLAN_EID_SSID, ies: a_ies->data, len: a_ies->len);
1442	ie2 = cfg80211_find_ie(eid: WLAN_EID_SSID, ies: b_ies->data, len: b_ies->len);
1443
1444	if (!ie1 && !ie2)
1445	return 0;
1446
1447	/*
1448	* Note that with "hide_ssid", the function returns a match if
1449	* the already-present BSS ("b") is a hidden SSID beacon for
1450	* the new BSS ("a").
1451	*/
1452
1453	/* sort missing IE before (left of) present IE */
1454	if (!ie1)
1455	return -1;
1456	if (!ie2)
1457	return 1;
1458
1459	switch (mode) {
1460	case BSS_CMP_HIDE_ZLEN:
1461	/*
1462	* In ZLEN mode we assume the BSS entry we're
1463	* looking for has a zero-length SSID. So if
1464	* the one we're looking at right now has that,
1465	* return 0. Otherwise, return the difference
1466	* in length, but since we're looking for the
1467	* 0-length it's really equivalent to returning
1468	* the length of the one we're looking at.
1469	*
1470	* No content comparison is needed as we assume
1471	* the content length is zero.
1472	*/
1473	return ie2[1];
1474	case BSS_CMP_REGULAR:
1475	default:
1476	/* sort by length first, then by contents */
1477	if (ie1[1] != ie2[1])
1478	return ie2[1] - ie1[1];
1479	return memcmp(p: ie1 + 2, q: ie2 + 2, size: ie1[1]);
1480	case BSS_CMP_HIDE_NUL:
1481	if (ie1[1] != ie2[1])
1482	return ie2[1] - ie1[1];
1483	/* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
1484	for (i = 0; i < ie2[1]; i++)
1485	if (ie2[i + 2])
1486	return -1;
1487	return 0;
1488	}
1489	}
1490
1491	static bool cfg80211_bss_type_match(u16 capability,
1492	enum nl80211_band band,
1493	enum ieee80211_bss_type bss_type)
1494	{
1495	bool ret = true;
1496	u16 mask, val;
1497
1498	if (bss_type == IEEE80211_BSS_TYPE_ANY)
1499	return ret;
1500
1501	if (band == NL80211_BAND_60GHZ) {
1502	mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
1503	switch (bss_type) {
1504	case IEEE80211_BSS_TYPE_ESS:
1505	val = WLAN_CAPABILITY_DMG_TYPE_AP;
1506	break;
1507	case IEEE80211_BSS_TYPE_PBSS:
1508	val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
1509	break;
1510	case IEEE80211_BSS_TYPE_IBSS:
1511	val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
1512	break;
1513	default:
1514	return false;
1515	}
1516	} else {
1517	mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
1518	switch (bss_type) {
1519	case IEEE80211_BSS_TYPE_ESS:
1520	val = WLAN_CAPABILITY_ESS;
1521	break;
1522	case IEEE80211_BSS_TYPE_IBSS:
1523	val = WLAN_CAPABILITY_IBSS;
1524	break;
1525	case IEEE80211_BSS_TYPE_MBSS:
1526	val = 0;
1527	break;
1528	default:
1529	return false;
1530	}
1531	}
1532
1533	ret = ((capability & mask) == val);
1534	return ret;
1535	}
1536
1537	/* Returned bss is reference counted and must be cleaned up appropriately. */
1538	struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
1539	struct ieee80211_channel *channel,
1540	const u8 *bssid,
1541	const u8 *ssid, size_t ssid_len,
1542	enum ieee80211_bss_type bss_type,
1543	enum ieee80211_privacy privacy)
1544	{
1545	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1546	struct cfg80211_internal_bss *bss, *res = NULL;
1547	unsigned long now = jiffies;
1548	int bss_privacy;
1549
1550	trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
1551	privacy);
1552
1553	spin_lock_bh(lock: &rdev->bss_lock);
1554
1555	list_for_each_entry(bss, &rdev->bss_list, list) {
1556	if (!cfg80211_bss_type_match(capability: bss->pub.capability,
1557	band: bss->pub.channel->band, bss_type))
1558	continue;
1559
1560	bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
1561	if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
1562	(privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
1563	continue;
1564	if (channel && bss->pub.channel != channel)
1565	continue;
1566	if (!is_valid_ether_addr(addr: bss->pub.bssid))
1567	continue;
1568	/* Don't get expired BSS structs */
1569	if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
1570	!atomic_read(v: &bss->hold))
1571	continue;
1572	if (is_bss(a: &bss->pub, bssid, ssid, ssid_len)) {
1573	res = bss;
1574	bss_ref_get(rdev, bss: res);
1575	break;
1576	}
1577	}
1578
1579	spin_unlock_bh(lock: &rdev->bss_lock);
1580	if (!res)
1581	return NULL;
1582	trace_cfg80211_return_bss(pub: &res->pub);
1583	return &res->pub;
1584	}
1585	EXPORT_SYMBOL(cfg80211_get_bss);
1586
1587	static void rb_insert_bss(struct cfg80211_registered_device *rdev,
1588	struct cfg80211_internal_bss *bss)
1589	{
1590	struct rb_node **p = &rdev->bss_tree.rb_node;
1591	struct rb_node *parent = NULL;
1592	struct cfg80211_internal_bss *tbss;
1593	int cmp;
1594
1595	while (*p) {
1596	parent = *p;
1597	tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
1598
1599	cmp = cmp_bss(a: &bss->pub, b: &tbss->pub, mode: BSS_CMP_REGULAR);
1600
1601	if (WARN_ON(!cmp)) {
1602	/* will sort of leak this BSS */
1603	return;
1604	}
1605
1606	if (cmp < 0)
1607	p = &(*p)->rb_left;
1608	else
1609	p = &(*p)->rb_right;
1610	}
1611
1612	rb_link_node(node: &bss->rbn, parent, rb_link: p);
1613	rb_insert_color(&bss->rbn, &rdev->bss_tree);
1614	}
1615
1616	static struct cfg80211_internal_bss *
1617	rb_find_bss(struct cfg80211_registered_device *rdev,
1618	struct cfg80211_internal_bss *res,
1619	enum bss_compare_mode mode)
1620	{
1621	struct rb_node *n = rdev->bss_tree.rb_node;
1622	struct cfg80211_internal_bss *bss;
1623	int r;
1624
1625	while (n) {
1626	bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
1627	r = cmp_bss(a: &res->pub, b: &bss->pub, mode);
1628
1629	if (r == 0)
1630	return bss;
1631	else if (r < 0)
1632	n = n->rb_left;
1633	else
1634	n = n->rb_right;
1635	}
1636
1637	return NULL;
1638	}
1639
1640	static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
1641	struct cfg80211_internal_bss *new)
1642	{
1643	const struct cfg80211_bss_ies *ies;
1644	struct cfg80211_internal_bss *bss;
1645	const u8 *ie;
1646	int i, ssidlen;
1647	u8 fold = 0;
1648	u32 n_entries = 0;
1649
1650	ies = rcu_access_pointer(new->pub.beacon_ies);
1651	if (WARN_ON(!ies))
1652	return false;
1653
1654	ie = cfg80211_find_ie(eid: WLAN_EID_SSID, ies: ies->data, len: ies->len);
1655	if (!ie) {
1656	/* nothing to do */
1657	return true;
1658	}
1659
1660	ssidlen = ie[1];
1661	for (i = 0; i < ssidlen; i++)
1662	fold |= ie[2 + i];
1663
1664	if (fold) {
1665	/* not a hidden SSID */
1666	return true;
1667	}
1668
1669	/* This is the bad part ... */
1670
1671	list_for_each_entry(bss, &rdev->bss_list, list) {
1672	/*
1673	* we're iterating all the entries anyway, so take the
1674	* opportunity to validate the list length accounting
1675	*/
1676	n_entries++;
1677
1678	if (!ether_addr_equal(addr1: bss->pub.bssid, addr2: new->pub.bssid))
1679	continue;
1680	if (bss->pub.channel != new->pub.channel)
1681	continue;
1682	if (rcu_access_pointer(bss->pub.beacon_ies))
1683	continue;
1684	ies = rcu_access_pointer(bss->pub.ies);
1685	if (!ies)
1686	continue;
1687	ie = cfg80211_find_ie(eid: WLAN_EID_SSID, ies: ies->data, len: ies->len);
1688	if (!ie)
1689	continue;
1690	if (ssidlen && ie[1] != ssidlen)
1691	continue;
1692	if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
1693	continue;
1694	if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
1695	list_del(entry: &bss->hidden_list);
1696	/* combine them */
1697	list_add(new: &bss->hidden_list, head: &new->hidden_list);
1698	bss->pub.hidden_beacon_bss = &new->pub;
1699	new->refcount += bss->refcount;
1700	rcu_assign_pointer(bss->pub.beacon_ies,
1701	new->pub.beacon_ies);
1702	}
1703
1704	WARN_ONCE(n_entries != rdev->bss_entries,
1705	"rdev bss entries[%d]/list[len:%d] corruption\n",
1706	rdev->bss_entries, n_entries);
1707
1708	return true;
1709	}
1710
1711	static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
1712	const struct cfg80211_bss_ies *new_ies,
1713	const struct cfg80211_bss_ies *old_ies)
1714	{
1715	struct cfg80211_internal_bss *bss;
1716
1717	/* Assign beacon IEs to all sub entries */
1718	list_for_each_entry(bss, &known->hidden_list, hidden_list) {
1719	const struct cfg80211_bss_ies *ies;
1720
1721	ies = rcu_access_pointer(bss->pub.beacon_ies);
1722	WARN_ON(ies != old_ies);
1723
1724	rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
1725	}
1726	}
1727
1728	static bool
1729	cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
1730	struct cfg80211_internal_bss *known,
1731	struct cfg80211_internal_bss *new,
1732	bool signal_valid)
1733	{
1734	lockdep_assert_held(&rdev->bss_lock);
1735
1736	/* Update IEs */
1737	if (rcu_access_pointer(new->pub.proberesp_ies)) {
1738	const struct cfg80211_bss_ies *old;
1739
1740	old = rcu_access_pointer(known->pub.proberesp_ies);
1741
1742	rcu_assign_pointer(known->pub.proberesp_ies,
1743	new->pub.proberesp_ies);
1744	/* Override possible earlier Beacon frame IEs */
1745	rcu_assign_pointer(known->pub.ies,
1746	new->pub.proberesp_ies);
1747	if (old)
1748	kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1749	} else if (rcu_access_pointer(new->pub.beacon_ies)) {
1750	const struct cfg80211_bss_ies *old;
1751
1752	if (known->pub.hidden_beacon_bss &&
1753	!list_empty(head: &known->hidden_list)) {
1754	const struct cfg80211_bss_ies *f;
1755
1756	/* The known BSS struct is one of the probe
1757	* response members of a group, but we're
1758	* receiving a beacon (beacon_ies in the new
1759	* bss is used). This can only mean that the
1760	* AP changed its beacon from not having an
1761	* SSID to showing it, which is confusing so
1762	* drop this information.
1763	*/
1764
1765	f = rcu_access_pointer(new->pub.beacon_ies);
1766	kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
1767	return false;
1768	}
1769
1770	old = rcu_access_pointer(known->pub.beacon_ies);
1771
1772	rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
1773
1774	/* Override IEs if they were from a beacon before */
1775	if (old == rcu_access_pointer(known->pub.ies))
1776	rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
1777
1778	cfg80211_update_hidden_bsses(known,
1779	rcu_access_pointer(new->pub.beacon_ies),
1780	old_ies: old);
1781
1782	if (old)
1783	kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1784	}
1785
1786	known->pub.beacon_interval = new->pub.beacon_interval;
1787
1788	/* don't update the signal if beacon was heard on
1789	* adjacent channel.
1790	*/
1791	if (signal_valid)
1792	known->pub.signal = new->pub.signal;
1793	known->pub.capability = new->pub.capability;
1794	known->ts = new->ts;
1795	known->ts_boottime = new->ts_boottime;
1796	known->parent_tsf = new->parent_tsf;
1797	known->pub.chains = new->pub.chains;
1798	memcpy(known->pub.chain_signal, new->pub.chain_signal,
1799	IEEE80211_MAX_CHAINS);
1800	ether_addr_copy(dst: known->parent_bssid, src: new->parent_bssid);
1801	known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
1802	known->pub.bssid_index = new->pub.bssid_index;
1803
1804	return true;
1805	}
1806
1807	/* Returned bss is reference counted and must be cleaned up appropriately. */
1808	static struct cfg80211_internal_bss *
1809	__cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1810	struct cfg80211_internal_bss *tmp,
1811	bool signal_valid, unsigned long ts)
1812	{
1813	struct cfg80211_internal_bss *found = NULL;
1814
1815	if (WARN_ON(!tmp->pub.channel))
1816	return NULL;
1817
1818	tmp->ts = ts;
1819
1820	if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
1821	return NULL;
1822	}
1823
1824	found = rb_find_bss(rdev, res: tmp, mode: BSS_CMP_REGULAR);
1825
1826	if (found) {
1827	if (!cfg80211_update_known_bss(rdev, known: found, new: tmp, signal_valid))
1828	return NULL;
1829	} else {
1830	struct cfg80211_internal_bss *new;
1831	struct cfg80211_internal_bss *hidden;
1832	struct cfg80211_bss_ies *ies;
1833
1834	/*
1835	* create a copy -- the "res" variable that is passed in
1836	* is allocated on the stack since it's not needed in the
1837	* more common case of an update
1838	*/
1839	new = kzalloc(size: sizeof(*new) + rdev->wiphy.bss_priv_size,
1840	GFP_ATOMIC);
1841	if (!new) {
1842	ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
1843	if (ies)
1844	kfree_rcu(ies, rcu_head);
1845	ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1846	if (ies)
1847	kfree_rcu(ies, rcu_head);
1848	return NULL;
1849	}
1850	memcpy(new, tmp, sizeof(*new));
1851	new->refcount = 1;
1852	INIT_LIST_HEAD(list: &new->hidden_list);
1853	INIT_LIST_HEAD(list: &new->pub.nontrans_list);
1854	/* we'll set this later if it was non-NULL */
1855	new->pub.transmitted_bss = NULL;
1856
1857	if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1858	hidden = rb_find_bss(rdev, res: tmp, mode: BSS_CMP_HIDE_ZLEN);
1859	if (!hidden)
1860	hidden = rb_find_bss(rdev, res: tmp,
1861	mode: BSS_CMP_HIDE_NUL);
1862	if (hidden) {
1863	new->pub.hidden_beacon_bss = &hidden->pub;
1864	list_add(new: &new->hidden_list,
1865	head: &hidden->hidden_list);
1866	hidden->refcount++;
1867	rcu_assign_pointer(new->pub.beacon_ies,
1868	hidden->pub.beacon_ies);
1869	}
1870	} else {
1871	/*
1872	* Ok so we found a beacon, and don't have an entry. If
1873	* it's a beacon with hidden SSID, we might be in for an
1874	* expensive search for any probe responses that should
1875	* be grouped with this beacon for updates ...
1876	*/
1877	if (!cfg80211_combine_bsses(rdev, new)) {
1878	bss_ref_put(rdev, bss: new);
1879	return NULL;
1880	}
1881	}
1882
1883	if (rdev->bss_entries >= bss_entries_limit &&
1884	!cfg80211_bss_expire_oldest(rdev)) {
1885	bss_ref_put(rdev, bss: new);
1886	return NULL;
1887	}
1888
1889	/* This must be before the call to bss_ref_get */
1890	if (tmp->pub.transmitted_bss) {
1891	new->pub.transmitted_bss = tmp->pub.transmitted_bss;
1892	bss_ref_get(rdev, bss: bss_from_pub(pub: tmp->pub.transmitted_bss));
1893	}
1894
1895	list_add_tail(new: &new->list, head: &rdev->bss_list);
1896	rdev->bss_entries++;
1897	rb_insert_bss(rdev, bss: new);
1898	found = new;
1899	}
1900
1901	rdev->bss_generation++;
1902	bss_ref_get(rdev, bss: found);
1903
1904	return found;
1905	}
1906
1907	struct cfg80211_internal_bss *
1908	cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1909	struct cfg80211_internal_bss *tmp,
1910	bool signal_valid, unsigned long ts)
1911	{
1912	struct cfg80211_internal_bss *res;
1913
1914	spin_lock_bh(lock: &rdev->bss_lock);
1915	res = __cfg80211_bss_update(rdev, tmp, signal_valid, ts);
1916	spin_unlock_bh(lock: &rdev->bss_lock);
1917
1918	return res;
1919	}
1920
1921	int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen,
1922	enum nl80211_band band)
1923	{
1924	const struct element *tmp;
1925
1926	if (band == NL80211_BAND_6GHZ) {
1927	struct ieee80211_he_operation *he_oper;
1928
1929	tmp = cfg80211_find_ext_elem(ext_eid: WLAN_EID_EXT_HE_OPERATION, ies: ie,
1930	len: ielen);
1931	if (tmp && tmp->datalen >= sizeof(*he_oper) &&
1932	tmp->datalen >= ieee80211_he_oper_size(he_oper_ie: &tmp->data[1])) {
1933	const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
1934
1935	he_oper = (void *)&tmp->data[1];
1936
1937	he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
1938	if (!he_6ghz_oper)
1939	return -1;
1940
1941	return he_6ghz_oper->primary;
1942	}
1943	} else if (band == NL80211_BAND_S1GHZ) {
1944	tmp = cfg80211_find_elem(eid: WLAN_EID_S1G_OPERATION, ies: ie, len: ielen);
1945	if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) {
1946	struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data;
1947
1948	return s1gop->oper_ch;
1949	}
1950	} else {
1951	tmp = cfg80211_find_elem(eid: WLAN_EID_DS_PARAMS, ies: ie, len: ielen);
1952	if (tmp && tmp->datalen == 1)
1953	return tmp->data[0];
1954
1955	tmp = cfg80211_find_elem(eid: WLAN_EID_HT_OPERATION, ies: ie, len: ielen);
1956	if (tmp &&
1957	tmp->datalen >= sizeof(struct ieee80211_ht_operation)) {
1958	struct ieee80211_ht_operation *htop = (void *)tmp->data;
1959
1960	return htop->primary_chan;
1961	}
1962	}
1963
1964	return -1;
1965	}
1966	EXPORT_SYMBOL(cfg80211_get_ies_channel_number);
1967
1968	/*
1969	* Update RX channel information based on the available frame payload
1970	* information. This is mainly for the 2.4 GHz band where frames can be received
1971	* from neighboring channels and the Beacon frames use the DSSS Parameter Set
1972	* element to indicate the current (transmitting) channel, but this might also
1973	* be needed on other bands if RX frequency does not match with the actual
1974	* operating channel of a BSS, or if the AP reports a different primary channel.
1975	*/
1976	static struct ieee80211_channel *
1977	cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1978	struct ieee80211_channel *channel)
1979	{
1980	u32 freq;
1981	int channel_number;
1982	struct ieee80211_channel *alt_channel;
1983
1984	channel_number = cfg80211_get_ies_channel_number(ie, ielen,
1985	channel->band);
1986
1987	if (channel_number < 0) {
1988	/* No channel information in frame payload */
1989	return channel;
1990	}
1991
1992	freq = ieee80211_channel_to_freq_khz(chan: channel_number, band: channel->band);
1993
1994	/*
1995	* Frame info (beacon/prob res) is the same as received channel,
1996	* no need for further processing.
1997	*/
1998	if (freq == ieee80211_channel_to_khz(chan: channel))
1999	return channel;
2000
2001	alt_channel = ieee80211_get_channel_khz(wiphy, freq);
2002	if (!alt_channel) {
2003	if (channel->band == NL80211_BAND_2GHZ ||
2004	channel->band == NL80211_BAND_6GHZ) {
2005	/*
2006	* Better not allow unexpected channels when that could
2007	* be going beyond the 1-11 range (e.g., discovering
2008	* BSS on channel 12 when radio is configured for
2009	* channel 11) or beyond the 6 GHz channel range.
2010	*/
2011	return NULL;
2012	}
2013
2014	/* No match for the payload channel number - ignore it */
2015	return channel;
2016	}
2017
2018	/*
2019	* Use the channel determined through the payload channel number
2020	* instead of the RX channel reported by the driver.
2021	*/
2022	if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
2023	return NULL;
2024	return alt_channel;
2025	}
2026
2027	struct cfg80211_inform_single_bss_data {
2028	struct cfg80211_inform_bss *drv_data;
2029	enum cfg80211_bss_frame_type ftype;
2030	struct ieee80211_channel *channel;
2031	u8 bssid[ETH_ALEN];
2032	u64 tsf;
2033	u16 capability;
2034	u16 beacon_interval;
2035	const u8 *ie;
2036	size_t ielen;
2037
2038	enum {
2039	BSS_SOURCE_DIRECT = 0,
2040	BSS_SOURCE_MBSSID,
2041	BSS_SOURCE_STA_PROFILE,
2042	} bss_source;
2043	/* Set if reporting bss_source != BSS_SOURCE_DIRECT */
2044	struct cfg80211_bss *source_bss;
2045	u8 max_bssid_indicator;
2046	u8 bssid_index;
2047	};
2048
2049	/* Returned bss is reference counted and must be cleaned up appropriately. */
2050	static struct cfg80211_bss *
2051	cfg80211_inform_single_bss_data(struct wiphy *wiphy,
2052	struct cfg80211_inform_single_bss_data *data,
2053	gfp_t gfp)
2054	{
2055	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2056	struct cfg80211_inform_bss *drv_data = data->drv_data;
2057	struct cfg80211_bss_ies *ies;
2058	struct ieee80211_channel *channel;
2059	struct cfg80211_internal_bss tmp = {}, *res;
2060	int bss_type;
2061	bool signal_valid;
2062	unsigned long ts;
2063
2064	if (WARN_ON(!wiphy))
2065	return NULL;
2066
2067	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2068	(drv_data->signal < 0 || drv_data->signal > 100)))
2069	return NULL;
2070
2071	if (WARN_ON(data->bss_source != BSS_SOURCE_DIRECT && !data->source_bss))
2072	return NULL;
2073
2074	channel = data->channel;
2075	if (!channel)
2076	channel = cfg80211_get_bss_channel(wiphy, ie: data->ie, ielen: data->ielen,
2077	channel: drv_data->chan);
2078	if (!channel)
2079	return NULL;
2080
2081	memcpy(tmp.pub.bssid, data->bssid, ETH_ALEN);
2082	tmp.pub.channel = channel;
2083	if (data->bss_source != BSS_SOURCE_STA_PROFILE)
2084	tmp.pub.signal = drv_data->signal;
2085	else
2086	tmp.pub.signal = 0;
2087	tmp.pub.beacon_interval = data->beacon_interval;
2088	tmp.pub.capability = data->capability;
2089	tmp.ts_boottime = drv_data->boottime_ns;
2090	tmp.parent_tsf = drv_data->parent_tsf;
2091	ether_addr_copy(dst: tmp.parent_bssid, src: drv_data->parent_bssid);
2092
2093	if (data->bss_source != BSS_SOURCE_DIRECT) {
2094	tmp.pub.transmitted_bss = data->source_bss;
2095	ts = bss_from_pub(pub: data->source_bss)->ts;
2096	tmp.pub.bssid_index = data->bssid_index;
2097	tmp.pub.max_bssid_indicator = data->max_bssid_indicator;
2098	} else {
2099	ts = jiffies;
2100
2101	if (channel->band == NL80211_BAND_60GHZ) {
2102	bss_type = data->capability &
2103	WLAN_CAPABILITY_DMG_TYPE_MASK;
2104	if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2105	bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2106	regulatory_hint_found_beacon(wiphy, beacon_chan: channel,
2107	gfp);
2108	} else {
2109	if (data->capability & WLAN_CAPABILITY_ESS)
2110	regulatory_hint_found_beacon(wiphy, beacon_chan: channel,
2111	gfp);
2112	}
2113	}
2114
2115	/*
2116	* If we do not know here whether the IEs are from a Beacon or Probe
2117	* Response frame, we need to pick one of the options and only use it
2118	* with the driver that does not provide the full Beacon/Probe Response
2119	* frame. Use Beacon frame pointer to avoid indicating that this should
2120	* override the IEs pointer should we have received an earlier
2121	* indication of Probe Response data.
2122	*/
2123	ies = kzalloc(size: sizeof(*ies) + data->ielen, flags: gfp);
2124	if (!ies)
2125	return NULL;
2126	ies->len = data->ielen;
2127	ies->tsf = data->tsf;
2128	ies->from_beacon = false;
2129	memcpy(ies->data, data->ie, data->ielen);
2130
2131	switch (data->ftype) {
2132	case CFG80211_BSS_FTYPE_BEACON:
2133	ies->from_beacon = true;
2134	fallthrough;
2135	case CFG80211_BSS_FTYPE_UNKNOWN:
2136	rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2137	break;
2138	case CFG80211_BSS_FTYPE_PRESP:
2139	rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2140	break;
2141	}
2142	rcu_assign_pointer(tmp.pub.ies, ies);
2143
2144	signal_valid = drv_data->chan == channel;
2145	spin_lock_bh(lock: &rdev->bss_lock);
2146	res = __cfg80211_bss_update(rdev, tmp: &tmp, signal_valid, ts);
2147	if (!res)
2148	goto drop;
2149
2150	rdev_inform_bss(rdev, bss: &res->pub, ies, drv_data: drv_data->drv_data);
2151
2152	if (data->bss_source == BSS_SOURCE_MBSSID) {
2153	/* this is a nontransmitting bss, we need to add it to
2154	* transmitting bss' list if it is not there
2155	*/
2156	if (cfg80211_add_nontrans_list(trans_bss: data->source_bss, nontrans_bss: &res->pub)) {
2157	if (__cfg80211_unlink_bss(rdev, bss: res)) {
2158	rdev->bss_generation++;
2159	res = NULL;
2160	}
2161	}
2162
2163	if (!res)
2164	goto drop;
2165	}
2166	spin_unlock_bh(lock: &rdev->bss_lock);
2167
2168	trace_cfg80211_return_bss(pub: &res->pub);
2169	/* __cfg80211_bss_update gives us a referenced result */
2170	return &res->pub;
2171
2172	drop:
2173	spin_unlock_bh(lock: &rdev->bss_lock);
2174	return NULL;
2175	}
2176
2177	static const struct element
2178	*cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
2179	const struct element *mbssid_elem,
2180	const struct element *sub_elem)
2181	{
2182	const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
2183	const struct element *next_mbssid;
2184	const struct element *next_sub;
2185
2186	next_mbssid = cfg80211_find_elem(eid: WLAN_EID_MULTIPLE_BSSID,
2187	ies: mbssid_end,
2188	len: ielen - (mbssid_end - ie));
2189
2190	/*
2191	* If it is not the last subelement in current MBSSID IE or there isn't
2192	* a next MBSSID IE - profile is complete.
2193	*/
2194	if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
2195	!next_mbssid)
2196	return NULL;
2197
2198	/* For any length error, just return NULL */
2199
2200	if (next_mbssid->datalen < 4)
2201	return NULL;
2202
2203	next_sub = (void *)&next_mbssid->data[1];
2204
2205	if (next_mbssid->data + next_mbssid->datalen <
2206	next_sub->data + next_sub->datalen)
2207	return NULL;
2208
2209	if (next_sub->id != 0 || next_sub->datalen < 2)
2210	return NULL;
2211
2212	/*
2213	* Check if the first element in the next sub element is a start
2214	* of a new profile
2215	*/
2216	return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
2217	NULL : next_mbssid;
2218	}
2219
2220	size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
2221	const struct element *mbssid_elem,
2222	const struct element *sub_elem,
2223	u8 *merged_ie, size_t max_copy_len)
2224	{
2225	size_t copied_len = sub_elem->datalen;
2226	const struct element *next_mbssid;
2227
2228	if (sub_elem->datalen > max_copy_len)
2229	return 0;
2230
2231	memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
2232
2233	while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
2234	mbssid_elem,
2235	sub_elem))) {
2236	const struct element *next_sub = (void *)&next_mbssid->data[1];
2237
2238	if (copied_len + next_sub->datalen > max_copy_len)
2239	break;
2240	memcpy(merged_ie + copied_len, next_sub->data,
2241	next_sub->datalen);
2242	copied_len += next_sub->datalen;
2243	}
2244
2245	return copied_len;
2246	}
2247	EXPORT_SYMBOL(cfg80211_merge_profile);
2248
2249	static void
2250	cfg80211_parse_mbssid_data(struct wiphy *wiphy,
2251	struct cfg80211_inform_single_bss_data *tx_data,
2252	struct cfg80211_bss *source_bss,
2253	gfp_t gfp)
2254	{
2255	struct cfg80211_inform_single_bss_data data = {
2256	.drv_data = tx_data->drv_data,
2257	.ftype = tx_data->ftype,
2258	.tsf = tx_data->tsf,
2259	.beacon_interval = tx_data->beacon_interval,
2260	.source_bss = source_bss,
2261	.bss_source = BSS_SOURCE_MBSSID,
2262	};
2263	const u8 *mbssid_index_ie;
2264	const struct element *elem, *sub;
2265	u8 *new_ie, *profile;
2266	u64 seen_indices = 0;
2267	struct cfg80211_bss *bss;
2268
2269	if (!source_bss)
2270	return;
2271	if (!cfg80211_find_elem(eid: WLAN_EID_MULTIPLE_BSSID,
2272	ies: tx_data->ie, len: tx_data->ielen))
2273	return;
2274	if (!wiphy->support_mbssid)
2275	return;
2276	if (wiphy->support_only_he_mbssid &&
2277	!cfg80211_find_ext_elem(ext_eid: WLAN_EID_EXT_HE_CAPABILITY,
2278	ies: tx_data->ie, len: tx_data->ielen))
2279	return;
2280
2281	new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, flags: gfp);
2282	if (!new_ie)
2283	return;
2284
2285	profile = kmalloc(size: tx_data->ielen, flags: gfp);
2286	if (!profile)
2287	goto out;
2288
2289	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
2290	tx_data->ie, tx_data->ielen) {
2291	if (elem->datalen < 4)
2292	continue;
2293	if (elem->data[0] < 1 || (int)elem->data[0] > 8)
2294	continue;
2295	for_each_element(sub, elem->data + 1, elem->datalen - 1) {
2296	u8 profile_len;
2297
2298	if (sub->id != 0 || sub->datalen < 4) {
2299	/* not a valid BSS profile */
2300	continue;
2301	}
2302
2303	if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
2304	sub->data[1] != 2) {
2305	/* The first element within the Nontransmitted
2306	* BSSID Profile is not the Nontransmitted
2307	* BSSID Capability element.
2308	*/
2309	continue;
2310	}
2311
2312	memset(profile, 0, tx_data->ielen);
2313	profile_len = cfg80211_merge_profile(tx_data->ie,
2314	tx_data->ielen,
2315	elem,
2316	sub,
2317	profile,
2318	tx_data->ielen);
2319
2320	/* found a Nontransmitted BSSID Profile */
2321	mbssid_index_ie = cfg80211_find_ie
2322	(eid: WLAN_EID_MULTI_BSSID_IDX,
2323	ies: profile, len: profile_len);
2324	if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
2325	mbssid_index_ie[2] == 0 ||
2326	mbssid_index_ie[2] > 46) {
2327	/* No valid Multiple BSSID-Index element */
2328	continue;
2329	}
2330
2331	if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
2332	/* We don't support legacy split of a profile */
2333	net_dbg_ratelimited("Partial info for BSSID index %d\n",
2334	mbssid_index_ie[2]);
2335
2336	seen_indices |= BIT_ULL(mbssid_index_ie[2]);
2337
2338	data.bssid_index = mbssid_index_ie[2];
2339	data.max_bssid_indicator = elem->data[0];
2340
2341	cfg80211_gen_new_bssid(bssid: tx_data->bssid,
2342	max_bssid: data.max_bssid_indicator,
2343	mbssid_index: data.bssid_index,
2344	new_bssid: data.bssid);
2345
2346	memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2347	data.ie = new_ie;
2348	data.ielen = cfg80211_gen_new_ie(ie: tx_data->ie,
2349	ielen: tx_data->ielen,
2350	subie: profile,
2351	subie_len: profile_len,
2352	new_ie,
2353	IEEE80211_MAX_DATA_LEN);
2354	if (!data.ielen)
2355	continue;
2356
2357	data.capability = get_unaligned_le16(p: profile + 2);
2358	bss = cfg80211_inform_single_bss_data(wiphy, data: &data, gfp);
2359	if (!bss)
2360	break;
2361	cfg80211_put_bss(wiphy, bss);
2362	}
2363	}
2364
2365	out:
2366	kfree(objp: new_ie);
2367	kfree(objp: profile);
2368	}
2369
2370	ssize_t cfg80211_defragment_element(const struct element *elem, const u8 *ies,
2371	size_t ieslen, u8 *data, size_t data_len,
2372	u8 frag_id)
2373	{
2374	const struct element *next;
2375	ssize_t copied;
2376	u8 elem_datalen;
2377
2378	if (!elem)
2379	return -EINVAL;
2380
2381	/* elem might be invalid after the memmove */
2382	next = (void *)(elem->data + elem->datalen);
2383	elem_datalen = elem->datalen;
2384
2385	if (elem->id == WLAN_EID_EXTENSION) {
2386	copied = elem->datalen - 1;
2387	if (copied > data_len)
2388	return -ENOSPC;
2389
2390	memmove(data, elem->data + 1, copied);
2391	} else {
2392	copied = elem->datalen;
2393	if (copied > data_len)
2394	return -ENOSPC;
2395
2396	memmove(data, elem->data, copied);
2397	}
2398
2399	/* Fragmented elements must have 255 bytes */
2400	if (elem_datalen < 255)
2401	return copied;
2402
2403	for (elem = next;
2404	elem->data < ies + ieslen &&
2405	elem->data + elem->datalen <= ies + ieslen;
2406	elem = next) {
2407	/* elem might be invalid after the memmove */
2408	next = (void *)(elem->data + elem->datalen);
2409
2410	if (elem->id != frag_id)
2411	break;
2412
2413	elem_datalen = elem->datalen;
2414
2415	if (copied + elem_datalen > data_len)
2416	return -ENOSPC;
2417
2418	memmove(data + copied, elem->data, elem_datalen);
2419	copied += elem_datalen;
2420
2421	/* Only the last fragment may be short */
2422	if (elem_datalen != 255)
2423	break;
2424	}
2425
2426	return copied;
2427	}
2428	EXPORT_SYMBOL(cfg80211_defragment_element);
2429
2430	struct cfg80211_mle {
2431	struct ieee80211_multi_link_elem *mle;
2432	struct ieee80211_mle_per_sta_profile
2433	*sta_prof[IEEE80211_MLD_MAX_NUM_LINKS];
2434	ssize_t sta_prof_len[IEEE80211_MLD_MAX_NUM_LINKS];
2435
2436	u8 data[];
2437	};
2438
2439	static struct cfg80211_mle *
2440	cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen,
2441	gfp_t gfp)
2442	{
2443	const struct element *elem;
2444	struct cfg80211_mle *res;
2445	size_t buf_len;
2446	ssize_t mle_len;
2447	u8 common_size, idx;
2448
2449	if (!mle || !ieee80211_mle_size_ok(data: mle->data + 1, len: mle->datalen - 1))
2450	return NULL;
2451
2452	/* Required length for first defragmentation */
2453	buf_len = mle->datalen - 1;
2454	for_each_element(elem, mle->data + mle->datalen,
2455	ielen - sizeof(*mle) + mle->datalen) {
2456	if (elem->id != WLAN_EID_FRAGMENT)
2457	break;
2458
2459	buf_len += elem->datalen;
2460	}
2461
2462	res = kzalloc(struct_size(res, data, buf_len), flags: gfp);
2463	if (!res)
2464	return NULL;
2465
2466	mle_len = cfg80211_defragment_element(mle, ie, ielen,
2467	res->data, buf_len,
2468	WLAN_EID_FRAGMENT);
2469	if (mle_len < 0)
2470	goto error;
2471
2472	res->mle = (void *)res->data;
2473
2474	/* Find the sub-element area in the buffer */
2475	common_size = ieee80211_mle_common_size(data: (u8 *)res->mle);
2476	ie = res->data + common_size;
2477	ielen = mle_len - common_size;
2478
2479	idx = 0;
2480	for_each_element_id(elem, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE,
2481	ie, ielen) {
2482	res->sta_prof[idx] = (void *)elem->data;
2483	res->sta_prof_len[idx] = elem->datalen;
2484
2485	idx++;
2486	if (idx >= IEEE80211_MLD_MAX_NUM_LINKS)
2487	break;
2488	}
2489	if (!for_each_element_completed(element: elem, data: ie, datalen: ielen))
2490	goto error;
2491
2492	/* Defragment sta_info in-place */
2493	for (idx = 0; idx < IEEE80211_MLD_MAX_NUM_LINKS && res->sta_prof[idx];
2494	idx++) {
2495	if (res->sta_prof_len[idx] < 255)
2496	continue;
2497
2498	elem = (void *)res->sta_prof[idx] - 2;
2499
2500	if (idx + 1 < ARRAY_SIZE(res->sta_prof) &&
2501	res->sta_prof[idx + 1])
2502	buf_len = (u8 *)res->sta_prof[idx + 1] -
2503	(u8 *)res->sta_prof[idx];
2504	else
2505	buf_len = ielen + ie - (u8 *)elem;
2506
2507	res->sta_prof_len[idx] =
2508	cfg80211_defragment_element(elem,
2509	(u8 *)elem, buf_len,
2510	(u8 *)res->sta_prof[idx],
2511	buf_len,
2512	IEEE80211_MLE_SUBELEM_FRAGMENT);
2513	if (res->sta_prof_len[idx] < 0)
2514	goto error;
2515	}
2516
2517	return res;
2518
2519	error:
2520	kfree(objp: res);
2521	return NULL;
2522	}
2523
2524	static bool
2525	cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
2526	const struct ieee80211_neighbor_ap_info **ap_info,
2527	const u8 **tbtt_info)
2528	{
2529	const struct ieee80211_neighbor_ap_info *info;
2530	const struct element *rnr;
2531	const u8 *pos, *end;
2532
2533	for_each_element_id(rnr, WLAN_EID_REDUCED_NEIGHBOR_REPORT, ie, ielen) {
2534	pos = rnr->data;
2535	end = rnr->data + rnr->datalen;
2536
2537	/* RNR IE may contain more than one NEIGHBOR_AP_INFO */
2538	while (sizeof(*info) <= end - pos) {
2539	const struct ieee80211_rnr_mld_params *mld_params;
2540	u16 params;
2541	u8 length, i, count, mld_params_offset;
2542	u8 type, lid;
2543
2544	info = (void *)pos;
2545	count = u8_get_bits(v: info->tbtt_info_hdr,
2546	IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
2547	length = info->tbtt_info_len;
2548
2549	pos += sizeof(*info);
2550
2551	if (count * length > end - pos)
2552	return false;
2553
2554	type = u8_get_bits(v: info->tbtt_info_hdr,
2555	IEEE80211_AP_INFO_TBTT_HDR_TYPE);
2556
2557	/* Only accept full TBTT information. NSTR mobile APs
2558	* use the shortened version, but we ignore them here.
2559	*/
2560	if (type == IEEE80211_TBTT_INFO_TYPE_TBTT &&
2561	length >=
2562	offsetofend(struct ieee80211_tbtt_info_ge_11,
2563	mld_params)) {
2564	mld_params_offset =
2565	offsetof(struct ieee80211_tbtt_info_ge_11, mld_params);
2566	} else {
2567	pos += count * length;
2568	continue;
2569	}
2570
2571	for (i = 0; i < count; i++) {
2572	mld_params = (void *)pos + mld_params_offset;
2573	params = le16_to_cpu(mld_params->params);
2574
2575	lid = u16_get_bits(v: params,
2576	IEEE80211_RNR_MLD_PARAMS_LINK_ID);
2577
2578	if (mld_id == mld_params->mld_id &&
2579	link_id == lid) {
2580	*ap_info = info;
2581	*tbtt_info = pos;
2582
2583	return true;
2584	}
2585
2586	pos += length;
2587	}
2588	}
2589	}
2590
2591	return false;
2592	}
2593
2594	static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
2595	struct cfg80211_inform_single_bss_data *tx_data,
2596	struct cfg80211_bss *source_bss,
2597	gfp_t gfp)
2598	{
2599	struct cfg80211_inform_single_bss_data data = {
2600	.drv_data = tx_data->drv_data,
2601	.ftype = tx_data->ftype,
2602	.source_bss = source_bss,
2603	.bss_source = BSS_SOURCE_STA_PROFILE,
2604	};
2605	struct ieee80211_multi_link_elem *ml_elem;
2606	const struct element *elem;
2607	struct cfg80211_mle *mle;
2608	u16 control;
2609	u8 *new_ie;
2610	struct cfg80211_bss *bss;
2611	int mld_id;
2612	u16 seen_links = 0;
2613	const u8 *pos;
2614	u8 i;
2615
2616	if (!source_bss)
2617	return;
2618
2619	if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP)
2620	return;
2621
2622	elem = cfg80211_find_ext_elem(ext_eid: WLAN_EID_EXT_EHT_MULTI_LINK,
2623	ies: tx_data->ie, len: tx_data->ielen);
2624	if (!elem || !ieee80211_mle_size_ok(data: elem->data + 1, len: elem->datalen - 1))
2625	return;
2626
2627	ml_elem = (void *)elem->data + 1;
2628	control = le16_to_cpu(ml_elem->control);
2629	if (u16_get_bits(v: control, IEEE80211_ML_CONTROL_TYPE) !=
2630	IEEE80211_ML_CONTROL_TYPE_BASIC)
2631	return;
2632
2633	/* Must be present when transmitted by an AP (in a probe response) */
2634	if (!(control & IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT) ||
2635	!(control & IEEE80211_MLC_BASIC_PRES_LINK_ID) ||
2636	!(control & IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP))
2637	return;
2638
2639	/* length + MLD MAC address + link ID info + BSS Params Change Count */
2640	pos = ml_elem->variable + 1 + 6 + 1 + 1;
2641
2642	if (u16_get_bits(v: control, IEEE80211_MLC_BASIC_PRES_MED_SYNC_DELAY))
2643	pos += 2;
2644	if (u16_get_bits(v: control, IEEE80211_MLC_BASIC_PRES_EML_CAPA))
2645	pos += 2;
2646
2647	/* MLD capabilities and operations */
2648	pos += 2;
2649
2650	/* Not included when the (nontransmitted) AP is responding itself,
2651	* but defined to zero then (Draft P802.11be_D3.0, 9.4.2.170.2)
2652	*/
2653	if (u16_get_bits(v: control, IEEE80211_MLC_BASIC_PRES_MLD_ID)) {
2654	mld_id = *pos;
2655	pos += 1;
2656	} else {
2657	mld_id = 0;
2658	}
2659
2660	/* Extended MLD capabilities and operations */
2661	pos += 2;
2662
2663	/* Fully defrag the ML element for sta information/profile iteration */
2664	mle = cfg80211_defrag_mle(mle: elem, ie: tx_data->ie, ielen: tx_data->ielen, gfp);
2665	if (!mle)
2666	return;
2667
2668	new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, flags: gfp);
2669	if (!new_ie)
2670	goto out;
2671
2672	for (i = 0; i < ARRAY_SIZE(mle->sta_prof) && mle->sta_prof[i]; i++) {
2673	const struct ieee80211_neighbor_ap_info *ap_info;
2674	enum nl80211_band band;
2675	u32 freq;
2676	const u8 *profile;
2677	const u8 *tbtt_info;
2678	ssize_t profile_len;
2679	u8 link_id;
2680
2681	if (!ieee80211_mle_basic_sta_prof_size_ok(data: (u8 *)mle->sta_prof[i],
2682	len: mle->sta_prof_len[i]))
2683	continue;
2684
2685	control = le16_to_cpu(mle->sta_prof[i]->control);
2686
2687	if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
2688	continue;
2689
2690	link_id = u16_get_bits(v: control,
2691	IEEE80211_MLE_STA_CONTROL_LINK_ID);
2692	if (seen_links & BIT(link_id))
2693	break;
2694	seen_links |= BIT(link_id);
2695
2696	if (!(control & IEEE80211_MLE_STA_CONTROL_BEACON_INT_PRESENT) ||
2697	!(control & IEEE80211_MLE_STA_CONTROL_TSF_OFFS_PRESENT) ||
2698	!(control & IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT))
2699	continue;
2700
2701	memcpy(data.bssid, mle->sta_prof[i]->variable, ETH_ALEN);
2702	data.beacon_interval =
2703	get_unaligned_le16(p: mle->sta_prof[i]->variable + 6);
2704	data.tsf = tx_data->tsf +
2705	get_unaligned_le64(p: mle->sta_prof[i]->variable + 8);
2706
2707	/* sta_info_len counts itself */
2708	profile = mle->sta_prof[i]->variable +
2709	mle->sta_prof[i]->sta_info_len - 1;
2710	profile_len = (u8 *)mle->sta_prof[i] + mle->sta_prof_len[i] -
2711	profile;
2712
2713	if (profile_len < 2)
2714	continue;
2715
2716	data.capability = get_unaligned_le16(p: profile);
2717	profile += 2;
2718	profile_len -= 2;
2719
2720	/* Find in RNR to look up channel information */
2721	if (!cfg80211_tbtt_info_for_mld_ap(ie: tx_data->ie, ielen: tx_data->ielen,
2722	mld_id, link_id,
2723	ap_info: &ap_info, tbtt_info: &tbtt_info))
2724	continue;
2725
2726	/* We could sanity check the BSSID is included */
2727
2728	if (!ieee80211_operating_class_to_band(operating_class: ap_info->op_class,
2729	band: &band))
2730	continue;
2731
2732	freq = ieee80211_channel_to_freq_khz(chan: ap_info->channel, band);
2733	data.channel = ieee80211_get_channel_khz(wiphy, freq);
2734
2735	/* Generate new elements */
2736	memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2737	data.ie = new_ie;
2738	data.ielen = cfg80211_gen_new_ie(ie: tx_data->ie, ielen: tx_data->ielen,
2739	subie: profile, subie_len: profile_len,
2740	new_ie,
2741	IEEE80211_MAX_DATA_LEN);
2742	if (!data.ielen)
2743	continue;
2744
2745	bss = cfg80211_inform_single_bss_data(wiphy, data: &data, gfp);
2746	if (!bss)
2747	break;
2748	cfg80211_put_bss(wiphy, bss);
2749	}
2750
2751	out:
2752	kfree(objp: new_ie);
2753	kfree(objp: mle);
2754	}
2755
2756	struct cfg80211_bss *
2757	cfg80211_inform_bss_data(struct wiphy *wiphy,
2758	struct cfg80211_inform_bss *data,
2759	enum cfg80211_bss_frame_type ftype,
2760	const u8 *bssid, u64 tsf, u16 capability,
2761	u16 beacon_interval, const u8 *ie, size_t ielen,
2762	gfp_t gfp)
2763	{
2764	struct cfg80211_inform_single_bss_data inform_data = {
2765	.drv_data = data,
2766	.ftype = ftype,
2767	.tsf = tsf,
2768	.capability = capability,
2769	.beacon_interval = beacon_interval,
2770	.ie = ie,
2771	.ielen = ielen,
2772	};
2773	struct cfg80211_bss *res;
2774
2775	memcpy(inform_data.bssid, bssid, ETH_ALEN);
2776
2777	res = cfg80211_inform_single_bss_data(wiphy, data: &inform_data, gfp);
2778	if (!res)
2779	return NULL;
2780
2781	cfg80211_parse_mbssid_data(wiphy, tx_data: &inform_data, source_bss: res, gfp);
2782
2783	cfg80211_parse_ml_sta_data(wiphy, tx_data: &inform_data, source_bss: res, gfp);
2784
2785	return res;
2786	}
2787	EXPORT_SYMBOL(cfg80211_inform_bss_data);
2788
2789	/* cfg80211_inform_bss_width_frame helper */
2790	static struct cfg80211_bss *
2791	cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
2792	struct cfg80211_inform_bss *data,
2793	struct ieee80211_mgmt *mgmt, size_t len,
2794	gfp_t gfp)
2795	{
2796	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2797	struct cfg80211_internal_bss tmp = {}, *res;
2798	struct cfg80211_bss_ies *ies;
2799	struct ieee80211_channel *channel;
2800	bool signal_valid;
2801	struct ieee80211_ext *ext = NULL;
2802	u8 *bssid, *variable;
2803	u16 capability, beacon_int;
2804	size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
2805	u.probe_resp.variable);
2806	int bss_type;
2807
2808	BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
2809	offsetof(struct ieee80211_mgmt, u.beacon.variable));
2810
2811	trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
2812
2813	if (WARN_ON(!mgmt))
2814	return NULL;
2815
2816	if (WARN_ON(!wiphy))
2817	return NULL;
2818
2819	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2820	(data->signal < 0 || data->signal > 100)))
2821	return NULL;
2822
2823	if (ieee80211_is_s1g_beacon(fc: mgmt->frame_control)) {
2824	ext = (void *) mgmt;
2825	min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
2826	if (ieee80211_is_s1g_short_beacon(fc: mgmt->frame_control))
2827	min_hdr_len = offsetof(struct ieee80211_ext,
2828	u.s1g_short_beacon.variable);
2829	}
2830
2831	if (WARN_ON(len < min_hdr_len))
2832	return NULL;
2833
2834	ielen = len - min_hdr_len;
2835	variable = mgmt->u.probe_resp.variable;
2836	if (ext) {
2837	if (ieee80211_is_s1g_short_beacon(fc: mgmt->frame_control))
2838	variable = ext->u.s1g_short_beacon.variable;
2839	else
2840	variable = ext->u.s1g_beacon.variable;
2841	}
2842
2843	channel = cfg80211_get_bss_channel(wiphy, ie: variable, ielen, channel: data->chan);
2844	if (!channel)
2845	return NULL;
2846
2847	if (ext) {
2848	const struct ieee80211_s1g_bcn_compat_ie *compat;
2849	const struct element *elem;
2850
2851	elem = cfg80211_find_elem(eid: WLAN_EID_S1G_BCN_COMPAT,
2852	ies: variable, len: ielen);
2853	if (!elem)
2854	return NULL;
2855	if (elem->datalen < sizeof(*compat))
2856	return NULL;
2857	compat = (void *)elem->data;
2858	bssid = ext->u.s1g_beacon.sa;
2859	capability = le16_to_cpu(compat->compat_info);
2860	beacon_int = le16_to_cpu(compat->beacon_int);
2861	} else {
2862	bssid = mgmt->bssid;
2863	beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2864	capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
2865	}
2866
2867	if (channel->band == NL80211_BAND_60GHZ) {
2868	bss_type = capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
2869	if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2870	bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2871	regulatory_hint_found_beacon(wiphy, beacon_chan: channel, gfp);
2872	} else {
2873	if (capability & WLAN_CAPABILITY_ESS)
2874	regulatory_hint_found_beacon(wiphy, beacon_chan: channel, gfp);
2875	}
2876
2877	ies = kzalloc(size: sizeof(*ies) + ielen, flags: gfp);
2878	if (!ies)
2879	return NULL;
2880	ies->len = ielen;
2881	ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2882	ies->from_beacon = ieee80211_is_beacon(fc: mgmt->frame_control) ||
2883	ieee80211_is_s1g_beacon(fc: mgmt->frame_control);
2884	memcpy(ies->data, variable, ielen);
2885
2886	if (ieee80211_is_probe_resp(fc: mgmt->frame_control))
2887	rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2888	else
2889	rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2890	rcu_assign_pointer(tmp.pub.ies, ies);
2891
2892	memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
2893	tmp.pub.beacon_interval = beacon_int;
2894	tmp.pub.capability = capability;
2895	tmp.pub.channel = channel;
2896	tmp.pub.signal = data->signal;
2897	tmp.ts_boottime = data->boottime_ns;
2898	tmp.parent_tsf = data->parent_tsf;
2899	tmp.pub.chains = data->chains;
2900	memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS);
2901	ether_addr_copy(dst: tmp.parent_bssid, src: data->parent_bssid);
2902
2903	signal_valid = data->chan == channel;
2904	spin_lock_bh(lock: &rdev->bss_lock);
2905	res = __cfg80211_bss_update(rdev, tmp: &tmp, signal_valid, ts: jiffies);
2906	if (!res)
2907	goto drop;
2908
2909	rdev_inform_bss(rdev, bss: &res->pub, ies, drv_data: data->drv_data);
2910
2911	spin_unlock_bh(lock: &rdev->bss_lock);
2912
2913	trace_cfg80211_return_bss(pub: &res->pub);
2914	/* __cfg80211_bss_update gives us a referenced result */
2915	return &res->pub;
2916
2917	drop:
2918	spin_unlock_bh(lock: &rdev->bss_lock);
2919	return NULL;
2920	}
2921
2922	struct cfg80211_bss *
2923	cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
2924	struct cfg80211_inform_bss *data,
2925	struct ieee80211_mgmt *mgmt, size_t len,
2926	gfp_t gfp)
2927	{
2928	struct cfg80211_inform_single_bss_data inform_data = {
2929	.drv_data = data,
2930	.ie = mgmt->u.probe_resp.variable,
2931	.ielen = len - offsetof(struct ieee80211_mgmt,
2932	u.probe_resp.variable),
2933	};
2934	struct cfg80211_bss *res;
2935
2936	res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
2937	len, gfp);
2938	if (!res)
2939	return NULL;
2940
2941	/* don't do any further MBSSID/ML handling for S1G */
2942	if (ieee80211_is_s1g_beacon(fc: mgmt->frame_control))
2943	return res;
2944
2945	inform_data.ftype = ieee80211_is_beacon(fc: mgmt->frame_control) ?
2946	CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
2947	memcpy(inform_data.bssid, mgmt->bssid, ETH_ALEN);
2948	inform_data.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2949	inform_data.beacon_interval =
2950	le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2951
2952	/* process each non-transmitting bss */
2953	cfg80211_parse_mbssid_data(wiphy, tx_data: &inform_data, source_bss: res, gfp);
2954
2955	cfg80211_parse_ml_sta_data(wiphy, tx_data: &inform_data, source_bss: res, gfp);
2956
2957	return res;
2958	}
2959	EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
2960
2961	void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2962	{
2963	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2964
2965	if (!pub)
2966	return;
2967
2968	spin_lock_bh(lock: &rdev->bss_lock);
2969	bss_ref_get(rdev, bss: bss_from_pub(pub));
2970	spin_unlock_bh(lock: &rdev->bss_lock);
2971	}
2972	EXPORT_SYMBOL(cfg80211_ref_bss);
2973
2974	void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2975	{
2976	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2977
2978	if (!pub)
2979	return;
2980
2981	spin_lock_bh(lock: &rdev->bss_lock);
2982	bss_ref_put(rdev, bss: bss_from_pub(pub));
2983	spin_unlock_bh(lock: &rdev->bss_lock);
2984	}
2985	EXPORT_SYMBOL(cfg80211_put_bss);
2986
2987	void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2988	{
2989	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2990	struct cfg80211_internal_bss *bss, *tmp1;
2991	struct cfg80211_bss *nontrans_bss, *tmp;
2992
2993	if (WARN_ON(!pub))
2994	return;
2995
2996	bss = bss_from_pub(pub);
2997
2998	spin_lock_bh(lock: &rdev->bss_lock);
2999	if (list_empty(head: &bss->list))
3000	goto out;
3001
3002	list_for_each_entry_safe(nontrans_bss, tmp,
3003	&pub->nontrans_list,
3004	nontrans_list) {
3005	tmp1 = bss_from_pub(pub: nontrans_bss);
3006	if (__cfg80211_unlink_bss(rdev, bss: tmp1))
3007	rdev->bss_generation++;
3008	}
3009
3010	if (__cfg80211_unlink_bss(rdev, bss))
3011	rdev->bss_generation++;
3012	out:
3013	spin_unlock_bh(lock: &rdev->bss_lock);
3014	}
3015	EXPORT_SYMBOL(cfg80211_unlink_bss);
3016
3017	void cfg80211_bss_iter(struct wiphy *wiphy,
3018	struct cfg80211_chan_def *chandef,
3019	void (*iter)(struct wiphy *wiphy,
3020	struct cfg80211_bss *bss,
3021	void *data),
3022	void *iter_data)
3023	{
3024	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3025	struct cfg80211_internal_bss *bss;
3026
3027	spin_lock_bh(lock: &rdev->bss_lock);
3028
3029	list_for_each_entry(bss, &rdev->bss_list, list) {
3030	if (!chandef || cfg80211_is_sub_chan(chandef, chan: bss->pub.channel,
3031	primary_only: false))
3032	iter(wiphy, &bss->pub, iter_data);
3033	}
3034
3035	spin_unlock_bh(lock: &rdev->bss_lock);
3036	}
3037	EXPORT_SYMBOL(cfg80211_bss_iter);
3038
3039	void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
3040	unsigned int link_id,
3041	struct ieee80211_channel *chan)
3042	{
3043	struct wiphy *wiphy = wdev->wiphy;
3044	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3045	struct cfg80211_internal_bss *cbss = wdev->links[link_id].client.current_bss;
3046	struct cfg80211_internal_bss *new = NULL;
3047	struct cfg80211_internal_bss *bss;
3048	struct cfg80211_bss *nontrans_bss;
3049	struct cfg80211_bss *tmp;
3050
3051	spin_lock_bh(lock: &rdev->bss_lock);
3052
3053	/*
3054	* Some APs use CSA also for bandwidth changes, i.e., without actually
3055	* changing the control channel, so no need to update in such a case.
3056	*/
3057	if (cbss->pub.channel == chan)
3058	goto done;
3059
3060	/* use transmitting bss */
3061	if (cbss->pub.transmitted_bss)
3062	cbss = bss_from_pub(pub: cbss->pub.transmitted_bss);
3063
3064	cbss->pub.channel = chan;
3065
3066	list_for_each_entry(bss, &rdev->bss_list, list) {
3067	if (!cfg80211_bss_type_match(capability: bss->pub.capability,
3068	band: bss->pub.channel->band,
3069	bss_type: wdev->conn_bss_type))
3070	continue;
3071
3072	if (bss == cbss)
3073	continue;
3074
3075	if (!cmp_bss(a: &bss->pub, b: &cbss->pub, mode: BSS_CMP_REGULAR)) {
3076	new = bss;
3077	break;
3078	}
3079	}
3080
3081	if (new) {
3082	/* to save time, update IEs for transmitting bss only */
3083	if (cfg80211_update_known_bss(rdev, known: cbss, new, signal_valid: false)) {
3084	new->pub.proberesp_ies = NULL;
3085	new->pub.beacon_ies = NULL;
3086	}
3087
3088	list_for_each_entry_safe(nontrans_bss, tmp,
3089	&new->pub.nontrans_list,
3090	nontrans_list) {
3091	bss = bss_from_pub(pub: nontrans_bss);
3092	if (__cfg80211_unlink_bss(rdev, bss))
3093	rdev->bss_generation++;
3094	}
3095
3096	WARN_ON(atomic_read(&new->hold));
3097	if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
3098	rdev->bss_generation++;
3099	}
3100
3101	rb_erase(&cbss->rbn, &rdev->bss_tree);
3102	rb_insert_bss(rdev, bss: cbss);
3103	rdev->bss_generation++;
3104
3105	list_for_each_entry_safe(nontrans_bss, tmp,
3106	&cbss->pub.nontrans_list,
3107	nontrans_list) {
3108	bss = bss_from_pub(pub: nontrans_bss);
3109	bss->pub.channel = chan;
3110	rb_erase(&bss->rbn, &rdev->bss_tree);
3111	rb_insert_bss(rdev, bss);
3112	rdev->bss_generation++;
3113	}
3114
3115	done:
3116	spin_unlock_bh(lock: &rdev->bss_lock);
3117	}
3118
3119	#ifdef CONFIG_CFG80211_WEXT
3120	static struct cfg80211_registered_device *
3121	cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
3122	{
3123	struct cfg80211_registered_device *rdev;
3124	struct net_device *dev;
3125
3126	ASSERT_RTNL();
3127
3128	dev = dev_get_by_index(net, ifindex);
3129	if (!dev)
3130	return ERR_PTR(error: -ENODEV);
3131	if (dev->ieee80211_ptr)
3132	rdev = wiphy_to_rdev(wiphy: dev->ieee80211_ptr->wiphy);
3133	else
3134	rdev = ERR_PTR(error: -ENODEV);
3135	dev_put(dev);
3136	return rdev;
3137	}
3138
3139	int cfg80211_wext_siwscan(struct net_device *dev,
3140	struct iw_request_info *info,
3141	union iwreq_data *wrqu, char *extra)
3142	{
3143	struct cfg80211_registered_device *rdev;
3144	struct wiphy *wiphy;
3145	struct iw_scan_req *wreq = NULL;
3146	struct cfg80211_scan_request *creq;
3147	int i, err, n_channels = 0;
3148	enum nl80211_band band;
3149
3150	if (!netif_running(dev))
3151	return -ENETDOWN;
3152
3153	if (wrqu->data.length == sizeof(struct iw_scan_req))
3154	wreq = (struct iw_scan_req *)extra;
3155
3156	rdev = cfg80211_get_dev_from_ifindex(net: dev_net(dev), ifindex: dev->ifindex);
3157
3158	if (IS_ERR(ptr: rdev))
3159	return PTR_ERR(ptr: rdev);
3160
3161	if (rdev->scan_req || rdev->scan_msg)
3162	return -EBUSY;
3163
3164	wiphy = &rdev->wiphy;
3165
3166	/* Determine number of channels, needed to allocate creq */
3167	if (wreq && wreq->num_channels)
3168	n_channels = wreq->num_channels;
3169	else
3170	n_channels = ieee80211_get_num_supported_channels(wiphy);
3171
3172	creq = kzalloc(size: sizeof(*creq) + sizeof(struct cfg80211_ssid) +
3173	n_channels * sizeof(void *),
3174	GFP_ATOMIC);
3175	if (!creq)
3176	return -ENOMEM;
3177
3178	creq->wiphy = wiphy;
3179	creq->wdev = dev->ieee80211_ptr;
3180	/* SSIDs come after channels */
3181	creq->ssids = (void *)&creq->channels[n_channels];
3182	creq->n_channels = n_channels;
3183	creq->n_ssids = 1;
3184	creq->scan_start = jiffies;
3185
3186	/* translate "Scan on frequencies" request */
3187	i = 0;
3188	for (band = 0; band < NUM_NL80211_BANDS; band++) {
3189	int j;
3190
3191	if (!wiphy->bands[band])
3192	continue;
3193
3194	for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3195	/* ignore disabled channels */
3196	if (wiphy->bands[band]->channels[j].flags &
3197	IEEE80211_CHAN_DISABLED)
3198	continue;
3199
3200	/* If we have a wireless request structure and the
3201	* wireless request specifies frequencies, then search
3202	* for the matching hardware channel.
3203	*/
3204	if (wreq && wreq->num_channels) {
3205	int k;
3206	int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
3207	for (k = 0; k < wreq->num_channels; k++) {
3208	struct iw_freq *freq =
3209	&wreq->channel_list[k];
3210	int wext_freq =
3211	cfg80211_wext_freq(freq);
3212
3213	if (wext_freq == wiphy_freq)
3214	goto wext_freq_found;
3215	}
3216	goto wext_freq_not_found;
3217	}
3218
3219	wext_freq_found:
3220	creq->channels[i] = &wiphy->bands[band]->channels[j];
3221	i++;
3222	wext_freq_not_found: ;
3223	}
3224	}
3225	/* No channels found? */
3226	if (!i) {
3227	err = -EINVAL;
3228	goto out;
3229	}
3230
3231	/* Set real number of channels specified in creq->channels[] */
3232	creq->n_channels = i;
3233
3234	/* translate "Scan for SSID" request */
3235	if (wreq) {
3236	if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
3237	if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
3238	err = -EINVAL;
3239	goto out;
3240	}
3241	memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
3242	creq->ssids[0].ssid_len = wreq->essid_len;
3243	}
3244	if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
3245	creq->n_ssids = 0;
3246	}
3247
3248	for (i = 0; i < NUM_NL80211_BANDS; i++)
3249	if (wiphy->bands[i])
3250	creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
3251
3252	eth_broadcast_addr(addr: creq->bssid);
3253
3254	wiphy_lock(wiphy: &rdev->wiphy);
3255
3256	rdev->scan_req = creq;
3257	err = rdev_scan(rdev, request: creq);
3258	if (err) {
3259	rdev->scan_req = NULL;
3260	/* creq will be freed below */
3261	} else {
3262	nl80211_send_scan_start(rdev, wdev: dev->ieee80211_ptr);
3263	/* creq now owned by driver */
3264	creq = NULL;
3265	dev_hold(dev);
3266	}
3267	wiphy_unlock(wiphy: &rdev->wiphy);
3268	out:
3269	kfree(objp: creq);
3270	return err;
3271	}
3272	EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
3273
3274	static char *ieee80211_scan_add_ies(struct iw_request_info *info,
3275	const struct cfg80211_bss_ies *ies,
3276	char *current_ev, char *end_buf)
3277	{
3278	const u8 *pos, *end, *next;
3279	struct iw_event iwe;
3280
3281	if (!ies)
3282	return current_ev;
3283
3284	/*
3285	* If needed, fragment the IEs buffer (at IE boundaries) into short
3286	* enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
3287	*/
3288	pos = ies->data;
3289	end = pos + ies->len;
3290
3291	while (end - pos > IW_GENERIC_IE_MAX) {
3292	next = pos + 2 + pos[1];
3293	while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
3294	next = next + 2 + next[1];
3295
3296	memset(&iwe, 0, sizeof(iwe));
3297	iwe.cmd = IWEVGENIE;
3298	iwe.u.data.length = next - pos;
3299	current_ev = iwe_stream_add_point_check(info, stream: current_ev,
3300	ends: end_buf, iwe: &iwe,
3301	extra: (void *)pos);
3302	if (IS_ERR(ptr: current_ev))
3303	return current_ev;
3304	pos = next;
3305	}
3306
3307	if (end > pos) {
3308	memset(&iwe, 0, sizeof(iwe));
3309	iwe.cmd = IWEVGENIE;
3310	iwe.u.data.length = end - pos;
3311	current_ev = iwe_stream_add_point_check(info, stream: current_ev,
3312	ends: end_buf, iwe: &iwe,
3313	extra: (void *)pos);
3314	if (IS_ERR(ptr: current_ev))
3315	return current_ev;
3316	}
3317
3318	return current_ev;
3319	}
3320
3321	static char *
3322	ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
3323	struct cfg80211_internal_bss *bss, char *current_ev,
3324	char *end_buf)
3325	{
3326	const struct cfg80211_bss_ies *ies;
3327	struct iw_event iwe;
3328	const u8 *ie;
3329	u8 buf[50];
3330	u8 *cfg, *p, *tmp;
3331	int rem, i, sig;
3332	bool ismesh = false;
3333
3334	memset(&iwe, 0, sizeof(iwe));
3335	iwe.cmd = SIOCGIWAP;
3336	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
3337	memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
3338	current_ev = iwe_stream_add_event_check(info, stream: current_ev, ends: end_buf, iwe: &iwe,
3339	IW_EV_ADDR_LEN);
3340	if (IS_ERR(ptr: current_ev))
3341	return current_ev;
3342
3343	memset(&iwe, 0, sizeof(iwe));
3344	iwe.cmd = SIOCGIWFREQ;
3345	iwe.u.freq.m = ieee80211_frequency_to_channel(freq: bss->pub.channel->center_freq);
3346	iwe.u.freq.e = 0;
3347	current_ev = iwe_stream_add_event_check(info, stream: current_ev, ends: end_buf, iwe: &iwe,
3348	IW_EV_FREQ_LEN);
3349	if (IS_ERR(ptr: current_ev))
3350	return current_ev;
3351
3352	memset(&iwe, 0, sizeof(iwe));
3353	iwe.cmd = SIOCGIWFREQ;
3354	iwe.u.freq.m = bss->pub.channel->center_freq;
3355	iwe.u.freq.e = 6;
3356	current_ev = iwe_stream_add_event_check(info, stream: current_ev, ends: end_buf, iwe: &iwe,
3357	IW_EV_FREQ_LEN);
3358	if (IS_ERR(ptr: current_ev))
3359	return current_ev;
3360
3361	if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
3362	memset(&iwe, 0, sizeof(iwe));
3363	iwe.cmd = IWEVQUAL;
3364	iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
3365	IW_QUAL_NOISE_INVALID |
3366	IW_QUAL_QUAL_UPDATED;
3367	switch (wiphy->signal_type) {
3368	case CFG80211_SIGNAL_TYPE_MBM:
3369	sig = bss->pub.signal / 100;
3370	iwe.u.qual.level = sig;
3371	iwe.u.qual.updated |= IW_QUAL_DBM;
3372	if (sig < -110) /* rather bad */
3373	sig = -110;
3374	else if (sig > -40) /* perfect */
3375	sig = -40;
3376	/* will give a range of 0 .. 70 */
3377	iwe.u.qual.qual = sig + 110;
3378	break;
3379	case CFG80211_SIGNAL_TYPE_UNSPEC:
3380	iwe.u.qual.level = bss->pub.signal;
3381	/* will give range 0 .. 100 */
3382	iwe.u.qual.qual = bss->pub.signal;
3383	break;
3384	default:
3385	/* not reached */
3386	break;
3387	}
3388	current_ev = iwe_stream_add_event_check(info, stream: current_ev,
3389	ends: end_buf, iwe: &iwe,
3390	IW_EV_QUAL_LEN);
3391	if (IS_ERR(ptr: current_ev))
3392	return current_ev;
3393	}
3394
3395	memset(&iwe, 0, sizeof(iwe));
3396	iwe.cmd = SIOCGIWENCODE;
3397	if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
3398	iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
3399	else
3400	iwe.u.data.flags = IW_ENCODE_DISABLED;
3401	iwe.u.data.length = 0;
3402	current_ev = iwe_stream_add_point_check(info, stream: current_ev, ends: end_buf,
3403	iwe: &iwe, extra: "");
3404	if (IS_ERR(ptr: current_ev))
3405	return current_ev;
3406
3407	rcu_read_lock();
3408	ies = rcu_dereference(bss->pub.ies);
3409	rem = ies->len;
3410	ie = ies->data;
3411
3412	while (rem >= 2) {
3413	/* invalid data */
3414	if (ie[1] > rem - 2)
3415	break;
3416
3417	switch (ie[0]) {
3418	case WLAN_EID_SSID:
3419	memset(&iwe, 0, sizeof(iwe));
3420	iwe.cmd = SIOCGIWESSID;
3421	iwe.u.data.length = ie[1];
3422	iwe.u.data.flags = 1;
3423	current_ev = iwe_stream_add_point_check(info,
3424	stream: current_ev,
3425	ends: end_buf, iwe: &iwe,
3426	extra: (u8 *)ie + 2);
3427	if (IS_ERR(ptr: current_ev))
3428	goto unlock;
3429	break;
3430	case WLAN_EID_MESH_ID:
3431	memset(&iwe, 0, sizeof(iwe));
3432	iwe.cmd = SIOCGIWESSID;
3433	iwe.u.data.length = ie[1];
3434	iwe.u.data.flags = 1;
3435	current_ev = iwe_stream_add_point_check(info,
3436	stream: current_ev,
3437	ends: end_buf, iwe: &iwe,
3438	extra: (u8 *)ie + 2);
3439	if (IS_ERR(ptr: current_ev))
3440	goto unlock;
3441	break;
3442	case WLAN_EID_MESH_CONFIG:
3443	ismesh = true;
3444	if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
3445	break;
3446	cfg = (u8 *)ie + 2;
3447	memset(&iwe, 0, sizeof(iwe));
3448	iwe.cmd = IWEVCUSTOM;
3449	iwe.u.data.length = sprintf(buf,
3450	fmt: "Mesh Network Path Selection Protocol ID: 0x%02X",
3451	cfg[0]);
3452	current_ev = iwe_stream_add_point_check(info,
3453	stream: current_ev,
3454	ends: end_buf,
3455	iwe: &iwe, extra: buf);
3456	if (IS_ERR(ptr: current_ev))
3457	goto unlock;
3458	iwe.u.data.length = sprintf(buf,
3459	fmt: "Path Selection Metric ID: 0x%02X",
3460	cfg[1]);
3461	current_ev = iwe_stream_add_point_check(info,
3462	stream: current_ev,
3463	ends: end_buf,
3464	iwe: &iwe, extra: buf);
3465	if (IS_ERR(ptr: current_ev))
3466	goto unlock;
3467	iwe.u.data.length = sprintf(buf,
3468	fmt: "Congestion Control Mode ID: 0x%02X",
3469	cfg[2]);
3470	current_ev = iwe_stream_add_point_check(info,
3471	stream: current_ev,
3472	ends: end_buf,
3473	iwe: &iwe, extra: buf);
3474	if (IS_ERR(ptr: current_ev))
3475	goto unlock;
3476	iwe.u.data.length = sprintf(buf,
3477	fmt: "Synchronization ID: 0x%02X",
3478	cfg[3]);
3479	current_ev = iwe_stream_add_point_check(info,
3480	stream: current_ev,
3481	ends: end_buf,
3482	iwe: &iwe, extra: buf);
3483	if (IS_ERR(ptr: current_ev))
3484	goto unlock;
3485	iwe.u.data.length = sprintf(buf,
3486	fmt: "Authentication ID: 0x%02X",
3487	cfg[4]);
3488	current_ev = iwe_stream_add_point_check(info,
3489	stream: current_ev,
3490	ends: end_buf,
3491	iwe: &iwe, extra: buf);
3492	if (IS_ERR(ptr: current_ev))
3493	goto unlock;
3494	iwe.u.data.length = sprintf(buf,
3495	fmt: "Formation Info: 0x%02X",
3496	cfg[5]);
3497	current_ev = iwe_stream_add_point_check(info,
3498	stream: current_ev,
3499	ends: end_buf,
3500	iwe: &iwe, extra: buf);
3501	if (IS_ERR(ptr: current_ev))
3502	goto unlock;
3503	iwe.u.data.length = sprintf(buf,
3504	fmt: "Capabilities: 0x%02X",
3505	cfg[6]);
3506	current_ev = iwe_stream_add_point_check(info,
3507	stream: current_ev,
3508	ends: end_buf,
3509	iwe: &iwe, extra: buf);
3510	if (IS_ERR(ptr: current_ev))
3511	goto unlock;
3512	break;
3513	case WLAN_EID_SUPP_RATES:
3514	case WLAN_EID_EXT_SUPP_RATES:
3515	/* display all supported rates in readable format */
3516	p = current_ev + iwe_stream_lcp_len(info);
3517
3518	memset(&iwe, 0, sizeof(iwe));
3519	iwe.cmd = SIOCGIWRATE;
3520	/* Those two flags are ignored... */
3521	iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3522
3523	for (i = 0; i < ie[1]; i++) {
3524	iwe.u.bitrate.value =
3525	((ie[i + 2] & 0x7f) * 500000);
3526	tmp = p;
3527	p = iwe_stream_add_value(info, event: current_ev, value: p,
3528	ends: end_buf, iwe: &iwe,
3529	IW_EV_PARAM_LEN);
3530	if (p == tmp) {
3531	current_ev = ERR_PTR(error: -E2BIG);
3532	goto unlock;
3533	}
3534	}
3535	current_ev = p;
3536	break;
3537	}
3538	rem -= ie[1] + 2;
3539	ie += ie[1] + 2;
3540	}
3541
3542	if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
3543	ismesh) {
3544	memset(&iwe, 0, sizeof(iwe));
3545	iwe.cmd = SIOCGIWMODE;
3546	if (ismesh)
3547	iwe.u.mode = IW_MODE_MESH;
3548	else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
3549	iwe.u.mode = IW_MODE_MASTER;
3550	else
3551	iwe.u.mode = IW_MODE_ADHOC;
3552	current_ev = iwe_stream_add_event_check(info, stream: current_ev,
3553	ends: end_buf, iwe: &iwe,
3554	IW_EV_UINT_LEN);
3555	if (IS_ERR(ptr: current_ev))
3556	goto unlock;
3557	}
3558
3559	memset(&iwe, 0, sizeof(iwe));
3560	iwe.cmd = IWEVCUSTOM;
3561	iwe.u.data.length = sprintf(buf, fmt: "tsf=%016llx",
3562	(unsigned long long)(ies->tsf));
3563	current_ev = iwe_stream_add_point_check(info, stream: current_ev, ends: end_buf,
3564	iwe: &iwe, extra: buf);
3565	if (IS_ERR(ptr: current_ev))
3566	goto unlock;
3567	memset(&iwe, 0, sizeof(iwe));
3568	iwe.cmd = IWEVCUSTOM;
3569	iwe.u.data.length = sprintf(buf, fmt: " Last beacon: %ums ago",
3570	elapsed_jiffies_msecs(start: bss->ts));
3571	current_ev = iwe_stream_add_point_check(info, stream: current_ev,
3572	ends: end_buf, iwe: &iwe, extra: buf);
3573	if (IS_ERR(ptr: current_ev))
3574	goto unlock;
3575
3576	current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
3577
3578	unlock:
3579	rcu_read_unlock();
3580	return current_ev;
3581	}
3582
3583
3584	static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
3585	struct iw_request_info *info,
3586	char *buf, size_t len)
3587	{
3588	char *current_ev = buf;
3589	char *end_buf = buf + len;
3590	struct cfg80211_internal_bss *bss;
3591	int err = 0;
3592
3593	spin_lock_bh(lock: &rdev->bss_lock);
3594	cfg80211_bss_expire(rdev);
3595
3596	list_for_each_entry(bss, &rdev->bss_list, list) {
3597	if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3598	err = -E2BIG;
3599	break;
3600	}
3601	current_ev = ieee80211_bss(wiphy: &rdev->wiphy, info, bss,
3602	current_ev, end_buf);
3603	if (IS_ERR(ptr: current_ev)) {
3604	err = PTR_ERR(ptr: current_ev);
3605	break;
3606	}
3607	}
3608	spin_unlock_bh(lock: &rdev->bss_lock);
3609
3610	if (err)
3611	return err;
3612	return current_ev - buf;
3613	}
3614
3615
3616	int cfg80211_wext_giwscan(struct net_device *dev,
3617	struct iw_request_info *info,
3618	union iwreq_data *wrqu, char *extra)
3619	{
3620	struct iw_point *data = &wrqu->data;
3621	struct cfg80211_registered_device *rdev;
3622	int res;
3623
3624	if (!netif_running(dev))
3625	return -ENETDOWN;
3626
3627	rdev = cfg80211_get_dev_from_ifindex(net: dev_net(dev), ifindex: dev->ifindex);
3628
3629	if (IS_ERR(ptr: rdev))
3630	return PTR_ERR(ptr: rdev);
3631
3632	if (rdev->scan_req || rdev->scan_msg)
3633	return -EAGAIN;
3634
3635	res = ieee80211_scan_results(rdev, info, buf: extra, len: data->length);
3636	data->length = 0;
3637	if (res >= 0) {
3638	data->length = res;
3639	res = 0;
3640	}
3641
3642	return res;
3643	}
3644	EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
3645	#endif
3646