src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/ioctl.h>
  15 #include <sys/types.h>
  16 #include <sys/stat.h>
  17 #include <fcntl.h>
  18 #include <net/if.h>
  19 #include <netlink/genl/genl.h>
  20 #include <netlink/genl/family.h>
  21 #include <netlink/genl/ctrl.h>
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/filter.h>
  25 #include <linux/errqueue.h>
  26 #include "nl80211_copy.h"
  27
  28 #include "common.h"
  29 #include "eloop.h"
  30 #include "utils/list.h"
  31 #include "common/qca-vendor.h"
  32 #include "common/qca-vendor-attr.h"
  33 #include "common/ieee802_11_defs.h"
  34 #include "common/ieee802_11_common.h"
  35 #include "l2_packet/l2_packet.h"
  36 #include "netlink.h"
  37 #include "linux_ioctl.h"
  38 #include "radiotap.h"
  39 #include "radiotap_iter.h"
  40 #include "rfkill.h"
  41 #include "driver.h"
  42
  43 #ifndef SO_WIFI_STATUS
  44 # if defined(__sparc__)
  45 #  define SO_WIFI_STATUS        0x0025
  46 # elif defined(__parisc__)
  47 #  define SO_WIFI_STATUS        0x4022
  48 # else
  49 #  define SO_WIFI_STATUS        41
  50 # endif
  51
  52 # define SCM_WIFI_STATUS        SO_WIFI_STATUS
  53 #endif
  54
  55 #ifndef SO_EE_ORIGIN_TXSTATUS
  56 #define SO_EE_ORIGIN_TXSTATUS   4
  57 #endif
  58
  59 #ifndef PACKET_TX_TIMESTAMP
  60 #define PACKET_TX_TIMESTAMP     16
  61 #endif
  62
  63 #ifdef ANDROID
  64 #include "android_drv.h"
  65 #endif /* ANDROID */
  66 #ifdef CONFIG_LIBNL20
  67 /* libnl 2.0 compatibility code */
  68 #define nl_handle nl_sock
  69 #define nl80211_handle_alloc nl_socket_alloc_cb
  70 #define nl80211_handle_destroy nl_socket_free
  71 #else
  72 /*
  73  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  74  * but when you free a socket again it will mess up its bitmap and
  75  * and use the wrong number the next time it needs a socket ID.
  76  * Therefore, we wrap the handle alloc/destroy and add our own pid
  77  * accounting.
  78  */
  79 static uint32_t port_bitmap[32] = { 0 };
  80
  81 static struct nl_handle *nl80211_handle_alloc(void *cb)
  82 {
  83         struct nl_handle *handle;
  84         uint32_t pid = getpid() & 0x3FFFFF;
  85         int i;
  86
  87         handle = nl_handle_alloc_cb(cb);
  88
  89         for (i = 0; i < 1024; i++) {
  90                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  91                         continue;
  92                 port_bitmap[i / 32] |= 1 << (i % 32);
  93                 pid += i << 22;
  94                 break;
  95         }
  96
  97         nl_socket_set_local_port(handle, pid);
  98
  99         return handle;
 100 }
 101
 102 static void nl80211_handle_destroy(struct nl_handle *handle)
 103 {
 104         uint32_t port = nl_socket_get_local_port(handle);
 105
 106         port >>= 22;
 107         port_bitmap[port / 32] &= ~(1 << (port % 32));
 108
 109         nl_handle_destroy(handle);
 110 }
 111 #endif /* CONFIG_LIBNL20 */
 112
 113
 114 #ifdef ANDROID
 115 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
 116 static int android_nl_socket_set_nonblocking(struct nl_handle *handle)
 117 {
 118         return fcntl(nl_socket_get_fd(handle), F_SETFL, O_NONBLOCK);
 119 }
 120 #undef nl_socket_set_nonblocking
 121 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
 122 #endif /* ANDROID */
 123
 124
 125 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
 126 {
 127         struct nl_handle *handle;
 128
 129         handle = nl80211_handle_alloc(cb);
 130         if (handle == NULL) {
 131                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 132                            "callbacks (%s)", dbg);
 133                 return NULL;
 134         }
 135
 136         if (genl_connect(handle)) {
 137                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 138                            "netlink (%s)", dbg);
 139                 nl80211_handle_destroy(handle);
 140                 return NULL;
 141         }
 142
 143         return handle;
 144 }
 145
 146
 147 static void nl_destroy_handles(struct nl_handle **handle)
 148 {
 149         if (*handle == NULL)
 150                 return;
 151         nl80211_handle_destroy(*handle);
 152         *handle = NULL;
 153 }
 154
 155
 156 #if __WORDSIZE == 64
 157 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 158 #else
 159 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 160 #endif
 161
 162 static void nl80211_register_eloop_read(struct nl_handle **handle,
 163                                         eloop_sock_handler handler,
 164                                         void *eloop_data)
 165 {
 166         nl_socket_set_nonblocking(*handle);
 167         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 168                                  eloop_data, *handle);
 169         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 170 }
 171
 172
 173 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 174 {
 175         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 176         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 177         nl_destroy_handles(handle);
 178 }
 179
 180
 181 #ifndef IFF_LOWER_UP
 182 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
 183 #endif
 184 #ifndef IFF_DORMANT
 185 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
 186 #endif
 187
 188 #ifndef IF_OPER_DORMANT
 189 #define IF_OPER_DORMANT 5
 190 #endif
 191 #ifndef IF_OPER_UP
 192 #define IF_OPER_UP 6
 193 #endif
 194
 195 struct nl80211_global {
 196         struct dl_list interfaces;
 197         int if_add_ifindex;
 198         u64 if_add_wdevid;
 199         int if_add_wdevid_set;
 200         struct netlink_data *netlink;
 201         struct nl_cb *nl_cb;
 202         struct nl_handle *nl;
 203         int nl80211_id;
 204         int ioctl_sock; /* socket for ioctl() use */
 205
 206         struct nl_handle *nl_event;
 207 };
 208
 209 struct nl80211_wiphy_data {
 210         struct dl_list list;
 211         struct dl_list bsss;
 212         struct dl_list drvs;
 213
 214         struct nl_handle *nl_beacons;
 215         struct nl_cb *nl_cb;
 216
 217         int wiphy_idx;
 218 };
 219
 220 static void nl80211_global_deinit(void *priv);
 221
 222 struct i802_bss {
 223         struct wpa_driver_nl80211_data *drv;
 224         struct i802_bss *next;
 225         int ifindex;
 226         u64 wdev_id;
 227         char ifname[IFNAMSIZ + 1];
 228         char brname[IFNAMSIZ];
 229         unsigned int beacon_set:1;
 230         unsigned int added_if_into_bridge:1;
 231         unsigned int added_bridge:1;
 232         unsigned int in_deinit:1;
 233         unsigned int wdev_id_set:1;
 234         unsigned int added_if:1;
 235
 236         u8 addr[ETH_ALEN];
 237
 238         int freq;
 239         int bandwidth;
 240         int if_dynamic;
 241
 242         void *ctx;
 243         struct nl_handle *nl_preq, *nl_mgmt;
 244         struct nl_cb *nl_cb;
 245
 246         struct nl80211_wiphy_data *wiphy_data;
 247         struct dl_list wiphy_list;
 248 };
 249
 250 struct wpa_driver_nl80211_data {
 251         struct nl80211_global *global;
 252         struct dl_list list;
 253         struct dl_list wiphy_list;
 254         char phyname[32];
 255         void *ctx;
 256         int ifindex;
 257         int if_removed;
 258         int if_disabled;
 259         int ignore_if_down_event;
 260         struct rfkill_data *rfkill;
 261         struct wpa_driver_capa capa;
 262         u8 *extended_capa, *extended_capa_mask;
 263         unsigned int extended_capa_len;
 264         int has_capability;
 265
 266         int operstate;
 267
 268         int scan_complete_events;
 269         enum scan_states {
 270                 NO_SCAN, SCAN_REQUESTED, SCAN_STARTED, SCAN_COMPLETED,
 271                 SCAN_ABORTED, SCHED_SCAN_STARTED, SCHED_SCAN_STOPPED,
 272                 SCHED_SCAN_RESULTS
 273         } scan_state;
 274
 275         struct nl_cb *nl_cb;
 276
 277         u8 auth_bssid[ETH_ALEN];
 278         u8 auth_attempt_bssid[ETH_ALEN];
 279         u8 bssid[ETH_ALEN];
 280         u8 prev_bssid[ETH_ALEN];
 281         int associated;
 282         u8 ssid[32];
 283         size_t ssid_len;
 284         enum nl80211_iftype nlmode;
 285         enum nl80211_iftype ap_scan_as_station;
 286         unsigned int assoc_freq;
 287
 288         int monitor_sock;
 289         int monitor_ifidx;
 290         int monitor_refcount;
 291
 292         unsigned int disabled_11b_rates:1;
 293         unsigned int pending_remain_on_chan:1;
 294         unsigned int in_interface_list:1;
 295         unsigned int device_ap_sme:1;
 296         unsigned int poll_command_supported:1;
 297         unsigned int data_tx_status:1;
 298         unsigned int scan_for_auth:1;
 299         unsigned int retry_auth:1;
 300         unsigned int use_monitor:1;
 301         unsigned int ignore_next_local_disconnect:1;
 302         unsigned int ignore_next_local_deauth:1;
 303         unsigned int allow_p2p_device:1;
 304         unsigned int hostapd:1;
 305         unsigned int start_mode_ap:1;
 306         unsigned int start_iface_up:1;
 307         unsigned int test_use_roc_tx:1;
 308         unsigned int ignore_deauth_event:1;
 309         unsigned int dfs_vendor_cmd_avail:1;
 310         unsigned int have_low_prio_scan:1;
 311
 312         u64 remain_on_chan_cookie;
 313         u64 send_action_cookie;
 314
 315         unsigned int last_mgmt_freq;
 316
 317         struct wpa_driver_scan_filter *filter_ssids;
 318         size_t num_filter_ssids;
 319
 320         struct i802_bss *first_bss;
 321
 322         int eapol_tx_sock;
 323
 324         int eapol_sock; /* socket for EAPOL frames */
 325
 326         int default_if_indices[16];
 327         int *if_indices;
 328         int num_if_indices;
 329
 330         /* From failed authentication command */
 331         int auth_freq;
 332         u8 auth_bssid_[ETH_ALEN];
 333         u8 auth_ssid[32];
 334         size_t auth_ssid_len;
 335         int auth_alg;
 336         u8 *auth_ie;
 337         size_t auth_ie_len;
 338         u8 auth_wep_key[4][16];
 339         size_t auth_wep_key_len[4];
 340         int auth_wep_tx_keyidx;
 341         int auth_local_state_change;
 342         int auth_p2p;
 343 };
 344
 345
 346 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 347 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 348                                             void *timeout_ctx);
 349 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
 350                                        enum nl80211_iftype nlmode);
 351 static int
 352 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 353                                    const u8 *set_addr, int first);
 354 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 355                                    const u8 *addr, int cmd, u16 reason_code,
 356                                    int local_state_change);
 357 static void nl80211_remove_monitor_interface(
 358         struct wpa_driver_nl80211_data *drv);
 359 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 360                                   unsigned int freq, unsigned int wait,
 361                                   const u8 *buf, size_t buf_len, u64 *cookie,
 362                                   int no_cck, int no_ack, int offchanok);
 363 static int nl80211_register_frame(struct i802_bss *bss,
 364                                   struct nl_handle *hl_handle,
 365                                   u16 type, const u8 *match, size_t match_len);
 366 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 367                                                int report);
 368 #ifdef ANDROID
 369 static int android_pno_start(struct i802_bss *bss,
 370                              struct wpa_driver_scan_params *params);
 371 static int android_pno_stop(struct i802_bss *bss);
 372 extern int wpa_driver_nl80211_driver_cmd(void *priv, char *cmd, char *buf,
 373                                          size_t buf_len);
 374 #endif /* ANDROID */
 375 #ifdef ANDROID_P2P
 376 #ifdef ANDROID_P2P_STUB
 377 int wpa_driver_set_p2p_noa(void *priv, u8 count, int start, int duration) {
 378         return 0;
 379 }
 380 int wpa_driver_get_p2p_noa(void *priv, u8 *buf, size_t len) {
 381         return 0;
 382 }
 383 int wpa_driver_set_p2p_ps(void *priv, int legacy_ps, int opp_ps, int ctwindow) {
 384         return -1;
 385 }
 386 int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon,
 387                                  const struct wpabuf *proberesp,
 388                                  const struct wpabuf *assocresp) {
 389         return 0;
 390 }
 391 #else /* ANDROID_P2P_STUB */
 392 int wpa_driver_set_p2p_noa(void *priv, u8 count, int start, int duration);
 393 int wpa_driver_get_p2p_noa(void *priv, u8 *buf, size_t len);
 394 int wpa_driver_set_p2p_ps(void *priv, int legacy_ps, int opp_ps, int ctwindow);
 395 int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon,
 396                                  const struct wpabuf *proberesp,
 397                                  const struct wpabuf *assocresp);
 398 #endif /* ANDROID_P2P_STUB */
 399 #endif /* ANDROID_P2P */
 400
 401 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 402 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 403 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 404 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
 405                                         enum wpa_driver_if_type type,
 406                                         const char *ifname);
 407
 408 static int nl80211_set_channel(struct i802_bss *bss,
 409                                struct hostapd_freq_params *freq, int set_chan);
 410 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 411                                      int ifindex, int disabled);
 412
 413 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 414 static int wpa_driver_nl80211_authenticate_retry(
 415         struct wpa_driver_nl80211_data *drv);
 416
 417 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 418
 419
 420 static const char * nl80211_command_to_string(enum nl80211_commands cmd)
 421 {
 422 #define C2S(x) case x: return #x;
 423         switch (cmd) {
 424         C2S(NL80211_CMD_UNSPEC)
 425         C2S(NL80211_CMD_GET_WIPHY)
 426         C2S(NL80211_CMD_SET_WIPHY)
 427         C2S(NL80211_CMD_NEW_WIPHY)
 428         C2S(NL80211_CMD_DEL_WIPHY)
 429         C2S(NL80211_CMD_GET_INTERFACE)
 430         C2S(NL80211_CMD_SET_INTERFACE)
 431         C2S(NL80211_CMD_NEW_INTERFACE)
 432         C2S(NL80211_CMD_DEL_INTERFACE)
 433         C2S(NL80211_CMD_GET_KEY)
 434         C2S(NL80211_CMD_SET_KEY)
 435         C2S(NL80211_CMD_NEW_KEY)
 436         C2S(NL80211_CMD_DEL_KEY)
 437         C2S(NL80211_CMD_GET_BEACON)
 438         C2S(NL80211_CMD_SET_BEACON)
 439         C2S(NL80211_CMD_START_AP)
 440         C2S(NL80211_CMD_STOP_AP)
 441         C2S(NL80211_CMD_GET_STATION)
 442         C2S(NL80211_CMD_SET_STATION)
 443         C2S(NL80211_CMD_NEW_STATION)
 444         C2S(NL80211_CMD_DEL_STATION)
 445         C2S(NL80211_CMD_GET_MPATH)
 446         C2S(NL80211_CMD_SET_MPATH)
 447         C2S(NL80211_CMD_NEW_MPATH)
 448         C2S(NL80211_CMD_DEL_MPATH)
 449         C2S(NL80211_CMD_SET_BSS)
 450         C2S(NL80211_CMD_SET_REG)
 451         C2S(NL80211_CMD_REQ_SET_REG)
 452         C2S(NL80211_CMD_GET_MESH_CONFIG)
 453         C2S(NL80211_CMD_SET_MESH_CONFIG)
 454         C2S(NL80211_CMD_SET_MGMT_EXTRA_IE)
 455         C2S(NL80211_CMD_GET_REG)
 456         C2S(NL80211_CMD_GET_SCAN)
 457         C2S(NL80211_CMD_TRIGGER_SCAN)
 458         C2S(NL80211_CMD_NEW_SCAN_RESULTS)
 459         C2S(NL80211_CMD_SCAN_ABORTED)
 460         C2S(NL80211_CMD_REG_CHANGE)
 461         C2S(NL80211_CMD_AUTHENTICATE)
 462         C2S(NL80211_CMD_ASSOCIATE)
 463         C2S(NL80211_CMD_DEAUTHENTICATE)
 464         C2S(NL80211_CMD_DISASSOCIATE)
 465         C2S(NL80211_CMD_MICHAEL_MIC_FAILURE)
 466         C2S(NL80211_CMD_REG_BEACON_HINT)
 467         C2S(NL80211_CMD_JOIN_IBSS)
 468         C2S(NL80211_CMD_LEAVE_IBSS)
 469         C2S(NL80211_CMD_TESTMODE)
 470         C2S(NL80211_CMD_CONNECT)
 471         C2S(NL80211_CMD_ROAM)
 472         C2S(NL80211_CMD_DISCONNECT)
 473         C2S(NL80211_CMD_SET_WIPHY_NETNS)
 474         C2S(NL80211_CMD_GET_SURVEY)
 475         C2S(NL80211_CMD_NEW_SURVEY_RESULTS)
 476         C2S(NL80211_CMD_SET_PMKSA)
 477         C2S(NL80211_CMD_DEL_PMKSA)
 478         C2S(NL80211_CMD_FLUSH_PMKSA)
 479         C2S(NL80211_CMD_REMAIN_ON_CHANNEL)
 480         C2S(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL)
 481         C2S(NL80211_CMD_SET_TX_BITRATE_MASK)
 482         C2S(NL80211_CMD_REGISTER_FRAME)
 483         C2S(NL80211_CMD_FRAME)
 484         C2S(NL80211_CMD_FRAME_TX_STATUS)
 485         C2S(NL80211_CMD_SET_POWER_SAVE)
 486         C2S(NL80211_CMD_GET_POWER_SAVE)
 487         C2S(NL80211_CMD_SET_CQM)
 488         C2S(NL80211_CMD_NOTIFY_CQM)
 489         C2S(NL80211_CMD_SET_CHANNEL)
 490         C2S(NL80211_CMD_SET_WDS_PEER)
 491         C2S(NL80211_CMD_FRAME_WAIT_CANCEL)
 492         C2S(NL80211_CMD_JOIN_MESH)
 493         C2S(NL80211_CMD_LEAVE_MESH)
 494         C2S(NL80211_CMD_UNPROT_DEAUTHENTICATE)
 495         C2S(NL80211_CMD_UNPROT_DISASSOCIATE)
 496         C2S(NL80211_CMD_NEW_PEER_CANDIDATE)
 497         C2S(NL80211_CMD_GET_WOWLAN)
 498         C2S(NL80211_CMD_SET_WOWLAN)
 499         C2S(NL80211_CMD_START_SCHED_SCAN)
 500         C2S(NL80211_CMD_STOP_SCHED_SCAN)
 501         C2S(NL80211_CMD_SCHED_SCAN_RESULTS)
 502         C2S(NL80211_CMD_SCHED_SCAN_STOPPED)
 503         C2S(NL80211_CMD_SET_REKEY_OFFLOAD)
 504         C2S(NL80211_CMD_PMKSA_CANDIDATE)
 505         C2S(NL80211_CMD_TDLS_OPER)
 506         C2S(NL80211_CMD_TDLS_MGMT)
 507         C2S(NL80211_CMD_UNEXPECTED_FRAME)
 508         C2S(NL80211_CMD_PROBE_CLIENT)
 509         C2S(NL80211_CMD_REGISTER_BEACONS)
 510         C2S(NL80211_CMD_UNEXPECTED_4ADDR_FRAME)
 511         C2S(NL80211_CMD_SET_NOACK_MAP)
 512         C2S(NL80211_CMD_CH_SWITCH_NOTIFY)
 513         C2S(NL80211_CMD_START_P2P_DEVICE)
 514         C2S(NL80211_CMD_STOP_P2P_DEVICE)
 515         C2S(NL80211_CMD_CONN_FAILED)
 516         C2S(NL80211_CMD_SET_MCAST_RATE)
 517         C2S(NL80211_CMD_SET_MAC_ACL)
 518         C2S(NL80211_CMD_RADAR_DETECT)
 519         C2S(NL80211_CMD_GET_PROTOCOL_FEATURES)
 520         C2S(NL80211_CMD_UPDATE_FT_IES)
 521         C2S(NL80211_CMD_FT_EVENT)
 522         C2S(NL80211_CMD_CRIT_PROTOCOL_START)
 523         C2S(NL80211_CMD_CRIT_PROTOCOL_STOP)
 524         C2S(NL80211_CMD_GET_COALESCE)
 525         C2S(NL80211_CMD_SET_COALESCE)
 526         C2S(NL80211_CMD_CHANNEL_SWITCH)
 527         C2S(NL80211_CMD_VENDOR)
 528         C2S(NL80211_CMD_SET_QOS_MAP)
 529         default:
 530                 return "NL80211_CMD_UNKNOWN";
 531         }
 532 #undef C2S
 533 }
 534
 535
 536 /* Converts nl80211_chan_width to a common format */
 537 static enum chan_width convert2width(int width)
 538 {
 539         switch (width) {
 540         case NL80211_CHAN_WIDTH_20_NOHT:
 541                 return CHAN_WIDTH_20_NOHT;
 542         case NL80211_CHAN_WIDTH_20:
 543                 return CHAN_WIDTH_20;
 544         case NL80211_CHAN_WIDTH_40:
 545                 return CHAN_WIDTH_40;
 546         case NL80211_CHAN_WIDTH_80:
 547                 return CHAN_WIDTH_80;
 548         case NL80211_CHAN_WIDTH_80P80:
 549                 return CHAN_WIDTH_80P80;
 550         case NL80211_CHAN_WIDTH_160:
 551                 return CHAN_WIDTH_160;
 552         }
 553         return CHAN_WIDTH_UNKNOWN;
 554 }
 555
 556
 557 static int is_ap_interface(enum nl80211_iftype nlmode)
 558 {
 559         return nlmode == NL80211_IFTYPE_AP ||
 560                 nlmode == NL80211_IFTYPE_P2P_GO;
 561 }
 562
 563
 564 static int is_sta_interface(enum nl80211_iftype nlmode)
 565 {
 566         return nlmode == NL80211_IFTYPE_STATION ||
 567                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 568 }
 569
 570
 571 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 572 {
 573         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 574                 nlmode == NL80211_IFTYPE_P2P_GO;
 575 }
 576
 577
 578 static void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 579 {
 580         if (drv->associated)
 581                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 582         drv->associated = 0;
 583         os_memset(drv->bssid, 0, ETH_ALEN);
 584 }
 585
 586
 587 struct nl80211_bss_info_arg {
 588         struct wpa_driver_nl80211_data *drv;
 589         struct wpa_scan_results *res;
 590         unsigned int assoc_freq;
 591         unsigned int ibss_freq;
 592         u8 assoc_bssid[ETH_ALEN];
 593 };
 594
 595 static int bss_info_handler(struct nl_msg *msg, void *arg);
 596
 597
 598 /* nl80211 code */
 599 static int ack_handler(struct nl_msg *msg, void *arg)
 600 {
 601         int *err = arg;
 602         *err = 0;
 603         return NL_STOP;
 604 }
 605
 606 static int finish_handler(struct nl_msg *msg, void *arg)
 607 {
 608         int *ret = arg;
 609         *ret = 0;
 610         return NL_SKIP;
 611 }
 612
 613 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 614                          void *arg)
 615 {
 616         int *ret = arg;
 617         *ret = err->error;
 618         return NL_SKIP;
 619 }
 620
 621
 622 static int no_seq_check(struct nl_msg *msg, void *arg)
 623 {
 624         return NL_OK;
 625 }
 626
 627
 628 static int send_and_recv(struct nl80211_global *global,
 629                          struct nl_handle *nl_handle, struct nl_msg *msg,
 630                          int (*valid_handler)(struct nl_msg *, void *),
 631                          void *valid_data)
 632 {
 633         struct nl_cb *cb;
 634         int err = -ENOMEM;
 635
 636         cb = nl_cb_clone(global->nl_cb);
 637         if (!cb)
 638                 goto out;
 639
 640         err = nl_send_auto_complete(nl_handle, msg);
 641         if (err < 0)
 642                 goto out;
 643
 644         err = 1;
 645
 646         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 647         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 648         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 649
 650         if (valid_handler)
 651                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 652                           valid_handler, valid_data);
 653
 654         while (err > 0) {
 655                 int res = nl_recvmsgs(nl_handle, cb);
 656                 if (res < 0) {
 657                         wpa_printf(MSG_INFO,
 658                                    "nl80211: %s->nl_recvmsgs failed: %d",
 659                                    __func__, res);
 660                 }
 661         }
 662  out:
 663         nl_cb_put(cb);
 664         nlmsg_free(msg);
 665         return err;
 666 }
 667
 668
 669 static int send_and_recv_msgs_global(struct nl80211_global *global,
 670                                      struct nl_msg *msg,
 671                                      int (*valid_handler)(struct nl_msg *, void *),
 672                                      void *valid_data)
 673 {
 674         return send_and_recv(global, global->nl, msg, valid_handler,
 675                              valid_data);
 676 }
 677
 678
 679 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 680                               struct nl_msg *msg,
 681                               int (*valid_handler)(struct nl_msg *, void *),
 682                               void *valid_data)
 683 {
 684         return send_and_recv(drv->global, drv->global->nl, msg,
 685                              valid_handler, valid_data);
 686 }
 687
 688
 689 struct family_data {
 690         const char *group;
 691         int id;
 692 };
 693
 694
 695 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 696 {
 697         if (bss->wdev_id_set)
 698                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 699         else
 700                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 701         return 0;
 702
 703 nla_put_failure:
 704         return -1;
 705 }
 706
 707
 708 static int family_handler(struct nl_msg *msg, void *arg)
 709 {
 710         struct family_data *res = arg;
 711         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 712         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 713         struct nlattr *mcgrp;
 714         int i;
 715
 716         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 717                   genlmsg_attrlen(gnlh, 0), NULL);
 718         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 719                 return NL_SKIP;
 720
 721         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 722                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 723                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 724                           nla_len(mcgrp), NULL);
 725                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 726                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 727                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 728                                res->group,
 729                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 730                         continue;
 731                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 732                 break;
 733         };
 734
 735         return NL_SKIP;
 736 }
 737
 738
 739 static int nl_get_multicast_id(struct nl80211_global *global,
 740                                const char *family, const char *group)
 741 {
 742         struct nl_msg *msg;
 743         int ret = -1;
 744         struct family_data res = { group, -ENOENT };
 745
 746         msg = nlmsg_alloc();
 747         if (!msg)
 748                 return -ENOMEM;
 749         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 750                     0, 0, CTRL_CMD_GETFAMILY, 0);
 751         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 752
 753         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 754         msg = NULL;
 755         if (ret == 0)
 756                 ret = res.id;
 757
 758 nla_put_failure:
 759         nlmsg_free(msg);
 760         return ret;
 761 }
 762
 763
 764 static void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 765                           struct nl_msg *msg, int flags, uint8_t cmd)
 766 {
 767         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 768                            0, flags, cmd, 0);
 769 }
 770
 771
 772 struct wiphy_idx_data {
 773         int wiphy_idx;
 774         enum nl80211_iftype nlmode;
 775         u8 *macaddr;
 776 };
 777
 778
 779 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 780 {
 781         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 782         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 783         struct wiphy_idx_data *info = arg;
 784
 785         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 786                   genlmsg_attrlen(gnlh, 0), NULL);
 787
 788         if (tb[NL80211_ATTR_WIPHY])
 789                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 790
 791         if (tb[NL80211_ATTR_IFTYPE])
 792                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 793
 794         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 795                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 796                           ETH_ALEN);
 797
 798         return NL_SKIP;
 799 }
 800
 801
 802 static int nl80211_get_wiphy_index(struct i802_bss *bss)
 803 {
 804         struct nl_msg *msg;
 805         struct wiphy_idx_data data = {
 806                 .wiphy_idx = -1,
 807                 .macaddr = NULL,
 808         };
 809
 810         msg = nlmsg_alloc();
 811         if (!msg)
 812                 return NL80211_IFTYPE_UNSPECIFIED;
 813
 814         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 815
 816         if (nl80211_set_iface_id(msg, bss) < 0)
 817                 goto nla_put_failure;
 818
 819         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 820                 return data.wiphy_idx;
 821         msg = NULL;
 822 nla_put_failure:
 823         nlmsg_free(msg);
 824         return -1;
 825 }
 826
 827
 828 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 829 {
 830         struct nl_msg *msg;
 831         struct wiphy_idx_data data = {
 832                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 833                 .macaddr = NULL,
 834         };
 835
 836         msg = nlmsg_alloc();
 837         if (!msg)
 838                 return -1;
 839
 840         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 841
 842         if (nl80211_set_iface_id(msg, bss) < 0)
 843                 goto nla_put_failure;
 844
 845         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 846                 return data.nlmode;
 847         msg = NULL;
 848 nla_put_failure:
 849         nlmsg_free(msg);
 850         return NL80211_IFTYPE_UNSPECIFIED;
 851 }
 852
 853
 854 static int nl80211_get_macaddr(struct i802_bss *bss)
 855 {
 856         struct nl_msg *msg;
 857         struct wiphy_idx_data data = {
 858                 .macaddr = bss->addr,
 859         };
 860
 861         msg = nlmsg_alloc();
 862         if (!msg)
 863                 return NL80211_IFTYPE_UNSPECIFIED;
 864
 865         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 866         if (nl80211_set_iface_id(msg, bss) < 0)
 867                 goto nla_put_failure;
 868
 869         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 870
 871 nla_put_failure:
 872         nlmsg_free(msg);
 873         return NL80211_IFTYPE_UNSPECIFIED;
 874 }
 875
 876
 877 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 878                                     struct nl80211_wiphy_data *w)
 879 {
 880         struct nl_msg *msg;
 881         int ret = -1;
 882
 883         msg = nlmsg_alloc();
 884         if (!msg)
 885                 return -1;
 886
 887         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
 888
 889         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
 890
 891         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 892         msg = NULL;
 893         if (ret) {
 894                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 895                            "failed: ret=%d (%s)",
 896                            ret, strerror(-ret));
 897                 goto nla_put_failure;
 898         }
 899         ret = 0;
 900 nla_put_failure:
 901         nlmsg_free(msg);
 902         return ret;
 903 }
 904
 905
 906 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 907 {
 908         struct nl80211_wiphy_data *w = eloop_ctx;
 909         int res;
 910
 911         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 912
 913         res = nl_recvmsgs(handle, w->nl_cb);
 914         if (res < 0) {
 915                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 916                            __func__, res);
 917         }
 918 }
 919
 920
 921 static int process_beacon_event(struct nl_msg *msg, void *arg)
 922 {
 923         struct nl80211_wiphy_data *w = arg;
 924         struct wpa_driver_nl80211_data *drv;
 925         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 926         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 927         union wpa_event_data event;
 928
 929         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 930                   genlmsg_attrlen(gnlh, 0), NULL);
 931
 932         if (gnlh->cmd != NL80211_CMD_FRAME) {
 933                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 934                            gnlh->cmd);
 935                 return NL_SKIP;
 936         }
 937
 938         if (!tb[NL80211_ATTR_FRAME])
 939                 return NL_SKIP;
 940
 941         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 942                          wiphy_list) {
 943                 os_memset(&event, 0, sizeof(event));
 944                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 945                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 946                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 947         }
 948
 949         return NL_SKIP;
 950 }
 951
 952
 953 static struct nl80211_wiphy_data *
 954 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 955 {
 956         static DEFINE_DL_LIST(nl80211_wiphys);
 957         struct nl80211_wiphy_data *w;
 958         int wiphy_idx, found = 0;
 959         struct i802_bss *tmp_bss;
 960
 961         if (bss->wiphy_data != NULL)
 962                 return bss->wiphy_data;
 963
 964         wiphy_idx = nl80211_get_wiphy_index(bss);
 965
 966         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 967                 if (w->wiphy_idx == wiphy_idx)
 968                         goto add;
 969         }
 970
 971         /* alloc new one */
 972         w = os_zalloc(sizeof(*w));
 973         if (w == NULL)
 974                 return NULL;
 975         w->wiphy_idx = wiphy_idx;
 976         dl_list_init(&w->bsss);
 977         dl_list_init(&w->drvs);
 978
 979         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 980         if (!w->nl_cb) {
 981                 os_free(w);
 982                 return NULL;
 983         }
 984         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 985         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 986                   w);
 987
 988         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 989                                          "wiphy beacons");
 990         if (w->nl_beacons == NULL) {
 991                 os_free(w);
 992                 return NULL;
 993         }
 994
 995         if (nl80211_register_beacons(bss->drv, w)) {
 996                 nl_destroy_handles(&w->nl_beacons);
 997                 os_free(w);
 998                 return NULL;
 999         }
1000
1001         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
1002
1003         dl_list_add(&nl80211_wiphys, &w->list);
1004
1005 add:
1006         /* drv entry for this bss already there? */
1007         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
1008                 if (tmp_bss->drv == bss->drv) {
1009                         found = 1;
1010                         break;
1011                 }
1012         }
1013         /* if not add it */
1014         if (!found)
1015                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
1016
1017         dl_list_add(&w->bsss, &bss->wiphy_list);
1018         bss->wiphy_data = w;
1019         return w;
1020 }
1021
1022
1023 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
1024 {
1025         struct nl80211_wiphy_data *w = bss->wiphy_data;
1026         struct i802_bss *tmp_bss;
1027         int found = 0;
1028
1029         if (w == NULL)
1030                 return;
1031         bss->wiphy_data = NULL;
1032         dl_list_del(&bss->wiphy_list);
1033
1034         /* still any for this drv present? */
1035         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
1036                 if (tmp_bss->drv == bss->drv) {
1037                         found = 1;
1038                         break;
1039                 }
1040         }
1041         /* if not remove it */
1042         if (!found)
1043                 dl_list_del(&bss->drv->wiphy_list);
1044
1045         if (!dl_list_empty(&w->bsss))
1046                 return;
1047
1048         nl80211_destroy_eloop_handle(&w->nl_beacons);
1049
1050         nl_cb_put(w->nl_cb);
1051         dl_list_del(&w->list);
1052         os_free(w);
1053 }
1054
1055
1056 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
1057 {
1058         struct i802_bss *bss = priv;
1059         struct wpa_driver_nl80211_data *drv = bss->drv;
1060         if (!drv->associated)
1061                 return -1;
1062         os_memcpy(bssid, drv->bssid, ETH_ALEN);
1063         return 0;
1064 }
1065
1066
1067 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
1068 {
1069         struct i802_bss *bss = priv;
1070         struct wpa_driver_nl80211_data *drv = bss->drv;
1071         if (!drv->associated)
1072                 return -1;
1073         os_memcpy(ssid, drv->ssid, drv->ssid_len);
1074         return drv->ssid_len;
1075 }
1076
1077
1078 static void wpa_driver_nl80211_event_newlink(
1079         struct wpa_driver_nl80211_data *drv, char *ifname)
1080 {
1081         union wpa_event_data event;
1082
1083         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
1084                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
1085                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
1086                                    drv->first_bss->ifname);
1087                         return;
1088                 }
1089                 if (!drv->if_removed)
1090                         return;
1091                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
1092                            drv->first_bss->ifname);
1093                 drv->if_removed = 0;
1094         }
1095
1096         os_memset(&event, 0, sizeof(event));
1097         os_strlcpy(event.interface_status.ifname, ifname,
1098                    sizeof(event.interface_status.ifname));
1099         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
1100         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1101 }
1102
1103
1104 static void wpa_driver_nl80211_event_dellink(
1105         struct wpa_driver_nl80211_data *drv, char *ifname)
1106 {
1107         union wpa_event_data event;
1108
1109         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
1110                 if (drv->if_removed) {
1111                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
1112                                    ifname);
1113                         return;
1114                 }
1115                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
1116                            ifname);
1117                 drv->if_removed = 1;
1118         } else {
1119                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
1120                            ifname);
1121         }
1122
1123         os_memset(&event, 0, sizeof(event));
1124         os_strlcpy(event.interface_status.ifname, ifname,
1125                    sizeof(event.interface_status.ifname));
1126         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
1127         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1128 }
1129
1130
1131 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
1132                                          u8 *buf, size_t len)
1133 {
1134         int attrlen, rta_len;
1135         struct rtattr *attr;
1136
1137         attrlen = len;
1138         attr = (struct rtattr *) buf;
1139
1140         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1141         while (RTA_OK(attr, attrlen)) {
1142                 if (attr->rta_type == IFLA_IFNAME) {
1143                         if (os_strcmp(((char *) attr) + rta_len,
1144                                       drv->first_bss->ifname) == 0)
1145                                 return 1;
1146                         else
1147                                 break;
1148                 }
1149                 attr = RTA_NEXT(attr, attrlen);
1150         }
1151
1152         return 0;
1153 }
1154
1155
1156 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
1157                                           int ifindex, u8 *buf, size_t len)
1158 {
1159         if (drv->ifindex == ifindex)
1160                 return 1;
1161
1162         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
1163                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
1164                            "interface");
1165                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0);
1166                 return 1;
1167         }
1168
1169         return 0;
1170 }
1171
1172
1173 static struct wpa_driver_nl80211_data *
1174 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
1175 {
1176         struct wpa_driver_nl80211_data *drv;
1177         dl_list_for_each(drv, &global->interfaces,
1178                          struct wpa_driver_nl80211_data, list) {
1179                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
1180                     have_ifidx(drv, idx))
1181                         return drv;
1182         }
1183         return NULL;
1184 }
1185
1186
1187 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
1188                                                  struct ifinfomsg *ifi,
1189                                                  u8 *buf, size_t len)
1190 {
1191         struct nl80211_global *global = ctx;
1192         struct wpa_driver_nl80211_data *drv;
1193         int attrlen;
1194         struct rtattr *attr;
1195         u32 brid = 0;
1196         char namebuf[IFNAMSIZ];
1197         char ifname[IFNAMSIZ + 1];
1198         char extra[100], *pos, *end;
1199
1200         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1201         if (!drv) {
1202                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_NEWLINK event for foreign ifindex %d",
1203                            ifi->ifi_index);
1204                 return;
1205         }
1206
1207         extra[0] = '\0';
1208         pos = extra;
1209         end = pos + sizeof(extra);
1210         ifname[0] = '\0';
1211
1212         attrlen = len;
1213         attr = (struct rtattr *) buf;
1214         while (RTA_OK(attr, attrlen)) {
1215                 switch (attr->rta_type) {
1216                 case IFLA_IFNAME:
1217                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1218                                 break;
1219                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1220                         ifname[RTA_PAYLOAD(attr)] = '\0';
1221                         break;
1222                 case IFLA_MASTER:
1223                         brid = nla_get_u32((struct nlattr *) attr);
1224                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1225                         break;
1226                 case IFLA_WIRELESS:
1227                         pos += os_snprintf(pos, end - pos, " wext");
1228                         break;
1229                 case IFLA_OPERSTATE:
1230                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1231                                            nla_get_u32((struct nlattr *) attr));
1232                         break;
1233                 case IFLA_LINKMODE:
1234                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1235                                            nla_get_u32((struct nlattr *) attr));
1236                         break;
1237                 }
1238                 attr = RTA_NEXT(attr, attrlen);
1239         }
1240         extra[sizeof(extra) - 1] = '\0';
1241
1242         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_flags=0x%x (%s%s%s%s)",
1243                    ifi->ifi_index, ifname, extra, ifi->ifi_flags,
1244                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1245                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1246                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1247                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1248
1249         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
1250                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1251                     linux_iface_up(drv->global->ioctl_sock,
1252                                    drv->first_bss->ifname) > 0) {
1253                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
1254                                    "event since interface %s is up", namebuf);
1255                         return;
1256                 }
1257                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
1258                 if (drv->ignore_if_down_event) {
1259                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
1260                                    "event generated by mode change");
1261                         drv->ignore_if_down_event = 0;
1262                 } else {
1263                         drv->if_disabled = 1;
1264                         wpa_supplicant_event(drv->ctx,
1265                                              EVENT_INTERFACE_DISABLED, NULL);
1266
1267                         /*
1268                          * Try to get drv again, since it may be removed as
1269                          * part of the EVENT_INTERFACE_DISABLED handling for
1270                          * dynamic interfaces
1271                          */
1272                         drv = nl80211_find_drv(global, ifi->ifi_index,
1273                                                buf, len);
1274                         if (!drv)
1275                                 return;
1276                 }
1277         }
1278
1279         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
1280                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1281                     linux_iface_up(drv->global->ioctl_sock,
1282                                    drv->first_bss->ifname) == 0) {
1283                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1284                                    "event since interface %s is down",
1285                                    namebuf);
1286                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
1287                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1288                                    "event since interface %s does not exist",
1289                                    drv->first_bss->ifname);
1290                 } else if (drv->if_removed) {
1291                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1292                                    "event since interface %s is marked "
1293                                    "removed", drv->first_bss->ifname);
1294                 } else {
1295                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1296                         drv->if_disabled = 0;
1297                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1298                                              NULL);
1299                 }
1300         }
1301
1302         /*
1303          * Some drivers send the association event before the operup event--in
1304          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1305          * fails. This will hit us when wpa_supplicant does not need to do
1306          * IEEE 802.1X authentication
1307          */
1308         if (drv->operstate == 1 &&
1309             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1310             !(ifi->ifi_flags & IFF_RUNNING)) {
1311                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1312                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1313                                        -1, IF_OPER_UP);
1314         }
1315
1316         if (ifname[0])
1317                 wpa_driver_nl80211_event_newlink(drv, ifname);
1318
1319         if (ifi->ifi_family == AF_BRIDGE && brid) {
1320                 /* device has been added to bridge */
1321                 if_indextoname(brid, namebuf);
1322                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1323                            brid, namebuf);
1324                 add_ifidx(drv, brid);
1325         }
1326 }
1327
1328
1329 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1330                                                  struct ifinfomsg *ifi,
1331                                                  u8 *buf, size_t len)
1332 {
1333         struct nl80211_global *global = ctx;
1334         struct wpa_driver_nl80211_data *drv;
1335         int attrlen;
1336         struct rtattr *attr;
1337         u32 brid = 0;
1338         char ifname[IFNAMSIZ + 1];
1339
1340         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1341         if (!drv) {
1342                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_DELLINK event for foreign ifindex %d",
1343                            ifi->ifi_index);
1344                 return;
1345         }
1346
1347         ifname[0] = '\0';
1348
1349         attrlen = len;
1350         attr = (struct rtattr *) buf;
1351         while (RTA_OK(attr, attrlen)) {
1352                 switch (attr->rta_type) {
1353                 case IFLA_IFNAME:
1354                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1355                                 break;
1356                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1357                         ifname[RTA_PAYLOAD(attr)] = '\0';
1358                         break;
1359                 case IFLA_MASTER:
1360                         brid = nla_get_u32((struct nlattr *) attr);
1361                         break;
1362                 }
1363                 attr = RTA_NEXT(attr, attrlen);
1364         }
1365
1366         if (ifname[0])
1367                 wpa_driver_nl80211_event_dellink(drv, ifname);
1368
1369         if (ifi->ifi_family == AF_BRIDGE && brid) {
1370                 /* device has been removed from bridge */
1371                 char namebuf[IFNAMSIZ];
1372                 if_indextoname(brid, namebuf);
1373                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1374                            "%s", brid, namebuf);
1375                 del_ifidx(drv, brid);
1376         }
1377 }
1378
1379
1380 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
1381                             const u8 *frame, size_t len)
1382 {
1383         const struct ieee80211_mgmt *mgmt;
1384         union wpa_event_data event;
1385
1386         wpa_printf(MSG_DEBUG, "nl80211: Authenticate event");
1387         mgmt = (const struct ieee80211_mgmt *) frame;
1388         if (len < 24 + sizeof(mgmt->u.auth)) {
1389                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1390                            "frame");
1391                 return;
1392         }
1393
1394         os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
1395         os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
1396         os_memset(&event, 0, sizeof(event));
1397         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
1398         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1399         event.auth.auth_transaction =
1400                 le_to_host16(mgmt->u.auth.auth_transaction);
1401         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
1402         if (len > 24 + sizeof(mgmt->u.auth)) {
1403                 event.auth.ies = mgmt->u.auth.variable;
1404                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
1405         }
1406
1407         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
1408 }
1409
1410
1411 static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1412 {
1413         struct nl_msg *msg;
1414         int ret;
1415         struct nl80211_bss_info_arg arg;
1416
1417         os_memset(&arg, 0, sizeof(arg));
1418         msg = nlmsg_alloc();
1419         if (!msg)
1420                 goto nla_put_failure;
1421
1422         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1423         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1424
1425         arg.drv = drv;
1426         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1427         msg = NULL;
1428         if (ret == 0) {
1429                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1430                         arg.ibss_freq : arg.assoc_freq;
1431                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1432                            "associated BSS from scan results: %u MHz", freq);
1433                 if (freq)
1434                         drv->assoc_freq = freq;
1435                 return drv->assoc_freq;
1436         }
1437         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1438                    "(%s)", ret, strerror(-ret));
1439 nla_put_failure:
1440         nlmsg_free(msg);
1441         return drv->assoc_freq;
1442 }
1443
1444
1445 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
1446                             const u8 *frame, size_t len)
1447 {
1448         const struct ieee80211_mgmt *mgmt;
1449         union wpa_event_data event;
1450         u16 status;
1451
1452         wpa_printf(MSG_DEBUG, "nl80211: Associate event");
1453         mgmt = (const struct ieee80211_mgmt *) frame;
1454         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
1455                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1456                            "frame");
1457                 return;
1458         }
1459
1460         status = le_to_host16(mgmt->u.assoc_resp.status_code);
1461         if (status != WLAN_STATUS_SUCCESS) {
1462                 os_memset(&event, 0, sizeof(event));
1463                 event.assoc_reject.bssid = mgmt->bssid;
1464                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1465                         event.assoc_reject.resp_ies =
1466                                 (u8 *) mgmt->u.assoc_resp.variable;
1467                         event.assoc_reject.resp_ies_len =
1468                                 len - 24 - sizeof(mgmt->u.assoc_resp);
1469                 }
1470                 event.assoc_reject.status_code = status;
1471
1472                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1473                 return;
1474         }
1475
1476         drv->associated = 1;
1477         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
1478         os_memcpy(drv->prev_bssid, mgmt->sa, ETH_ALEN);
1479
1480         os_memset(&event, 0, sizeof(event));
1481         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1482                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
1483                 event.assoc_info.resp_ies_len =
1484                         len - 24 - sizeof(mgmt->u.assoc_resp);
1485         }
1486
1487         event.assoc_info.freq = drv->assoc_freq;
1488
1489         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1490 }
1491
1492
1493 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
1494                                enum nl80211_commands cmd, struct nlattr *status,
1495                                struct nlattr *addr, struct nlattr *req_ie,
1496                                struct nlattr *resp_ie)
1497 {
1498         union wpa_event_data event;
1499
1500         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1501                 /*
1502                  * Avoid reporting two association events that would confuse
1503                  * the core code.
1504                  */
1505                 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
1506                            "when using userspace SME", cmd);
1507                 return;
1508         }
1509
1510         if (cmd == NL80211_CMD_CONNECT)
1511                 wpa_printf(MSG_DEBUG, "nl80211: Connect event");
1512         else if (cmd == NL80211_CMD_ROAM)
1513                 wpa_printf(MSG_DEBUG, "nl80211: Roam event");
1514
1515         os_memset(&event, 0, sizeof(event));
1516         if (cmd == NL80211_CMD_CONNECT &&
1517             nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
1518                 if (addr)
1519                         event.assoc_reject.bssid = nla_data(addr);
1520                 if (resp_ie) {
1521                         event.assoc_reject.resp_ies = nla_data(resp_ie);
1522                         event.assoc_reject.resp_ies_len = nla_len(resp_ie);
1523                 }
1524                 event.assoc_reject.status_code = nla_get_u16(status);
1525                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1526                 return;
1527         }
1528
1529         drv->associated = 1;
1530         if (addr) {
1531                 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1532                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
1533         }
1534
1535         if (req_ie) {
1536                 event.assoc_info.req_ies = nla_data(req_ie);
1537                 event.assoc_info.req_ies_len = nla_len(req_ie);
1538         }
1539         if (resp_ie) {
1540                 event.assoc_info.resp_ies = nla_data(resp_ie);
1541                 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1542         }
1543
1544         event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1545
1546         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1547 }
1548
1549
1550 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1551                                   struct nlattr *reason, struct nlattr *addr,
1552                                   struct nlattr *by_ap)
1553 {
1554         union wpa_event_data data;
1555         unsigned int locally_generated = by_ap == NULL;
1556
1557         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1558                 /*
1559                  * Avoid reporting two disassociation events that could
1560                  * confuse the core code.
1561                  */
1562                 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1563                            "event when using userspace SME");
1564                 return;
1565         }
1566
1567         if (drv->ignore_next_local_disconnect) {
1568                 drv->ignore_next_local_disconnect = 0;
1569                 if (locally_generated) {
1570                         wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1571                                    "event triggered during reassociation");
1572                         return;
1573                 }
1574                 wpa_printf(MSG_WARNING, "nl80211: Was expecting local "
1575                            "disconnect but got another disconnect "
1576                            "event first");
1577         }
1578
1579         wpa_printf(MSG_DEBUG, "nl80211: Disconnect event");
1580         nl80211_mark_disconnected(drv);
1581         os_memset(&data, 0, sizeof(data));
1582         if (reason)
1583                 data.deauth_info.reason_code = nla_get_u16(reason);
1584         data.deauth_info.locally_generated = by_ap == NULL;
1585         wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1586 }
1587
1588
1589 static int calculate_chan_offset(int width, int freq, int cf1, int cf2)
1590 {
1591         int freq1 = 0;
1592
1593         switch (convert2width(width)) {
1594         case CHAN_WIDTH_20_NOHT:
1595         case CHAN_WIDTH_20:
1596                 return 0;
1597         case CHAN_WIDTH_40:
1598                 freq1 = cf1 - 10;
1599                 break;
1600         case CHAN_WIDTH_80:
1601                 freq1 = cf1 - 30;
1602                 break;
1603         case CHAN_WIDTH_160:
1604                 freq1 = cf1 - 70;
1605                 break;
1606         case CHAN_WIDTH_UNKNOWN:
1607         case CHAN_WIDTH_80P80:
1608                 /* FIXME: implement this */
1609                 return 0;
1610         }
1611
1612         return (abs(freq - freq1) / 20) % 2 == 0 ? 1 : -1;
1613 }
1614
1615
1616 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1617                                  struct nlattr *ifindex, struct nlattr *freq,
1618                                  struct nlattr *type, struct nlattr *bw,
1619                                  struct nlattr *cf1, struct nlattr *cf2)
1620 {
1621         struct i802_bss *bss;
1622         union wpa_event_data data;
1623         int ht_enabled = 1;
1624         int chan_offset = 0;
1625         int ifidx;
1626
1627         wpa_printf(MSG_DEBUG, "nl80211: Channel switch event");
1628
1629         if (!freq)
1630                 return;
1631
1632         ifidx = nla_get_u32(ifindex);
1633         for (bss = drv->first_bss; bss; bss = bss->next)
1634                 if (bss->ifindex == ifidx)
1635                         break;
1636
1637         if (bss == NULL) {
1638                 wpa_printf(MSG_WARNING, "nl80211: Unknown ifindex (%d) for channel switch, ignoring",
1639                            ifidx);
1640                 return;
1641         }
1642
1643         if (type) {
1644                 switch (nla_get_u32(type)) {
1645                 case NL80211_CHAN_NO_HT:
1646                         ht_enabled = 0;
1647                         break;
1648                 case NL80211_CHAN_HT20:
1649                         break;
1650                 case NL80211_CHAN_HT40PLUS:
1651                         chan_offset = 1;
1652                         break;
1653                 case NL80211_CHAN_HT40MINUS:
1654                         chan_offset = -1;
1655                         break;
1656                 }
1657         } else if (bw && cf1) {
1658                 /* This can happen for example with VHT80 ch switch */
1659                 chan_offset = calculate_chan_offset(nla_get_u32(bw),
1660                                                     nla_get_u32(freq),
1661                                                     nla_get_u32(cf1),
1662                                                     cf2 ? nla_get_u32(cf2) : 0);
1663         } else {
1664                 wpa_printf(MSG_WARNING, "nl80211: Unknown secondary channel information - following channel definition calculations may fail");
1665         }
1666
1667         os_memset(&data, 0, sizeof(data));
1668         data.ch_switch.freq = nla_get_u32(freq);
1669         data.ch_switch.ht_enabled = ht_enabled;
1670         data.ch_switch.ch_offset = chan_offset;
1671         if (bw)
1672                 data.ch_switch.ch_width = convert2width(nla_get_u32(bw));
1673         if (cf1)
1674                 data.ch_switch.cf1 = nla_get_u32(cf1);
1675         if (cf2)
1676                 data.ch_switch.cf2 = nla_get_u32(cf2);
1677
1678         bss->freq = data.ch_switch.freq;
1679
1680         wpa_supplicant_event(drv->ctx, EVENT_CH_SWITCH, &data);
1681 }
1682
1683
1684 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1685                                enum nl80211_commands cmd, struct nlattr *addr)
1686 {
1687         union wpa_event_data event;
1688         enum wpa_event_type ev;
1689
1690         if (nla_len(addr) != ETH_ALEN)
1691                 return;
1692
1693         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1694                    cmd, MAC2STR((u8 *) nla_data(addr)));
1695
1696         if (cmd == NL80211_CMD_AUTHENTICATE)
1697                 ev = EVENT_AUTH_TIMED_OUT;
1698         else if (cmd == NL80211_CMD_ASSOCIATE)
1699                 ev = EVENT_ASSOC_TIMED_OUT;
1700         else
1701                 return;
1702
1703         os_memset(&event, 0, sizeof(event));
1704         os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1705         wpa_supplicant_event(drv->ctx, ev, &event);
1706 }
1707
1708
1709 static void mlme_event_mgmt(struct i802_bss *bss,
1710                             struct nlattr *freq, struct nlattr *sig,
1711                             const u8 *frame, size_t len)
1712 {
1713         struct wpa_driver_nl80211_data *drv = bss->drv;
1714         const struct ieee80211_mgmt *mgmt;
1715         union wpa_event_data event;
1716         u16 fc, stype;
1717         int ssi_signal = 0;
1718         int rx_freq = 0;
1719
1720         wpa_printf(MSG_MSGDUMP, "nl80211: Frame event");
1721         mgmt = (const struct ieee80211_mgmt *) frame;
1722         if (len < 24) {
1723                 wpa_printf(MSG_DEBUG, "nl80211: Too short management frame");
1724                 return;
1725         }
1726
1727         fc = le_to_host16(mgmt->frame_control);
1728         stype = WLAN_FC_GET_STYPE(fc);
1729
1730         if (sig)
1731                 ssi_signal = (s32) nla_get_u32(sig);
1732
1733         os_memset(&event, 0, sizeof(event));
1734         if (freq) {
1735                 event.rx_mgmt.freq = nla_get_u32(freq);
1736                 rx_freq = drv->last_mgmt_freq = event.rx_mgmt.freq;
1737         }
1738         wpa_printf(MSG_DEBUG,
1739                    "nl80211: RX frame freq=%d ssi_signal=%d stype=%u len=%u",
1740                    rx_freq, ssi_signal, stype, (unsigned int) len);
1741         event.rx_mgmt.frame = frame;
1742         event.rx_mgmt.frame_len = len;
1743         event.rx_mgmt.ssi_signal = ssi_signal;
1744         event.rx_mgmt.drv_priv = bss;
1745         wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1746 }
1747
1748
1749 static void mlme_event_mgmt_tx_status(struct wpa_driver_nl80211_data *drv,
1750                                       struct nlattr *cookie, const u8 *frame,
1751                                       size_t len, struct nlattr *ack)
1752 {
1753         union wpa_event_data event;
1754         const struct ieee80211_hdr *hdr;
1755         u16 fc;
1756
1757         wpa_printf(MSG_DEBUG, "nl80211: Frame TX status event");
1758         if (!is_ap_interface(drv->nlmode)) {
1759                 u64 cookie_val;
1760
1761                 if (!cookie)
1762                         return;
1763
1764                 cookie_val = nla_get_u64(cookie);
1765                 wpa_printf(MSG_DEBUG, "nl80211: Action TX status:"
1766                            " cookie=0%llx%s (ack=%d)",
1767                            (long long unsigned int) cookie_val,
1768                            cookie_val == drv->send_action_cookie ?
1769                            " (match)" : " (unknown)", ack != NULL);
1770                 if (cookie_val != drv->send_action_cookie)
1771                         return;
1772         }
1773
1774         hdr = (const struct ieee80211_hdr *) frame;
1775         fc = le_to_host16(hdr->frame_control);
1776
1777         os_memset(&event, 0, sizeof(event));
1778         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1779         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1780         event.tx_status.dst = hdr->addr1;
1781         event.tx_status.data = frame;
1782         event.tx_status.data_len = len;
1783         event.tx_status.ack = ack != NULL;
1784         wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event);
1785 }
1786
1787
1788 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1789                                        enum wpa_event_type type,
1790                                        const u8 *frame, size_t len)
1791 {
1792         const struct ieee80211_mgmt *mgmt;
1793         union wpa_event_data event;
1794         const u8 *bssid = NULL;
1795         u16 reason_code = 0;
1796
1797         if (type == EVENT_DEAUTH)
1798                 wpa_printf(MSG_DEBUG, "nl80211: Deauthenticate event");
1799         else
1800                 wpa_printf(MSG_DEBUG, "nl80211: Disassociate event");
1801
1802         mgmt = (const struct ieee80211_mgmt *) frame;
1803         if (len >= 24) {
1804                 bssid = mgmt->bssid;
1805
1806                 if ((drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
1807                     !drv->associated &&
1808                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0 &&
1809                     os_memcmp(bssid, drv->auth_attempt_bssid, ETH_ALEN) != 0 &&
1810                     os_memcmp(bssid, drv->prev_bssid, ETH_ALEN) == 0) {
1811                         /*
1812                          * Avoid issues with some roaming cases where
1813                          * disconnection event for the old AP may show up after
1814                          * we have started connection with the new AP.
1815                          */
1816                         wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth/disassoc event from old AP " MACSTR " when already authenticating with " MACSTR,
1817                                    MAC2STR(bssid),
1818                                    MAC2STR(drv->auth_attempt_bssid));
1819                         return;
1820                 }
1821
1822                 if (drv->associated != 0 &&
1823                     os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
1824                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
1825                         /*
1826                          * We have presumably received this deauth as a
1827                          * response to a clear_state_mismatch() outgoing
1828                          * deauth.  Don't let it take us offline!
1829                          */
1830                         wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1831                                    "from Unknown BSSID " MACSTR " -- ignoring",
1832                                    MAC2STR(bssid));
1833                         return;
1834                 }
1835         }
1836
1837         nl80211_mark_disconnected(drv);
1838         os_memset(&event, 0, sizeof(event));
1839
1840         /* Note: Same offset for Reason Code in both frame subtypes */
1841         if (len >= 24 + sizeof(mgmt->u.deauth))
1842                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1843
1844         if (type == EVENT_DISASSOC) {
1845                 event.disassoc_info.locally_generated =
1846                         !os_memcmp(mgmt->sa, drv->first_bss->addr, ETH_ALEN);
1847                 event.disassoc_info.addr = bssid;
1848                 event.disassoc_info.reason_code = reason_code;
1849                 if (frame + len > mgmt->u.disassoc.variable) {
1850                         event.disassoc_info.ie = mgmt->u.disassoc.variable;
1851                         event.disassoc_info.ie_len = frame + len -
1852                                 mgmt->u.disassoc.variable;
1853                 }
1854         } else {
1855                 if (drv->ignore_deauth_event) {
1856                         wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event due to previous forced deauth-during-auth");
1857                         drv->ignore_deauth_event = 0;
1858                         return;
1859                 }
1860                 event.deauth_info.locally_generated =
1861                         !os_memcmp(mgmt->sa, drv->first_bss->addr, ETH_ALEN);
1862                 if (drv->ignore_next_local_deauth) {
1863                         drv->ignore_next_local_deauth = 0;
1864                         if (event.deauth_info.locally_generated) {
1865                                 wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event triggered due to own deauth request");
1866                                 return;
1867                         }
1868                         wpa_printf(MSG_WARNING, "nl80211: Was expecting local deauth but got another disconnect event first");
1869                 }
1870                 event.deauth_info.addr = bssid;
1871                 event.deauth_info.reason_code = reason_code;
1872                 if (frame + len > mgmt->u.deauth.variable) {
1873                         event.deauth_info.ie = mgmt->u.deauth.variable;
1874                         event.deauth_info.ie_len = frame + len -
1875                                 mgmt->u.deauth.variable;
1876                 }
1877         }
1878
1879         wpa_supplicant_event(drv->ctx, type, &event);
1880 }
1881
1882
1883 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1884                                          enum wpa_event_type type,
1885                                          const u8 *frame, size_t len)
1886 {
1887         const struct ieee80211_mgmt *mgmt;
1888         union wpa_event_data event;
1889         u16 reason_code = 0;
1890
1891         if (type == EVENT_UNPROT_DEAUTH)
1892                 wpa_printf(MSG_DEBUG, "nl80211: Unprot Deauthenticate event");
1893         else
1894                 wpa_printf(MSG_DEBUG, "nl80211: Unprot Disassociate event");
1895
1896         if (len < 24)
1897                 return;
1898
1899         mgmt = (const struct ieee80211_mgmt *) frame;
1900
1901         os_memset(&event, 0, sizeof(event));
1902         /* Note: Same offset for Reason Code in both frame subtypes */
1903         if (len >= 24 + sizeof(mgmt->u.deauth))
1904                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1905
1906         if (type == EVENT_UNPROT_DISASSOC) {
1907                 event.unprot_disassoc.sa = mgmt->sa;
1908                 event.unprot_disassoc.da = mgmt->da;
1909                 event.unprot_disassoc.reason_code = reason_code;
1910         } else {
1911                 event.unprot_deauth.sa = mgmt->sa;
1912                 event.unprot_deauth.da = mgmt->da;
1913                 event.unprot_deauth.reason_code = reason_code;
1914         }
1915
1916         wpa_supplicant_event(drv->ctx, type, &event);
1917 }
1918
1919
1920 static void mlme_event(struct i802_bss *bss,
1921                        enum nl80211_commands cmd, struct nlattr *frame,
1922                        struct nlattr *addr, struct nlattr *timed_out,
1923                        struct nlattr *freq, struct nlattr *ack,
1924                        struct nlattr *cookie, struct nlattr *sig)
1925 {
1926         struct wpa_driver_nl80211_data *drv = bss->drv;
1927         const u8 *data;
1928         size_t len;
1929
1930         if (timed_out && addr) {
1931                 mlme_timeout_event(drv, cmd, addr);
1932                 return;
1933         }
1934
1935         if (frame == NULL) {
1936                 wpa_printf(MSG_DEBUG,
1937                            "nl80211: MLME event %d (%s) without frame data",
1938                            cmd, nl80211_command_to_string(cmd));
1939                 return;
1940         }
1941
1942         data = nla_data(frame);
1943         len = nla_len(frame);
1944         if (len < 4 + 2 * ETH_ALEN) {
1945                 wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s("
1946                            MACSTR ") - too short",
1947                            cmd, nl80211_command_to_string(cmd), bss->ifname,
1948                            MAC2STR(bss->addr));
1949                 return;
1950         }
1951         wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s(" MACSTR
1952                    ") A1=" MACSTR " A2=" MACSTR, cmd,
1953                    nl80211_command_to_string(cmd), bss->ifname,
1954                    MAC2STR(bss->addr), MAC2STR(data + 4),
1955                    MAC2STR(data + 4 + ETH_ALEN));
1956         if (cmd != NL80211_CMD_FRAME_TX_STATUS && !(data[4] & 0x01) &&
1957             os_memcmp(bss->addr, data + 4, ETH_ALEN) != 0 &&
1958             os_memcmp(bss->addr, data + 4 + ETH_ALEN, ETH_ALEN) != 0) {
1959                 wpa_printf(MSG_MSGDUMP, "nl80211: %s: Ignore MLME frame event "
1960                            "for foreign address", bss->ifname);
1961                 return;
1962         }
1963         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1964                     nla_data(frame), nla_len(frame));
1965
1966         switch (cmd) {
1967         case NL80211_CMD_AUTHENTICATE:
1968                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1969                 break;
1970         case NL80211_CMD_ASSOCIATE:
1971                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
1972                 break;
1973         case NL80211_CMD_DEAUTHENTICATE:
1974                 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1975                                            nla_data(frame), nla_len(frame));
1976                 break;
1977         case NL80211_CMD_DISASSOCIATE:
1978                 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1979                                            nla_data(frame), nla_len(frame));
1980                 break;
1981         case NL80211_CMD_FRAME:
1982                 mlme_event_mgmt(bss, freq, sig, nla_data(frame),
1983                                 nla_len(frame));
1984                 break;
1985         case NL80211_CMD_FRAME_TX_STATUS:
1986                 mlme_event_mgmt_tx_status(drv, cookie, nla_data(frame),
1987                                           nla_len(frame), ack);
1988                 break;
1989         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1990                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1991                                              nla_data(frame), nla_len(frame));
1992                 break;
1993         case NL80211_CMD_UNPROT_DISASSOCIATE:
1994                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1995                                              nla_data(frame), nla_len(frame));
1996                 break;
1997         default:
1998                 break;
1999         }
2000 }
2001
2002
2003 static void mlme_event_michael_mic_failure(struct i802_bss *bss,
2004                                            struct nlattr *tb[])
2005 {
2006         union wpa_event_data data;
2007
2008         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
2009         os_memset(&data, 0, sizeof(data));
2010         if (tb[NL80211_ATTR_MAC]) {
2011                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
2012                             nla_data(tb[NL80211_ATTR_MAC]),
2013                             nla_len(tb[NL80211_ATTR_MAC]));
2014                 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
2015         }
2016         if (tb[NL80211_ATTR_KEY_SEQ]) {
2017                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
2018                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
2019                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
2020         }
2021         if (tb[NL80211_ATTR_KEY_TYPE]) {
2022                 enum nl80211_key_type key_type =
2023                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
2024                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
2025                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
2026                         data.michael_mic_failure.unicast = 1;
2027         } else
2028                 data.michael_mic_failure.unicast = 1;
2029
2030         if (tb[NL80211_ATTR_KEY_IDX]) {
2031                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
2032                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
2033         }
2034
2035         wpa_supplicant_event(bss->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
2036 }
2037
2038
2039 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
2040                                  struct nlattr *tb[])
2041 {
2042         unsigned int freq;
2043
2044         if (tb[NL80211_ATTR_MAC] == NULL) {
2045                 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
2046                            "event");
2047                 return;
2048         }
2049         os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2050
2051         drv->associated = 1;
2052         wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
2053                    MAC2STR(drv->bssid));
2054
2055         freq = nl80211_get_assoc_freq(drv);
2056         if (freq) {
2057                 wpa_printf(MSG_DEBUG, "nl80211: IBSS on frequency %u MHz",
2058                            freq);
2059                 drv->first_bss->freq = freq;
2060         }
2061
2062         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
2063 }
2064
2065
2066 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
2067                                          int cancel_event, struct nlattr *tb[])
2068 {
2069         unsigned int freq, chan_type, duration;
2070         union wpa_event_data data;
2071         u64 cookie;
2072
2073         if (tb[NL80211_ATTR_WIPHY_FREQ])
2074                 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2075         else
2076                 freq = 0;
2077
2078         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
2079                 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2080         else
2081                 chan_type = 0;
2082
2083         if (tb[NL80211_ATTR_DURATION])
2084                 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
2085         else
2086                 duration = 0;
2087
2088         if (tb[NL80211_ATTR_COOKIE])
2089                 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
2090         else
2091                 cookie = 0;
2092
2093         wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
2094                    "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
2095                    cancel_event, freq, chan_type, duration,
2096                    (long long unsigned int) cookie,
2097                    cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
2098
2099         if (cookie != drv->remain_on_chan_cookie)
2100                 return; /* not for us */
2101
2102         if (cancel_event)
2103                 drv->pending_remain_on_chan = 0;
2104
2105         os_memset(&data, 0, sizeof(data));
2106         data.remain_on_channel.freq = freq;
2107         data.remain_on_channel.duration = duration;
2108         wpa_supplicant_event(drv->ctx, cancel_event ?
2109                              EVENT_CANCEL_REMAIN_ON_CHANNEL :
2110                              EVENT_REMAIN_ON_CHANNEL, &data);
2111 }
2112
2113
2114 static void mlme_event_ft_event(struct wpa_driver_nl80211_data *drv,
2115                                 struct nlattr *tb[])
2116 {
2117         union wpa_event_data data;
2118
2119         os_memset(&data, 0, sizeof(data));
2120
2121         if (tb[NL80211_ATTR_IE]) {
2122                 data.ft_ies.ies = nla_data(tb[NL80211_ATTR_IE]);
2123                 data.ft_ies.ies_len = nla_len(tb[NL80211_ATTR_IE]);
2124         }
2125
2126         if (tb[NL80211_ATTR_IE_RIC]) {
2127                 data.ft_ies.ric_ies = nla_data(tb[NL80211_ATTR_IE_RIC]);
2128                 data.ft_ies.ric_ies_len = nla_len(tb[NL80211_ATTR_IE_RIC]);
2129         }
2130
2131         if (tb[NL80211_ATTR_MAC])
2132                 os_memcpy(data.ft_ies.target_ap,
2133                           nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2134
2135         wpa_printf(MSG_DEBUG, "nl80211: FT event target_ap " MACSTR,
2136                    MAC2STR(data.ft_ies.target_ap));
2137
2138         wpa_supplicant_event(drv->ctx, EVENT_FT_RESPONSE, &data);
2139 }
2140
2141
2142 static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
2143                             struct nlattr *tb[])
2144 {
2145         union wpa_event_data event;
2146         struct nlattr *nl;
2147         int rem;
2148         struct scan_info *info;
2149 #define MAX_REPORT_FREQS 50
2150         int freqs[MAX_REPORT_FREQS];
2151         int num_freqs = 0;
2152
2153         if (drv->scan_for_auth) {
2154                 drv->scan_for_auth = 0;
2155                 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
2156                            "cfg80211 BSS entry");
2157                 wpa_driver_nl80211_authenticate_retry(drv);
2158                 return;
2159         }
2160
2161         os_memset(&event, 0, sizeof(event));
2162         info = &event.scan_info;
2163         info->aborted = aborted;
2164
2165         if (tb[NL80211_ATTR_SCAN_SSIDS]) {
2166                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
2167                         struct wpa_driver_scan_ssid *s =
2168                                 &info->ssids[info->num_ssids];
2169                         s->ssid = nla_data(nl);
2170                         s->ssid_len = nla_len(nl);
2171                         wpa_printf(MSG_DEBUG, "nl80211: Scan probed for SSID '%s'",
2172                                    wpa_ssid_txt(s->ssid, s->ssid_len));
2173                         info->num_ssids++;
2174                         if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
2175                                 break;
2176                 }
2177         }
2178         if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
2179                 char msg[200], *pos, *end;
2180                 int res;
2181
2182                 pos = msg;
2183                 end = pos + sizeof(msg);
2184                 *pos = '\0';
2185
2186                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
2187                 {
2188                         freqs[num_freqs] = nla_get_u32(nl);
2189                         res = os_snprintf(pos, end - pos, " %d",
2190                                           freqs[num_freqs]);
2191                         if (res > 0 && end - pos > res)
2192                                 pos += res;
2193                         num_freqs++;
2194                         if (num_freqs == MAX_REPORT_FREQS - 1)
2195                                 break;
2196                 }
2197                 info->freqs = freqs;
2198                 info->num_freqs = num_freqs;
2199                 wpa_printf(MSG_DEBUG, "nl80211: Scan included frequencies:%s",
2200                            msg);
2201         }
2202         wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
2203 }
2204
2205
2206 static int get_link_signal(struct nl_msg *msg, void *arg)
2207 {
2208         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2209         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2210         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
2211         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
2212                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
2213                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
2214         };
2215         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
2216         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
2217                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
2218                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
2219                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
2220                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
2221         };
2222         struct wpa_signal_info *sig_change = arg;
2223
2224         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2225                   genlmsg_attrlen(gnlh, 0), NULL);
2226         if (!tb[NL80211_ATTR_STA_INFO] ||
2227             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
2228                              tb[NL80211_ATTR_STA_INFO], policy))
2229                 return NL_SKIP;
2230         if (!sinfo[NL80211_STA_INFO_SIGNAL])
2231                 return NL_SKIP;
2232
2233         sig_change->current_signal =
2234                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
2235
2236         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
2237                 sig_change->avg_signal =
2238                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
2239         else
2240                 sig_change->avg_signal = 0;
2241
2242         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
2243                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
2244                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
2245                                      rate_policy)) {
2246                         sig_change->current_txrate = 0;
2247                 } else {
2248                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
2249                                 sig_change->current_txrate =
2250                                         nla_get_u16(rinfo[
2251                                              NL80211_RATE_INFO_BITRATE]) * 100;
2252                         }
2253                 }
2254         }
2255
2256         return NL_SKIP;
2257 }
2258
2259
2260 static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
2261                                    struct wpa_signal_info *sig)
2262 {
2263         struct nl_msg *msg;
2264
2265         sig->current_signal = -9999;
2266         sig->current_txrate = 0;
2267
2268         msg = nlmsg_alloc();
2269         if (!msg)
2270                 return -ENOMEM;
2271
2272         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
2273
2274         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2275         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
2276
2277         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
2278  nla_put_failure:
2279         nlmsg_free(msg);
2280         return -ENOBUFS;
2281 }
2282
2283
2284 static int get_link_noise(struct nl_msg *msg, void *arg)
2285 {
2286         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2287         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2288         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
2289         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
2290                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
2291                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
2292         };
2293         struct wpa_signal_info *sig_change = arg;
2294
2295         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2296                   genlmsg_attrlen(gnlh, 0), NULL);
2297
2298         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
2299                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
2300                 return NL_SKIP;
2301         }
2302
2303         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
2304                              tb[NL80211_ATTR_SURVEY_INFO],
2305                              survey_policy)) {
2306                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
2307                            "attributes!");
2308                 return NL_SKIP;
2309         }
2310
2311         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
2312                 return NL_SKIP;
2313
2314         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
2315             sig_change->frequency)
2316                 return NL_SKIP;
2317
2318         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
2319                 return NL_SKIP;
2320
2321         sig_change->current_noise =
2322                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
2323
2324         return NL_SKIP;
2325 }
2326
2327
2328 static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
2329                                   struct wpa_signal_info *sig_change)
2330 {
2331         struct nl_msg *msg;
2332
2333         sig_change->current_noise = 9999;
2334         sig_change->frequency = drv->assoc_freq;
2335
2336         msg = nlmsg_alloc();
2337         if (!msg)
2338                 return -ENOMEM;
2339
2340         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
2341
2342         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2343
2344         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
2345  nla_put_failure:
2346         nlmsg_free(msg);
2347         return -ENOBUFS;
2348 }
2349
2350
2351 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
2352 {
2353         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2354         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2355         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
2356         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
2357                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
2358                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
2359         };
2360         struct wpa_scan_results *scan_results = arg;
2361         struct wpa_scan_res *scan_res;
2362         size_t i;
2363
2364         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2365                   genlmsg_attrlen(gnlh, 0), NULL);
2366
2367         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
2368                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
2369                 return NL_SKIP;
2370         }
2371
2372         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
2373                              tb[NL80211_ATTR_SURVEY_INFO],
2374                              survey_policy)) {
2375                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
2376                            "attributes");
2377                 return NL_SKIP;
2378         }
2379
2380         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
2381                 return NL_SKIP;
2382
2383         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
2384                 return NL_SKIP;
2385
2386         for (i = 0; i < scan_results->num; ++i) {
2387                 scan_res = scan_results->res[i];
2388                 if (!scan_res)
2389                         continue;
2390                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
2391                     scan_res->freq)
2392                         continue;
2393                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
2394                         continue;
2395                 scan_res->noise = (s8)
2396                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
2397                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
2398         }
2399
2400         return NL_SKIP;
2401 }
2402
2403
2404 static int nl80211_get_noise_for_scan_results(
2405         struct wpa_driver_nl80211_data *drv,
2406         struct wpa_scan_results *scan_res)
2407 {
2408         struct nl_msg *msg;
2409
2410         msg = nlmsg_alloc();
2411         if (!msg)
2412                 return -ENOMEM;
2413
2414         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
2415
2416         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2417
2418         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
2419                                   scan_res);
2420  nla_put_failure:
2421         nlmsg_free(msg);
2422         return -ENOBUFS;
2423 }
2424
2425
2426 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
2427                               struct nlattr *tb[])
2428 {
2429         static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
2430                 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
2431                 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
2432                 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
2433                 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
2434         };
2435         struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
2436         enum nl80211_cqm_rssi_threshold_event event;
2437         union wpa_event_data ed;
2438         struct wpa_signal_info sig;
2439         int res;
2440
2441         if (tb[NL80211_ATTR_CQM] == NULL ||
2442             nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
2443                              cqm_policy)) {
2444                 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
2445                 return;
2446         }
2447
2448         os_memset(&ed, 0, sizeof(ed));
2449
2450         if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
2451                 if (!tb[NL80211_ATTR_MAC])
2452                         return;
2453                 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
2454                           ETH_ALEN);
2455                 wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed);
2456                 return;
2457         }
2458
2459         if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
2460                 return;
2461         event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
2462
2463         if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
2464                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2465                            "event: RSSI high");
2466                 ed.signal_change.above_threshold = 1;
2467         } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
2468                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2469                            "event: RSSI low");
2470                 ed.signal_change.above_threshold = 0;
2471         } else
2472                 return;
2473
2474         res = nl80211_get_link_signal(drv, &sig);
2475         if (res == 0) {
2476                 ed.signal_change.current_signal = sig.current_signal;
2477                 ed.signal_change.current_txrate = sig.current_txrate;
2478                 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm  txrate: %d",
2479                            sig.current_signal, sig.current_txrate);
2480         }
2481
2482         res = nl80211_get_link_noise(drv, &sig);
2483         if (res == 0) {
2484                 ed.signal_change.current_noise = sig.current_noise;
2485                 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
2486                            sig.current_noise);
2487         }
2488
2489         wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
2490 }
2491
2492
2493 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
2494                                       struct nlattr **tb)
2495 {
2496         u8 *addr;
2497         union wpa_event_data data;
2498
2499         if (tb[NL80211_ATTR_MAC] == NULL)
2500                 return;
2501         addr = nla_data(tb[NL80211_ATTR_MAC]);
2502         wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr));
2503
2504         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2505                 u8 *ies = NULL;
2506                 size_t ies_len = 0;
2507                 if (tb[NL80211_ATTR_IE]) {
2508                         ies = nla_data(tb[NL80211_ATTR_IE]);
2509                         ies_len = nla_len(tb[NL80211_ATTR_IE]);
2510                 }
2511                 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len);
2512                 drv_event_assoc(drv->ctx, addr, ies, ies_len, 0);
2513                 return;
2514         }
2515
2516         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2517                 return;
2518
2519         os_memset(&data, 0, sizeof(data));
2520         os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN);
2521         wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data);
2522 }
2523
2524
2525 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
2526                                       struct nlattr **tb)
2527 {
2528         u8 *addr;
2529         union wpa_event_data data;
2530
2531         if (tb[NL80211_ATTR_MAC] == NULL)
2532                 return;
2533         addr = nla_data(tb[NL80211_ATTR_MAC]);
2534         wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
2535                    MAC2STR(addr));
2536
2537         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2538                 drv_event_disassoc(drv->ctx, addr);
2539                 return;
2540         }
2541
2542         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2543                 return;
2544
2545         os_memset(&data, 0, sizeof(data));
2546         os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
2547         wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data);
2548 }
2549
2550
2551 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
2552                                         struct nlattr **tb)
2553 {
2554         struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
2555         static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
2556                 [NL80211_REKEY_DATA_KEK] = {
2557                         .minlen = NL80211_KEK_LEN,
2558                         .maxlen = NL80211_KEK_LEN,
2559                 },
2560                 [NL80211_REKEY_DATA_KCK] = {
2561                         .minlen = NL80211_KCK_LEN,
2562                         .maxlen = NL80211_KCK_LEN,
2563                 },
2564                 [NL80211_REKEY_DATA_REPLAY_CTR] = {
2565                         .minlen = NL80211_REPLAY_CTR_LEN,
2566                         .maxlen = NL80211_REPLAY_CTR_LEN,
2567                 },
2568         };
2569         union wpa_event_data data;
2570
2571         if (!tb[NL80211_ATTR_MAC])
2572                 return;
2573         if (!tb[NL80211_ATTR_REKEY_DATA])
2574                 return;
2575         if (nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2576                              tb[NL80211_ATTR_REKEY_DATA], rekey_policy))
2577                 return;
2578         if (!rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2579                 return;
2580
2581         os_memset(&data, 0, sizeof(data));
2582         data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2583         wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2584                    MAC2STR(data.driver_gtk_rekey.bssid));
2585         data.driver_gtk_rekey.replay_ctr =
2586                 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2587         wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2588                     data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2589         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2590 }
2591
2592
2593 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2594                                           struct nlattr **tb)
2595 {
2596         struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2597         static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2598                 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2599                 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2600                         .minlen = ETH_ALEN,
2601                         .maxlen = ETH_ALEN,
2602                 },
2603                 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2604         };
2605         union wpa_event_data data;
2606
2607         wpa_printf(MSG_DEBUG, "nl80211: PMKSA candidate event");
2608
2609         if (!tb[NL80211_ATTR_PMKSA_CANDIDATE])
2610                 return;
2611         if (nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2612                              tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy))
2613                 return;
2614         if (!cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2615             !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2616                 return;
2617
2618         os_memset(&data, 0, sizeof(data));
2619         os_memcpy(data.pmkid_candidate.bssid,
2620                   nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2621         data.pmkid_candidate.index =
2622                 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2623         data.pmkid_candidate.preauth =
2624                 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2625         wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2626 }
2627
2628
2629 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2630                                        struct nlattr **tb)
2631 {
2632         union wpa_event_data data;
2633
2634         wpa_printf(MSG_DEBUG, "nl80211: Probe client event");
2635
2636         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_ACK])
2637                 return;
2638
2639         os_memset(&data, 0, sizeof(data));
2640         os_memcpy(data.client_poll.addr,
2641                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2642
2643         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2644 }
2645
2646
2647 static void nl80211_tdls_oper_event(struct wpa_driver_nl80211_data *drv,
2648                                     struct nlattr **tb)
2649 {
2650         union wpa_event_data data;
2651
2652         wpa_printf(MSG_DEBUG, "nl80211: TDLS operation event");
2653
2654         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_TDLS_OPERATION])
2655                 return;
2656
2657         os_memset(&data, 0, sizeof(data));
2658         os_memcpy(data.tdls.peer, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2659         switch (nla_get_u8(tb[NL80211_ATTR_TDLS_OPERATION])) {
2660         case NL80211_TDLS_SETUP:
2661                 wpa_printf(MSG_DEBUG, "nl80211: TDLS setup request for peer "
2662                            MACSTR, MAC2STR(data.tdls.peer));
2663                 data.tdls.oper = TDLS_REQUEST_SETUP;
2664                 break;
2665         case NL80211_TDLS_TEARDOWN:
2666                 wpa_printf(MSG_DEBUG, "nl80211: TDLS teardown request for peer "
2667                            MACSTR, MAC2STR(data.tdls.peer));
2668                 data.tdls.oper = TDLS_REQUEST_TEARDOWN;
2669                 break;
2670         default:
2671                 wpa_printf(MSG_DEBUG, "nl80211: Unsupported TDLS operatione "
2672                            "event");
2673                 return;
2674         }
2675         if (tb[NL80211_ATTR_REASON_CODE]) {
2676                 data.tdls.reason_code =
2677                         nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
2678         }
2679
2680         wpa_supplicant_event(drv->ctx, EVENT_TDLS, &data);
2681 }
2682
2683
2684 static void nl80211_stop_ap(struct wpa_driver_nl80211_data *drv,
2685                             struct nlattr **tb)
2686 {
2687         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_UNAVAILABLE, NULL);
2688 }
2689
2690
2691 static void nl80211_connect_failed_event(struct wpa_driver_nl80211_data *drv,
2692                                          struct nlattr **tb)
2693 {
2694         union wpa_event_data data;
2695         u32 reason;
2696
2697         wpa_printf(MSG_DEBUG, "nl80211: Connect failed event");
2698
2699         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_CONN_FAILED_REASON])
2700                 return;
2701
2702         os_memset(&data, 0, sizeof(data));
2703         os_memcpy(data.connect_failed_reason.addr,
2704                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2705
2706         reason = nla_get_u32(tb[NL80211_ATTR_CONN_FAILED_REASON]);
2707         switch (reason) {
2708         case NL80211_CONN_FAIL_MAX_CLIENTS:
2709                 wpa_printf(MSG_DEBUG, "nl80211: Max client reached");
2710                 data.connect_failed_reason.code = MAX_CLIENT_REACHED;
2711                 break;
2712         case NL80211_CONN_FAIL_BLOCKED_CLIENT:
2713                 wpa_printf(MSG_DEBUG, "nl80211: Blocked client " MACSTR
2714                            " tried to connect",
2715                            MAC2STR(data.connect_failed_reason.addr));
2716                 data.connect_failed_reason.code = BLOCKED_CLIENT;
2717                 break;
2718         default:
2719                 wpa_printf(MSG_DEBUG, "nl8021l: Unknown connect failed reason "
2720                            "%u", reason);
2721                 return;
2722         }
2723
2724         wpa_supplicant_event(drv->ctx, EVENT_CONNECT_FAILED_REASON, &data);
2725 }
2726
2727
2728 static void nl80211_radar_event(struct wpa_driver_nl80211_data *drv,
2729                                 struct nlattr **tb)
2730 {
2731         union wpa_event_data data;
2732         enum nl80211_radar_event event_type;
2733
2734         if (!tb[NL80211_ATTR_WIPHY_FREQ] || !tb[NL80211_ATTR_RADAR_EVENT])
2735                 return;
2736
2737         os_memset(&data, 0, sizeof(data));
2738         data.dfs_event.freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2739         event_type = nla_get_u32(tb[NL80211_ATTR_RADAR_EVENT]);
2740
2741         /* Check HT params */
2742         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2743                 data.dfs_event.ht_enabled = 1;
2744                 data.dfs_event.chan_offset = 0;
2745
2746                 switch (nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
2747                 case NL80211_CHAN_NO_HT:
2748                         data.dfs_event.ht_enabled = 0;
2749                         break;
2750                 case NL80211_CHAN_HT20:
2751                         break;
2752                 case NL80211_CHAN_HT40PLUS:
2753                         data.dfs_event.chan_offset = 1;
2754                         break;
2755                 case NL80211_CHAN_HT40MINUS:
2756                         data.dfs_event.chan_offset = -1;
2757                         break;
2758                 }
2759         }
2760
2761         /* Get VHT params */
2762         if (tb[NL80211_ATTR_CHANNEL_WIDTH])
2763                 data.dfs_event.chan_width =
2764                         convert2width(nla_get_u32(
2765                                               tb[NL80211_ATTR_CHANNEL_WIDTH]));
2766         if (tb[NL80211_ATTR_CENTER_FREQ1])
2767                 data.dfs_event.cf1 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
2768         if (tb[NL80211_ATTR_CENTER_FREQ2])
2769                 data.dfs_event.cf2 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
2770
2771         wpa_printf(MSG_DEBUG, "nl80211: DFS event on freq %d MHz, ht: %d, offset: %d, width: %d, cf1: %dMHz, cf2: %dMHz",
2772                    data.dfs_event.freq, data.dfs_event.ht_enabled,
2773                    data.dfs_event.chan_offset, data.dfs_event.chan_width,
2774                    data.dfs_event.cf1, data.dfs_event.cf2);
2775
2776         switch (event_type) {
2777         case NL80211_RADAR_DETECTED:
2778                 wpa_supplicant_event(drv->ctx, EVENT_DFS_RADAR_DETECTED, &data);
2779                 break;
2780         case NL80211_RADAR_CAC_FINISHED:
2781                 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_FINISHED, &data);
2782                 break;
2783         case NL80211_RADAR_CAC_ABORTED:
2784                 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_ABORTED, &data);
2785                 break;
2786         case NL80211_RADAR_NOP_FINISHED:
2787                 wpa_supplicant_event(drv->ctx, EVENT_DFS_NOP_FINISHED, &data);
2788                 break;
2789         default:
2790                 wpa_printf(MSG_DEBUG, "nl80211: Unknown radar event %d "
2791                            "received", event_type);
2792                 break;
2793         }
2794 }
2795
2796
2797 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2798                                    int wds)
2799 {
2800         struct wpa_driver_nl80211_data *drv = bss->drv;
2801         union wpa_event_data event;
2802
2803         if (!tb[NL80211_ATTR_MAC])
2804                 return;
2805
2806         os_memset(&event, 0, sizeof(event));
2807         event.rx_from_unknown.bssid = bss->addr;
2808         event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2809         event.rx_from_unknown.wds = wds;
2810
2811         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2812 }
2813
2814
2815 static void qca_nl80211_avoid_freq(struct wpa_driver_nl80211_data *drv,
2816                                    const u8 *data, size_t len)
2817 {
2818         u32 i, count;
2819         union wpa_event_data event;
2820         struct wpa_freq_range *range = NULL;
2821         const struct qca_avoid_freq_list *freq_range;
2822
2823         freq_range = (const struct qca_avoid_freq_list *) data;
2824         if (len < sizeof(freq_range->count))
2825                 return;
2826
2827         count = freq_range->count;
2828         if (len < sizeof(freq_range->count) +
2829             count * sizeof(struct qca_avoid_freq_range)) {
2830                 wpa_printf(MSG_DEBUG, "nl80211: Ignored too short avoid frequency list (len=%u)",
2831                            (unsigned int) len);
2832                 return;
2833         }
2834
2835         if (count > 0) {
2836                 range = os_calloc(count, sizeof(struct wpa_freq_range));
2837                 if (range == NULL)
2838                         return;
2839         }
2840
2841         os_memset(&event, 0, sizeof(event));
2842         for (i = 0; i < count; i++) {
2843                 unsigned int idx = event.freq_range.num;
2844                 range[idx].min = freq_range->range[i].start_freq;
2845                 range[idx].max = freq_range->range[i].end_freq;
2846                 wpa_printf(MSG_DEBUG, "nl80211: Avoid frequency range: %u-%u",
2847                            range[idx].min, range[idx].max);
2848                 if (range[idx].min > range[idx].max) {
2849                         wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid frequency range");
2850                         continue;
2851                 }
2852                 event.freq_range.num++;
2853         }
2854         event.freq_range.range = range;
2855
2856         wpa_supplicant_event(drv->ctx, EVENT_AVOID_FREQUENCIES, &event);
2857
2858         os_free(range);
2859 }
2860
2861
2862 static void nl80211_vendor_event_qca(struct wpa_driver_nl80211_data *drv,
2863                                      u32 subcmd, u8 *data, size_t len)
2864 {
2865         switch (subcmd) {
2866         case QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY:
2867                 qca_nl80211_avoid_freq(drv, data, len);
2868                 break;
2869         default:
2870                 wpa_printf(MSG_DEBUG,
2871                            "nl80211: Ignore unsupported QCA vendor event %u",
2872                            subcmd);
2873                 break;
2874         }
2875 }
2876
2877
2878 static void nl80211_vendor_event(struct wpa_driver_nl80211_data *drv,
2879                                  struct nlattr **tb)
2880 {
2881         u32 vendor_id, subcmd, wiphy = 0;
2882         int wiphy_idx;
2883         u8 *data = NULL;
2884         size_t len = 0;
2885
2886         if (!tb[NL80211_ATTR_VENDOR_ID] ||
2887             !tb[NL80211_ATTR_VENDOR_SUBCMD])
2888                 return;
2889
2890         vendor_id = nla_get_u32(tb[NL80211_ATTR_VENDOR_ID]);
2891         subcmd = nla_get_u32(tb[NL80211_ATTR_VENDOR_SUBCMD]);
2892
2893         if (tb[NL80211_ATTR_WIPHY])
2894                 wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2895
2896         wpa_printf(MSG_DEBUG, "nl80211: Vendor event: wiphy=%u vendor_id=0x%x subcmd=%u",
2897                    wiphy, vendor_id, subcmd);
2898
2899         if (tb[NL80211_ATTR_VENDOR_DATA]) {
2900                 data = nla_data(tb[NL80211_ATTR_VENDOR_DATA]);
2901                 len = nla_len(tb[NL80211_ATTR_VENDOR_DATA]);
2902                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Vendor data", data, len);
2903         }
2904
2905         wiphy_idx = nl80211_get_wiphy_index(drv->first_bss);
2906         if (wiphy_idx >= 0 && wiphy_idx != (int) wiphy) {
2907                 wpa_printf(MSG_DEBUG, "nl80211: Ignore vendor event for foreign wiphy %u (own: %d)",
2908                            wiphy, wiphy_idx);
2909                 return;
2910         }
2911
2912         switch (vendor_id) {
2913         case OUI_QCA:
2914                 nl80211_vendor_event_qca(drv, subcmd, data, len);
2915                 break;
2916         default:
2917                 wpa_printf(MSG_DEBUG, "nl80211: Ignore unsupported vendor event");
2918                 break;
2919         }
2920 }
2921
2922
2923 static void nl80211_reg_change_event(struct wpa_driver_nl80211_data *drv,
2924                                      struct nlattr *tb[])
2925 {
2926         union wpa_event_data data;
2927         enum nl80211_reg_initiator init;
2928
2929         wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
2930
2931         if (tb[NL80211_ATTR_REG_INITIATOR] == NULL)
2932                 return;
2933
2934         os_memset(&data, 0, sizeof(data));
2935         init = nla_get_u8(tb[NL80211_ATTR_REG_INITIATOR]);
2936         wpa_printf(MSG_DEBUG, " * initiator=%d", init);
2937         switch (init) {
2938         case NL80211_REGDOM_SET_BY_CORE:
2939                 data.channel_list_changed.initiator = REGDOM_SET_BY_CORE;
2940                 break;
2941         case NL80211_REGDOM_SET_BY_USER:
2942                 data.channel_list_changed.initiator = REGDOM_SET_BY_USER;
2943                 break;
2944         case NL80211_REGDOM_SET_BY_DRIVER:
2945                 data.channel_list_changed.initiator = REGDOM_SET_BY_DRIVER;
2946                 break;
2947         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
2948                 data.channel_list_changed.initiator = REGDOM_SET_BY_COUNTRY_IE;
2949                 break;
2950         }
2951
2952         if (tb[NL80211_ATTR_REG_TYPE]) {
2953                 enum nl80211_reg_type type;
2954                 type = nla_get_u8(tb[NL80211_ATTR_REG_TYPE]);
2955                 wpa_printf(MSG_DEBUG, " * type=%d", type);
2956                 switch (type) {
2957                 case NL80211_REGDOM_TYPE_COUNTRY:
2958                         data.channel_list_changed.type = REGDOM_TYPE_COUNTRY;
2959                         break;
2960                 case NL80211_REGDOM_TYPE_WORLD:
2961                         data.channel_list_changed.type = REGDOM_TYPE_WORLD;
2962                         break;
2963                 case NL80211_REGDOM_TYPE_CUSTOM_WORLD:
2964                         data.channel_list_changed.type =
2965                                 REGDOM_TYPE_CUSTOM_WORLD;
2966                         break;
2967                 case NL80211_REGDOM_TYPE_INTERSECTION:
2968                         data.channel_list_changed.type =
2969                                 REGDOM_TYPE_INTERSECTION;
2970                         break;
2971                 }
2972         }
2973
2974         if (tb[NL80211_ATTR_REG_ALPHA2]) {
2975                 os_strlcpy(data.channel_list_changed.alpha2,
2976                            nla_get_string(tb[NL80211_ATTR_REG_ALPHA2]),
2977                            sizeof(data.channel_list_changed.alpha2));
2978                 wpa_printf(MSG_DEBUG, " * alpha2=%s",
2979                            data.channel_list_changed.alpha2);
2980         }
2981
2982         wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, &data);
2983 }
2984
2985
2986 static void do_process_drv_event(struct i802_bss *bss, int cmd,
2987                                  struct nlattr **tb)
2988 {
2989         struct wpa_driver_nl80211_data *drv = bss->drv;
2990         union wpa_event_data data;
2991
2992         wpa_printf(MSG_DEBUG, "nl80211: Drv Event %d (%s) received for %s",
2993                    cmd, nl80211_command_to_string(cmd), bss->ifname);
2994
2995         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
2996             (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
2997              cmd == NL80211_CMD_SCAN_ABORTED)) {
2998                 wpa_driver_nl80211_set_mode(drv->first_bss,
2999                                             drv->ap_scan_as_station);
3000                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
3001         }
3002
3003         switch (cmd) {
3004         case NL80211_CMD_TRIGGER_SCAN:
3005                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan trigger");
3006                 drv->scan_state = SCAN_STARTED;
3007                 if (drv->scan_for_auth) {
3008                         /*
3009                          * Cannot indicate EVENT_SCAN_STARTED here since we skip
3010                          * EVENT_SCAN_RESULTS in scan_for_auth case and the
3011                          * upper layer implementation could get confused about
3012                          * scanning state.
3013                          */
3014                         wpa_printf(MSG_DEBUG, "nl80211: Do not indicate scan-start event due to internal scan_for_auth");
3015                         break;
3016                 }
3017                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_STARTED, NULL);
3018                 break;
3019         case NL80211_CMD_START_SCHED_SCAN:
3020                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan started");
3021                 drv->scan_state = SCHED_SCAN_STARTED;
3022                 break;
3023         case NL80211_CMD_SCHED_SCAN_STOPPED:
3024                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan stopped");
3025                 drv->scan_state = SCHED_SCAN_STOPPED;
3026                 wpa_supplicant_event(drv->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
3027                 break;
3028         case NL80211_CMD_NEW_SCAN_RESULTS:
3029                 wpa_dbg(drv->ctx, MSG_DEBUG,
3030                         "nl80211: New scan results available");
3031                 drv->scan_state = SCAN_COMPLETED;
3032                 drv->scan_complete_events = 1;
3033                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
3034                                      drv->ctx);
3035                 send_scan_event(drv, 0, tb);
3036                 break;
3037         case NL80211_CMD_SCHED_SCAN_RESULTS:
3038                 wpa_dbg(drv->ctx, MSG_DEBUG,
3039                         "nl80211: New sched scan results available");
3040                 drv->scan_state = SCHED_SCAN_RESULTS;
3041                 send_scan_event(drv, 0, tb);
3042                 break;
3043         case NL80211_CMD_SCAN_ABORTED:
3044                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan aborted");
3045                 drv->scan_state = SCAN_ABORTED;
3046                 /*
3047                  * Need to indicate that scan results are available in order
3048                  * not to make wpa_supplicant stop its scanning.
3049                  */
3050                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
3051                                      drv->ctx);
3052                 send_scan_event(drv, 1, tb);
3053                 break;
3054         case NL80211_CMD_AUTHENTICATE:
3055         case NL80211_CMD_ASSOCIATE:
3056         case NL80211_CMD_DEAUTHENTICATE:
3057         case NL80211_CMD_DISASSOCIATE:
3058         case NL80211_CMD_FRAME_TX_STATUS:
3059         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
3060         case NL80211_CMD_UNPROT_DISASSOCIATE:
3061                 mlme_event(bss, cmd, tb[NL80211_ATTR_FRAME],
3062                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
3063                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
3064                            tb[NL80211_ATTR_COOKIE],
3065                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
3066                 break;
3067         case NL80211_CMD_CONNECT:
3068         case NL80211_CMD_ROAM:
3069                 mlme_event_connect(drv, cmd,
3070                                    tb[NL80211_ATTR_STATUS_CODE],
3071                                    tb[NL80211_ATTR_MAC],
3072                                    tb[NL80211_ATTR_REQ_IE],
3073                                    tb[NL80211_ATTR_RESP_IE]);
3074                 break;
3075         case NL80211_CMD_CH_SWITCH_NOTIFY:
3076                 mlme_event_ch_switch(drv,
3077                                      tb[NL80211_ATTR_IFINDEX],
3078                                      tb[NL80211_ATTR_WIPHY_FREQ],
3079                                      tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3080                                      tb[NL80211_ATTR_CHANNEL_WIDTH],
3081                                      tb[NL80211_ATTR_CENTER_FREQ1],
3082                                      tb[NL80211_ATTR_CENTER_FREQ2]);
3083                 break;
3084         case NL80211_CMD_DISCONNECT:
3085                 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
3086                                       tb[NL80211_ATTR_MAC],
3087                                       tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
3088                 break;
3089         case NL80211_CMD_MICHAEL_MIC_FAILURE:
3090                 mlme_event_michael_mic_failure(bss, tb);
3091                 break;
3092         case NL80211_CMD_JOIN_IBSS:
3093                 mlme_event_join_ibss(drv, tb);
3094                 break;
3095         case NL80211_CMD_REMAIN_ON_CHANNEL:
3096                 mlme_event_remain_on_channel(drv, 0, tb);
3097                 break;
3098         case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
3099                 mlme_event_remain_on_channel(drv, 1, tb);
3100                 break;
3101         case NL80211_CMD_NOTIFY_CQM:
3102                 nl80211_cqm_event(drv, tb);
3103                 break;
3104         case NL80211_CMD_REG_CHANGE:
3105                 nl80211_reg_change_event(drv, tb);
3106                 break;
3107         case NL80211_CMD_REG_BEACON_HINT:
3108                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
3109                 os_memset(&data, 0, sizeof(data));
3110                 data.channel_list_changed.initiator = REGDOM_BEACON_HINT;
3111                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
3112                                      &data);
3113                 break;
3114         case NL80211_CMD_NEW_STATION:
3115                 nl80211_new_station_event(drv, tb);
3116                 break;
3117         case NL80211_CMD_DEL_STATION:
3118                 nl80211_del_station_event(drv, tb);
3119                 break;
3120         case NL80211_CMD_SET_REKEY_OFFLOAD:
3121                 nl80211_rekey_offload_event(drv, tb);
3122                 break;
3123         case NL80211_CMD_PMKSA_CANDIDATE:
3124                 nl80211_pmksa_candidate_event(drv, tb);
3125                 break;
3126         case NL80211_CMD_PROBE_CLIENT:
3127                 nl80211_client_probe_event(drv, tb);
3128                 break;
3129         case NL80211_CMD_TDLS_OPER:
3130                 nl80211_tdls_oper_event(drv, tb);
3131                 break;
3132         case NL80211_CMD_CONN_FAILED:
3133                 nl80211_connect_failed_event(drv, tb);
3134                 break;
3135         case NL80211_CMD_FT_EVENT:
3136                 mlme_event_ft_event(drv, tb);
3137                 break;
3138         case NL80211_CMD_RADAR_DETECT:
3139                 nl80211_radar_event(drv, tb);
3140                 break;
3141         case NL80211_CMD_STOP_AP:
3142                 nl80211_stop_ap(drv, tb);
3143                 break;
3144         case NL80211_CMD_VENDOR:
3145                 nl80211_vendor_event(drv, tb);
3146                 break;
3147         default:
3148                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Ignored unknown event "
3149                         "(cmd=%d)", cmd);
3150                 break;
3151         }
3152 }
3153
3154
3155 static int process_drv_event(struct nl_msg *msg, void *arg)
3156 {
3157         struct wpa_driver_nl80211_data *drv = arg;
3158         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3159         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3160         struct i802_bss *bss;
3161         int ifidx = -1;
3162
3163         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3164                   genlmsg_attrlen(gnlh, 0), NULL);
3165
3166         if (tb[NL80211_ATTR_IFINDEX]) {
3167                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3168
3169                 for (bss = drv->first_bss; bss; bss = bss->next)
3170                         if (ifidx == -1 || ifidx == bss->ifindex) {
3171                                 do_process_drv_event(bss, gnlh->cmd, tb);
3172                                 return NL_SKIP;
3173                         }
3174                 wpa_printf(MSG_DEBUG,
3175                            "nl80211: Ignored event (cmd=%d) for foreign interface (ifindex %d)",
3176                            gnlh->cmd, ifidx);
3177         } else if (tb[NL80211_ATTR_WDEV]) {
3178                 u64 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
3179                 wpa_printf(MSG_DEBUG, "nl80211: Process event on P2P device");
3180                 for (bss = drv->first_bss; bss; bss = bss->next) {
3181                         if (bss->wdev_id_set && wdev_id == bss->wdev_id) {
3182                                 do_process_drv_event(bss, gnlh->cmd, tb);
3183                                 return NL_SKIP;
3184                         }
3185                 }
3186                 wpa_printf(MSG_DEBUG,
3187                            "nl80211: Ignored event (cmd=%d) for foreign interface (wdev 0x%llx)",
3188                            gnlh->cmd, (long long unsigned int) wdev_id);
3189         }
3190
3191         return NL_SKIP;
3192 }
3193
3194
3195 static int process_global_event(struct nl_msg *msg, void *arg)
3196 {
3197         struct nl80211_global *global = arg;
3198         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3199         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3200         struct wpa_driver_nl80211_data *drv, *tmp;
3201         int ifidx = -1;
3202         struct i802_bss *bss;
3203         u64 wdev_id = 0;
3204         int wdev_id_set = 0;
3205
3206         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3207                   genlmsg_attrlen(gnlh, 0), NULL);
3208
3209         if (tb[NL80211_ATTR_IFINDEX])
3210                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3211         else if (tb[NL80211_ATTR_WDEV]) {
3212                 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
3213                 wdev_id_set = 1;
3214         }
3215
3216         dl_list_for_each_safe(drv, tmp, &global->interfaces,
3217                               struct wpa_driver_nl80211_data, list) {
3218                 for (bss = drv->first_bss; bss; bss = bss->next) {
3219                         if ((ifidx == -1 && !wdev_id_set) ||
3220                             ifidx == bss->ifindex ||
3221                             (wdev_id_set && bss->wdev_id_set &&
3222                              wdev_id == bss->wdev_id)) {
3223                                 do_process_drv_event(bss, gnlh->cmd, tb);
3224                                 return NL_SKIP;
3225                         }
3226                 }
3227         }
3228
3229         return NL_SKIP;
3230 }
3231
3232
3233 static int process_bss_event(struct nl_msg *msg, void *arg)
3234 {
3235         struct i802_bss *bss = arg;
3236         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3237         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3238
3239         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3240                   genlmsg_attrlen(gnlh, 0), NULL);
3241
3242         wpa_printf(MSG_DEBUG, "nl80211: BSS Event %d (%s) received for %s",
3243                    gnlh->cmd, nl80211_command_to_string(gnlh->cmd),
3244                    bss->ifname);
3245
3246         switch (gnlh->cmd) {
3247         case NL80211_CMD_FRAME:
3248         case NL80211_CMD_FRAME_TX_STATUS:
3249                 mlme_event(bss, gnlh->cmd, tb[NL80211_ATTR_FRAME],
3250                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
3251                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
3252                            tb[NL80211_ATTR_COOKIE],
3253                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
3254                 break;
3255         case NL80211_CMD_UNEXPECTED_FRAME:
3256                 nl80211_spurious_frame(bss, tb, 0);
3257                 break;
3258         case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
3259                 nl80211_spurious_frame(bss, tb, 1);
3260                 break;
3261         default:
3262                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
3263                            "(cmd=%d)", gnlh->cmd);
3264                 break;
3265         }
3266
3267         return NL_SKIP;
3268 }
3269
3270
3271 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
3272                                              void *handle)
3273 {
3274         struct nl_cb *cb = eloop_ctx;
3275         int res;
3276
3277         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
3278
3279         res = nl_recvmsgs(handle, cb);
3280         if (res < 0) {
3281                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
3282                            __func__, res);
3283         }
3284 }
3285
3286
3287 /**
3288  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
3289  * @priv: driver_nl80211 private data
3290  * @alpha2_arg: country to which to switch to
3291  * Returns: 0 on success, -1 on failure
3292  *
3293  * This asks nl80211 to set the regulatory domain for given
3294  * country ISO / IEC alpha2.
3295  */
3296 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
3297 {
3298         struct i802_bss *bss = priv;
3299         struct wpa_driver_nl80211_data *drv = bss->drv;
3300         char alpha2[3];
3301         struct nl_msg *msg;
3302
3303         msg = nlmsg_alloc();
3304         if (!msg)
3305                 return -ENOMEM;
3306
3307         alpha2[0] = alpha2_arg[0];
3308         alpha2[1] = alpha2_arg[1];
3309         alpha2[2] = '\0';
3310
3311         nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
3312
3313         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
3314         if (send_and_recv_msgs(drv, msg, NULL, NULL))
3315                 return -EINVAL;
3316         return 0;
3317 nla_put_failure:
3318         nlmsg_free(msg);
3319         return -EINVAL;
3320 }
3321
3322
3323 static int nl80211_get_country(struct nl_msg *msg, void *arg)
3324 {
3325         char *alpha2 = arg;
3326         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
3327         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3328
3329         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3330                   genlmsg_attrlen(gnlh, 0), NULL);
3331         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
3332                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
3333                 return NL_SKIP;
3334         }
3335         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
3336         return NL_SKIP;
3337 }
3338
3339
3340 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
3341 {
3342         struct i802_bss *bss = priv;
3343         struct wpa_driver_nl80211_data *drv = bss->drv;
3344         struct nl_msg *msg;
3345         int ret;
3346
3347         msg = nlmsg_alloc();
3348         if (!msg)
3349                 return -ENOMEM;
3350
3351         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
3352         alpha2[0] = '\0';
3353         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
3354         if (!alpha2[0])
3355                 ret = -1;
3356
3357         return ret;
3358 }
3359
3360
3361 static int protocol_feature_handler(struct nl_msg *msg, void *arg)
3362 {
3363         u32 *feat = arg;
3364         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
3365         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3366
3367         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3368                   genlmsg_attrlen(gnlh, 0), NULL);
3369
3370         if (tb_msg[NL80211_ATTR_PROTOCOL_FEATURES])
3371                 *feat = nla_get_u32(tb_msg[NL80211_ATTR_PROTOCOL_FEATURES]);
3372
3373         return NL_SKIP;
3374 }
3375
3376
3377 static u32 get_nl80211_protocol_features(struct wpa_driver_nl80211_data *drv)
3378 {
3379         u32 feat = 0;
3380         struct nl_msg *msg;
3381
3382         msg = nlmsg_alloc();
3383         if (!msg)
3384                 goto nla_put_failure;
3385
3386         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_PROTOCOL_FEATURES);
3387         if (send_and_recv_msgs(drv, msg, protocol_feature_handler, &feat) == 0)
3388                 return feat;
3389
3390         msg = NULL;
3391 nla_put_failure:
3392         nlmsg_free(msg);
3393         return 0;
3394 }
3395
3396
3397 struct wiphy_info_data {
3398         struct wpa_driver_nl80211_data *drv;
3399         struct wpa_driver_capa *capa;
3400
3401         unsigned int num_multichan_concurrent;
3402
3403         unsigned int error:1;
3404         unsigned int device_ap_sme:1;
3405         unsigned int poll_command_supported:1;
3406         unsigned int data_tx_status:1;
3407         unsigned int monitor_supported:1;
3408         unsigned int auth_supported:1;
3409         unsigned int connect_supported:1;
3410         unsigned int p2p_go_supported:1;
3411         unsigned int p2p_client_supported:1;
3412         unsigned int p2p_concurrent:1;
3413         unsigned int channel_switch_supported:1;
3414         unsigned int set_qos_map_supported:1;
3415         unsigned int have_low_prio_scan:1;
3416 };
3417
3418
3419 static unsigned int probe_resp_offload_support(int supp_protocols)
3420 {
3421         unsigned int prot = 0;
3422
3423         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS)
3424                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS;
3425         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2)
3426                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2;
3427         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P)
3428                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P;
3429         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U)
3430                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING;
3431
3432         return prot;
3433 }
3434
3435
3436 static void wiphy_info_supported_iftypes(struct wiphy_info_data *info,
3437                                          struct nlattr *tb)
3438 {
3439         struct nlattr *nl_mode;
3440         int i;
3441
3442         if (tb == NULL)
3443                 return;
3444
3445         nla_for_each_nested(nl_mode, tb, i) {
3446                 switch (nla_type(nl_mode)) {
3447                 case NL80211_IFTYPE_AP:
3448                         info->capa->flags |= WPA_DRIVER_FLAGS_AP;
3449                         break;
3450                 case NL80211_IFTYPE_ADHOC:
3451                         info->capa->flags |= WPA_DRIVER_FLAGS_IBSS;
3452                         break;
3453                 case NL80211_IFTYPE_P2P_DEVICE:
3454                         info->capa->flags |=
3455                                 WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE;
3456                         break;
3457                 case NL80211_IFTYPE_P2P_GO:
3458                         info->p2p_go_supported = 1;
3459                         break;
3460                 case NL80211_IFTYPE_P2P_CLIENT:
3461                         info->p2p_client_supported = 1;
3462                         break;
3463                 case NL80211_IFTYPE_MONITOR:
3464                         info->monitor_supported = 1;
3465                         break;
3466                 }
3467         }
3468 }
3469
3470
3471 static int wiphy_info_iface_comb_process(struct wiphy_info_data *info,
3472                                          struct nlattr *nl_combi)
3473 {
3474         struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
3475         struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
3476         struct nlattr *nl_limit, *nl_mode;
3477         int err, rem_limit, rem_mode;
3478         int combination_has_p2p = 0, combination_has_mgd = 0;
3479         static struct nla_policy
3480         iface_combination_policy[NUM_NL80211_IFACE_COMB] = {
3481                 [NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
3482                 [NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
3483                 [NL80211_IFACE_COMB_STA_AP_BI_MATCH] = { .type = NLA_FLAG },
3484                 [NL80211_IFACE_COMB_NUM_CHANNELS] = { .type = NLA_U32 },
3485                 [NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS] = { .type = NLA_U32 },
3486         },
3487         iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
3488                 [NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
3489                 [NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
3490         };
3491
3492         err = nla_parse_nested(tb_comb, MAX_NL80211_IFACE_COMB,
3493                                nl_combi, iface_combination_policy);
3494         if (err || !tb_comb[NL80211_IFACE_COMB_LIMITS] ||
3495             !tb_comb[NL80211_IFACE_COMB_MAXNUM] ||
3496             !tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS])
3497                 return 0; /* broken combination */
3498
3499         if (tb_comb[NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS])
3500                 info->capa->flags |= WPA_DRIVER_FLAGS_RADAR;
3501
3502         nla_for_each_nested(nl_limit, tb_comb[NL80211_IFACE_COMB_LIMITS],
3503                             rem_limit) {
3504                 err = nla_parse_nested(tb_limit, MAX_NL80211_IFACE_LIMIT,
3505                                        nl_limit, iface_limit_policy);
3506                 if (err || !tb_limit[NL80211_IFACE_LIMIT_TYPES])
3507                         return 0; /* broken combination */
3508
3509                 nla_for_each_nested(nl_mode,
3510                                     tb_limit[NL80211_IFACE_LIMIT_TYPES],
3511                                     rem_mode) {
3512                         int ift = nla_type(nl_mode);
3513                         if (ift == NL80211_IFTYPE_P2P_GO ||
3514                             ift == NL80211_IFTYPE_P2P_CLIENT)
3515                                 combination_has_p2p = 1;
3516                         if (ift == NL80211_IFTYPE_STATION)
3517                                 combination_has_mgd = 1;
3518                 }
3519                 if (combination_has_p2p && combination_has_mgd)
3520                         break;
3521         }
3522
3523         if (combination_has_p2p && combination_has_mgd) {
3524                 unsigned int num_channels =
3525                         nla_get_u32(tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS]);
3526
3527                 info->p2p_concurrent = 1;
3528                 if (info->num_multichan_concurrent < num_channels)
3529                         info->num_multichan_concurrent = num_channels;
3530         }
3531
3532         return 0;
3533 }
3534
3535
3536 static void wiphy_info_iface_comb(struct wiphy_info_data *info,
3537                                   struct nlattr *tb)
3538 {
3539         struct nlattr *nl_combi;
3540         int rem_combi;
3541
3542         if (tb == NULL)
3543                 return;
3544
3545         nla_for_each_nested(nl_combi, tb, rem_combi) {
3546                 if (wiphy_info_iface_comb_process(info, nl_combi) > 0)
3547                         break;
3548         }
3549 }
3550
3551
3552 static void wiphy_info_supp_cmds(struct wiphy_info_data *info,
3553                                  struct nlattr *tb)
3554 {
3555         struct nlattr *nl_cmd;
3556         int i;
3557
3558         if (tb == NULL)
3559                 return;
3560
3561         nla_for_each_nested(nl_cmd, tb, i) {
3562                 switch (nla_get_u32(nl_cmd)) {
3563                 case NL80211_CMD_AUTHENTICATE:
3564                         info->auth_supported = 1;
3565                         break;
3566                 case NL80211_CMD_CONNECT:
3567                         info->connect_supported = 1;
3568                         break;
3569                 case NL80211_CMD_START_SCHED_SCAN:
3570                         info->capa->sched_scan_supported = 1;
3571                         break;
3572                 case NL80211_CMD_PROBE_CLIENT:
3573                         info->poll_command_supported = 1;
3574                         break;
3575                 case NL80211_CMD_CHANNEL_SWITCH:
3576                         info->channel_switch_supported = 1;
3577                         break;
3578                 case NL80211_CMD_SET_QOS_MAP:
3579                         info->set_qos_map_supported = 1;
3580                         break;
3581                 }
3582         }
3583 }
3584
3585
3586 static void wiphy_info_cipher_suites(struct wiphy_info_data *info,
3587                                      struct nlattr *tb)
3588 {
3589         int i, num;
3590         u32 *ciphers;
3591
3592         if (tb == NULL)
3593                 return;
3594
3595         num = nla_len(tb) / sizeof(u32);
3596         ciphers = nla_data(tb);
3597         for (i = 0; i < num; i++) {
3598                 u32 c = ciphers[i];
3599
3600                 wpa_printf(MSG_DEBUG, "nl80211: Supported cipher %02x-%02x-%02x:%d",
3601                            c >> 24, (c >> 16) & 0xff,
3602                            (c >> 8) & 0xff, c & 0xff);
3603                 switch (c) {
3604                 case WLAN_CIPHER_SUITE_CCMP_256:
3605                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_CCMP_256;
3606                         break;
3607                 case WLAN_CIPHER_SUITE_GCMP_256:
3608                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_GCMP_256;
3609                         break;
3610                 case WLAN_CIPHER_SUITE_CCMP:
3611                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_CCMP;
3612                         break;
3613                 case WLAN_CIPHER_SUITE_GCMP:
3614                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_GCMP;
3615                         break;
3616                 case WLAN_CIPHER_SUITE_TKIP:
3617                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_TKIP;
3618                         break;
3619                 case WLAN_CIPHER_SUITE_WEP104:
3620                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_WEP104;
3621                         break;
3622                 case WLAN_CIPHER_SUITE_WEP40:
3623                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_WEP40;
3624                         break;
3625                 case WLAN_CIPHER_SUITE_AES_CMAC:
3626                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP;
3627                         break;
3628                 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3629                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_GMAC_128;
3630                         break;
3631                 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3632                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_GMAC_256;
3633                         break;
3634                 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
3635                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_CMAC_256;
3636                         break;
3637                 case WLAN_CIPHER_SUITE_NO_GROUP_ADDR:
3638                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_GTK_NOT_USED;
3639                         break;
3640                 }
3641         }
3642 }
3643
3644
3645 static void wiphy_info_max_roc(struct wpa_driver_capa *capa,
3646                                struct nlattr *tb)
3647 {
3648         if (tb)
3649                 capa->max_remain_on_chan = nla_get_u32(tb);
3650 }
3651
3652
3653 static void wiphy_info_tdls(struct wpa_driver_capa *capa, struct nlattr *tdls,
3654                             struct nlattr *ext_setup)
3655 {
3656         if (tdls == NULL)
3657                 return;
3658
3659         wpa_printf(MSG_DEBUG, "nl80211: TDLS supported");
3660         capa->flags |= WPA_DRIVER_FLAGS_TDLS_SUPPORT;
3661
3662         if (ext_setup) {
3663                 wpa_printf(MSG_DEBUG, "nl80211: TDLS external setup");
3664                 capa->flags |= WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP;
3665         }
3666 }
3667
3668
3669 static void wiphy_info_feature_flags(struct wiphy_info_data *info,
3670                                      struct nlattr *tb)
3671 {
3672         u32 flags;
3673         struct wpa_driver_capa *capa = info->capa;
3674
3675         if (tb == NULL)
3676                 return;
3677
3678         flags = nla_get_u32(tb);
3679
3680         if (flags & NL80211_FEATURE_SK_TX_STATUS)
3681                 info->data_tx_status = 1;
3682
3683         if (flags & NL80211_FEATURE_INACTIVITY_TIMER)
3684                 capa->flags |= WPA_DRIVER_FLAGS_INACTIVITY_TIMER;
3685
3686         if (flags & NL80211_FEATURE_SAE)
3687                 capa->flags |= WPA_DRIVER_FLAGS_SAE;
3688
3689         if (flags & NL80211_FEATURE_NEED_OBSS_SCAN)
3690                 capa->flags |= WPA_DRIVER_FLAGS_OBSS_SCAN;
3691
3692         if (flags & NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)
3693                 capa->flags |= WPA_DRIVER_FLAGS_HT_2040_COEX;
3694
3695         if (flags & NL80211_FEATURE_LOW_PRIORITY_SCAN)
3696                 info->have_low_prio_scan = 1;
3697 }
3698
3699
3700 static void wiphy_info_probe_resp_offload(struct wpa_driver_capa *capa,
3701                                           struct nlattr *tb)
3702 {
3703         u32 protocols;
3704
3705         if (tb == NULL)
3706                 return;
3707
3708         protocols = nla_get_u32(tb);
3709         wpa_printf(MSG_DEBUG, "nl80211: Supports Probe Response offload in AP "
3710                    "mode");
3711         capa->flags |= WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD;
3712         capa->probe_resp_offloads = probe_resp_offload_support(protocols);
3713 }
3714
3715
3716 static void wiphy_info_wowlan_triggers(struct wpa_driver_capa *capa,
3717                                        struct nlattr *tb)
3718 {
3719         struct nlattr *triggers[MAX_NL80211_WOWLAN_TRIG + 1];
3720
3721         if (tb == NULL)
3722                 return;
3723
3724         if (nla_parse_nested(triggers, MAX_NL80211_WOWLAN_TRIG,
3725                              tb, NULL))
3726                 return;
3727
3728         if (triggers[NL80211_WOWLAN_TRIG_ANY])
3729                 capa->wowlan_triggers.any = 1;
3730         if (triggers[NL80211_WOWLAN_TRIG_DISCONNECT])
3731                 capa->wowlan_triggers.disconnect = 1;
3732         if (triggers[NL80211_WOWLAN_TRIG_MAGIC_PKT])
3733                 capa->wowlan_triggers.magic_pkt = 1;
3734         if (triggers[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE])
3735                 capa->wowlan_triggers.gtk_rekey_failure = 1;
3736         if (triggers[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST])
3737                 capa->wowlan_triggers.eap_identity_req = 1;
3738         if (triggers[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE])
3739                 capa->wowlan_triggers.four_way_handshake = 1;
3740         if (triggers[NL80211_WOWLAN_TRIG_RFKILL_RELEASE])
3741                 capa->wowlan_triggers.rfkill_release = 1;
3742 }
3743
3744
3745 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
3746 {
3747         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3748         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3749         struct wiphy_info_data *info = arg;
3750         struct wpa_driver_capa *capa = info->capa;
3751         struct wpa_driver_nl80211_data *drv = info->drv;
3752
3753         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3754                   genlmsg_attrlen(gnlh, 0), NULL);
3755
3756         if (tb[NL80211_ATTR_WIPHY_NAME])
3757                 os_strlcpy(drv->phyname,
3758                            nla_get_string(tb[NL80211_ATTR_WIPHY_NAME]),
3759                            sizeof(drv->phyname));
3760         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
3761                 capa->max_scan_ssids =
3762                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
3763
3764         if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS])
3765                 capa->max_sched_scan_ssids =
3766                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS]);
3767
3768         if (tb[NL80211_ATTR_MAX_MATCH_SETS])
3769                 capa->max_match_sets =
3770                         nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
3771
3772         if (tb[NL80211_ATTR_MAC_ACL_MAX])
3773                 capa->max_acl_mac_addrs =
3774                         nla_get_u8(tb[NL80211_ATTR_MAC_ACL_MAX]);
3775
3776         wiphy_info_supported_iftypes(info, tb[NL80211_ATTR_SUPPORTED_IFTYPES]);
3777         wiphy_info_iface_comb(info, tb[NL80211_ATTR_INTERFACE_COMBINATIONS]);
3778         wiphy_info_supp_cmds(info, tb[NL80211_ATTR_SUPPORTED_COMMANDS]);
3779         wiphy_info_cipher_suites(info, tb[NL80211_ATTR_CIPHER_SUITES]);
3780
3781         if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) {
3782                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
3783                            "off-channel TX");
3784                 capa->flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
3785         }
3786
3787         if (tb[NL80211_ATTR_ROAM_SUPPORT]) {
3788                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based roaming");
3789                 capa->flags |= WPA_DRIVER_FLAGS_BSS_SELECTION;
3790         }
3791
3792         wiphy_info_max_roc(capa,
3793                            tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
3794
3795         if (tb[NL80211_ATTR_SUPPORT_AP_UAPSD])
3796                 capa->flags |= WPA_DRIVER_FLAGS_AP_UAPSD;
3797
3798         wiphy_info_tdls(capa, tb[NL80211_ATTR_TDLS_SUPPORT],
3799                         tb[NL80211_ATTR_TDLS_EXTERNAL_SETUP]);
3800
3801         if (tb[NL80211_ATTR_DEVICE_AP_SME])
3802                 info->device_ap_sme = 1;
3803
3804         wiphy_info_feature_flags(info, tb[NL80211_ATTR_FEATURE_FLAGS]);
3805         wiphy_info_probe_resp_offload(capa,
3806                                       tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]);
3807
3808         if (tb[NL80211_ATTR_EXT_CAPA] && tb[NL80211_ATTR_EXT_CAPA_MASK] &&
3809             drv->extended_capa == NULL) {
3810                 drv->extended_capa =
3811                         os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3812                 if (drv->extended_capa) {
3813                         os_memcpy(drv->extended_capa,
3814                                   nla_data(tb[NL80211_ATTR_EXT_CAPA]),
3815                                   nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3816                         drv->extended_capa_len =
3817                                 nla_len(tb[NL80211_ATTR_EXT_CAPA]);
3818                 }
3819                 drv->extended_capa_mask =
3820                         os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3821                 if (drv->extended_capa_mask) {
3822                         os_memcpy(drv->extended_capa_mask,
3823                                   nla_data(tb[NL80211_ATTR_EXT_CAPA]),
3824                                   nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3825                 } else {
3826                         os_free(drv->extended_capa);
3827                         drv->extended_capa = NULL;
3828                         drv->extended_capa_len = 0;
3829                 }
3830         }
3831
3832         if (tb[NL80211_ATTR_VENDOR_DATA]) {
3833                 struct nlattr *nl;
3834                 int rem;
3835
3836                 nla_for_each_nested(nl, tb[NL80211_ATTR_VENDOR_DATA], rem) {
3837                         struct nl80211_vendor_cmd_info *vinfo;
3838                         if (nla_len(nl) != sizeof(*vinfo)) {
3839                                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected vendor data info");
3840                                 continue;
3841                         }
3842                         vinfo = nla_data(nl);
3843                         if (vinfo->subcmd ==
3844                             QCA_NL80211_VENDOR_SUBCMD_DFS_CAPABILITY)
3845                                 drv->dfs_vendor_cmd_avail = 1;
3846
3847                         wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
3848                                    vinfo->vendor_id, vinfo->subcmd);
3849                 }
3850         }
3851
3852         if (tb[NL80211_ATTR_VENDOR_EVENTS]) {
3853                 struct nlattr *nl;
3854                 int rem;
3855
3856                 nla_for_each_nested(nl, tb[NL80211_ATTR_VENDOR_EVENTS], rem) {
3857                         struct nl80211_vendor_cmd_info *vinfo;
3858                         if (nla_len(nl) != sizeof(*vinfo)) {
3859                                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected vendor data info");
3860                                 continue;
3861                         }
3862                         vinfo = nla_data(nl);
3863                         wpa_printf(MSG_DEBUG, "nl80211: Supported vendor event: vendor_id=0x%x subcmd=%u",
3864                                    vinfo->vendor_id, vinfo->subcmd);
3865                 }
3866         }
3867
3868         wiphy_info_wowlan_triggers(capa,
3869                                    tb[NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED]);
3870
3871         if (tb[NL80211_ATTR_MAX_AP_ASSOC_STA])
3872                 capa->max_stations =
3873                         nla_get_u32(tb[NL80211_ATTR_MAX_AP_ASSOC_STA]);
3874
3875         return NL_SKIP;
3876 }
3877
3878
3879 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
3880                                        struct wiphy_info_data *info)
3881 {
3882         u32 feat;
3883         struct nl_msg *msg;
3884
3885         os_memset(info, 0, sizeof(*info));
3886         info->capa = &drv->capa;
3887         info->drv = drv;
3888
3889         msg = nlmsg_alloc();
3890         if (!msg)
3891                 return -1;
3892
3893         feat = get_nl80211_protocol_features(drv);
3894         if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
3895                 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
3896         else
3897                 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
3898
3899         NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
3900         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
3901                 goto nla_put_failure;
3902
3903         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info))
3904                 return -1;
3905
3906         if (info->auth_supported)
3907                 drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
3908         else if (!info->connect_supported) {
3909                 wpa_printf(MSG_INFO, "nl80211: Driver does not support "
3910                            "authentication/association or connect commands");
3911                 info->error = 1;
3912         }
3913
3914         if (info->p2p_go_supported && info->p2p_client_supported)
3915                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
3916         if (info->p2p_concurrent) {
3917                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
3918                            "interface (driver advertised support)");
3919                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
3920                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
3921         }
3922         if (info->num_multichan_concurrent > 1) {
3923                 wpa_printf(MSG_DEBUG, "nl80211: Enable multi-channel "
3924                            "concurrent (driver advertised support)");
3925                 drv->capa.num_multichan_concurrent =
3926                         info->num_multichan_concurrent;
3927         }
3928
3929         /* default to 5000 since early versions of mac80211 don't set it */
3930         if (!drv->capa.max_remain_on_chan)
3931                 drv->capa.max_remain_on_chan = 5000;
3932
3933         if (info->channel_switch_supported)
3934                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_CSA;
3935
3936         return 0;
3937 nla_put_failure:
3938         nlmsg_free(msg);
3939         return -1;
3940 }
3941
3942
3943 static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
3944 {
3945         struct wiphy_info_data info;
3946         if (wpa_driver_nl80211_get_info(drv, &info))
3947                 return -1;
3948
3949         if (info.error)
3950                 return -1;
3951
3952         drv->has_capability = 1;
3953         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3954                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3955                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
3956                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
3957         drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
3958                 WPA_DRIVER_AUTH_SHARED |
3959                 WPA_DRIVER_AUTH_LEAP;
3960
3961         drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES;
3962         drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
3963         drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3964
3965         /*
3966          * As all cfg80211 drivers must support cases where the AP interface is
3967          * removed without the knowledge of wpa_supplicant/hostapd, e.g., in
3968          * case that the user space daemon has crashed, they must be able to
3969          * cleanup all stations and key entries in the AP tear down flow. Thus,
3970          * this flag can/should always be set for cfg80211 drivers.
3971          */
3972         drv->capa.flags |= WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT;
3973
3974         if (!info.device_ap_sme) {
3975                 drv->capa.flags |= WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS;
3976
3977                 /*
3978                  * No AP SME is currently assumed to also indicate no AP MLME
3979                  * in the driver/firmware.
3980                  */
3981                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_MLME;
3982         }
3983
3984         drv->device_ap_sme = info.device_ap_sme;
3985         drv->poll_command_supported = info.poll_command_supported;
3986         drv->data_tx_status = info.data_tx_status;
3987         if (info.set_qos_map_supported)
3988                 drv->capa.flags |= WPA_DRIVER_FLAGS_QOS_MAPPING;
3989         drv->have_low_prio_scan = info.have_low_prio_scan;
3990
3991         /*
3992          * If poll command and tx status are supported, mac80211 is new enough
3993          * to have everything we need to not need monitor interfaces.
3994          */
3995         drv->use_monitor = !info.poll_command_supported || !info.data_tx_status;
3996
3997         if (drv->device_ap_sme && drv->use_monitor) {
3998                 /*
3999                  * Non-mac80211 drivers may not support monitor interface.
4000                  * Make sure we do not get stuck with incorrect capability here
4001                  * by explicitly testing this.
4002                  */
4003                 if (!info.monitor_supported) {
4004                         wpa_printf(MSG_DEBUG, "nl80211: Disable use_monitor "
4005                                    "with device_ap_sme since no monitor mode "
4006                                    "support detected");
4007                         drv->use_monitor = 0;
4008                 }
4009         }
4010
4011         /*
4012          * If we aren't going to use monitor interfaces, but the
4013          * driver doesn't support data TX status, we won't get TX
4014          * status for EAPOL frames.
4015          */
4016         if (!drv->use_monitor && !info.data_tx_status)
4017                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
4018
4019         return 0;
4020 }
4021
4022
4023 #ifdef ANDROID
4024 static int android_genl_ctrl_resolve(struct nl_handle *handle,
4025                                      const char *name)
4026 {
4027         /*
4028          * Android ICS has very minimal genl_ctrl_resolve() implementation, so
4029          * need to work around that.
4030          */
4031         struct nl_cache *cache = NULL;
4032         struct genl_family *nl80211 = NULL;
4033         int id = -1;
4034
4035         if (genl_ctrl_alloc_cache(handle, &cache) < 0) {
4036                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
4037                            "netlink cache");
4038                 goto fail;
4039         }
4040
4041         nl80211 = genl_ctrl_search_by_name(cache, name);
4042         if (nl80211 == NULL)
4043                 goto fail;
4044
4045         id = genl_family_get_id(nl80211);
4046
4047 fail:
4048         if (nl80211)
4049                 genl_family_put(nl80211);
4050         if (cache)
4051                 nl_cache_free(cache);
4052
4053         return id;
4054 }
4055 #define genl_ctrl_resolve android_genl_ctrl_resolve
4056 #endif /* ANDROID */
4057
4058
4059 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
4060 {
4061         int ret;
4062
4063         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4064         if (global->nl_cb == NULL) {
4065                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
4066                            "callbacks");
4067                 return -1;
4068         }
4069
4070         global->nl = nl_create_handle(global->nl_cb, "nl");
4071         if (global->nl == NULL)
4072                 goto err;
4073
4074         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
4075         if (global->nl80211_id < 0) {
4076                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
4077                            "found");
4078                 goto err;
4079         }
4080
4081         global->nl_event = nl_create_handle(global->nl_cb, "event");
4082         if (global->nl_event == NULL)
4083                 goto err;
4084
4085         ret = nl_get_multicast_id(global, "nl80211", "scan");
4086         if (ret >= 0)
4087                 ret = nl_socket_add_membership(global->nl_event, ret);
4088         if (ret < 0) {
4089                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
4090                            "membership for scan events: %d (%s)",
4091                            ret, strerror(-ret));
4092                 goto err;
4093         }
4094
4095         ret = nl_get_multicast_id(global, "nl80211", "mlme");
4096         if (ret >= 0)
4097                 ret = nl_socket_add_membership(global->nl_event, ret);
4098         if (ret < 0) {
4099                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
4100                            "membership for mlme events: %d (%s)",
4101                            ret, strerror(-ret));
4102                 goto err;
4103         }
4104
4105         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
4106         if (ret >= 0)
4107                 ret = nl_socket_add_membership(global->nl_event, ret);
4108         if (ret < 0) {
4109                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4110                            "membership for regulatory events: %d (%s)",
4111                            ret, strerror(-ret));
4112                 /* Continue without regulatory events */
4113         }
4114
4115         ret = nl_get_multicast_id(global, "nl80211", "vendor");
4116         if (ret >= 0)
4117                 ret = nl_socket_add_membership(global->nl_event, ret);
4118         if (ret < 0) {
4119                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4120                            "membership for vendor events: %d (%s)",
4121                            ret, strerror(-ret));
4122                 /* Continue without vendor events */
4123         }
4124
4125         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
4126                   no_seq_check, NULL);
4127         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
4128                   process_global_event, global);
4129
4130         nl80211_register_eloop_read(&global->nl_event,
4131                                     wpa_driver_nl80211_event_receive,
4132                                     global->nl_cb);
4133
4134         return 0;
4135
4136 err:
4137         nl_destroy_handles(&global->nl_event);
4138         nl_destroy_handles(&global->nl);
4139         nl_cb_put(global->nl_cb);
4140         global->nl_cb = NULL;
4141         return -1;
4142 }
4143
4144
4145 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
4146 {
4147         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4148         if (!drv->nl_cb) {
4149                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
4150                 return -1;
4151         }
4152
4153         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
4154                   no_seq_check, NULL);
4155         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
4156                   process_drv_event, drv);
4157
4158         return 0;
4159 }
4160
4161
4162 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
4163 {
4164         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
4165         /*
4166          * This may be for any interface; use ifdown event to disable
4167          * interface.
4168          */
4169 }
4170
4171
4172 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
4173 {
4174         struct wpa_driver_nl80211_data *drv = ctx;
4175         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
4176         if (i802_set_iface_flags(drv->first_bss, 1)) {
4177                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
4178                            "after rfkill unblock");
4179                 return;
4180         }
4181         /* rtnetlink ifup handler will report interface as enabled */
4182 }
4183
4184
4185 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
4186                                                       void *eloop_ctx,
4187                                                       void *handle)
4188 {
4189         struct wpa_driver_nl80211_data *drv = eloop_ctx;
4190         u8 data[2048];
4191         struct msghdr msg;
4192         struct iovec entry;
4193         u8 control[512];
4194         struct cmsghdr *cmsg;
4195         int res, found_ee = 0, found_wifi = 0, acked = 0;
4196         union wpa_event_data event;
4197
4198         memset(&msg, 0, sizeof(msg));
4199         msg.msg_iov = &entry;
4200         msg.msg_iovlen = 1;
4201         entry.iov_base = data;
4202         entry.iov_len = sizeof(data);
4203         msg.msg_control = &control;
4204         msg.msg_controllen = sizeof(control);
4205
4206         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
4207         /* if error or not fitting 802.3 header, return */
4208         if (res < 14)
4209                 return;
4210
4211         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
4212         {
4213                 if (cmsg->cmsg_level == SOL_SOCKET &&
4214                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
4215                         int *ack;
4216
4217                         found_wifi = 1;
4218                         ack = (void *)CMSG_DATA(cmsg);
4219                         acked = *ack;
4220                 }
4221
4222                 if (cmsg->cmsg_level == SOL_PACKET &&
4223                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
4224                         struct sock_extended_err *err =
4225                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
4226
4227                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
4228                                 found_ee = 1;
4229                 }
4230         }
4231
4232         if (!found_ee || !found_wifi)
4233                 return;
4234
4235         memset(&event, 0, sizeof(event));
4236         event.eapol_tx_status.dst = data;
4237         event.eapol_tx_status.data = data + 14;
4238         event.eapol_tx_status.data_len = res - 14;
4239         event.eapol_tx_status.ack = acked;
4240         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
4241 }
4242
4243
4244 static int nl80211_init_bss(struct i802_bss *bss)
4245 {
4246         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4247         if (!bss->nl_cb)
4248                 return -1;
4249
4250         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
4251                   no_seq_check, NULL);
4252         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
4253                   process_bss_event, bss);
4254
4255         return 0;
4256 }
4257
4258
4259 static void nl80211_destroy_bss(struct i802_bss *bss)
4260 {
4261         nl_cb_put(bss->nl_cb);
4262         bss->nl_cb = NULL;
4263 }
4264
4265
4266 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
4267                                           void *global_priv, int hostapd,
4268                                           const u8 *set_addr)
4269 {
4270         struct wpa_driver_nl80211_data *drv;
4271         struct rfkill_config *rcfg;
4272         struct i802_bss *bss;
4273
4274         if (global_priv == NULL)
4275                 return NULL;
4276         drv = os_zalloc(sizeof(*drv));
4277         if (drv == NULL)
4278                 return NULL;
4279         drv->global = global_priv;
4280         drv->ctx = ctx;
4281         drv->hostapd = !!hostapd;
4282         drv->eapol_sock = -1;
4283         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
4284         drv->if_indices = drv->default_if_indices;
4285
4286         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
4287         if (!drv->first_bss) {
4288                 os_free(drv);
4289                 return NULL;
4290         }
4291         bss = drv->first_bss;
4292         bss->drv = drv;
4293         bss->ctx = ctx;
4294
4295         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
4296         drv->monitor_ifidx = -1;
4297         drv->monitor_sock = -1;
4298         drv->eapol_tx_sock = -1;
4299         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
4300
4301         if (wpa_driver_nl80211_init_nl(drv)) {
4302                 os_free(drv);
4303                 return NULL;
4304         }
4305
4306         if (nl80211_init_bss(bss))
4307                 goto failed;
4308
4309         rcfg = os_zalloc(sizeof(*rcfg));
4310         if (rcfg == NULL)
4311                 goto failed;
4312         rcfg->ctx = drv;
4313         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
4314         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
4315         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
4316         drv->rfkill = rfkill_init(rcfg);
4317         if (drv->rfkill == NULL) {
4318                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
4319                 os_free(rcfg);
4320         }
4321
4322         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
4323                 drv->start_iface_up = 1;
4324
4325         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1))
4326                 goto failed;
4327
4328         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
4329         if (drv->eapol_tx_sock < 0)
4330                 goto failed;
4331
4332         if (drv->data_tx_status) {
4333                 int enabled = 1;
4334
4335                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
4336                                &enabled, sizeof(enabled)) < 0) {
4337                         wpa_printf(MSG_DEBUG,
4338                                 "nl80211: wifi status sockopt failed\n");
4339                         drv->data_tx_status = 0;
4340                         if (!drv->use_monitor)
4341                                 drv->capa.flags &=
4342                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
4343                 } else {
4344                         eloop_register_read_sock(drv->eapol_tx_sock,
4345                                 wpa_driver_nl80211_handle_eapol_tx_status,
4346                                 drv, NULL);
4347                 }
4348         }
4349
4350         if (drv->global) {
4351                 dl_list_add(&drv->global->interfaces, &drv->list);
4352                 drv->in_interface_list = 1;
4353         }
4354
4355         return bss;
4356
4357 failed:
4358         wpa_driver_nl80211_deinit(bss);
4359         return NULL;
4360 }
4361
4362
4363 /**
4364  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
4365  * @ctx: context to be used when calling wpa_supplicant functions,
4366  * e.g., wpa_supplicant_event()
4367  * @ifname: interface name, e.g., wlan0
4368  * @global_priv: private driver global data from global_init()
4369  * Returns: Pointer to private data, %NULL on failure
4370  */
4371 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
4372                                       void *global_priv)
4373 {
4374         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL);
4375 }
4376
4377
4378 static int nl80211_register_frame(struct i802_bss *bss,
4379                                   struct nl_handle *nl_handle,
4380                                   u16 type, const u8 *match, size_t match_len)
4381 {
4382         struct wpa_driver_nl80211_data *drv = bss->drv;
4383         struct nl_msg *msg;
4384         int ret = -1;
4385         char buf[30];
4386
4387         msg = nlmsg_alloc();
4388         if (!msg)
4389                 return -1;
4390
4391         buf[0] = '\0';
4392         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
4393         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x nl_handle=%p match=%s",
4394                    type, nl_handle, buf);
4395
4396         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
4397
4398         if (nl80211_set_iface_id(msg, bss) < 0)
4399                 goto nla_put_failure;
4400
4401         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
4402         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
4403
4404         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
4405         msg = NULL;
4406         if (ret) {
4407                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
4408                            "failed (type=%u): ret=%d (%s)",
4409                            type, ret, strerror(-ret));
4410                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
4411                             match, match_len);
4412                 goto nla_put_failure;
4413         }
4414         ret = 0;
4415 nla_put_failure:
4416         nlmsg_free(msg);
4417         return ret;
4418 }
4419
4420
4421 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
4422 {
4423         struct wpa_driver_nl80211_data *drv = bss->drv;
4424
4425         if (bss->nl_mgmt) {
4426                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
4427                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
4428                 return -1;
4429         }
4430
4431         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
4432         if (bss->nl_mgmt == NULL)
4433                 return -1;
4434
4435         return 0;
4436 }
4437
4438
4439 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
4440 {
4441         nl80211_register_eloop_read(&bss->nl_mgmt,
4442                                     wpa_driver_nl80211_event_receive,
4443                                     bss->nl_cb);
4444 }
4445
4446
4447 static int nl80211_register_action_frame(struct i802_bss *bss,
4448                                          const u8 *match, size_t match_len)
4449 {
4450         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
4451         return nl80211_register_frame(bss, bss->nl_mgmt,
4452                                       type, match, match_len);
4453 }
4454
4455
4456 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
4457 {
4458         struct wpa_driver_nl80211_data *drv = bss->drv;
4459         int ret = 0;
4460
4461         if (nl80211_alloc_mgmt_handle(bss))
4462                 return -1;
4463         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
4464                    "handle %p", bss->nl_mgmt);
4465
4466         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
4467                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
4468
4469                 /* register for any AUTH message */
4470                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
4471         }
4472
4473 #ifdef CONFIG_INTERWORKING
4474         /* QoS Map Configure */
4475         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
4476                 ret = -1;
4477 #endif /* CONFIG_INTERWORKING */
4478 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
4479         /* GAS Initial Request */
4480         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
4481                 ret = -1;
4482         /* GAS Initial Response */
4483         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
4484                 ret = -1;
4485         /* GAS Comeback Request */
4486         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
4487                 ret = -1;
4488         /* GAS Comeback Response */
4489         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
4490                 ret = -1;
4491         /* Protected GAS Initial Request */
4492         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
4493                 ret = -1;
4494         /* Protected GAS Initial Response */
4495         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
4496                 ret = -1;
4497         /* Protected GAS Comeback Request */
4498         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
4499                 ret = -1;
4500         /* Protected GAS Comeback Response */
4501         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
4502                 ret = -1;
4503 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
4504 #ifdef CONFIG_P2P
4505         /* P2P Public Action */
4506         if (nl80211_register_action_frame(bss,
4507                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
4508                                           6) < 0)
4509                 ret = -1;
4510         /* P2P Action */
4511         if (nl80211_register_action_frame(bss,
4512                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
4513                                           5) < 0)
4514                 ret = -1;
4515 #endif /* CONFIG_P2P */
4516 #ifdef CONFIG_IEEE80211W
4517         /* SA Query Response */
4518         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
4519                 ret = -1;
4520 #endif /* CONFIG_IEEE80211W */
4521 #ifdef CONFIG_TDLS
4522         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
4523                 /* TDLS Discovery Response */
4524                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
4525                     0)
4526                         ret = -1;
4527         }
4528 #endif /* CONFIG_TDLS */
4529
4530         /* FT Action frames */
4531         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
4532                 ret = -1;
4533         else
4534                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
4535                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
4536
4537         /* WNM - BSS Transition Management Request */
4538         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
4539                 ret = -1;
4540         /* WNM-Sleep Mode Response */
4541         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
4542                 ret = -1;
4543
4544 #ifdef CONFIG_HS20
4545         /* WNM-Notification */
4546         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
4547                 return -1;
4548 #endif /* CONFIG_HS20 */
4549
4550         nl80211_mgmt_handle_register_eloop(bss);
4551
4552         return ret;
4553 }
4554
4555
4556 static int nl80211_register_spurious_class3(struct i802_bss *bss)
4557 {
4558         struct wpa_driver_nl80211_data *drv = bss->drv;
4559         struct nl_msg *msg;
4560         int ret = -1;
4561
4562         msg = nlmsg_alloc();
4563         if (!msg)
4564                 return -1;
4565
4566         nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
4567
4568         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
4569
4570         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
4571         msg = NULL;
4572         if (ret) {
4573                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
4574                            "failed: ret=%d (%s)",
4575                            ret, strerror(-ret));
4576                 goto nla_put_failure;
4577         }
4578         ret = 0;
4579 nla_put_failure:
4580         nlmsg_free(msg);
4581         return ret;
4582 }
4583
4584
4585 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
4586 {
4587         static const int stypes[] = {
4588                 WLAN_FC_STYPE_AUTH,
4589                 WLAN_FC_STYPE_ASSOC_REQ,
4590                 WLAN_FC_STYPE_REASSOC_REQ,
4591                 WLAN_FC_STYPE_DISASSOC,
4592                 WLAN_FC_STYPE_DEAUTH,
4593                 WLAN_FC_STYPE_ACTION,
4594                 WLAN_FC_STYPE_PROBE_REQ,
4595 /* Beacon doesn't work as mac80211 doesn't currently allow
4596  * it, but it wouldn't really be the right thing anyway as
4597  * it isn't per interface ... maybe just dump the scan
4598  * results periodically for OLBC?
4599  */
4600                 /* WLAN_FC_STYPE_BEACON, */
4601         };
4602         unsigned int i;
4603
4604         if (nl80211_alloc_mgmt_handle(bss))
4605                 return -1;
4606         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
4607                    "handle %p", bss->nl_mgmt);
4608
4609         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
4610                 if (nl80211_register_frame(bss, bss->nl_mgmt,
4611                                            (WLAN_FC_TYPE_MGMT << 2) |
4612                                            (stypes[i] << 4),
4613                                            NULL, 0) < 0) {
4614                         goto out_err;
4615                 }
4616         }
4617
4618         if (nl80211_register_spurious_class3(bss))
4619                 goto out_err;
4620
4621         if (nl80211_get_wiphy_data_ap(bss) == NULL)
4622                 goto out_err;
4623
4624         nl80211_mgmt_handle_register_eloop(bss);
4625         return 0;
4626
4627 out_err:
4628         nl_destroy_handles(&bss->nl_mgmt);
4629         return -1;
4630 }
4631
4632
4633 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
4634 {
4635         if (nl80211_alloc_mgmt_handle(bss))
4636                 return -1;
4637         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
4638                    "handle %p (device SME)", bss->nl_mgmt);
4639
4640         if (nl80211_register_frame(bss, bss->nl_mgmt,
4641                                    (WLAN_FC_TYPE_MGMT << 2) |
4642                                    (WLAN_FC_STYPE_ACTION << 4),
4643                                    NULL, 0) < 0)
4644                 goto out_err;
4645
4646         nl80211_mgmt_handle_register_eloop(bss);
4647         return 0;
4648
4649 out_err:
4650         nl_destroy_handles(&bss->nl_mgmt);
4651         return -1;
4652 }
4653
4654
4655 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
4656 {
4657         if (bss->nl_mgmt == NULL)
4658                 return;
4659         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
4660                    "(%s)", bss->nl_mgmt, reason);
4661         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
4662
4663         nl80211_put_wiphy_data_ap(bss);
4664 }
4665
4666
4667 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
4668 {
4669         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
4670 }
4671
4672
4673 static void nl80211_del_p2pdev(struct i802_bss *bss)
4674 {
4675         struct wpa_driver_nl80211_data *drv = bss->drv;
4676         struct nl_msg *msg;
4677         int ret;
4678
4679         msg = nlmsg_alloc();
4680         if (!msg)
4681                 return;
4682
4683         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
4684         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
4685
4686         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4687         msg = NULL;
4688
4689         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
4690                    bss->ifname, (long long unsigned int) bss->wdev_id,
4691                    strerror(-ret));
4692
4693 nla_put_failure:
4694         nlmsg_free(msg);
4695 }
4696
4697
4698 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
4699 {
4700         struct wpa_driver_nl80211_data *drv = bss->drv;
4701         struct nl_msg *msg;
4702         int ret = -1;
4703
4704         msg = nlmsg_alloc();
4705         if (!msg)
4706                 return -1;
4707
4708         if (start)
4709                 nl80211_cmd(drv, msg, 0, NL80211_CMD_START_P2P_DEVICE);
4710         else
4711                 nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_P2P_DEVICE);
4712
4713         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
4714
4715         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4716         msg = NULL;
4717
4718         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
4719                    start ? "Start" : "Stop",
4720                    bss->ifname, (long long unsigned int) bss->wdev_id,
4721                    strerror(-ret));
4722
4723 nla_put_failure:
4724         nlmsg_free(msg);
4725         return ret;
4726 }
4727
4728
4729 static int i802_set_iface_flags(struct i802_bss *bss, int up)
4730 {
4731         enum nl80211_iftype nlmode;
4732
4733         nlmode = nl80211_get_ifmode(bss);
4734         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
4735                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
4736                                              bss->ifname, up);
4737         }
4738
4739         /* P2P Device has start/stop which is equivalent */
4740         return nl80211_set_p2pdev(bss, up);
4741 }
4742
4743
4744 static int
4745 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
4746                                    const u8 *set_addr, int first)
4747 {
4748         struct i802_bss *bss = drv->first_bss;
4749         int send_rfkill_event = 0;
4750         enum nl80211_iftype nlmode;
4751
4752         drv->ifindex = if_nametoindex(bss->ifname);
4753         bss->ifindex = drv->ifindex;
4754         bss->wdev_id = drv->global->if_add_wdevid;
4755         bss->wdev_id_set = drv->global->if_add_wdevid_set;
4756
4757         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
4758         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
4759         drv->global->if_add_wdevid_set = 0;
4760
4761         if (wpa_driver_nl80211_capa(drv))
4762                 return -1;
4763
4764         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
4765                    bss->ifname, drv->phyname);
4766
4767         if (set_addr &&
4768             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
4769              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
4770                                 set_addr)))
4771                 return -1;
4772
4773         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
4774                 drv->start_mode_ap = 1;
4775
4776         if (drv->hostapd)
4777                 nlmode = NL80211_IFTYPE_AP;
4778         else if (bss->if_dynamic)
4779                 nlmode = nl80211_get_ifmode(bss);
4780         else
4781                 nlmode = NL80211_IFTYPE_STATION;
4782
4783         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
4784                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
4785                 return -1;
4786         }
4787
4788         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
4789                 nl80211_get_macaddr(bss);
4790
4791         if (!rfkill_is_blocked(drv->rfkill)) {
4792                 int ret = i802_set_iface_flags(bss, 1);
4793                 if (ret) {
4794                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
4795                                    "interface '%s' UP", bss->ifname);
4796                         return ret;
4797                 }
4798                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
4799                         return ret;
4800         } else {
4801                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
4802                            "interface '%s' due to rfkill", bss->ifname);
4803                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
4804                         return 0;
4805                 drv->if_disabled = 1;
4806                 send_rfkill_event = 1;
4807         }
4808
4809         if (!drv->hostapd)
4810                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
4811                                        1, IF_OPER_DORMANT);
4812
4813         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
4814                                bss->addr))
4815                 return -1;
4816
4817         if (send_rfkill_event) {
4818                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
4819                                        drv, drv->ctx);
4820         }
4821
4822         return 0;
4823 }
4824
4825
4826 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
4827 {
4828         struct nl_msg *msg;
4829
4830         msg = nlmsg_alloc();
4831         if (!msg)
4832                 return -ENOMEM;
4833
4834         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
4835                    drv->ifindex);
4836         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
4837         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4838
4839         return send_and_recv_msgs(drv, msg, NULL, NULL);
4840  nla_put_failure:
4841         nlmsg_free(msg);
4842         return -ENOBUFS;
4843 }
4844
4845
4846 /**
4847  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
4848  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
4849  *
4850  * Shut down driver interface and processing of driver events. Free
4851  * private data buffer if one was allocated in wpa_driver_nl80211_init().
4852  */
4853 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
4854 {
4855         struct wpa_driver_nl80211_data *drv = bss->drv;
4856
4857         bss->in_deinit = 1;
4858         if (drv->data_tx_status)
4859                 eloop_unregister_read_sock(drv->eapol_tx_sock);
4860         if (drv->eapol_tx_sock >= 0)
4861                 close(drv->eapol_tx_sock);
4862
4863         if (bss->nl_preq)
4864                 wpa_driver_nl80211_probe_req_report(bss, 0);
4865         if (bss->added_if_into_bridge) {
4866                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
4867                                     bss->ifname) < 0)
4868                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
4869                                    "interface %s from bridge %s: %s",
4870                                    bss->ifname, bss->brname, strerror(errno));
4871         }
4872         if (bss->added_bridge) {
4873                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
4874                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
4875                                    "bridge %s: %s",
4876                                    bss->brname, strerror(errno));
4877         }
4878
4879         nl80211_remove_monitor_interface(drv);
4880
4881         if (is_ap_interface(drv->nlmode))
4882                 wpa_driver_nl80211_del_beacon(drv);
4883
4884         if (drv->eapol_sock >= 0) {
4885                 eloop_unregister_read_sock(drv->eapol_sock);
4886                 close(drv->eapol_sock);
4887         }
4888
4889         if (drv->if_indices != drv->default_if_indices)
4890                 os_free(drv->if_indices);
4891
4892         if (drv->disabled_11b_rates)
4893                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
4894
4895         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
4896                                IF_OPER_UP);
4897         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
4898         rfkill_deinit(drv->rfkill);
4899
4900         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
4901
4902         if (!drv->start_iface_up)
4903                 (void) i802_set_iface_flags(bss, 0);
4904         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
4905                 if (!drv->hostapd || !drv->start_mode_ap)
4906                         wpa_driver_nl80211_set_mode(bss,
4907                                                     NL80211_IFTYPE_STATION);
4908                 nl80211_mgmt_unsubscribe(bss, "deinit");
4909         } else {
4910                 nl80211_mgmt_unsubscribe(bss, "deinit");
4911                 nl80211_del_p2pdev(bss);
4912         }
4913         nl_cb_put(drv->nl_cb);
4914
4915         nl80211_destroy_bss(drv->first_bss);
4916
4917         os_free(drv->filter_ssids);
4918
4919         os_free(drv->auth_ie);
4920
4921         if (drv->in_interface_list)
4922                 dl_list_del(&drv->list);
4923
4924         os_free(drv->extended_capa);
4925         os_free(drv->extended_capa_mask);
4926         os_free(drv->first_bss);
4927         os_free(drv);
4928 }
4929
4930
4931 /**
4932  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
4933  * @eloop_ctx: Driver private data
4934  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
4935  *
4936  * This function can be used as registered timeout when starting a scan to
4937  * generate a scan completed event if the driver does not report this.
4938  */
4939 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
4940 {
4941         struct wpa_driver_nl80211_data *drv = eloop_ctx;
4942         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
4943                 wpa_driver_nl80211_set_mode(drv->first_bss,
4944                                             drv->ap_scan_as_station);
4945                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
4946         }
4947         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
4948         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
4949 }
4950
4951
4952 static struct nl_msg *
4953 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
4954                     struct wpa_driver_scan_params *params, u64 *wdev_id)
4955 {
4956         struct nl_msg *msg;
4957         size_t i;
4958         u32 scan_flags = 0;
4959
4960         msg = nlmsg_alloc();
4961         if (!msg)
4962                 return NULL;
4963
4964         nl80211_cmd(drv, msg, 0, cmd);
4965
4966         if (!wdev_id)
4967                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4968         else
4969                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, *wdev_id);
4970
4971         if (params->num_ssids) {
4972                 struct nlattr *ssids;
4973
4974                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4975                 if (ssids == NULL)
4976                         goto fail;
4977                 for (i = 0; i < params->num_ssids; i++) {
4978                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
4979                                           params->ssids[i].ssid,
4980                                           params->ssids[i].ssid_len);
4981                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
4982                                     params->ssids[i].ssid) < 0)
4983                                 goto fail;
4984                 }
4985                 nla_nest_end(msg, ssids);
4986         }
4987
4988         if (params->extra_ies) {
4989                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
4990                             params->extra_ies, params->extra_ies_len);
4991                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
4992                             params->extra_ies) < 0)
4993                         goto fail;
4994         }
4995
4996         if (params->freqs) {
4997                 struct nlattr *freqs;
4998                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4999                 if (freqs == NULL)
5000                         goto fail;
5001                 for (i = 0; params->freqs[i]; i++) {
5002                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
5003                                    "MHz", params->freqs[i]);
5004                         if (nla_put_u32(msg, i + 1, params->freqs[i]) < 0)
5005                                 goto fail;
5006                 }
5007                 nla_nest_end(msg, freqs);
5008         }
5009
5010         os_free(drv->filter_ssids);
5011         drv->filter_ssids = params->filter_ssids;
5012         params->filter_ssids = NULL;
5013         drv->num_filter_ssids = params->num_filter_ssids;
5014
5015         if (params->only_new_results) {
5016                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
5017                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
5018         }
5019
5020         if (params->low_priority && drv->have_low_prio_scan) {
5021                 wpa_printf(MSG_DEBUG,
5022                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
5023                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
5024         }
5025
5026         if (scan_flags)
5027                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags);
5028
5029         return msg;
5030
5031 fail:
5032 nla_put_failure:
5033         nlmsg_free(msg);
5034         return NULL;
5035 }
5036
5037
5038 /**
5039  * wpa_driver_nl80211_scan - Request the driver to initiate scan
5040  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
5041  * @params: Scan parameters
5042  * Returns: 0 on success, -1 on failure
5043  */
5044 static int wpa_driver_nl80211_scan(struct i802_bss *bss,
5045                                    struct wpa_driver_scan_params *params)
5046 {
5047         struct wpa_driver_nl80211_data *drv = bss->drv;
5048         int ret = -1, timeout;
5049         struct nl_msg *msg = NULL;
5050
5051         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
5052         drv->scan_for_auth = 0;
5053
5054         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params,
5055                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
5056         if (!msg)
5057                 return -1;
5058
5059         if (params->p2p_probe) {
5060                 struct nlattr *rates;
5061
5062                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
5063
5064                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
5065                 if (rates == NULL)
5066                         goto nla_put_failure;
5067
5068                 /*
5069                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
5070                  * by masking out everything else apart from the OFDM rates 6,
5071                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
5072                  * rates are left enabled.
5073                  */
5074                 NLA_PUT(msg, NL80211_BAND_2GHZ, 8,
5075                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
5076                 nla_nest_end(msg, rates);
5077
5078                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
5079         }
5080
5081         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5082         msg = NULL;
5083         if (ret) {
5084                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
5085                            "(%s)", ret, strerror(-ret));
5086                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
5087                         enum nl80211_iftype old_mode = drv->nlmode;
5088
5089                         /*
5090                          * mac80211 does not allow scan requests in AP mode, so
5091                          * try to do this in station mode.
5092                          */
5093                         if (wpa_driver_nl80211_set_mode(
5094                                     bss, NL80211_IFTYPE_STATION))
5095                                 goto nla_put_failure;
5096
5097                         if (wpa_driver_nl80211_scan(bss, params)) {
5098                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
5099                                 goto nla_put_failure;
5100                         }
5101
5102                         /* Restore AP mode when processing scan results */
5103                         drv->ap_scan_as_station = old_mode;
5104                         ret = 0;
5105                 } else
5106                         goto nla_put_failure;
5107         }
5108
5109         drv->scan_state = SCAN_REQUESTED;
5110         /* Not all drivers generate "scan completed" wireless event, so try to
5111          * read results after a timeout. */
5112         timeout = 10;
5113         if (drv->scan_complete_events) {
5114                 /*
5115                  * The driver seems to deliver events to notify when scan is
5116                  * complete, so use longer timeout to avoid race conditions
5117                  * with scanning and following association request.
5118                  */
5119                 timeout = 30;
5120         }
5121         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
5122                    "seconds", ret, timeout);
5123         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
5124         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
5125                                drv, drv->ctx);
5126
5127 nla_put_failure:
5128         nlmsg_free(msg);
5129         return ret;
5130 }
5131
5132
5133 /**
5134  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
5135  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
5136  * @params: Scan parameters
5137  * @interval: Interval between scan cycles in milliseconds
5138  * Returns: 0 on success, -1 on failure or if not supported
5139  */
5140 static int wpa_driver_nl80211_sched_scan(void *priv,
5141                                          struct wpa_driver_scan_params *params,
5142                                          u32 interval)
5143 {
5144         struct i802_bss *bss = priv;
5145         struct wpa_driver_nl80211_data *drv = bss->drv;
5146         int ret = -1;
5147         struct nl_msg *msg;
5148         size_t i;
5149
5150         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
5151
5152 #ifdef ANDROID
5153         if (!drv->capa.sched_scan_supported)
5154                 return android_pno_start(bss, params);
5155 #endif /* ANDROID */
5156
5157         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params,
5158                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
5159         if (!msg)
5160                 goto nla_put_failure;
5161
5162         NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
5163
5164         if ((drv->num_filter_ssids &&
5165             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
5166             params->filter_rssi) {
5167                 struct nlattr *match_sets;
5168                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
5169                 if (match_sets == NULL)
5170                         goto nla_put_failure;
5171
5172                 for (i = 0; i < drv->num_filter_ssids; i++) {
5173                         struct nlattr *match_set_ssid;
5174                         wpa_hexdump_ascii(MSG_MSGDUMP,
5175                                           "nl80211: Sched scan filter SSID",
5176                                           drv->filter_ssids[i].ssid,
5177                                           drv->filter_ssids[i].ssid_len);
5178
5179                         match_set_ssid = nla_nest_start(msg, i + 1);
5180                         if (match_set_ssid == NULL)
5181                                 goto nla_put_failure;
5182                         NLA_PUT(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
5183                                 drv->filter_ssids[i].ssid_len,
5184                                 drv->filter_ssids[i].ssid);
5185                         if (params->filter_rssi)
5186                                 NLA_PUT_U32(msg,
5187                                             NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
5188                                             params->filter_rssi);
5189
5190                         nla_nest_end(msg, match_set_ssid);
5191                 }
5192
5193                 /*
5194                  * Due to backward compatibility code, newer kernels treat this
5195                  * matchset (with only an RSSI filter) as the default for all
5196                  * other matchsets, unless it's the only one, in which case the
5197                  * matchset will actually allow all SSIDs above the RSSI.
5198                  */
5199                 if (params->filter_rssi) {
5200                         struct nlattr *match_set_rssi;
5201                         match_set_rssi = nla_nest_start(msg, 0);
5202                         if (match_set_rssi == NULL)
5203                                 goto nla_put_failure;
5204                         NLA_PUT_U32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
5205                                     params->filter_rssi);
5206                         wpa_printf(MSG_MSGDUMP,
5207                                    "nl80211: Sched scan RSSI filter %d dBm",
5208                                    params->filter_rssi);
5209                         nla_nest_end(msg, match_set_rssi);
5210                 }
5211
5212                 nla_nest_end(msg, match_sets);
5213         }
5214
5215         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5216
5217         /* TODO: if we get an error here, we should fall back to normal scan */
5218
5219         msg = NULL;
5220         if (ret) {
5221                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
5222                            "ret=%d (%s)", ret, strerror(-ret));
5223                 goto nla_put_failure;
5224         }
5225
5226         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
5227                    "scan interval %d msec", ret, interval);
5228
5229 nla_put_failure:
5230         nlmsg_free(msg);
5231         return ret;
5232 }
5233
5234
5235 /**
5236  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
5237  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
5238  * Returns: 0 on success, -1 on failure or if not supported
5239  */
5240 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
5241 {
5242         struct i802_bss *bss = priv;
5243         struct wpa_driver_nl80211_data *drv = bss->drv;
5244         int ret = 0;
5245         struct nl_msg *msg;
5246
5247 #ifdef ANDROID
5248         if (!drv->capa.sched_scan_supported)
5249                 return android_pno_stop(bss);
5250 #endif /* ANDROID */
5251
5252         msg = nlmsg_alloc();
5253         if (!msg)
5254                 return -1;
5255
5256         nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
5257
5258         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5259
5260         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5261         msg = NULL;
5262         if (ret) {
5263                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
5264                            "ret=%d (%s)", ret, strerror(-ret));
5265                 goto nla_put_failure;
5266         }
5267
5268         wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
5269
5270 nla_put_failure:
5271         nlmsg_free(msg);
5272         return ret;
5273 }
5274
5275
5276 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
5277 {
5278         const u8 *end, *pos;
5279
5280         if (ies == NULL)
5281                 return NULL;
5282
5283         pos = ies;
5284         end = ies + ies_len;
5285
5286         while (pos + 1 < end) {
5287                 if (pos + 2 + pos[1] > end)
5288                         break;
5289                 if (pos[0] == ie)
5290                         return pos;
5291                 pos += 2 + pos[1];
5292         }
5293
5294         return NULL;
5295 }
5296
5297
5298 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
5299                                  const u8 *ie, size_t ie_len)
5300 {
5301         const u8 *ssid;
5302         size_t i;
5303
5304         if (drv->filter_ssids == NULL)
5305                 return 0;
5306
5307         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
5308         if (ssid == NULL)
5309                 return 1;
5310
5311         for (i = 0; i < drv->num_filter_ssids; i++) {
5312                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
5313                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
5314                     0)
5315                         return 0;
5316         }
5317
5318         return 1;
5319 }
5320
5321
5322 static int bss_info_handler(struct nl_msg *msg, void *arg)
5323 {
5324         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5325         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5326         struct nlattr *bss[NL80211_BSS_MAX + 1];
5327         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
5328                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
5329                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
5330                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
5331                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
5332                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
5333                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
5334                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
5335                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
5336                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
5337                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
5338                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
5339         };
5340         struct nl80211_bss_info_arg *_arg = arg;
5341         struct wpa_scan_results *res = _arg->res;
5342         struct wpa_scan_res **tmp;
5343         struct wpa_scan_res *r;
5344         const u8 *ie, *beacon_ie;
5345         size_t ie_len, beacon_ie_len;
5346         u8 *pos;
5347         size_t i;
5348
5349         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5350                   genlmsg_attrlen(gnlh, 0), NULL);
5351         if (!tb[NL80211_ATTR_BSS])
5352                 return NL_SKIP;
5353         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
5354                              bss_policy))
5355                 return NL_SKIP;
5356         if (bss[NL80211_BSS_STATUS]) {
5357                 enum nl80211_bss_status status;
5358                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
5359                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
5360                     bss[NL80211_BSS_FREQUENCY]) {
5361                         _arg->assoc_freq =
5362                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
5363                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
5364                                    _arg->assoc_freq);
5365                 }
5366                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
5367                     bss[NL80211_BSS_FREQUENCY]) {
5368                         _arg->ibss_freq =
5369                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
5370                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
5371                                    _arg->ibss_freq);
5372                 }
5373                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
5374                     bss[NL80211_BSS_BSSID]) {
5375                         os_memcpy(_arg->assoc_bssid,
5376                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
5377                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
5378                                    MACSTR, MAC2STR(_arg->assoc_bssid));
5379                 }
5380         }
5381         if (!res)
5382                 return NL_SKIP;
5383         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
5384                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
5385                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
5386         } else {
5387                 ie = NULL;
5388                 ie_len = 0;
5389         }
5390         if (bss[NL80211_BSS_BEACON_IES]) {
5391                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
5392                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
5393         } else {
5394                 beacon_ie = NULL;
5395                 beacon_ie_len = 0;
5396         }
5397
5398         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
5399                                   ie ? ie_len : beacon_ie_len))
5400                 return NL_SKIP;
5401
5402         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
5403         if (r == NULL)
5404                 return NL_SKIP;
5405         if (bss[NL80211_BSS_BSSID])
5406                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
5407                           ETH_ALEN);
5408         if (bss[NL80211_BSS_FREQUENCY])
5409                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
5410         if (bss[NL80211_BSS_BEACON_INTERVAL])
5411                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
5412         if (bss[NL80211_BSS_CAPABILITY])
5413                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
5414         r->flags |= WPA_SCAN_NOISE_INVALID;
5415         if (bss[NL80211_BSS_SIGNAL_MBM]) {
5416                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
5417                 r->level /= 100; /* mBm to dBm */
5418                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
5419         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
5420                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
5421                 r->flags |= WPA_SCAN_QUAL_INVALID;
5422         } else
5423                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
5424         if (bss[NL80211_BSS_TSF])
5425                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
5426         if (bss[NL80211_BSS_SEEN_MS_AGO])
5427                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
5428         r->ie_len = ie_len;
5429         pos = (u8 *) (r + 1);
5430         if (ie) {
5431                 os_memcpy(pos, ie, ie_len);
5432                 pos += ie_len;
5433         }
5434         r->beacon_ie_len = beacon_ie_len;
5435         if (beacon_ie)
5436                 os_memcpy(pos, beacon_ie, beacon_ie_len);
5437
5438         if (bss[NL80211_BSS_STATUS]) {
5439                 enum nl80211_bss_status status;
5440                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
5441                 switch (status) {
5442                 case NL80211_BSS_STATUS_AUTHENTICATED:
5443                         r->flags |= WPA_SCAN_AUTHENTICATED;
5444                         break;
5445                 case NL80211_BSS_STATUS_ASSOCIATED:
5446                         r->flags |= WPA_SCAN_ASSOCIATED;
5447                         break;
5448                 default:
5449                         break;
5450                 }
5451         }
5452
5453         /*
5454          * cfg80211 maintains separate BSS table entries for APs if the same
5455          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
5456          * not use frequency as a separate key in the BSS table, so filter out
5457          * duplicated entries. Prefer associated BSS entry in such a case in
5458          * order to get the correct frequency into the BSS table. Similarly,
5459          * prefer newer entries over older.
5460          */
5461         for (i = 0; i < res->num; i++) {
5462                 const u8 *s1, *s2;
5463                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
5464                         continue;
5465
5466                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
5467                                     res->res[i]->ie_len, WLAN_EID_SSID);
5468                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
5469                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
5470                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
5471                         continue;
5472
5473                 /* Same BSSID,SSID was already included in scan results */
5474                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
5475                            "for " MACSTR, MAC2STR(r->bssid));
5476
5477                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
5478                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
5479                     r->age < res->res[i]->age) {
5480                         os_free(res->res[i]);
5481                         res->res[i] = r;
5482                 } else
5483                         os_free(r);
5484                 return NL_SKIP;
5485         }
5486
5487         tmp = os_realloc_array(res->res, res->num + 1,
5488                                sizeof(struct wpa_scan_res *));
5489         if (tmp == NULL) {
5490                 os_free(r);
5491                 return NL_SKIP;
5492         }
5493         tmp[res->num++] = r;
5494         res->res = tmp;
5495
5496         return NL_SKIP;
5497 }
5498
5499
5500 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
5501                                  const u8 *addr)
5502 {
5503         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
5504                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
5505                            "mismatch (" MACSTR ")", MAC2STR(addr));
5506                 wpa_driver_nl80211_mlme(drv, addr,
5507                                         NL80211_CMD_DEAUTHENTICATE,
5508                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
5509         }
5510 }
5511
5512
5513 static void wpa_driver_nl80211_check_bss_status(
5514         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
5515 {
5516         size_t i;
5517
5518         for (i = 0; i < res->num; i++) {
5519                 struct wpa_scan_res *r = res->res[i];
5520                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
5521                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
5522                                    "indicates BSS status with " MACSTR
5523                                    " as authenticated",
5524                                    MAC2STR(r->bssid));
5525                         if (is_sta_interface(drv->nlmode) &&
5526                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
5527                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
5528                             0) {
5529                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
5530                                            " in local state (auth=" MACSTR
5531                                            " assoc=" MACSTR ")",
5532                                            MAC2STR(drv->auth_bssid),
5533                                            MAC2STR(drv->bssid));
5534                                 clear_state_mismatch(drv, r->bssid);
5535                         }
5536                 }
5537
5538                 if (r->flags & WPA_SCAN_ASSOCIATED) {
5539                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
5540                                    "indicate BSS status with " MACSTR
5541                                    " as associated",
5542                                    MAC2STR(r->bssid));
5543                         if (is_sta_interface(drv->nlmode) &&
5544                             !drv->associated) {
5545                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
5546                                            "(not associated) does not match "
5547                                            "with BSS state");
5548                                 clear_state_mismatch(drv, r->bssid);
5549                         } else if (is_sta_interface(drv->nlmode) &&
5550                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
5551                                    0) {
5552                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
5553                                            "(associated with " MACSTR ") does "
5554                                            "not match with BSS state",
5555                                            MAC2STR(drv->bssid));
5556                                 clear_state_mismatch(drv, r->bssid);
5557                                 clear_state_mismatch(drv, drv->bssid);
5558                         }
5559                 }
5560         }
5561 }
5562
5563
5564 static struct wpa_scan_results *
5565 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
5566 {
5567         struct nl_msg *msg;
5568         struct wpa_scan_results *res;
5569         int ret;
5570         struct nl80211_bss_info_arg arg;
5571
5572         res = os_zalloc(sizeof(*res));
5573         if (res == NULL)
5574                 return NULL;
5575         msg = nlmsg_alloc();
5576         if (!msg)
5577                 goto nla_put_failure;
5578
5579         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
5580         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
5581                 goto nla_put_failure;
5582
5583         arg.drv = drv;
5584         arg.res = res;
5585         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
5586         msg = NULL;
5587         if (ret == 0) {
5588                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
5589                            "BSSes)", (unsigned long) res->num);
5590                 nl80211_get_noise_for_scan_results(drv, res);
5591                 return res;
5592         }
5593         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
5594                    "(%s)", ret, strerror(-ret));
5595 nla_put_failure:
5596         nlmsg_free(msg);
5597         wpa_scan_results_free(res);
5598         return NULL;
5599 }
5600
5601
5602 /**
5603  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
5604  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
5605  * Returns: Scan results on success, -1 on failure
5606  */
5607 static struct wpa_scan_results *
5608 wpa_driver_nl80211_get_scan_results(void *priv)
5609 {
5610         struct i802_bss *bss = priv;
5611         struct wpa_driver_nl80211_data *drv = bss->drv;
5612         struct wpa_scan_results *res;
5613
5614         res = nl80211_get_scan_results(drv);
5615         if (res)
5616                 wpa_driver_nl80211_check_bss_status(drv, res);
5617         return res;
5618 }
5619
5620
5621 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
5622 {
5623         struct wpa_scan_results *res;
5624         size_t i;
5625
5626         res = nl80211_get_scan_results(drv);
5627         if (res == NULL) {
5628                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
5629                 return;
5630         }
5631
5632         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
5633         for (i = 0; i < res->num; i++) {
5634                 struct wpa_scan_res *r = res->res[i];
5635                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
5636                            (int) i, (int) res->num, MAC2STR(r->bssid),
5637                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
5638                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
5639         }
5640
5641         wpa_scan_results_free(res);
5642 }
5643
5644
5645 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
5646 {
5647         switch (alg) {
5648         case WPA_ALG_WEP:
5649                 if (key_len == 5)
5650                         return WLAN_CIPHER_SUITE_WEP40;
5651                 return WLAN_CIPHER_SUITE_WEP104;
5652         case WPA_ALG_TKIP:
5653                 return WLAN_CIPHER_SUITE_TKIP;
5654         case WPA_ALG_CCMP:
5655                 return WLAN_CIPHER_SUITE_CCMP;
5656         case WPA_ALG_GCMP:
5657                 return WLAN_CIPHER_SUITE_GCMP;
5658         case WPA_ALG_CCMP_256:
5659                 return WLAN_CIPHER_SUITE_CCMP_256;
5660         case WPA_ALG_GCMP_256:
5661                 return WLAN_CIPHER_SUITE_GCMP_256;
5662         case WPA_ALG_IGTK:
5663                 return WLAN_CIPHER_SUITE_AES_CMAC;
5664         case WPA_ALG_BIP_GMAC_128:
5665                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
5666         case WPA_ALG_BIP_GMAC_256:
5667                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
5668         case WPA_ALG_BIP_CMAC_256:
5669                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
5670         case WPA_ALG_SMS4:
5671                 return WLAN_CIPHER_SUITE_SMS4;
5672         case WPA_ALG_KRK:
5673                 return WLAN_CIPHER_SUITE_KRK;
5674         case WPA_ALG_NONE:
5675         case WPA_ALG_PMK:
5676                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
5677                            alg);
5678                 return 0;
5679         }
5680
5681         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
5682                    alg);
5683         return 0;
5684 }
5685
5686
5687 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
5688 {
5689         switch (cipher) {
5690         case WPA_CIPHER_CCMP_256:
5691                 return WLAN_CIPHER_SUITE_CCMP_256;
5692         case WPA_CIPHER_GCMP_256:
5693                 return WLAN_CIPHER_SUITE_GCMP_256;
5694         case WPA_CIPHER_CCMP:
5695                 return WLAN_CIPHER_SUITE_CCMP;
5696         case WPA_CIPHER_GCMP:
5697                 return WLAN_CIPHER_SUITE_GCMP;
5698         case WPA_CIPHER_TKIP:
5699                 return WLAN_CIPHER_SUITE_TKIP;
5700         case WPA_CIPHER_WEP104:
5701                 return WLAN_CIPHER_SUITE_WEP104;
5702         case WPA_CIPHER_WEP40:
5703                 return WLAN_CIPHER_SUITE_WEP40;
5704         case WPA_CIPHER_GTK_NOT_USED:
5705                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
5706         }
5707
5708         return 0;
5709 }
5710
5711
5712 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
5713                                        int max_suites)
5714 {
5715         int num_suites = 0;
5716
5717         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
5718                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
5719         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
5720                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
5721         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
5722                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
5723         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
5724                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
5725         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
5726                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
5727         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
5728                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
5729         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
5730                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
5731
5732         return num_suites;
5733 }
5734
5735
5736 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
5737                                       enum wpa_alg alg, const u8 *addr,
5738                                       int key_idx, int set_tx,
5739                                       const u8 *seq, size_t seq_len,
5740                                       const u8 *key, size_t key_len)
5741 {
5742         struct wpa_driver_nl80211_data *drv = bss->drv;
5743         int ifindex;
5744         struct nl_msg *msg;
5745         int ret;
5746         int tdls = 0;
5747
5748         /* Ignore for P2P Device */
5749         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
5750                 return 0;
5751
5752         ifindex = if_nametoindex(ifname);
5753         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
5754                    "set_tx=%d seq_len=%lu key_len=%lu",
5755                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
5756                    (unsigned long) seq_len, (unsigned long) key_len);
5757 #ifdef CONFIG_TDLS
5758         if (key_idx == -1) {
5759                 key_idx = 0;
5760                 tdls = 1;
5761         }
5762 #endif /* CONFIG_TDLS */
5763
5764         msg = nlmsg_alloc();
5765         if (!msg)
5766                 return -ENOMEM;
5767
5768         if (alg == WPA_ALG_NONE) {
5769                 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
5770         } else {
5771                 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
5772                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
5773                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
5774                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5775                             wpa_alg_to_cipher_suite(alg, key_len));
5776         }
5777
5778         if (seq && seq_len) {
5779                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
5780                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
5781         }
5782
5783         if (addr && !is_broadcast_ether_addr(addr)) {
5784                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
5785                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5786
5787                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
5788                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
5789                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
5790                                     NL80211_KEYTYPE_GROUP);
5791                 }
5792         } else if (addr && is_broadcast_ether_addr(addr)) {
5793                 struct nlattr *types;
5794
5795                 wpa_printf(MSG_DEBUG, "   broadcast key");
5796
5797                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5798                 if (!types)
5799                         goto nla_put_failure;
5800                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
5801                 nla_nest_end(msg, types);
5802         }
5803         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
5804         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5805
5806         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5807         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
5808                 ret = 0;
5809         if (ret)
5810                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
5811                            ret, strerror(-ret));
5812
5813         /*
5814          * If we failed or don't need to set the default TX key (below),
5815          * we're done here.
5816          */
5817         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
5818                 return ret;
5819         if (is_ap_interface(drv->nlmode) && addr &&
5820             !is_broadcast_ether_addr(addr))
5821                 return ret;
5822
5823         msg = nlmsg_alloc();
5824         if (!msg)
5825                 return -ENOMEM;
5826
5827         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
5828         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
5829         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5830         if (alg == WPA_ALG_IGTK)
5831                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
5832         else
5833                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
5834         if (addr && is_broadcast_ether_addr(addr)) {
5835                 struct nlattr *types;
5836
5837                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5838                 if (!types)
5839                         goto nla_put_failure;
5840                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
5841                 nla_nest_end(msg, types);
5842         } else if (addr) {
5843                 struct nlattr *types;
5844
5845                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5846                 if (!types)
5847                         goto nla_put_failure;
5848                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST);
5849                 nla_nest_end(msg, types);
5850         }
5851
5852         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5853         if (ret == -ENOENT)
5854                 ret = 0;
5855         if (ret)
5856                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
5857                            "err=%d %s)", ret, strerror(-ret));
5858         return ret;
5859
5860 nla_put_failure:
5861         nlmsg_free(msg);
5862         return -ENOBUFS;
5863 }
5864
5865
5866 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
5867                       int key_idx, int defkey,
5868                       const u8 *seq, size_t seq_len,
5869                       const u8 *key, size_t key_len)
5870 {
5871         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
5872         if (!key_attr)
5873                 return -1;
5874
5875         if (defkey && alg == WPA_ALG_IGTK)
5876                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
5877         else if (defkey)
5878                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
5879
5880         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
5881
5882         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5883                     wpa_alg_to_cipher_suite(alg, key_len));
5884
5885         if (seq && seq_len)
5886                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
5887
5888         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
5889
5890         nla_nest_end(msg, key_attr);
5891
5892         return 0;
5893  nla_put_failure:
5894         return -1;
5895 }
5896
5897
5898 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
5899                                  struct nl_msg *msg)
5900 {
5901         int i, privacy = 0;
5902         struct nlattr *nl_keys, *nl_key;
5903
5904         for (i = 0; i < 4; i++) {
5905                 if (!params->wep_key[i])
5906                         continue;
5907                 privacy = 1;
5908                 break;
5909         }
5910         if (params->wps == WPS_MODE_PRIVACY)
5911                 privacy = 1;
5912         if (params->pairwise_suite &&
5913             params->pairwise_suite != WPA_CIPHER_NONE)
5914                 privacy = 1;
5915
5916         if (!privacy)
5917                 return 0;
5918
5919         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
5920
5921         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
5922         if (!nl_keys)
5923                 goto nla_put_failure;
5924
5925         for (i = 0; i < 4; i++) {
5926                 if (!params->wep_key[i])
5927                         continue;
5928
5929                 nl_key = nla_nest_start(msg, i);
5930                 if (!nl_key)
5931                         goto nla_put_failure;
5932
5933                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
5934                         params->wep_key[i]);
5935                 if (params->wep_key_len[i] == 5)
5936                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5937                                     WLAN_CIPHER_SUITE_WEP40);
5938                 else
5939                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5940                                     WLAN_CIPHER_SUITE_WEP104);
5941
5942                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
5943
5944                 if (i == params->wep_tx_keyidx)
5945                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
5946
5947                 nla_nest_end(msg, nl_key);
5948         }
5949         nla_nest_end(msg, nl_keys);
5950
5951         return 0;
5952
5953 nla_put_failure:
5954         return -ENOBUFS;
5955 }
5956
5957
5958 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
5959                                    const u8 *addr, int cmd, u16 reason_code,
5960                                    int local_state_change)
5961 {
5962         int ret = -1;
5963         struct nl_msg *msg;
5964
5965         msg = nlmsg_alloc();
5966         if (!msg)
5967                 return -1;
5968
5969         nl80211_cmd(drv, msg, 0, cmd);
5970
5971         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5972         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
5973         if (addr)
5974                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5975         if (local_state_change)
5976                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
5977
5978         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5979         msg = NULL;
5980         if (ret) {
5981                 wpa_dbg(drv->ctx, MSG_DEBUG,
5982                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
5983                         reason_code, ret, strerror(-ret));
5984                 goto nla_put_failure;
5985         }
5986         ret = 0;
5987
5988 nla_put_failure:
5989         nlmsg_free(msg);
5990         return ret;
5991 }
5992
5993
5994 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
5995                                          int reason_code)
5996 {
5997         int ret;
5998
5999         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
6000         nl80211_mark_disconnected(drv);
6001         /* Disconnect command doesn't need BSSID - it uses cached value */
6002         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
6003                                       reason_code, 0);
6004         /*
6005          * For locally generated disconnect, supplicant already generates a
6006          * DEAUTH event, so ignore the event from NL80211.
6007          */
6008         drv->ignore_next_local_disconnect = ret == 0;
6009
6010         return ret;
6011 }
6012
6013
6014 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
6015                                              const u8 *addr, int reason_code)
6016 {
6017         struct wpa_driver_nl80211_data *drv = bss->drv;
6018         int ret;
6019
6020         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
6021                 nl80211_mark_disconnected(drv);
6022                 return nl80211_leave_ibss(drv);
6023         }
6024         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
6025                 return wpa_driver_nl80211_disconnect(drv, reason_code);
6026         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
6027                    __func__, MAC2STR(addr), reason_code);
6028         nl80211_mark_disconnected(drv);
6029         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
6030                                       reason_code, 0);
6031         /*
6032          * For locally generated deauthenticate, supplicant already generates a
6033          * DEAUTH event, so ignore the event from NL80211.
6034          */
6035         drv->ignore_next_local_deauth = ret == 0;
6036         return ret;
6037 }
6038
6039
6040 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
6041                                      struct wpa_driver_auth_params *params)
6042 {
6043         int i;
6044
6045         drv->auth_freq = params->freq;
6046         drv->auth_alg = params->auth_alg;
6047         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
6048         drv->auth_local_state_change = params->local_state_change;
6049         drv->auth_p2p = params->p2p;
6050
6051         if (params->bssid)
6052                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
6053         else
6054                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
6055
6056         if (params->ssid) {
6057                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
6058                 drv->auth_ssid_len = params->ssid_len;
6059         } else
6060                 drv->auth_ssid_len = 0;
6061
6062
6063         os_free(drv->auth_ie);
6064         drv->auth_ie = NULL;
6065         drv->auth_ie_len = 0;
6066         if (params->ie) {
6067                 drv->auth_ie = os_malloc(params->ie_len);
6068                 if (drv->auth_ie) {
6069                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
6070                         drv->auth_ie_len = params->ie_len;
6071                 }
6072         }
6073
6074         for (i = 0; i < 4; i++) {
6075                 if (params->wep_key[i] && params->wep_key_len[i] &&
6076                     params->wep_key_len[i] <= 16) {
6077                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
6078                                   params->wep_key_len[i]);
6079                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
6080                 } else
6081                         drv->auth_wep_key_len[i] = 0;
6082         }
6083 }
6084
6085
6086 static int wpa_driver_nl80211_authenticate(
6087         struct i802_bss *bss, struct wpa_driver_auth_params *params)
6088 {
6089         struct wpa_driver_nl80211_data *drv = bss->drv;
6090         int ret = -1, i;
6091         struct nl_msg *msg;
6092         enum nl80211_auth_type type;
6093         enum nl80211_iftype nlmode;
6094         int count = 0;
6095         int is_retry;
6096
6097         is_retry = drv->retry_auth;
6098         drv->retry_auth = 0;
6099         drv->ignore_deauth_event = 0;
6100
6101         nl80211_mark_disconnected(drv);
6102         os_memset(drv->auth_bssid, 0, ETH_ALEN);
6103         if (params->bssid)
6104                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
6105         else
6106                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
6107         /* FIX: IBSS mode */
6108         nlmode = params->p2p ?
6109                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
6110         if (drv->nlmode != nlmode &&
6111             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
6112                 return -1;
6113
6114 retry:
6115         msg = nlmsg_alloc();
6116         if (!msg)
6117                 return -1;
6118
6119         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
6120                    drv->ifindex);
6121
6122         nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
6123
6124         for (i = 0; i < 4; i++) {
6125                 if (!params->wep_key[i])
6126                         continue;
6127                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
6128                                            NULL, i,
6129                                            i == params->wep_tx_keyidx, NULL, 0,
6130                                            params->wep_key[i],
6131                                            params->wep_key_len[i]);
6132                 if (params->wep_tx_keyidx != i)
6133                         continue;
6134                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
6135                                params->wep_key[i], params->wep_key_len[i])) {
6136                         nlmsg_free(msg);
6137                         return -1;
6138                 }
6139         }
6140
6141         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6142         if (params->bssid) {
6143                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
6144                            MAC2STR(params->bssid));
6145                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6146         }
6147         if (params->freq) {
6148                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6149                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6150         }
6151         if (params->ssid) {
6152                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6153                                   params->ssid, params->ssid_len);
6154                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6155                         params->ssid);
6156         }
6157         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
6158         if (params->ie)
6159                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
6160         if (params->sae_data) {
6161                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
6162                             params->sae_data_len);
6163                 NLA_PUT(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
6164                         params->sae_data);
6165         }
6166         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
6167                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
6168         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
6169                 type = NL80211_AUTHTYPE_SHARED_KEY;
6170         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
6171                 type = NL80211_AUTHTYPE_NETWORK_EAP;
6172         else if (params->auth_alg & WPA_AUTH_ALG_FT)
6173                 type = NL80211_AUTHTYPE_FT;
6174         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
6175                 type = NL80211_AUTHTYPE_SAE;
6176         else
6177                 goto nla_put_failure;
6178         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
6179         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
6180         if (params->local_state_change) {
6181                 wpa_printf(MSG_DEBUG, "  * Local state change only");
6182                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
6183         }
6184
6185         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6186         msg = NULL;
6187         if (ret) {
6188                 wpa_dbg(drv->ctx, MSG_DEBUG,
6189                         "nl80211: MLME command failed (auth): ret=%d (%s)",
6190                         ret, strerror(-ret));
6191                 count++;
6192                 if (ret == -EALREADY && count == 1 && params->bssid &&
6193                     !params->local_state_change) {
6194                         /*
6195                          * mac80211 does not currently accept new
6196                          * authentication if we are already authenticated. As a
6197                          * workaround, force deauthentication and try again.
6198                          */
6199                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
6200                                    "after forced deauthentication");
6201                         drv->ignore_deauth_event = 1;
6202                         wpa_driver_nl80211_deauthenticate(
6203                                 bss, params->bssid,
6204                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
6205                         nlmsg_free(msg);
6206                         goto retry;
6207                 }
6208
6209                 if (ret == -ENOENT && params->freq && !is_retry) {
6210                         /*
6211                          * cfg80211 has likely expired the BSS entry even
6212                          * though it was previously available in our internal
6213                          * BSS table. To recover quickly, start a single
6214                          * channel scan on the specified channel.
6215                          */
6216                         struct wpa_driver_scan_params scan;
6217                         int freqs[2];
6218
6219                         os_memset(&scan, 0, sizeof(scan));
6220                         scan.num_ssids = 1;
6221                         if (params->ssid) {
6222                                 scan.ssids[0].ssid = params->ssid;
6223                                 scan.ssids[0].ssid_len = params->ssid_len;
6224                         }
6225                         freqs[0] = params->freq;
6226                         freqs[1] = 0;
6227                         scan.freqs = freqs;
6228                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
6229                                    "channel scan to refresh cfg80211 BSS "
6230                                    "entry");
6231                         ret = wpa_driver_nl80211_scan(bss, &scan);
6232                         if (ret == 0) {
6233                                 nl80211_copy_auth_params(drv, params);
6234                                 drv->scan_for_auth = 1;
6235                         }
6236                 } else if (is_retry) {
6237                         /*
6238                          * Need to indicate this with an event since the return
6239                          * value from the retry is not delivered to core code.
6240                          */
6241                         union wpa_event_data event;
6242                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
6243                                    "failed");
6244                         os_memset(&event, 0, sizeof(event));
6245                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
6246                                   ETH_ALEN);
6247                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
6248                                              &event);
6249                 }
6250
6251                 goto nla_put_failure;
6252         }
6253         ret = 0;
6254         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
6255                    "successfully");
6256
6257 nla_put_failure:
6258         nlmsg_free(msg);
6259         return ret;
6260 }
6261
6262
6263 static int wpa_driver_nl80211_authenticate_retry(
6264         struct wpa_driver_nl80211_data *drv)
6265 {
6266         struct wpa_driver_auth_params params;
6267         struct i802_bss *bss = drv->first_bss;
6268         int i;
6269
6270         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
6271
6272         os_memset(&params, 0, sizeof(params));
6273         params.freq = drv->auth_freq;
6274         params.auth_alg = drv->auth_alg;
6275         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
6276         params.local_state_change = drv->auth_local_state_change;
6277         params.p2p = drv->auth_p2p;
6278
6279         if (!is_zero_ether_addr(drv->auth_bssid_))
6280                 params.bssid = drv->auth_bssid_;
6281
6282         if (drv->auth_ssid_len) {
6283                 params.ssid = drv->auth_ssid;
6284                 params.ssid_len = drv->auth_ssid_len;
6285         }
6286
6287         params.ie = drv->auth_ie;
6288         params.ie_len = drv->auth_ie_len;
6289
6290         for (i = 0; i < 4; i++) {
6291                 if (drv->auth_wep_key_len[i]) {
6292                         params.wep_key[i] = drv->auth_wep_key[i];
6293                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
6294                 }
6295         }
6296
6297         drv->retry_auth = 1;
6298         return wpa_driver_nl80211_authenticate(bss, &params);
6299 }
6300
6301
6302 struct phy_info_arg {
6303         u16 *num_modes;
6304         struct hostapd_hw_modes *modes;
6305         int last_mode, last_chan_idx;
6306 };
6307
6308 static void phy_info_ht_capa(struct hostapd_hw_modes *mode, struct nlattr *capa,
6309                              struct nlattr *ampdu_factor,
6310                              struct nlattr *ampdu_density,
6311                              struct nlattr *mcs_set)
6312 {
6313         if (capa)
6314                 mode->ht_capab = nla_get_u16(capa);
6315
6316         if (ampdu_factor)
6317                 mode->a_mpdu_params |= nla_get_u8(ampdu_factor) & 0x03;
6318
6319         if (ampdu_density)
6320                 mode->a_mpdu_params |= nla_get_u8(ampdu_density) << 2;
6321
6322         if (mcs_set && nla_len(mcs_set) >= 16) {
6323                 u8 *mcs;
6324                 mcs = nla_data(mcs_set);
6325                 os_memcpy(mode->mcs_set, mcs, 16);
6326         }
6327 }
6328
6329
6330 static void phy_info_vht_capa(struct hostapd_hw_modes *mode,
6331                               struct nlattr *capa,
6332                               struct nlattr *mcs_set)
6333 {
6334         if (capa)
6335                 mode->vht_capab = nla_get_u32(capa);
6336
6337         if (mcs_set && nla_len(mcs_set) >= 8) {
6338                 u8 *mcs;
6339                 mcs = nla_data(mcs_set);
6340                 os_memcpy(mode->vht_mcs_set, mcs, 8);
6341         }
6342 }
6343
6344
6345 static void phy_info_freq(struct hostapd_hw_modes *mode,
6346                           struct hostapd_channel_data *chan,
6347                           struct nlattr *tb_freq[])
6348 {
6349         u8 channel;
6350         chan->freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
6351         chan->flag = 0;
6352         chan->dfs_cac_ms = 0;
6353         if (ieee80211_freq_to_chan(chan->freq, &channel) != NUM_HOSTAPD_MODES)
6354                 chan->chan = channel;
6355
6356         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
6357                 chan->flag |= HOSTAPD_CHAN_DISABLED;
6358         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IR])
6359                 chan->flag |= HOSTAPD_CHAN_PASSIVE_SCAN | HOSTAPD_CHAN_NO_IBSS;
6360         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
6361                 chan->flag |= HOSTAPD_CHAN_RADAR;
6362
6363         if (tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]) {
6364                 enum nl80211_dfs_state state =
6365                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]);
6366
6367                 switch (state) {
6368                 case NL80211_DFS_USABLE:
6369                         chan->flag |= HOSTAPD_CHAN_DFS_USABLE;
6370                         break;
6371                 case NL80211_DFS_AVAILABLE:
6372                         chan->flag |= HOSTAPD_CHAN_DFS_AVAILABLE;
6373                         break;
6374                 case NL80211_DFS_UNAVAILABLE:
6375                         chan->flag |= HOSTAPD_CHAN_DFS_UNAVAILABLE;
6376                         break;
6377                 }
6378         }
6379
6380         if (tb_freq[NL80211_FREQUENCY_ATTR_DFS_CAC_TIME]) {
6381                 chan->dfs_cac_ms = nla_get_u32(
6382                         tb_freq[NL80211_FREQUENCY_ATTR_DFS_CAC_TIME]);
6383         }
6384 }
6385
6386
6387 static int phy_info_freqs(struct phy_info_arg *phy_info,
6388                           struct hostapd_hw_modes *mode, struct nlattr *tb)
6389 {
6390         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
6391                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
6392                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
6393                 [NL80211_FREQUENCY_ATTR_NO_IR] = { .type = NLA_FLAG },
6394                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
6395                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
6396                 [NL80211_FREQUENCY_ATTR_DFS_STATE] = { .type = NLA_U32 },
6397         };
6398         int new_channels = 0;
6399         struct hostapd_channel_data *channel;
6400         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
6401         struct nlattr *nl_freq;
6402         int rem_freq, idx;
6403
6404         if (tb == NULL)
6405                 return NL_OK;
6406
6407         nla_for_each_nested(nl_freq, tb, rem_freq) {
6408                 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
6409                           nla_data(nl_freq), nla_len(nl_freq), freq_policy);
6410                 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
6411                         continue;
6412                 new_channels++;
6413         }
6414
6415         channel = os_realloc_array(mode->channels,
6416                                    mode->num_channels + new_channels,
6417                                    sizeof(struct hostapd_channel_data));
6418         if (!channel)
6419                 return NL_SKIP;
6420
6421         mode->channels = channel;
6422         mode->num_channels += new_channels;
6423
6424         idx = phy_info->last_chan_idx;
6425
6426         nla_for_each_nested(nl_freq, tb, rem_freq) {
6427                 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
6428                           nla_data(nl_freq), nla_len(nl_freq), freq_policy);
6429                 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
6430                         continue;
6431                 phy_info_freq(mode, &mode->channels[idx], tb_freq);
6432                 idx++;
6433         }
6434         phy_info->last_chan_idx = idx;
6435
6436         return NL_OK;
6437 }
6438
6439
6440 static int phy_info_rates(struct hostapd_hw_modes *mode, struct nlattr *tb)
6441 {
6442         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
6443                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
6444                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] =
6445                 { .type = NLA_FLAG },
6446         };
6447         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
6448         struct nlattr *nl_rate;
6449         int rem_rate, idx;
6450
6451         if (tb == NULL)
6452                 return NL_OK;
6453
6454         nla_for_each_nested(nl_rate, tb, rem_rate) {
6455                 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
6456                           nla_data(nl_rate), nla_len(nl_rate),
6457                           rate_policy);
6458                 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
6459                         continue;
6460                 mode->num_rates++;
6461         }
6462
6463         mode->rates = os_calloc(mode->num_rates, sizeof(int));
6464         if (!mode->rates)
6465                 return NL_SKIP;
6466
6467         idx = 0;
6468
6469         nla_for_each_nested(nl_rate, tb, rem_rate) {
6470                 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
6471                           nla_data(nl_rate), nla_len(nl_rate),
6472                           rate_policy);
6473                 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
6474                         continue;
6475                 mode->rates[idx] = nla_get_u32(
6476                         tb_rate[NL80211_BITRATE_ATTR_RATE]);
6477                 idx++;
6478         }
6479
6480         return NL_OK;
6481 }
6482
6483
6484 static int phy_info_band(struct phy_info_arg *phy_info, struct nlattr *nl_band)
6485 {
6486         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
6487         struct hostapd_hw_modes *mode;
6488         int ret;
6489
6490         if (phy_info->last_mode != nl_band->nla_type) {
6491                 mode = os_realloc_array(phy_info->modes,
6492                                         *phy_info->num_modes + 1,
6493                                         sizeof(*mode));
6494                 if (!mode)
6495                         return NL_SKIP;
6496                 phy_info->modes = mode;
6497
6498                 mode = &phy_info->modes[*(phy_info->num_modes)];
6499                 os_memset(mode, 0, sizeof(*mode));
6500                 mode->mode = NUM_HOSTAPD_MODES;
6501                 mode->flags = HOSTAPD_MODE_FLAG_HT_INFO_KNOWN |
6502                         HOSTAPD_MODE_FLAG_VHT_INFO_KNOWN;
6503
6504                 /*
6505                  * Unsupported VHT MCS stream is defined as value 3, so the VHT
6506                  * MCS RX/TX map must be initialized with 0xffff to mark all 8
6507                  * possible streams as unsupported. This will be overridden if
6508                  * driver advertises VHT support.
6509                  */
6510                 mode->vht_mcs_set[0] = 0xff;
6511                 mode->vht_mcs_set[1] = 0xff;
6512                 mode->vht_mcs_set[4] = 0xff;
6513                 mode->vht_mcs_set[5] = 0xff;
6514
6515                 *(phy_info->num_modes) += 1;
6516                 phy_info->last_mode = nl_band->nla_type;
6517                 phy_info->last_chan_idx = 0;
6518         } else
6519                 mode = &phy_info->modes[*(phy_info->num_modes) - 1];
6520
6521         nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
6522                   nla_len(nl_band), NULL);
6523
6524         phy_info_ht_capa(mode, tb_band[NL80211_BAND_ATTR_HT_CAPA],
6525                          tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR],
6526                          tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY],
6527                          tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
6528         phy_info_vht_capa(mode, tb_band[NL80211_BAND_ATTR_VHT_CAPA],
6529                           tb_band[NL80211_BAND_ATTR_VHT_MCS_SET]);
6530         ret = phy_info_freqs(phy_info, mode, tb_band[NL80211_BAND_ATTR_FREQS]);
6531         if (ret != NL_OK)
6532                 return ret;
6533         ret = phy_info_rates(mode, tb_band[NL80211_BAND_ATTR_RATES]);
6534         if (ret != NL_OK)
6535                 return ret;
6536
6537         return NL_OK;
6538 }
6539
6540
6541 static int phy_info_handler(struct nl_msg *msg, void *arg)
6542 {
6543         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
6544         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6545         struct phy_info_arg *phy_info = arg;
6546         struct nlattr *nl_band;
6547         int rem_band;
6548
6549         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6550                   genlmsg_attrlen(gnlh, 0), NULL);
6551
6552         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
6553                 return NL_SKIP;
6554
6555         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band)
6556         {
6557                 int res = phy_info_band(phy_info, nl_band);
6558                 if (res != NL_OK)
6559                         return res;
6560         }
6561
6562         return NL_SKIP;
6563 }
6564
6565
6566 static struct hostapd_hw_modes *
6567 wpa_driver_nl80211_postprocess_modes(struct hostapd_hw_modes *modes,
6568                                      u16 *num_modes)
6569 {
6570         u16 m;
6571         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
6572         int i, mode11g_idx = -1;
6573
6574         /* heuristic to set up modes */
6575         for (m = 0; m < *num_modes; m++) {
6576                 if (!modes[m].num_channels)
6577                         continue;
6578                 if (modes[m].channels[0].freq < 4000) {
6579                         modes[m].mode = HOSTAPD_MODE_IEEE80211B;
6580                         for (i = 0; i < modes[m].num_rates; i++) {
6581                                 if (modes[m].rates[i] > 200) {
6582                                         modes[m].mode = HOSTAPD_MODE_IEEE80211G;
6583                                         break;
6584                                 }
6585                         }
6586                 } else if (modes[m].channels[0].freq > 50000)
6587                         modes[m].mode = HOSTAPD_MODE_IEEE80211AD;
6588                 else
6589                         modes[m].mode = HOSTAPD_MODE_IEEE80211A;
6590         }
6591
6592         /* If only 802.11g mode is included, use it to construct matching
6593          * 802.11b mode data. */
6594
6595         for (m = 0; m < *num_modes; m++) {
6596                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
6597                         return modes; /* 802.11b already included */
6598                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
6599                         mode11g_idx = m;
6600         }
6601
6602         if (mode11g_idx < 0)
6603                 return modes; /* 2.4 GHz band not supported at all */
6604
6605         nmodes = os_realloc_array(modes, *num_modes + 1, sizeof(*nmodes));
6606         if (nmodes == NULL)
6607                 return modes; /* Could not add 802.11b mode */
6608
6609         mode = &nmodes[*num_modes];
6610         os_memset(mode, 0, sizeof(*mode));
6611         (*num_modes)++;
6612         modes = nmodes;
6613
6614         mode->mode = HOSTAPD_MODE_IEEE80211B;
6615
6616         mode11g = &modes[mode11g_idx];
6617         mode->num_channels = mode11g->num_channels;
6618         mode->channels = os_malloc(mode11g->num_channels *
6619                                    sizeof(struct hostapd_channel_data));
6620         if (mode->channels == NULL) {
6621                 (*num_modes)--;
6622                 return modes; /* Could not add 802.11b mode */
6623         }
6624         os_memcpy(mode->channels, mode11g->channels,
6625                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
6626
6627         mode->num_rates = 0;
6628         mode->rates = os_malloc(4 * sizeof(int));
6629         if (mode->rates == NULL) {
6630                 os_free(mode->channels);
6631                 (*num_modes)--;
6632                 return modes; /* Could not add 802.11b mode */
6633         }
6634
6635         for (i = 0; i < mode11g->num_rates; i++) {
6636                 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
6637                     mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
6638                         continue;
6639                 mode->rates[mode->num_rates] = mode11g->rates[i];
6640                 mode->num_rates++;
6641                 if (mode->num_rates == 4)
6642                         break;
6643         }
6644
6645         if (mode->num_rates == 0) {
6646                 os_free(mode->channels);
6647                 os_free(mode->rates);
6648                 (*num_modes)--;
6649                 return modes; /* No 802.11b rates */
6650         }
6651
6652         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
6653                    "information");
6654
6655         return modes;
6656 }
6657
6658
6659 static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
6660                                   int end)
6661 {
6662         int c;
6663
6664         for (c = 0; c < mode->num_channels; c++) {
6665                 struct hostapd_channel_data *chan = &mode->channels[c];
6666                 if (chan->freq - 10 >= start && chan->freq + 10 <= end)
6667                         chan->flag |= HOSTAPD_CHAN_HT40;
6668         }
6669 }
6670
6671
6672 static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
6673                                       int end)
6674 {
6675         int c;
6676
6677         for (c = 0; c < mode->num_channels; c++) {
6678                 struct hostapd_channel_data *chan = &mode->channels[c];
6679                 if (!(chan->flag & HOSTAPD_CHAN_HT40))
6680                         continue;
6681                 if (chan->freq - 30 >= start && chan->freq - 10 <= end)
6682                         chan->flag |= HOSTAPD_CHAN_HT40MINUS;
6683                 if (chan->freq + 10 >= start && chan->freq + 30 <= end)
6684                         chan->flag |= HOSTAPD_CHAN_HT40PLUS;
6685         }
6686 }
6687
6688
6689 static void nl80211_reg_rule_max_eirp(u32 start, u32 end, u32 max_eirp,
6690                                       struct phy_info_arg *results)
6691 {
6692         u16 m;
6693
6694         for (m = 0; m < *results->num_modes; m++) {
6695                 int c;
6696                 struct hostapd_hw_modes *mode = &results->modes[m];
6697
6698                 for (c = 0; c < mode->num_channels; c++) {
6699                         struct hostapd_channel_data *chan = &mode->channels[c];
6700                         if ((u32) chan->freq - 10 >= start &&
6701                             (u32) chan->freq + 10 <= end)
6702                                 chan->max_tx_power = max_eirp;
6703                 }
6704         }
6705 }
6706
6707
6708 static void nl80211_reg_rule_ht40(u32 start, u32 end,
6709                                   struct phy_info_arg *results)
6710 {
6711         u16 m;
6712
6713         for (m = 0; m < *results->num_modes; m++) {
6714                 if (!(results->modes[m].ht_capab &
6715                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6716                         continue;
6717                 nl80211_set_ht40_mode(&results->modes[m], start, end);
6718         }
6719 }
6720
6721
6722 static void nl80211_reg_rule_sec(struct nlattr *tb[],
6723                                  struct phy_info_arg *results)
6724 {
6725         u32 start, end, max_bw;
6726         u16 m;
6727
6728         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6729             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6730             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
6731                 return;
6732
6733         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6734         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6735         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6736
6737         if (max_bw < 20)
6738                 return;
6739
6740         for (m = 0; m < *results->num_modes; m++) {
6741                 if (!(results->modes[m].ht_capab &
6742                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6743                         continue;
6744                 nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
6745         }
6746 }
6747
6748
6749 static void nl80211_set_vht_mode(struct hostapd_hw_modes *mode, int start,
6750                                  int end)
6751 {
6752         int c;
6753
6754         for (c = 0; c < mode->num_channels; c++) {
6755                 struct hostapd_channel_data *chan = &mode->channels[c];
6756                 if (chan->freq - 10 >= start && chan->freq + 70 <= end)
6757                         chan->flag |= HOSTAPD_CHAN_VHT_10_70;
6758
6759                 if (chan->freq - 30 >= start && chan->freq + 50 <= end)
6760                         chan->flag |= HOSTAPD_CHAN_VHT_30_50;
6761
6762                 if (chan->freq - 50 >= start && chan->freq + 30 <= end)
6763                         chan->flag |= HOSTAPD_CHAN_VHT_50_30;
6764
6765                 if (chan->freq - 70 >= start && chan->freq + 10 <= end)
6766                         chan->flag |= HOSTAPD_CHAN_VHT_70_10;
6767         }
6768 }
6769
6770
6771 static void nl80211_reg_rule_vht(struct nlattr *tb[],
6772                                  struct phy_info_arg *results)
6773 {
6774         u32 start, end, max_bw;
6775         u16 m;
6776
6777         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6778             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6779             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
6780                 return;
6781
6782         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6783         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6784         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6785
6786         if (max_bw < 80)
6787                 return;
6788
6789         for (m = 0; m < *results->num_modes; m++) {
6790                 if (!(results->modes[m].ht_capab &
6791                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6792                         continue;
6793                 /* TODO: use a real VHT support indication */
6794                 if (!results->modes[m].vht_capab)
6795                         continue;
6796
6797                 nl80211_set_vht_mode(&results->modes[m], start, end);
6798         }
6799 }
6800
6801
6802 static const char * dfs_domain_name(enum nl80211_dfs_regions region)
6803 {
6804         switch (region) {
6805         case NL80211_DFS_UNSET:
6806                 return "DFS-UNSET";
6807         case NL80211_DFS_FCC:
6808                 return "DFS-FCC";
6809         case NL80211_DFS_ETSI:
6810                 return "DFS-ETSI";
6811         case NL80211_DFS_JP:
6812                 return "DFS-JP";
6813         default:
6814                 return "DFS-invalid";
6815         }
6816 }
6817
6818
6819 static int nl80211_get_reg(struct nl_msg *msg, void *arg)
6820 {
6821         struct phy_info_arg *results = arg;
6822         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
6823         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6824         struct nlattr *nl_rule;
6825         struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
6826         int rem_rule;
6827         static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
6828                 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
6829                 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
6830                 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
6831                 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
6832                 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
6833                 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
6834         };
6835
6836         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6837                   genlmsg_attrlen(gnlh, 0), NULL);
6838         if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
6839             !tb_msg[NL80211_ATTR_REG_RULES]) {
6840                 wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
6841                            "available");
6842                 return NL_SKIP;
6843         }
6844
6845         if (tb_msg[NL80211_ATTR_DFS_REGION]) {
6846                 enum nl80211_dfs_regions dfs_domain;
6847                 dfs_domain = nla_get_u8(tb_msg[NL80211_ATTR_DFS_REGION]);
6848                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s (%s)",
6849                            (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]),
6850                            dfs_domain_name(dfs_domain));
6851         } else {
6852                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
6853                            (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
6854         }
6855
6856         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6857         {
6858                 u32 start, end, max_eirp = 0, max_bw = 0, flags = 0;
6859                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6860                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6861                 if (tb_rule[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6862                     tb_rule[NL80211_ATTR_FREQ_RANGE_END] == NULL)
6863                         continue;
6864                 start = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6865                 end = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6866                 if (tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6867                         max_eirp = nla_get_u32(tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP]) / 100;
6868                 if (tb_rule[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6869                         max_bw = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6870                 if (tb_rule[NL80211_ATTR_REG_RULE_FLAGS])
6871                         flags = nla_get_u32(tb_rule[NL80211_ATTR_REG_RULE_FLAGS]);
6872
6873                 wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz %u mBm%s%s%s%s%s%s%s%s",
6874                            start, end, max_bw, max_eirp,
6875                            flags & NL80211_RRF_NO_OFDM ? " (no OFDM)" : "",
6876                            flags & NL80211_RRF_NO_CCK ? " (no CCK)" : "",
6877                            flags & NL80211_RRF_NO_INDOOR ? " (no indoor)" : "",
6878                            flags & NL80211_RRF_NO_OUTDOOR ? " (no outdoor)" :
6879                            "",
6880                            flags & NL80211_RRF_DFS ? " (DFS)" : "",
6881                            flags & NL80211_RRF_PTP_ONLY ? " (PTP only)" : "",
6882                            flags & NL80211_RRF_PTMP_ONLY ? " (PTMP only)" : "",
6883                            flags & NL80211_RRF_NO_IR ? " (no IR)" : "");
6884                 if (max_bw >= 40)
6885                         nl80211_reg_rule_ht40(start, end, results);
6886                 if (tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6887                         nl80211_reg_rule_max_eirp(start, end, max_eirp,
6888                                                   results);
6889         }
6890
6891         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6892         {
6893                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6894                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6895                 nl80211_reg_rule_sec(tb_rule, results);
6896         }
6897
6898         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6899         {
6900                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6901                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6902                 nl80211_reg_rule_vht(tb_rule, results);
6903         }
6904
6905         return NL_SKIP;
6906 }
6907
6908
6909 static int nl80211_set_regulatory_flags(struct wpa_driver_nl80211_data *drv,
6910                                         struct phy_info_arg *results)
6911 {
6912         struct nl_msg *msg;
6913
6914         msg = nlmsg_alloc();
6915         if (!msg)
6916                 return -ENOMEM;
6917
6918         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
6919         return send_and_recv_msgs(drv, msg, nl80211_get_reg, results);
6920 }
6921
6922
6923 static struct hostapd_hw_modes *
6924 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
6925 {
6926         u32 feat;
6927         struct i802_bss *bss = priv;
6928         struct wpa_driver_nl80211_data *drv = bss->drv;
6929         struct nl_msg *msg;
6930         struct phy_info_arg result = {
6931                 .num_modes = num_modes,
6932                 .modes = NULL,
6933                 .last_mode = -1,
6934         };
6935
6936         *num_modes = 0;
6937         *flags = 0;
6938
6939         msg = nlmsg_alloc();
6940         if (!msg)
6941                 return NULL;
6942
6943         feat = get_nl80211_protocol_features(drv);
6944         if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
6945                 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
6946         else
6947                 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
6948
6949         NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
6950         if (nl80211_set_iface_id(msg, bss) < 0)
6951                 goto nla_put_failure;
6952
6953         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) {
6954                 nl80211_set_regulatory_flags(drv, &result);
6955                 return wpa_driver_nl80211_postprocess_modes(result.modes,
6956                                                             num_modes);
6957         }
6958         msg = NULL;
6959  nla_put_failure:
6960         nlmsg_free(msg);
6961         return NULL;
6962 }
6963
6964
6965 static int wpa_driver_nl80211_send_mntr(struct wpa_driver_nl80211_data *drv,
6966                                         const void *data, size_t len,
6967                                         int encrypt, int noack)
6968 {
6969         __u8 rtap_hdr[] = {
6970                 0x00, 0x00, /* radiotap version */
6971                 0x0e, 0x00, /* radiotap length */
6972                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
6973                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
6974                 0x00,       /* padding */
6975                 0x00, 0x00, /* RX and TX flags to indicate that */
6976                 0x00, 0x00, /* this is the injected frame directly */
6977         };
6978         struct iovec iov[2] = {
6979                 {
6980                         .iov_base = &rtap_hdr,
6981                         .iov_len = sizeof(rtap_hdr),
6982                 },
6983                 {
6984                         .iov_base = (void *) data,
6985                         .iov_len = len,
6986                 }
6987         };
6988         struct msghdr msg = {
6989                 .msg_name = NULL,
6990                 .msg_namelen = 0,
6991                 .msg_iov = iov,
6992                 .msg_iovlen = 2,
6993                 .msg_control = NULL,
6994                 .msg_controllen = 0,
6995                 .msg_flags = 0,
6996         };
6997         int res;
6998         u16 txflags = 0;
6999
7000         if (encrypt)
7001                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
7002
7003         if (drv->monitor_sock < 0) {
7004                 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
7005                            "for %s", __func__);
7006                 return -1;
7007         }
7008
7009         if (noack)
7010                 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
7011         WPA_PUT_LE16(&rtap_hdr[12], txflags);
7012
7013         res = sendmsg(drv->monitor_sock, &msg, 0);
7014         if (res < 0) {
7015                 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
7016                 return -1;
7017         }
7018         return 0;
7019 }
7020
7021
7022 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
7023                                          const void *data, size_t len,
7024                                          int encrypt, int noack,
7025                                          unsigned int freq, int no_cck,
7026                                          int offchanok, unsigned int wait_time)
7027 {
7028         struct wpa_driver_nl80211_data *drv = bss->drv;
7029         u64 cookie;
7030         int res;
7031
7032         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
7033                 freq = nl80211_get_assoc_freq(drv);
7034                 wpa_printf(MSG_DEBUG,
7035                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
7036                            freq);
7037         }
7038         if (freq == 0) {
7039                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
7040                            bss->freq);
7041                 freq = bss->freq;
7042         }
7043
7044         if (drv->use_monitor) {
7045                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_mntr",
7046                            freq, bss->freq);
7047                 return wpa_driver_nl80211_send_mntr(drv, data, len,
7048                                                     encrypt, noack);
7049         }
7050
7051         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
7052         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
7053                                      &cookie, no_cck, noack, offchanok);
7054         if (res == 0 && !noack) {
7055                 const struct ieee80211_mgmt *mgmt;
7056                 u16 fc;
7057
7058                 mgmt = (const struct ieee80211_mgmt *) data;
7059                 fc = le_to_host16(mgmt->frame_control);
7060                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
7061                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
7062                         wpa_printf(MSG_MSGDUMP,
7063                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
7064                                    (long long unsigned int)
7065                                    drv->send_action_cookie,
7066                                    (long long unsigned int) cookie);
7067                         drv->send_action_cookie = cookie;
7068                 }
7069         }
7070
7071         return res;
7072 }
7073
7074
7075 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
7076                                         size_t data_len, int noack,
7077                                         unsigned int freq, int no_cck,
7078                                         int offchanok,
7079                                         unsigned int wait_time)
7080 {
7081         struct wpa_driver_nl80211_data *drv = bss->drv;
7082         struct ieee80211_mgmt *mgmt;
7083         int encrypt = 1;
7084         u16 fc;
7085
7086         mgmt = (struct ieee80211_mgmt *) data;
7087         fc = le_to_host16(mgmt->frame_control);
7088         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x nlmode=%d",
7089                    noack, freq, no_cck, offchanok, wait_time, fc, drv->nlmode);
7090
7091         if ((is_sta_interface(drv->nlmode) ||
7092              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
7093             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
7094             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
7095                 /*
7096                  * The use of last_mgmt_freq is a bit of a hack,
7097                  * but it works due to the single-threaded nature
7098                  * of wpa_supplicant.
7099                  */
7100                 if (freq == 0) {
7101                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
7102                                    drv->last_mgmt_freq);
7103                         freq = drv->last_mgmt_freq;
7104                 }
7105                 return nl80211_send_frame_cmd(bss, freq, 0,
7106                                               data, data_len, NULL, 1, noack,
7107                                               1);
7108         }
7109
7110         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
7111                 if (freq == 0) {
7112                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
7113                                    bss->freq);
7114                         freq = bss->freq;
7115                 }
7116                 return nl80211_send_frame_cmd(bss, freq,
7117                                               (int) freq == bss->freq ? 0 :
7118                                               wait_time,
7119                                               data, data_len,
7120                                               &drv->send_action_cookie,
7121                                               no_cck, noack, offchanok);
7122         }
7123
7124         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
7125             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
7126                 /*
7127                  * Only one of the authentication frame types is encrypted.
7128                  * In order for static WEP encryption to work properly (i.e.,
7129                  * to not encrypt the frame), we need to tell mac80211 about
7130                  * the frames that must not be encrypted.
7131                  */
7132                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
7133                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
7134                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
7135                         encrypt = 0;
7136         }
7137
7138         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
7139         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
7140                                              noack, freq, no_cck, offchanok,
7141                                              wait_time);
7142 }
7143
7144
7145 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
7146                            int slot, int ht_opmode, int ap_isolate,
7147                            int *basic_rates)
7148 {
7149         struct wpa_driver_nl80211_data *drv = bss->drv;
7150         struct nl_msg *msg;
7151
7152         msg = nlmsg_alloc();
7153         if (!msg)
7154                 return -ENOMEM;
7155
7156         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
7157
7158         if (cts >= 0)
7159                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
7160         if (preamble >= 0)
7161                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
7162         if (slot >= 0)
7163                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
7164         if (ht_opmode >= 0)
7165                 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
7166         if (ap_isolate >= 0)
7167                 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
7168
7169         if (basic_rates) {
7170                 u8 rates[NL80211_MAX_SUPP_RATES];
7171                 u8 rates_len = 0;
7172                 int i;
7173
7174                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
7175                      i++)
7176                         rates[rates_len++] = basic_rates[i] / 5;
7177
7178                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
7179         }
7180
7181         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7182
7183         return send_and_recv_msgs(drv, msg, NULL, NULL);
7184  nla_put_failure:
7185         nlmsg_free(msg);
7186         return -ENOBUFS;
7187 }
7188
7189
7190 static int wpa_driver_nl80211_set_acl(void *priv,
7191                                       struct hostapd_acl_params *params)
7192 {
7193         struct i802_bss *bss = priv;
7194         struct wpa_driver_nl80211_data *drv = bss->drv;
7195         struct nl_msg *msg;
7196         struct nlattr *acl;
7197         unsigned int i;
7198         int ret = 0;
7199
7200         if (!(drv->capa.max_acl_mac_addrs))
7201                 return -ENOTSUP;
7202
7203         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
7204                 return -ENOTSUP;
7205
7206         msg = nlmsg_alloc();
7207         if (!msg)
7208                 return -ENOMEM;
7209
7210         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
7211                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
7212
7213         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_MAC_ACL);
7214
7215         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7216
7217         NLA_PUT_U32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
7218                     NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
7219                     NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED);
7220
7221         acl = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
7222         if (acl == NULL)
7223                 goto nla_put_failure;
7224
7225         for (i = 0; i < params->num_mac_acl; i++)
7226                 NLA_PUT(msg, i + 1, ETH_ALEN, params->mac_acl[i].addr);
7227
7228         nla_nest_end(msg, acl);
7229
7230         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7231         msg = NULL;
7232         if (ret) {
7233                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
7234                            ret, strerror(-ret));
7235         }
7236
7237 nla_put_failure:
7238         nlmsg_free(msg);
7239
7240         return ret;
7241 }
7242
7243
7244 static int wpa_driver_nl80211_set_ap(void *priv,
7245                                      struct wpa_driver_ap_params *params)
7246 {
7247         struct i802_bss *bss = priv;
7248         struct wpa_driver_nl80211_data *drv = bss->drv;
7249         struct nl_msg *msg;
7250         u8 cmd = NL80211_CMD_NEW_BEACON;
7251         int ret;
7252         int beacon_set;
7253         int ifindex = if_nametoindex(bss->ifname);
7254         int num_suites;
7255         u32 suites[10], suite;
7256         u32 ver;
7257
7258         beacon_set = bss->beacon_set;
7259
7260         msg = nlmsg_alloc();
7261         if (!msg)
7262                 return -ENOMEM;
7263
7264         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
7265                    beacon_set);
7266         if (beacon_set)
7267                 cmd = NL80211_CMD_SET_BEACON;
7268
7269         nl80211_cmd(drv, msg, 0, cmd);
7270         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
7271                     params->head, params->head_len);
7272         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
7273         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
7274                     params->tail, params->tail_len);
7275         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
7276         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", ifindex);
7277         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
7278         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
7279         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
7280         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
7281         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
7282         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
7283                           params->ssid, params->ssid_len);
7284         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
7285                 params->ssid);
7286         if (params->proberesp && params->proberesp_len) {
7287                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
7288                             params->proberesp, params->proberesp_len);
7289                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
7290                         params->proberesp);
7291         }
7292         switch (params->hide_ssid) {
7293         case NO_SSID_HIDING:
7294                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
7295                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
7296                             NL80211_HIDDEN_SSID_NOT_IN_USE);
7297                 break;
7298         case HIDDEN_SSID_ZERO_LEN:
7299                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
7300                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
7301                             NL80211_HIDDEN_SSID_ZERO_LEN);
7302                 break;
7303         case HIDDEN_SSID_ZERO_CONTENTS:
7304                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
7305                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
7306                             NL80211_HIDDEN_SSID_ZERO_CONTENTS);
7307                 break;
7308         }
7309         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
7310         if (params->privacy)
7311                 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
7312         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
7313         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
7314             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
7315                 /* Leave out the attribute */
7316         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
7317                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
7318                             NL80211_AUTHTYPE_SHARED_KEY);
7319         else
7320                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
7321                             NL80211_AUTHTYPE_OPEN_SYSTEM);
7322
7323         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
7324         ver = 0;
7325         if (params->wpa_version & WPA_PROTO_WPA)
7326                 ver |= NL80211_WPA_VERSION_1;
7327         if (params->wpa_version & WPA_PROTO_RSN)
7328                 ver |= NL80211_WPA_VERSION_2;
7329         if (ver)
7330                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
7331
7332         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
7333                    params->key_mgmt_suites);
7334         num_suites = 0;
7335         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
7336                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
7337         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
7338                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
7339         if (num_suites) {
7340                 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
7341                         num_suites * sizeof(u32), suites);
7342         }
7343
7344         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
7345             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
7346                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
7347
7348         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
7349                    params->pairwise_ciphers);
7350         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
7351                                                  suites, ARRAY_SIZE(suites));
7352         if (num_suites) {
7353                 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
7354                         num_suites * sizeof(u32), suites);
7355         }
7356
7357         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
7358                    params->group_cipher);
7359         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
7360         if (suite)
7361                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite);
7362
7363         if (params->beacon_ies) {
7364                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
7365                                 params->beacon_ies);
7366                 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
7367                         wpabuf_head(params->beacon_ies));
7368         }
7369         if (params->proberesp_ies) {
7370                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
7371                                 params->proberesp_ies);
7372                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
7373                         wpabuf_len(params->proberesp_ies),
7374                         wpabuf_head(params->proberesp_ies));
7375         }
7376         if (params->assocresp_ies) {
7377                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
7378                                 params->assocresp_ies);
7379                 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
7380                         wpabuf_len(params->assocresp_ies),
7381                         wpabuf_head(params->assocresp_ies));
7382         }
7383
7384         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
7385                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
7386                            params->ap_max_inactivity);
7387                 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
7388                             params->ap_max_inactivity);
7389         }
7390
7391         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7392         if (ret) {
7393                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
7394                            ret, strerror(-ret));
7395         } else {
7396                 bss->beacon_set = 1;
7397                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
7398                                 params->short_slot_time, params->ht_opmode,
7399                                 params->isolate, params->basic_rates);
7400                 if (beacon_set && params->freq &&
7401                     params->freq->bandwidth != bss->bandwidth) {
7402                         wpa_printf(MSG_DEBUG,
7403                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
7404                                    bss->ifname, bss->bandwidth,
7405                                    params->freq->bandwidth);
7406                         ret = nl80211_set_channel(bss, params->freq, 1);
7407                         if (ret) {
7408                                 wpa_printf(MSG_DEBUG,
7409                                            "nl80211: Frequency set failed: %d (%s)",
7410                                            ret, strerror(-ret));
7411                         } else {
7412                                 wpa_printf(MSG_DEBUG,
7413                                            "nl80211: Frequency set succeeded for ht2040 coex");
7414                                 bss->bandwidth = params->freq->bandwidth;
7415                         }
7416                 } else if (!beacon_set) {
7417                         /*
7418                          * cfg80211 updates the driver on frequence change in AP
7419                          * mode only at the point when beaconing is started, so
7420                          * set the initial value here.
7421                          */
7422                         bss->bandwidth = params->freq->bandwidth;
7423                 }
7424         }
7425         return ret;
7426  nla_put_failure:
7427         nlmsg_free(msg);
7428         return -ENOBUFS;
7429 }
7430
7431
7432 static int nl80211_put_freq_params(struct nl_msg *msg,
7433                                    struct hostapd_freq_params *freq)
7434 {
7435         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
7436         if (freq->vht_enabled) {
7437                 switch (freq->bandwidth) {
7438                 case 20:
7439                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7440                                     NL80211_CHAN_WIDTH_20);
7441                         break;
7442                 case 40:
7443                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7444                                     NL80211_CHAN_WIDTH_40);
7445                         break;
7446                 case 80:
7447                         if (freq->center_freq2)
7448                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7449                                             NL80211_CHAN_WIDTH_80P80);
7450                         else
7451                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7452                                             NL80211_CHAN_WIDTH_80);
7453                         break;
7454                 case 160:
7455                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7456                                     NL80211_CHAN_WIDTH_160);
7457                         break;
7458                 default:
7459                         return -EINVAL;
7460                 }
7461                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
7462                 if (freq->center_freq2)
7463                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
7464                                     freq->center_freq2);
7465         } else if (freq->ht_enabled) {
7466                 switch (freq->sec_channel_offset) {
7467                 case -1:
7468                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
7469                                     NL80211_CHAN_HT40MINUS);
7470                         break;
7471                 case 1:
7472                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
7473                                     NL80211_CHAN_HT40PLUS);
7474                         break;
7475                 default:
7476                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
7477                                     NL80211_CHAN_HT20);
7478                         break;
7479                 }
7480         }
7481         return 0;
7482
7483 nla_put_failure:
7484         return -ENOBUFS;
7485 }
7486
7487
7488 static int nl80211_set_channel(struct i802_bss *bss,
7489                                struct hostapd_freq_params *freq, int set_chan)
7490 {
7491         struct wpa_driver_nl80211_data *drv = bss->drv;
7492         struct nl_msg *msg;
7493         int ret;
7494
7495         wpa_printf(MSG_DEBUG,
7496                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7497                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7498                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7499         msg = nlmsg_alloc();
7500         if (!msg)
7501                 return -1;
7502
7503         nl80211_cmd(drv, msg, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
7504                     NL80211_CMD_SET_WIPHY);
7505
7506         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7507         if (nl80211_put_freq_params(msg, freq) < 0)
7508                 goto nla_put_failure;
7509
7510         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7511         msg = NULL;
7512         if (ret == 0) {
7513                 bss->freq = freq->freq;
7514                 return 0;
7515         }
7516         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
7517                    "%d (%s)", freq->freq, ret, strerror(-ret));
7518 nla_put_failure:
7519         nlmsg_free(msg);
7520         return -1;
7521 }
7522
7523
7524 static u32 sta_flags_nl80211(int flags)
7525 {
7526         u32 f = 0;
7527
7528         if (flags & WPA_STA_AUTHORIZED)
7529                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
7530         if (flags & WPA_STA_WMM)
7531                 f |= BIT(NL80211_STA_FLAG_WME);
7532         if (flags & WPA_STA_SHORT_PREAMBLE)
7533                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
7534         if (flags & WPA_STA_MFP)
7535                 f |= BIT(NL80211_STA_FLAG_MFP);
7536         if (flags & WPA_STA_TDLS_PEER)
7537                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
7538
7539         return f;
7540 }
7541
7542
7543 static int wpa_driver_nl80211_sta_add(void *priv,
7544                                       struct hostapd_sta_add_params *params)
7545 {
7546         struct i802_bss *bss = priv;
7547         struct wpa_driver_nl80211_data *drv = bss->drv;
7548         struct nl_msg *msg;
7549         struct nl80211_sta_flag_update upd;
7550         int ret = -ENOBUFS;
7551
7552         if ((params->flags & WPA_STA_TDLS_PEER) &&
7553             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7554                 return -EOPNOTSUPP;
7555
7556         msg = nlmsg_alloc();
7557         if (!msg)
7558                 return -ENOMEM;
7559
7560         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
7561                    params->set ? "Set" : "Add", MAC2STR(params->addr));
7562         nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
7563                     NL80211_CMD_NEW_STATION);
7564
7565         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7566         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
7567         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
7568                 params->supp_rates);
7569         wpa_hexdump(MSG_DEBUG, "  * supported rates", params->supp_rates,
7570                     params->supp_rates_len);
7571         if (!params->set) {
7572                 if (params->aid) {
7573                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
7574                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
7575                 } else {
7576                         /*
7577                          * cfg80211 validates that AID is non-zero, so we have
7578                          * to make this a non-zero value for the TDLS case where
7579                          * a dummy STA entry is used for now.
7580                          */
7581                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
7582                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, 1);
7583                 }
7584                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
7585                            params->listen_interval);
7586                 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
7587                             params->listen_interval);
7588         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
7589                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
7590                 NLA_PUT_U16(msg, NL80211_ATTR_PEER_AID, params->aid);
7591         }
7592         if (params->ht_capabilities) {
7593                 wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
7594                             (u8 *) params->ht_capabilities,
7595                             sizeof(*params->ht_capabilities));
7596                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
7597                         sizeof(*params->ht_capabilities),
7598                         params->ht_capabilities);
7599         }
7600
7601         if (params->vht_capabilities) {
7602                 wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
7603                             (u8 *) params->vht_capabilities,
7604                             sizeof(*params->vht_capabilities));
7605                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY,
7606                         sizeof(*params->vht_capabilities),
7607                         params->vht_capabilities);
7608         }
7609
7610         if (params->vht_opmode_enabled) {
7611                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
7612                 NLA_PUT_U8(msg, NL80211_ATTR_OPMODE_NOTIF,
7613                            params->vht_opmode);
7614         }
7615
7616         wpa_printf(MSG_DEBUG, "  * capability=0x%x", params->capability);
7617         NLA_PUT_U16(msg, NL80211_ATTR_STA_CAPABILITY, params->capability);
7618
7619         if (params->ext_capab) {
7620                 wpa_hexdump(MSG_DEBUG, "  * ext_capab",
7621                             params->ext_capab, params->ext_capab_len);
7622                 NLA_PUT(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
7623                         params->ext_capab_len, params->ext_capab);
7624         }
7625
7626         if (params->supp_channels) {
7627                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
7628                             params->supp_channels, params->supp_channels_len);
7629                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
7630                         params->supp_channels_len, params->supp_channels);
7631         }
7632
7633         if (params->supp_oper_classes) {
7634                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
7635                             params->supp_oper_classes,
7636                             params->supp_oper_classes_len);
7637                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
7638                         params->supp_oper_classes_len,
7639                         params->supp_oper_classes);
7640         }
7641
7642         os_memset(&upd, 0, sizeof(upd));
7643         upd.mask = sta_flags_nl80211(params->flags);
7644         upd.set = upd.mask;
7645         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
7646                    upd.set, upd.mask);
7647         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
7648
7649         if (params->flags & WPA_STA_WMM) {
7650                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
7651
7652                 if (!wme)
7653                         goto nla_put_failure;
7654
7655                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
7656                 NLA_PUT_U8(msg, NL80211_STA_WME_UAPSD_QUEUES,
7657                                 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
7658                 NLA_PUT_U8(msg, NL80211_STA_WME_MAX_SP,
7659                                 (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
7660                                 WMM_QOSINFO_STA_SP_MASK);
7661                 nla_nest_end(msg, wme);
7662         }
7663
7664         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7665         msg = NULL;
7666         if (ret)
7667                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
7668                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
7669                            strerror(-ret));
7670         if (ret == -EEXIST)
7671                 ret = 0;
7672  nla_put_failure:
7673         nlmsg_free(msg);
7674         return ret;
7675 }
7676
7677
7678 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr)
7679 {
7680         struct wpa_driver_nl80211_data *drv = bss->drv;
7681         struct nl_msg *msg;
7682         int ret;
7683
7684         msg = nlmsg_alloc();
7685         if (!msg)
7686                 return -ENOMEM;
7687
7688         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
7689
7690         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7691                     if_nametoindex(bss->ifname));
7692         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7693
7694         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7695         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
7696                    " --> %d (%s)",
7697                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
7698         if (ret == -ENOENT)
7699                 return 0;
7700         return ret;
7701  nla_put_failure:
7702         nlmsg_free(msg);
7703         return -ENOBUFS;
7704 }
7705
7706
7707 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
7708                                  int ifidx)
7709 {
7710         struct nl_msg *msg;
7711         struct wpa_driver_nl80211_data *drv2;
7712
7713         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
7714
7715         /* stop listening for EAPOL on this interface */
7716         dl_list_for_each(drv2, &drv->global->interfaces,
7717                          struct wpa_driver_nl80211_data, list)
7718                 del_ifidx(drv2, ifidx);
7719
7720         msg = nlmsg_alloc();
7721         if (!msg)
7722                 goto nla_put_failure;
7723
7724         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
7725         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
7726
7727         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
7728                 return;
7729         msg = NULL;
7730  nla_put_failure:
7731         nlmsg_free(msg);
7732         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
7733 }
7734
7735
7736 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
7737 {
7738         switch (mode) {
7739         case NL80211_IFTYPE_ADHOC:
7740                 return "ADHOC";
7741         case NL80211_IFTYPE_STATION:
7742                 return "STATION";
7743         case NL80211_IFTYPE_AP:
7744                 return "AP";
7745         case NL80211_IFTYPE_AP_VLAN:
7746                 return "AP_VLAN";
7747         case NL80211_IFTYPE_WDS:
7748                 return "WDS";
7749         case NL80211_IFTYPE_MONITOR:
7750                 return "MONITOR";
7751         case NL80211_IFTYPE_MESH_POINT:
7752                 return "MESH_POINT";
7753         case NL80211_IFTYPE_P2P_CLIENT:
7754                 return "P2P_CLIENT";
7755         case NL80211_IFTYPE_P2P_GO:
7756                 return "P2P_GO";
7757         case NL80211_IFTYPE_P2P_DEVICE:
7758                 return "P2P_DEVICE";
7759         default:
7760                 return "unknown";
7761         }
7762 }
7763
7764
7765 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
7766                                      const char *ifname,
7767                                      enum nl80211_iftype iftype,
7768                                      const u8 *addr, int wds,
7769                                      int (*handler)(struct nl_msg *, void *),
7770                                      void *arg)
7771 {
7772         struct nl_msg *msg;
7773         int ifidx;
7774         int ret = -ENOBUFS;
7775
7776         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
7777                    iftype, nl80211_iftype_str(iftype));
7778
7779         msg = nlmsg_alloc();
7780         if (!msg)
7781                 return -1;
7782
7783         nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
7784         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
7785                 goto nla_put_failure;
7786         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
7787         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
7788
7789         if (iftype == NL80211_IFTYPE_MONITOR) {
7790                 struct nlattr *flags;
7791
7792                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
7793                 if (!flags)
7794                         goto nla_put_failure;
7795
7796                 NLA_PUT_FLAG(msg, NL80211_MNTR_FLAG_COOK_FRAMES);
7797
7798                 nla_nest_end(msg, flags);
7799         } else if (wds) {
7800                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
7801         }
7802
7803         /*
7804          * Tell cfg80211 that the interface belongs to the socket that created
7805          * it, and the interface should be deleted when the socket is closed.
7806          */
7807         NLA_PUT_FLAG(msg, NL80211_ATTR_IFACE_SOCKET_OWNER);
7808
7809         ret = send_and_recv_msgs(drv, msg, handler, arg);
7810         msg = NULL;
7811         if (ret) {
7812  nla_put_failure:
7813                 nlmsg_free(msg);
7814                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
7815                            ifname, ret, strerror(-ret));
7816                 return ret;
7817         }
7818
7819         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
7820                 return 0;
7821
7822         ifidx = if_nametoindex(ifname);
7823         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
7824                    ifname, ifidx);
7825
7826         if (ifidx <= 0)
7827                 return -1;
7828
7829         /*
7830          * Some virtual interfaces need to process EAPOL packets and events on
7831          * the parent interface. This is used mainly with hostapd.
7832          */
7833         if (drv->hostapd ||
7834             iftype == NL80211_IFTYPE_AP_VLAN ||
7835             iftype == NL80211_IFTYPE_WDS ||
7836             iftype == NL80211_IFTYPE_MONITOR) {
7837                 /* start listening for EAPOL on this interface */
7838                 add_ifidx(drv, ifidx);
7839         }
7840
7841         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
7842             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
7843                 nl80211_remove_iface(drv, ifidx);
7844                 return -1;
7845         }
7846
7847         return ifidx;
7848 }
7849
7850
7851 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
7852                                 const char *ifname, enum nl80211_iftype iftype,
7853                                 const u8 *addr, int wds,
7854                                 int (*handler)(struct nl_msg *, void *),
7855                                 void *arg, int use_existing)
7856 {
7857         int ret;
7858
7859         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
7860                                         arg);
7861
7862         /* if error occurred and interface exists already */
7863         if (ret == -ENFILE && if_nametoindex(ifname)) {
7864                 if (use_existing) {
7865                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
7866                                    ifname);
7867                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
7868                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
7869                                                addr) < 0 &&
7870                             (linux_set_iface_flags(drv->global->ioctl_sock,
7871                                                    ifname, 0) < 0 ||
7872                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
7873                                                 addr) < 0 ||
7874                              linux_set_iface_flags(drv->global->ioctl_sock,
7875                                                    ifname, 1) < 0))
7876                                         return -1;
7877                         return -ENFILE;
7878                 }
7879                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
7880
7881                 /* Try to remove the interface that was already there. */
7882                 nl80211_remove_iface(drv, if_nametoindex(ifname));
7883
7884                 /* Try to create the interface again */
7885                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
7886                                                 wds, handler, arg);
7887         }
7888
7889         if (ret >= 0 && is_p2p_net_interface(iftype))
7890                 nl80211_disable_11b_rates(drv, ret, 1);
7891
7892         return ret;
7893 }
7894
7895
7896 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
7897 {
7898         struct ieee80211_hdr *hdr;
7899         u16 fc;
7900         union wpa_event_data event;
7901
7902         hdr = (struct ieee80211_hdr *) buf;
7903         fc = le_to_host16(hdr->frame_control);
7904
7905         os_memset(&event, 0, sizeof(event));
7906         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
7907         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
7908         event.tx_status.dst = hdr->addr1;
7909         event.tx_status.data = buf;
7910         event.tx_status.data_len = len;
7911         event.tx_status.ack = ok;
7912         wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
7913 }
7914
7915
7916 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
7917                              u8 *buf, size_t len)
7918 {
7919         struct ieee80211_hdr *hdr = (void *)buf;
7920         u16 fc;
7921         union wpa_event_data event;
7922
7923         if (len < sizeof(*hdr))
7924                 return;
7925
7926         fc = le_to_host16(hdr->frame_control);
7927
7928         os_memset(&event, 0, sizeof(event));
7929         event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
7930         event.rx_from_unknown.addr = hdr->addr2;
7931         event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
7932                 (WLAN_FC_FROMDS | WLAN_FC_TODS);
7933         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
7934 }
7935
7936
7937 static void handle_frame(struct wpa_driver_nl80211_data *drv,
7938                          u8 *buf, size_t len, int datarate, int ssi_signal)
7939 {
7940         struct ieee80211_hdr *hdr;
7941         u16 fc;
7942         union wpa_event_data event;
7943
7944         hdr = (struct ieee80211_hdr *) buf;
7945         fc = le_to_host16(hdr->frame_control);
7946
7947         switch (WLAN_FC_GET_TYPE(fc)) {
7948         case WLAN_FC_TYPE_MGMT:
7949                 os_memset(&event, 0, sizeof(event));
7950                 event.rx_mgmt.frame = buf;
7951                 event.rx_mgmt.frame_len = len;
7952                 event.rx_mgmt.datarate = datarate;
7953                 event.rx_mgmt.ssi_signal = ssi_signal;
7954                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
7955                 break;
7956         case WLAN_FC_TYPE_CTRL:
7957                 /* can only get here with PS-Poll frames */
7958                 wpa_printf(MSG_DEBUG, "CTRL");
7959                 from_unknown_sta(drv, buf, len);
7960                 break;
7961         case WLAN_FC_TYPE_DATA:
7962                 from_unknown_sta(drv, buf, len);
7963                 break;
7964         }
7965 }
7966
7967
7968 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
7969 {
7970         struct wpa_driver_nl80211_data *drv = eloop_ctx;
7971         int len;
7972         unsigned char buf[3000];
7973         struct ieee80211_radiotap_iterator iter;
7974         int ret;
7975         int datarate = 0, ssi_signal = 0;
7976         int injected = 0, failed = 0, rxflags = 0;
7977
7978         len = recv(sock, buf, sizeof(buf), 0);
7979         if (len < 0) {
7980                 wpa_printf(MSG_ERROR, "nl80211: Monitor socket recv failed: %s",
7981                            strerror(errno));
7982                 return;
7983         }
7984
7985         if (ieee80211_radiotap_iterator_init(&iter, (void *) buf, len, NULL)) {
7986                 wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame");
7987                 return;
7988         }
7989
7990         while (1) {
7991                 ret = ieee80211_radiotap_iterator_next(&iter);
7992                 if (ret == -ENOENT)
7993                         break;
7994                 if (ret) {
7995                         wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame (%d)",
7996                                    ret);
7997                         return;
7998                 }
7999                 switch (iter.this_arg_index) {
8000                 case IEEE80211_RADIOTAP_FLAGS:
8001                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
8002                                 len -= 4;
8003                         break;
8004                 case IEEE80211_RADIOTAP_RX_FLAGS:
8005                         rxflags = 1;
8006                         break;
8007                 case IEEE80211_RADIOTAP_TX_FLAGS:
8008                         injected = 1;
8009                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
8010                                         IEEE80211_RADIOTAP_F_TX_FAIL;
8011                         break;
8012                 case IEEE80211_RADIOTAP_DATA_RETRIES:
8013                         break;
8014                 case IEEE80211_RADIOTAP_CHANNEL:
8015                         /* TODO: convert from freq/flags to channel number */
8016                         break;
8017                 case IEEE80211_RADIOTAP_RATE:
8018                         datarate = *iter.this_arg * 5;
8019                         break;
8020                 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
8021                         ssi_signal = (s8) *iter.this_arg;
8022                         break;
8023                 }
8024         }
8025
8026         if (rxflags && injected)
8027                 return;
8028
8029         if (!injected)
8030                 handle_frame(drv, buf + iter._max_length,
8031                              len - iter._max_length, datarate, ssi_signal);
8032         else
8033                 handle_tx_callback(drv->ctx, buf + iter._max_length,
8034                                    len - iter._max_length, !failed);
8035 }
8036
8037
8038 /*
8039  * we post-process the filter code later and rewrite
8040  * this to the offset to the last instruction
8041  */
8042 #define PASS    0xFF
8043 #define FAIL    0xFE
8044
8045 static struct sock_filter msock_filter_insns[] = {
8046         /*
8047          * do a little-endian load of the radiotap length field
8048          */
8049         /* load lower byte into A */
8050         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
8051         /* put it into X (== index register) */
8052         BPF_STMT(BPF_MISC| BPF_TAX, 0),
8053         /* load upper byte into A */
8054         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
8055         /* left-shift it by 8 */
8056         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
8057         /* or with X */
8058         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
8059         /* put result into X */
8060         BPF_STMT(BPF_MISC| BPF_TAX, 0),
8061
8062         /*
8063          * Allow management frames through, this also gives us those
8064          * management frames that we sent ourselves with status
8065          */
8066         /* load the lower byte of the IEEE 802.11 frame control field */
8067         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
8068         /* mask off frame type and version */
8069         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
8070         /* accept frame if it's both 0, fall through otherwise */
8071         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
8072
8073         /*
8074          * TODO: add a bit to radiotap RX flags that indicates
8075          * that the sending station is not associated, then
8076          * add a filter here that filters on our DA and that flag
8077          * to allow us to deauth frames to that bad station.
8078          *
8079          * For now allow all To DS data frames through.
8080          */
8081         /* load the IEEE 802.11 frame control field */
8082         BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
8083         /* mask off frame type, version and DS status */
8084         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
8085         /* accept frame if version 0, type 2 and To DS, fall through otherwise
8086          */
8087         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
8088
8089 #if 0
8090         /*
8091          * drop non-data frames
8092          */
8093         /* load the lower byte of the frame control field */
8094         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
8095         /* mask off QoS bit */
8096         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
8097         /* drop non-data frames */
8098         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
8099 #endif
8100         /* load the upper byte of the frame control field */
8101         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
8102         /* mask off toDS/fromDS */
8103         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
8104         /* accept WDS frames */
8105         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
8106
8107         /*
8108          * add header length to index
8109          */
8110         /* load the lower byte of the frame control field */
8111         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
8112         /* mask off QoS bit */
8113         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
8114         /* right shift it by 6 to give 0 or 2 */
8115         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
8116         /* add data frame header length */
8117         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
8118         /* add index, was start of 802.11 header */
8119         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
8120         /* move to index, now start of LL header */
8121         BPF_STMT(BPF_MISC | BPF_TAX, 0),
8122
8123         /*
8124          * Accept empty data frames, we use those for
8125          * polling activity.
8126          */
8127         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
8128         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
8129
8130         /*
8131          * Accept EAPOL frames
8132          */
8133         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
8134         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
8135         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
8136         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
8137
8138         /* keep these last two statements or change the code below */
8139         /* return 0 == "DROP" */
8140         BPF_STMT(BPF_RET | BPF_K, 0),
8141         /* return ~0 == "keep all" */
8142         BPF_STMT(BPF_RET | BPF_K, ~0),
8143 };
8144
8145 static struct sock_fprog msock_filter = {
8146         .len = ARRAY_SIZE(msock_filter_insns),
8147         .filter = msock_filter_insns,
8148 };
8149
8150
8151 static int add_monitor_filter(int s)
8152 {
8153         int idx;
8154
8155         /* rewrite all PASS/FAIL jump offsets */
8156         for (idx = 0; idx < msock_filter.len; idx++) {
8157                 struct sock_filter *insn = &msock_filter_insns[idx];
8158
8159                 if (BPF_CLASS(insn->code) == BPF_JMP) {
8160                         if (insn->code == (BPF_JMP|BPF_JA)) {
8161                                 if (insn->k == PASS)
8162                                         insn->k = msock_filter.len - idx - 2;
8163                                 else if (insn->k == FAIL)
8164                                         insn->k = msock_filter.len - idx - 3;
8165                         }
8166
8167                         if (insn->jt == PASS)
8168                                 insn->jt = msock_filter.len - idx - 2;
8169                         else if (insn->jt == FAIL)
8170                                 insn->jt = msock_filter.len - idx - 3;
8171
8172                         if (insn->jf == PASS)
8173                                 insn->jf = msock_filter.len - idx - 2;
8174                         else if (insn->jf == FAIL)
8175                                 insn->jf = msock_filter.len - idx - 3;
8176                 }
8177         }
8178
8179         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
8180                        &msock_filter, sizeof(msock_filter))) {
8181                 wpa_printf(MSG_ERROR, "nl80211: setsockopt(SO_ATTACH_FILTER) failed: %s",
8182                            strerror(errno));
8183                 return -1;
8184         }
8185
8186         return 0;
8187 }
8188
8189
8190 static void nl80211_remove_monitor_interface(
8191         struct wpa_driver_nl80211_data *drv)
8192 {
8193         if (drv->monitor_refcount > 0)
8194                 drv->monitor_refcount--;
8195         wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface: refcount=%d",
8196                    drv->monitor_refcount);
8197         if (drv->monitor_refcount > 0)
8198                 return;
8199
8200         if (drv->monitor_ifidx >= 0) {
8201                 nl80211_remove_iface(drv, drv->monitor_ifidx);
8202                 drv->monitor_ifidx = -1;
8203         }
8204         if (drv->monitor_sock >= 0) {
8205                 eloop_unregister_read_sock(drv->monitor_sock);
8206                 close(drv->monitor_sock);
8207                 drv->monitor_sock = -1;
8208         }
8209 }
8210
8211
8212 static int
8213 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
8214 {
8215         char buf[IFNAMSIZ];
8216         struct sockaddr_ll ll;
8217         int optval;
8218         socklen_t optlen;
8219
8220         if (drv->monitor_ifidx >= 0) {
8221                 drv->monitor_refcount++;
8222                 wpa_printf(MSG_DEBUG, "nl80211: Re-use existing monitor interface: refcount=%d",
8223                            drv->monitor_refcount);
8224                 return 0;
8225         }
8226
8227         if (os_strncmp(drv->first_bss->ifname, "p2p-", 4) == 0) {
8228                 /*
8229                  * P2P interface name is of the format p2p-%s-%d. For monitor
8230                  * interface name corresponding to P2P GO, replace "p2p-" with
8231                  * "mon-" to retain the same interface name length and to
8232                  * indicate that it is a monitor interface.
8233                  */
8234                 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss->ifname + 4);
8235         } else {
8236                 /* Non-P2P interface with AP functionality. */
8237                 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss->ifname);
8238         }
8239
8240         buf[IFNAMSIZ - 1] = '\0';
8241
8242         drv->monitor_ifidx =
8243                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
8244                                      0, NULL, NULL, 0);
8245
8246         if (drv->monitor_ifidx == -EOPNOTSUPP) {
8247                 /*
8248                  * This is backward compatibility for a few versions of
8249                  * the kernel only that didn't advertise the right
8250                  * attributes for the only driver that then supported
8251                  * AP mode w/o monitor -- ath6kl.
8252                  */
8253                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
8254                            "monitor interface type - try to run without it");
8255                 drv->device_ap_sme = 1;
8256         }
8257
8258         if (drv->monitor_ifidx < 0)
8259                 return -1;
8260
8261         if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
8262                 goto error;
8263
8264         memset(&ll, 0, sizeof(ll));
8265         ll.sll_family = AF_PACKET;
8266         ll.sll_ifindex = drv->monitor_ifidx;
8267         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
8268         if (drv->monitor_sock < 0) {
8269                 wpa_printf(MSG_ERROR, "nl80211: socket[PF_PACKET,SOCK_RAW] failed: %s",
8270                            strerror(errno));
8271                 goto error;
8272         }
8273
8274         if (add_monitor_filter(drv->monitor_sock)) {
8275                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
8276                            "interface; do filtering in user space");
8277                 /* This works, but will cost in performance. */
8278         }
8279
8280         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
8281                 wpa_printf(MSG_ERROR, "nl80211: monitor socket bind failed: %s",
8282                            strerror(errno));
8283                 goto error;
8284         }
8285
8286         optlen = sizeof(optval);
8287         optval = 20;
8288         if (setsockopt
8289             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
8290                 wpa_printf(MSG_ERROR, "nl80211: Failed to set socket priority: %s",
8291                            strerror(errno));
8292                 goto error;
8293         }
8294
8295         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
8296                                      drv, NULL)) {
8297                 wpa_printf(MSG_INFO, "nl80211: Could not register monitor read socket");
8298                 goto error;
8299         }
8300
8301         drv->monitor_refcount++;
8302         return 0;
8303  error:
8304         nl80211_remove_monitor_interface(drv);
8305         return -1;
8306 }
8307
8308
8309 static int nl80211_setup_ap(struct i802_bss *bss)
8310 {
8311         struct wpa_driver_nl80211_data *drv = bss->drv;
8312
8313         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
8314                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
8315
8316         /*
8317          * Disable Probe Request reporting unless we need it in this way for
8318          * devices that include the AP SME, in the other case (unless using
8319          * monitor iface) we'll get it through the nl_mgmt socket instead.
8320          */
8321         if (!drv->device_ap_sme)
8322                 wpa_driver_nl80211_probe_req_report(bss, 0);
8323
8324         if (!drv->device_ap_sme && !drv->use_monitor)
8325                 if (nl80211_mgmt_subscribe_ap(bss))
8326                         return -1;
8327
8328         if (drv->device_ap_sme && !drv->use_monitor)
8329                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
8330                         return -1;
8331
8332         if (!drv->device_ap_sme && drv->use_monitor &&
8333             nl80211_create_monitor_interface(drv) &&
8334             !drv->device_ap_sme)
8335                 return -1;
8336
8337         if (drv->device_ap_sme &&
8338             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
8339                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
8340                            "Probe Request frame reporting in AP mode");
8341                 /* Try to survive without this */
8342         }
8343
8344         return 0;
8345 }
8346
8347
8348 static void nl80211_teardown_ap(struct i802_bss *bss)
8349 {
8350         struct wpa_driver_nl80211_data *drv = bss->drv;
8351
8352         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
8353                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
8354         if (drv->device_ap_sme) {
8355                 wpa_driver_nl80211_probe_req_report(bss, 0);
8356                 if (!drv->use_monitor)
8357                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
8358         } else if (drv->use_monitor)
8359                 nl80211_remove_monitor_interface(drv);
8360         else
8361                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
8362
8363         bss->beacon_set = 0;
8364 }
8365
8366
8367 static int nl80211_send_eapol_data(struct i802_bss *bss,
8368                                    const u8 *addr, const u8 *data,
8369                                    size_t data_len)
8370 {
8371         struct sockaddr_ll ll;
8372         int ret;
8373
8374         if (bss->drv->eapol_tx_sock < 0) {
8375                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
8376                 return -1;
8377         }
8378
8379         os_memset(&ll, 0, sizeof(ll));
8380         ll.sll_family = AF_PACKET;
8381         ll.sll_ifindex = bss->ifindex;
8382         ll.sll_protocol = htons(ETH_P_PAE);
8383         ll.sll_halen = ETH_ALEN;
8384         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
8385         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
8386                      (struct sockaddr *) &ll, sizeof(ll));
8387         if (ret < 0)
8388                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
8389                            strerror(errno));
8390
8391         return ret;
8392 }
8393
8394
8395 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
8396
8397 static int wpa_driver_nl80211_hapd_send_eapol(
8398         void *priv, const u8 *addr, const u8 *data,
8399         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
8400 {
8401         struct i802_bss *bss = priv;
8402         struct wpa_driver_nl80211_data *drv = bss->drv;
8403         struct ieee80211_hdr *hdr;
8404         size_t len;
8405         u8 *pos;
8406         int res;
8407         int qos = flags & WPA_STA_WMM;
8408
8409         if (drv->device_ap_sme || !drv->use_monitor)
8410                 return nl80211_send_eapol_data(bss, addr, data, data_len);
8411
8412         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
8413                 data_len;
8414         hdr = os_zalloc(len);
8415         if (hdr == NULL) {
8416                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
8417                            (unsigned long) len);
8418                 return -1;
8419         }
8420
8421         hdr->frame_control =
8422                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
8423         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
8424         if (encrypt)
8425                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
8426         if (qos) {
8427                 hdr->frame_control |=
8428                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
8429         }
8430
8431         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
8432         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
8433         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
8434         pos = (u8 *) (hdr + 1);
8435
8436         if (qos) {
8437                 /* Set highest priority in QoS header */
8438                 pos[0] = 7;
8439                 pos[1] = 0;
8440                 pos += 2;
8441         }
8442
8443         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
8444         pos += sizeof(rfc1042_header);
8445         WPA_PUT_BE16(pos, ETH_P_PAE);
8446         pos += 2;
8447         memcpy(pos, data, data_len);
8448
8449         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
8450                                             0, 0, 0, 0);
8451         if (res < 0) {
8452                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
8453                            "failed: %d (%s)",
8454                            (unsigned long) len, errno, strerror(errno));
8455         }
8456         os_free(hdr);
8457
8458         return res;
8459 }
8460
8461
8462 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
8463                                             int total_flags,
8464                                             int flags_or, int flags_and)
8465 {
8466         struct i802_bss *bss = priv;
8467         struct wpa_driver_nl80211_data *drv = bss->drv;
8468         struct nl_msg *msg;
8469         struct nlattr *flags;
8470         struct nl80211_sta_flag_update upd;
8471
8472         msg = nlmsg_alloc();
8473         if (!msg)
8474                 return -ENOMEM;
8475
8476         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
8477
8478         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
8479                     if_nametoindex(bss->ifname));
8480         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8481
8482         /*
8483          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
8484          * can be removed eventually.
8485          */
8486         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
8487         if (!flags)
8488                 goto nla_put_failure;
8489         if (total_flags & WPA_STA_AUTHORIZED)
8490                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_AUTHORIZED);
8491
8492         if (total_flags & WPA_STA_WMM)
8493                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_WME);
8494
8495         if (total_flags & WPA_STA_SHORT_PREAMBLE)
8496                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_SHORT_PREAMBLE);
8497
8498         if (total_flags & WPA_STA_MFP)
8499                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_MFP);
8500
8501         if (total_flags & WPA_STA_TDLS_PEER)
8502                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_TDLS_PEER);
8503
8504         nla_nest_end(msg, flags);
8505
8506         os_memset(&upd, 0, sizeof(upd));
8507         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
8508         upd.set = sta_flags_nl80211(flags_or);
8509         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
8510
8511         return send_and_recv_msgs(drv, msg, NULL, NULL);
8512  nla_put_failure:
8513         nlmsg_free(msg);
8514         return -ENOBUFS;
8515 }
8516
8517
8518 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
8519                                  struct wpa_driver_associate_params *params)
8520 {
8521         enum nl80211_iftype nlmode, old_mode;
8522         struct hostapd_freq_params freq = {
8523                 .freq = params->freq,
8524         };
8525
8526         if (params->p2p) {
8527                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
8528                            "group (GO)");
8529                 nlmode = NL80211_IFTYPE_P2P_GO;
8530         } else
8531                 nlmode = NL80211_IFTYPE_AP;
8532
8533         old_mode = drv->nlmode;
8534         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
8535                 nl80211_remove_monitor_interface(drv);
8536                 return -1;
8537         }
8538
8539         if (nl80211_set_channel(drv->first_bss, &freq, 0)) {
8540                 if (old_mode != nlmode)
8541                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
8542                 nl80211_remove_monitor_interface(drv);
8543                 return -1;
8544         }
8545
8546         return 0;
8547 }
8548
8549
8550 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
8551 {
8552         struct nl_msg *msg;
8553         int ret = -1;
8554
8555         msg = nlmsg_alloc();
8556         if (!msg)
8557                 return -1;
8558
8559         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
8560         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8561         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8562         msg = NULL;
8563         if (ret) {
8564                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
8565                            "(%s)", ret, strerror(-ret));
8566                 goto nla_put_failure;
8567         }
8568
8569         ret = 0;
8570         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
8571
8572 nla_put_failure:
8573         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8574                                         NL80211_IFTYPE_STATION)) {
8575                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
8576                            "station mode");
8577         }
8578
8579         nlmsg_free(msg);
8580         return ret;
8581 }
8582
8583
8584 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
8585                                    struct wpa_driver_associate_params *params)
8586 {
8587         struct nl_msg *msg;
8588         int ret = -1;
8589         int count = 0;
8590
8591         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
8592
8593         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8594                                         NL80211_IFTYPE_ADHOC)) {
8595                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
8596                            "IBSS mode");
8597                 return -1;
8598         }
8599
8600 retry:
8601         msg = nlmsg_alloc();
8602         if (!msg)
8603                 return -1;
8604
8605         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
8606         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8607
8608         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
8609                 goto nla_put_failure;
8610
8611         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8612                           params->ssid, params->ssid_len);
8613         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
8614                 params->ssid);
8615         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
8616         drv->ssid_len = params->ssid_len;
8617
8618         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8619         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
8620
8621         if (params->beacon_int > 0) {
8622                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", params->beacon_int);
8623                 NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL,
8624                             params->beacon_int);
8625         }
8626
8627         ret = nl80211_set_conn_keys(params, msg);
8628         if (ret)
8629                 goto nla_put_failure;
8630
8631         if (params->bssid && params->fixed_bssid) {
8632                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
8633                            MAC2STR(params->bssid));
8634                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
8635         }
8636
8637         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
8638             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
8639             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
8640             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
8641                 wpa_printf(MSG_DEBUG, "  * control port");
8642                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
8643         }
8644
8645         if (params->wpa_ie) {
8646                 wpa_hexdump(MSG_DEBUG,
8647                             "  * Extra IEs for Beacon/Probe Response frames",
8648                             params->wpa_ie, params->wpa_ie_len);
8649                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
8650                         params->wpa_ie);
8651         }
8652
8653         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8654         msg = NULL;
8655         if (ret) {
8656                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
8657                            ret, strerror(-ret));
8658                 count++;
8659                 if (ret == -EALREADY && count == 1) {
8660                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
8661                                    "forced leave");
8662                         nl80211_leave_ibss(drv);
8663                         nlmsg_free(msg);
8664                         goto retry;
8665                 }
8666
8667                 goto nla_put_failure;
8668         }
8669         ret = 0;
8670         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
8671
8672 nla_put_failure:
8673         nlmsg_free(msg);
8674         return ret;
8675 }
8676
8677
8678 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
8679                                   struct wpa_driver_associate_params *params,
8680                                   struct nl_msg *msg)
8681 {
8682         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8683
8684         if (params->bssid) {
8685                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
8686                            MAC2STR(params->bssid));
8687                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
8688         }
8689
8690         if (params->bssid_hint) {
8691                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
8692                            MAC2STR(params->bssid_hint));
8693                 NLA_PUT(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
8694                         params->bssid_hint);
8695         }
8696
8697         if (params->freq) {
8698                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8699                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
8700                 drv->assoc_freq = params->freq;
8701         } else
8702                 drv->assoc_freq = 0;
8703
8704         if (params->freq_hint) {
8705                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
8706                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
8707                             params->freq_hint);
8708         }
8709
8710         if (params->bg_scan_period >= 0) {
8711                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
8712                            params->bg_scan_period);
8713                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
8714                             params->bg_scan_period);
8715         }
8716
8717         if (params->ssid) {
8718                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8719                                   params->ssid, params->ssid_len);
8720                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
8721                         params->ssid);
8722                 if (params->ssid_len > sizeof(drv->ssid))
8723                         goto nla_put_failure;
8724                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
8725                 drv->ssid_len = params->ssid_len;
8726         }
8727
8728         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
8729         if (params->wpa_ie)
8730                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
8731                         params->wpa_ie);
8732
8733         if (params->wpa_proto) {
8734                 enum nl80211_wpa_versions ver = 0;
8735
8736                 if (params->wpa_proto & WPA_PROTO_WPA)
8737                         ver |= NL80211_WPA_VERSION_1;
8738                 if (params->wpa_proto & WPA_PROTO_RSN)
8739                         ver |= NL80211_WPA_VERSION_2;
8740
8741                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
8742                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
8743         }
8744
8745         if (params->pairwise_suite != WPA_CIPHER_NONE) {
8746                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
8747                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
8748                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
8749         }
8750
8751         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
8752             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
8753                 /*
8754                  * This is likely to work even though many drivers do not
8755                  * advertise support for operations without GTK.
8756                  */
8757                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
8758         } else if (params->group_suite != WPA_CIPHER_NONE) {
8759                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
8760                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
8761                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
8762         }
8763
8764         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
8765             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
8766             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
8767             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
8768             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
8769             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
8770             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
8771             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
8772                 int mgmt = WLAN_AKM_SUITE_PSK;
8773
8774                 switch (params->key_mgmt_suite) {
8775                 case WPA_KEY_MGMT_CCKM:
8776                         mgmt = WLAN_AKM_SUITE_CCKM;
8777                         break;
8778                 case WPA_KEY_MGMT_IEEE8021X:
8779                         mgmt = WLAN_AKM_SUITE_8021X;
8780                         break;
8781                 case WPA_KEY_MGMT_FT_IEEE8021X:
8782                         mgmt = WLAN_AKM_SUITE_FT_8021X;
8783                         break;
8784                 case WPA_KEY_MGMT_FT_PSK:
8785                         mgmt = WLAN_AKM_SUITE_FT_PSK;
8786                         break;
8787                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
8788                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
8789                         break;
8790                 case WPA_KEY_MGMT_PSK_SHA256:
8791                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
8792                         break;
8793                 case WPA_KEY_MGMT_OSEN:
8794                         mgmt = WLAN_AKM_SUITE_OSEN;
8795                         break;
8796                 case WPA_KEY_MGMT_PSK:
8797                 default:
8798                         mgmt = WLAN_AKM_SUITE_PSK;
8799                         break;
8800                 }
8801                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
8802                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
8803         }
8804
8805         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
8806
8807         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
8808                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
8809
8810         if (params->disable_ht)
8811                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
8812
8813         if (params->htcaps && params->htcaps_mask) {
8814                 int sz = sizeof(struct ieee80211_ht_capabilities);
8815                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
8816                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
8817                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
8818                             params->htcaps_mask, sz);
8819                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
8820                         params->htcaps_mask);
8821         }
8822
8823 #ifdef CONFIG_VHT_OVERRIDES
8824         if (params->disable_vht) {
8825                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
8826                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
8827         }
8828
8829         if (params->vhtcaps && params->vhtcaps_mask) {
8830                 int sz = sizeof(struct ieee80211_vht_capabilities);
8831                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
8832                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
8833                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
8834                             params->vhtcaps_mask, sz);
8835                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
8836                         params->vhtcaps_mask);
8837         }
8838 #endif /* CONFIG_VHT_OVERRIDES */
8839
8840         if (params->p2p)
8841                 wpa_printf(MSG_DEBUG, "  * P2P group");
8842
8843         return 0;
8844 nla_put_failure:
8845         return -1;
8846 }
8847
8848
8849 static int wpa_driver_nl80211_try_connect(
8850         struct wpa_driver_nl80211_data *drv,
8851         struct wpa_driver_associate_params *params)
8852 {
8853         struct nl_msg *msg;
8854         enum nl80211_auth_type type;
8855         int ret;
8856         int algs;
8857
8858         msg = nlmsg_alloc();
8859         if (!msg)
8860                 return -1;
8861
8862         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
8863         nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
8864
8865         ret = nl80211_connect_common(drv, params, msg);
8866         if (ret)
8867                 goto nla_put_failure;
8868
8869         algs = 0;
8870         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
8871                 algs++;
8872         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
8873                 algs++;
8874         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
8875                 algs++;
8876         if (algs > 1) {
8877                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
8878                            "selection");
8879                 goto skip_auth_type;
8880         }
8881
8882         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
8883                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
8884         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
8885                 type = NL80211_AUTHTYPE_SHARED_KEY;
8886         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
8887                 type = NL80211_AUTHTYPE_NETWORK_EAP;
8888         else if (params->auth_alg & WPA_AUTH_ALG_FT)
8889                 type = NL80211_AUTHTYPE_FT;
8890         else
8891                 goto nla_put_failure;
8892
8893         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
8894         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
8895
8896 skip_auth_type:
8897         ret = nl80211_set_conn_keys(params, msg);
8898         if (ret)
8899                 goto nla_put_failure;
8900
8901         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8902         msg = NULL;
8903         if (ret) {
8904                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
8905                            "(%s)", ret, strerror(-ret));
8906                 goto nla_put_failure;
8907         }
8908         ret = 0;
8909         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
8910
8911 nla_put_failure:
8912         nlmsg_free(msg);
8913         return ret;
8914
8915 }
8916
8917
8918 static int wpa_driver_nl80211_connect(
8919         struct wpa_driver_nl80211_data *drv,
8920         struct wpa_driver_associate_params *params)
8921 {
8922         int ret = wpa_driver_nl80211_try_connect(drv, params);
8923         if (ret == -EALREADY) {
8924                 /*
8925                  * cfg80211 does not currently accept new connections if
8926                  * we are already connected. As a workaround, force
8927                  * disconnection and try again.
8928                  */
8929                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
8930                            "disconnecting before reassociation "
8931                            "attempt");
8932                 if (wpa_driver_nl80211_disconnect(
8933                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
8934                         return -1;
8935                 ret = wpa_driver_nl80211_try_connect(drv, params);
8936         }
8937         return ret;
8938 }
8939
8940
8941 static int wpa_driver_nl80211_associate(
8942         void *priv, struct wpa_driver_associate_params *params)
8943 {
8944         struct i802_bss *bss = priv;
8945         struct wpa_driver_nl80211_data *drv = bss->drv;
8946         int ret;
8947         struct nl_msg *msg;
8948
8949         if (params->mode == IEEE80211_MODE_AP)
8950                 return wpa_driver_nl80211_ap(drv, params);
8951
8952         if (params->mode == IEEE80211_MODE_IBSS)
8953                 return wpa_driver_nl80211_ibss(drv, params);
8954
8955         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
8956                 enum nl80211_iftype nlmode = params->p2p ?
8957                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
8958
8959                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
8960                         return -1;
8961                 return wpa_driver_nl80211_connect(drv, params);
8962         }
8963
8964         nl80211_mark_disconnected(drv);
8965
8966         msg = nlmsg_alloc();
8967         if (!msg)
8968                 return -1;
8969
8970         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
8971                    drv->ifindex);
8972         nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
8973
8974         ret = nl80211_connect_common(drv, params, msg);
8975         if (ret)
8976                 goto nla_put_failure;
8977
8978         if (params->prev_bssid) {
8979                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
8980                            MAC2STR(params->prev_bssid));
8981                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
8982                         params->prev_bssid);
8983         }
8984
8985         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8986         msg = NULL;
8987         if (ret) {
8988                 wpa_dbg(drv->ctx, MSG_DEBUG,
8989                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
8990                         ret, strerror(-ret));
8991                 nl80211_dump_scan(drv);
8992                 goto nla_put_failure;
8993         }
8994         ret = 0;
8995         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
8996                    "successfully");
8997
8998 nla_put_failure:
8999         nlmsg_free(msg);
9000         return ret;
9001 }
9002
9003
9004 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
9005                             int ifindex, enum nl80211_iftype mode)
9006 {
9007         struct nl_msg *msg;
9008         int ret = -ENOBUFS;
9009
9010         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
9011                    ifindex, mode, nl80211_iftype_str(mode));
9012
9013         msg = nlmsg_alloc();
9014         if (!msg)
9015                 return -ENOMEM;
9016
9017         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
9018         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
9019                 goto nla_put_failure;
9020         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
9021
9022         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9023         msg = NULL;
9024         if (!ret)
9025                 return 0;
9026 nla_put_failure:
9027         nlmsg_free(msg);
9028         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
9029                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
9030         return ret;
9031 }
9032
9033
9034 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
9035                                        enum nl80211_iftype nlmode)
9036 {
9037         struct wpa_driver_nl80211_data *drv = bss->drv;
9038         int ret = -1;
9039         int i;
9040         int was_ap = is_ap_interface(drv->nlmode);
9041         int res;
9042
9043         res = nl80211_set_mode(drv, drv->ifindex, nlmode);
9044         if (res && nlmode == nl80211_get_ifmode(bss))
9045                 res = 0;
9046
9047         if (res == 0) {
9048                 drv->nlmode = nlmode;
9049                 ret = 0;
9050                 goto done;
9051         }
9052
9053         if (res == -ENODEV)
9054                 return -1;
9055
9056         if (nlmode == drv->nlmode) {
9057                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
9058                            "requested mode - ignore error");
9059                 ret = 0;
9060                 goto done; /* Already in the requested mode */
9061         }
9062
9063         /* mac80211 doesn't allow mode changes while the device is up, so
9064          * take the device down, try to set the mode again, and bring the
9065          * device back up.
9066          */
9067         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
9068                    "interface down");
9069         for (i = 0; i < 10; i++) {
9070                 res = i802_set_iface_flags(bss, 0);
9071                 if (res == -EACCES || res == -ENODEV)
9072                         break;
9073                 if (res == 0) {
9074                         /* Try to set the mode again while the interface is
9075                          * down */
9076                         ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
9077                         if (ret == -EACCES)
9078                                 break;
9079                         res = i802_set_iface_flags(bss, 1);
9080                         if (res && !ret)
9081                                 ret = -1;
9082                         else if (ret != -EBUSY)
9083                                 break;
9084                 } else
9085                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
9086                                    "interface down");
9087                 os_sleep(0, 100000);
9088         }
9089
9090         if (!ret) {
9091                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
9092                            "interface is down");
9093                 drv->nlmode = nlmode;
9094                 drv->ignore_if_down_event = 1;
9095         }
9096
9097 done:
9098         if (ret) {
9099                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
9100                            "from %d failed", nlmode, drv->nlmode);
9101                 return ret;
9102         }
9103
9104         if (is_p2p_net_interface(nlmode))
9105                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
9106         else if (drv->disabled_11b_rates)
9107                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
9108
9109         if (is_ap_interface(nlmode)) {
9110                 nl80211_mgmt_unsubscribe(bss, "start AP");
9111                 /* Setup additional AP mode functionality if needed */
9112                 if (nl80211_setup_ap(bss))
9113                         return -1;
9114         } else if (was_ap) {
9115                 /* Remove additional AP mode functionality */
9116                 nl80211_teardown_ap(bss);
9117         } else {
9118                 nl80211_mgmt_unsubscribe(bss, "mode change");
9119         }
9120
9121         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
9122             nl80211_mgmt_subscribe_non_ap(bss) < 0)
9123                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
9124                            "frame processing - ignore for now");
9125
9126         return 0;
9127 }
9128
9129
9130 static int dfs_info_handler(struct nl_msg *msg, void *arg)
9131 {
9132         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9133         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9134         int *dfs_capability_ptr = arg;
9135
9136         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9137                   genlmsg_attrlen(gnlh, 0), NULL);
9138
9139         if (tb[NL80211_ATTR_VENDOR_DATA]) {
9140                 struct nlattr *nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
9141                 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_MAX + 1];
9142
9143                 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_MAX,
9144                           nla_data(nl_vend), nla_len(nl_vend), NULL);
9145
9146                 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_DFS]) {
9147                         u32 val;
9148                         val = nla_get_u32(tb_vendor[QCA_WLAN_VENDOR_ATTR_DFS]);
9149                         wpa_printf(MSG_DEBUG, "nl80211: DFS offload capability: %u",
9150                                    val);
9151                         *dfs_capability_ptr = val;
9152                 }
9153         }
9154
9155         return NL_SKIP;
9156 }
9157
9158
9159 static int wpa_driver_nl80211_get_capa(void *priv,
9160                                        struct wpa_driver_capa *capa)
9161 {
9162         struct i802_bss *bss = priv;
9163         struct wpa_driver_nl80211_data *drv = bss->drv;
9164         struct nl_msg *msg;
9165         int dfs_capability = 0;
9166         int ret = 0;
9167
9168         if (!drv->has_capability)
9169                 return -1;
9170         os_memcpy(capa, &drv->capa, sizeof(*capa));
9171         if (drv->extended_capa && drv->extended_capa_mask) {
9172                 capa->extended_capa = drv->extended_capa;
9173                 capa->extended_capa_mask = drv->extended_capa_mask;
9174                 capa->extended_capa_len = drv->extended_capa_len;
9175         }
9176
9177         if ((capa->flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
9178             !drv->allow_p2p_device) {
9179                 wpa_printf(MSG_DEBUG, "nl80211: Do not indicate P2P_DEVICE support (p2p_device=1 driver param not specified)");
9180                 capa->flags &= ~WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE;
9181         }
9182
9183         if (drv->dfs_vendor_cmd_avail == 1) {
9184                 msg = nlmsg_alloc();
9185                 if (!msg)
9186                         return -ENOMEM;
9187
9188                 nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
9189
9190                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9191                 NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA);
9192                 NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9193                             QCA_NL80211_VENDOR_SUBCMD_DFS_CAPABILITY);
9194
9195                 ret = send_and_recv_msgs(drv, msg, dfs_info_handler,
9196                                          &dfs_capability);
9197                 if (!ret) {
9198                         if (dfs_capability)
9199                                 capa->flags |= WPA_DRIVER_FLAGS_DFS_OFFLOAD;
9200                 }
9201         }
9202
9203         return ret;
9204
9205  nla_put_failure:
9206         nlmsg_free(msg);
9207         return -ENOBUFS;
9208 }
9209
9210
9211 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
9212 {
9213         struct i802_bss *bss = priv;
9214         struct wpa_driver_nl80211_data *drv = bss->drv;
9215
9216         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
9217                    bss->ifname, drv->operstate, state,
9218                    state ? "UP" : "DORMANT");
9219         drv->operstate = state;
9220         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
9221                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
9222 }
9223
9224
9225 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
9226 {
9227         struct i802_bss *bss = priv;
9228         struct wpa_driver_nl80211_data *drv = bss->drv;
9229         struct nl_msg *msg;
9230         struct nl80211_sta_flag_update upd;
9231         int ret = -ENOBUFS;
9232
9233         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
9234                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
9235                 return 0;
9236         }
9237
9238         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
9239                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
9240
9241         msg = nlmsg_alloc();
9242         if (!msg)
9243                 return -ENOMEM;
9244
9245         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
9246
9247         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
9248                     if_nametoindex(bss->ifname));
9249         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
9250
9251         os_memset(&upd, 0, sizeof(upd));
9252         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
9253         if (authorized)
9254                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
9255         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
9256
9257         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9258         msg = NULL;
9259         if (!ret)
9260                 return 0;
9261  nla_put_failure:
9262         nlmsg_free(msg);
9263         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
9264                    ret, strerror(-ret));
9265         return ret;
9266 }
9267
9268
9269 /* Set kernel driver on given frequency (MHz) */
9270 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
9271 {
9272         struct i802_bss *bss = priv;
9273         return nl80211_set_channel(bss, freq, 0);
9274 }
9275
9276
9277 static inline int min_int(int a, int b)
9278 {
9279         if (a < b)
9280                 return a;
9281         return b;
9282 }
9283
9284
9285 static int get_key_handler(struct nl_msg *msg, void *arg)
9286 {
9287         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9288         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9289
9290         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9291                   genlmsg_attrlen(gnlh, 0), NULL);
9292
9293         /*
9294          * TODO: validate the key index and mac address!
9295          * Otherwise, there's a race condition as soon as
9296          * the kernel starts sending key notifications.
9297          */
9298
9299         if (tb[NL80211_ATTR_KEY_SEQ])
9300                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
9301                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
9302         return NL_SKIP;
9303 }
9304
9305
9306 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
9307                            int idx, u8 *seq)
9308 {
9309         struct i802_bss *bss = priv;
9310         struct wpa_driver_nl80211_data *drv = bss->drv;
9311         struct nl_msg *msg;
9312
9313         msg = nlmsg_alloc();
9314         if (!msg)
9315                 return -ENOMEM;
9316
9317         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
9318
9319         if (addr)
9320                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
9321         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
9322         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
9323
9324         memset(seq, 0, 6);
9325
9326         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
9327  nla_put_failure:
9328         nlmsg_free(msg);
9329         return -ENOBUFS;
9330 }
9331
9332
9333 static int i802_set_rts(void *priv, int rts)
9334 {
9335         struct i802_bss *bss = priv;
9336         struct wpa_driver_nl80211_data *drv = bss->drv;
9337         struct nl_msg *msg;
9338         int ret = -ENOBUFS;
9339         u32 val;
9340
9341         msg = nlmsg_alloc();
9342         if (!msg)
9343                 return -ENOMEM;
9344
9345         if (rts >= 2347)
9346                 val = (u32) -1;
9347         else
9348                 val = rts;
9349
9350         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
9351         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9352         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
9353
9354         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9355         msg = NULL;
9356         if (!ret)
9357                 return 0;
9358 nla_put_failure:
9359         nlmsg_free(msg);
9360         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
9361                    "%d (%s)", rts, ret, strerror(-ret));
9362         return ret;
9363 }
9364
9365
9366 static int i802_set_frag(void *priv, int frag)
9367 {
9368         struct i802_bss *bss = priv;
9369         struct wpa_driver_nl80211_data *drv = bss->drv;
9370         struct nl_msg *msg;
9371         int ret = -ENOBUFS;
9372         u32 val;
9373
9374         msg = nlmsg_alloc();
9375         if (!msg)
9376                 return -ENOMEM;
9377
9378         if (frag >= 2346)
9379                 val = (u32) -1;
9380         else
9381                 val = frag;
9382
9383         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
9384         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9385         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
9386
9387         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9388         msg = NULL;
9389         if (!ret)
9390                 return 0;
9391 nla_put_failure:
9392         nlmsg_free(msg);
9393         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
9394                    "%d: %d (%s)", frag, ret, strerror(-ret));
9395         return ret;
9396 }
9397
9398
9399 static int i802_flush(void *priv)
9400 {
9401         struct i802_bss *bss = priv;
9402         struct wpa_driver_nl80211_data *drv = bss->drv;
9403         struct nl_msg *msg;
9404         int res;
9405
9406         msg = nlmsg_alloc();
9407         if (!msg)
9408                 return -1;
9409
9410         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
9411                    bss->ifname);
9412         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
9413
9414         /*
9415          * XXX: FIX! this needs to flush all VLANs too
9416          */
9417         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
9418                     if_nametoindex(bss->ifname));
9419
9420         res = send_and_recv_msgs(drv, msg, NULL, NULL);
9421         if (res) {
9422                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
9423                            "(%s)", res, strerror(-res));
9424         }
9425         return res;
9426  nla_put_failure:
9427         nlmsg_free(msg);
9428         return -ENOBUFS;
9429 }
9430
9431
9432 static int get_sta_handler(struct nl_msg *msg, void *arg)
9433 {
9434         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9435         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9436         struct hostap_sta_driver_data *data = arg;
9437         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
9438         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
9439                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
9440                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
9441                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
9442                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
9443                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
9444                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
9445         };
9446
9447         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9448                   genlmsg_attrlen(gnlh, 0), NULL);
9449
9450         /*
9451          * TODO: validate the interface and mac address!
9452          * Otherwise, there's a race condition as soon as
9453          * the kernel starts sending station notifications.
9454          */
9455
9456         if (!tb[NL80211_ATTR_STA_INFO]) {
9457                 wpa_printf(MSG_DEBUG, "sta stats missing!");
9458                 return NL_SKIP;
9459         }
9460         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
9461                              tb[NL80211_ATTR_STA_INFO],
9462                              stats_policy)) {
9463                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
9464                 return NL_SKIP;
9465         }
9466
9467         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
9468                 data->inactive_msec =
9469                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
9470         if (stats[NL80211_STA_INFO_RX_BYTES])
9471                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
9472         if (stats[NL80211_STA_INFO_TX_BYTES])
9473                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
9474         if (stats[NL80211_STA_INFO_RX_PACKETS])
9475                 data->rx_packets =
9476                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
9477         if (stats[NL80211_STA_INFO_TX_PACKETS])
9478                 data->tx_packets =
9479                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
9480         if (stats[NL80211_STA_INFO_TX_FAILED])
9481                 data->tx_retry_failed =
9482                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
9483
9484         return NL_SKIP;
9485 }
9486
9487 static int i802_read_sta_data(struct i802_bss *bss,
9488                               struct hostap_sta_driver_data *data,
9489                               const u8 *addr)
9490 {
9491         struct wpa_driver_nl80211_data *drv = bss->drv;
9492         struct nl_msg *msg;
9493
9494         os_memset(data, 0, sizeof(*data));
9495         msg = nlmsg_alloc();
9496         if (!msg)
9497                 return -ENOMEM;
9498
9499         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
9500
9501         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
9502         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
9503
9504         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
9505  nla_put_failure:
9506         nlmsg_free(msg);
9507         return -ENOBUFS;
9508 }
9509
9510
9511 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
9512                                     int cw_min, int cw_max, int burst_time)
9513 {
9514         struct i802_bss *bss = priv;
9515         struct wpa_driver_nl80211_data *drv = bss->drv;
9516         struct nl_msg *msg;
9517         struct nlattr *txq, *params;
9518
9519         msg = nlmsg_alloc();
9520         if (!msg)
9521                 return -1;
9522
9523         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
9524
9525         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
9526
9527         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
9528         if (!txq)
9529                 goto nla_put_failure;
9530
9531         /* We are only sending parameters for a single TXQ at a time */
9532         params = nla_nest_start(msg, 1);
9533         if (!params)
9534                 goto nla_put_failure;
9535
9536         switch (queue) {
9537         case 0:
9538                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
9539                 break;
9540         case 1:
9541                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
9542                 break;
9543         case 2:
9544                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
9545                 break;
9546         case 3:
9547                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
9548                 break;
9549         }
9550         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
9551          * 32 usec, so need to convert the value here. */
9552         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
9553         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
9554         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
9555         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
9556
9557         nla_nest_end(msg, params);
9558
9559         nla_nest_end(msg, txq);
9560
9561         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
9562                 return 0;
9563         msg = NULL;
9564  nla_put_failure:
9565         nlmsg_free(msg);
9566         return -1;
9567 }
9568
9569
9570 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
9571                              const char *ifname, int vlan_id)
9572 {
9573         struct wpa_driver_nl80211_data *drv = bss->drv;
9574         struct nl_msg *msg;
9575         int ret = -ENOBUFS;
9576
9577         msg = nlmsg_alloc();
9578         if (!msg)
9579                 return -ENOMEM;
9580
9581         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
9582                    ", ifname=%s[%d], vlan_id=%d)",
9583                    bss->ifname, if_nametoindex(bss->ifname),
9584                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
9585         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
9586
9587         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
9588                     if_nametoindex(bss->ifname));
9589         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
9590         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
9591                     if_nametoindex(ifname));
9592
9593         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9594         msg = NULL;
9595         if (ret < 0) {
9596                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
9597                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
9598                            MAC2STR(addr), ifname, vlan_id, ret,
9599                            strerror(-ret));
9600         }
9601  nla_put_failure:
9602         nlmsg_free(msg);
9603         return ret;
9604 }
9605
9606
9607 static int i802_get_inact_sec(void *priv, const u8 *addr)
9608 {
9609         struct hostap_sta_driver_data data;
9610         int ret;
9611
9612         data.inactive_msec = (unsigned long) -1;
9613         ret = i802_read_sta_data(priv, &data, addr);
9614         if (ret || data.inactive_msec == (unsigned long) -1)
9615                 return -1;
9616         return data.inactive_msec / 1000;
9617 }
9618
9619
9620 static int i802_sta_clear_stats(void *priv, const u8 *addr)
9621 {
9622 #if 0
9623         /* TODO */
9624 #endif
9625         return 0;
9626 }
9627
9628
9629 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
9630                            int reason)
9631 {
9632         struct i802_bss *bss = priv;
9633         struct wpa_driver_nl80211_data *drv = bss->drv;
9634         struct ieee80211_mgmt mgmt;
9635
9636         if (drv->device_ap_sme)
9637                 return wpa_driver_nl80211_sta_remove(bss, addr);
9638
9639         memset(&mgmt, 0, sizeof(mgmt));
9640         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
9641                                           WLAN_FC_STYPE_DEAUTH);
9642         memcpy(mgmt.da, addr, ETH_ALEN);
9643         memcpy(mgmt.sa, own_addr, ETH_ALEN);
9644         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
9645         mgmt.u.deauth.reason_code = host_to_le16(reason);
9646         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
9647                                             IEEE80211_HDRLEN +
9648                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
9649                                             0);
9650 }
9651
9652
9653 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
9654                              int reason)
9655 {
9656         struct i802_bss *bss = priv;
9657         struct wpa_driver_nl80211_data *drv = bss->drv;
9658         struct ieee80211_mgmt mgmt;
9659
9660         if (drv->device_ap_sme)
9661                 return wpa_driver_nl80211_sta_remove(bss, addr);
9662
9663         memset(&mgmt, 0, sizeof(mgmt));
9664         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
9665                                           WLAN_FC_STYPE_DISASSOC);
9666         memcpy(mgmt.da, addr, ETH_ALEN);
9667         memcpy(mgmt.sa, own_addr, ETH_ALEN);
9668         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
9669         mgmt.u.disassoc.reason_code = host_to_le16(reason);
9670         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
9671                                             IEEE80211_HDRLEN +
9672                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
9673                                             0);
9674 }
9675
9676
9677 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
9678 {
9679         char buf[200], *pos, *end;
9680         int i, res;
9681
9682         pos = buf;
9683         end = pos + sizeof(buf);
9684
9685         for (i = 0; i < drv->num_if_indices; i++) {
9686                 if (!drv->if_indices[i])
9687                         continue;
9688                 res = os_snprintf(pos, end - pos, " %d", drv->if_indices[i]);
9689                 if (res < 0 || res >= end - pos)
9690                         break;
9691                 pos += res;
9692         }
9693         *pos = '\0';
9694
9695         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
9696                    drv->num_if_indices, buf);
9697 }
9698
9699
9700 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9701 {
9702         int i;
9703         int *old;
9704
9705         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
9706                    ifidx);
9707         if (have_ifidx(drv, ifidx)) {
9708                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
9709                            ifidx);
9710                 return;
9711         }
9712         for (i = 0; i < drv->num_if_indices; i++) {
9713                 if (drv->if_indices[i] == 0) {
9714                         drv->if_indices[i] = ifidx;
9715                         dump_ifidx(drv);
9716                         return;
9717                 }
9718         }
9719
9720         if (drv->if_indices != drv->default_if_indices)
9721                 old = drv->if_indices;
9722         else
9723                 old = NULL;
9724
9725         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
9726                                            sizeof(int));
9727         if (!drv->if_indices) {
9728                 if (!old)
9729                         drv->if_indices = drv->default_if_indices;
9730                 else
9731                         drv->if_indices = old;
9732                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
9733                            "interfaces");
9734                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
9735                 return;
9736         } else if (!old)
9737                 os_memcpy(drv->if_indices, drv->default_if_indices,
9738                           sizeof(drv->default_if_indices));
9739         drv->if_indices[drv->num_if_indices] = ifidx;
9740         drv->num_if_indices++;
9741         dump_ifidx(drv);
9742 }
9743
9744
9745 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9746 {
9747         int i;
9748
9749         for (i = 0; i < drv->num_if_indices; i++) {
9750                 if (drv->if_indices[i] == ifidx) {
9751                         drv->if_indices[i] = 0;
9752                         break;
9753                 }
9754         }
9755         dump_ifidx(drv);
9756 }
9757
9758
9759 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9760 {
9761         int i;
9762
9763         for (i = 0; i < drv->num_if_indices; i++)
9764                 if (drv->if_indices[i] == ifidx)
9765                         return 1;
9766
9767         return 0;
9768 }
9769
9770
9771 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
9772                             const char *bridge_ifname, char *ifname_wds)
9773 {
9774         struct i802_bss *bss = priv;
9775         struct wpa_driver_nl80211_data *drv = bss->drv;
9776         char name[IFNAMSIZ + 1];
9777
9778         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
9779         if (ifname_wds)
9780                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
9781
9782         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
9783                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
9784         if (val) {
9785                 if (!if_nametoindex(name)) {
9786                         if (nl80211_create_iface(drv, name,
9787                                                  NL80211_IFTYPE_AP_VLAN,
9788                                                  bss->addr, 1, NULL, NULL, 0) <
9789                             0)
9790                                 return -1;
9791                         if (bridge_ifname &&
9792                             linux_br_add_if(drv->global->ioctl_sock,
9793                                             bridge_ifname, name) < 0)
9794                                 return -1;
9795                 }
9796                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
9797                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
9798                                    "interface %s up", name);
9799                 }
9800                 return i802_set_sta_vlan(priv, addr, name, 0);
9801         } else {
9802                 if (bridge_ifname)
9803                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
9804                                         name);
9805
9806                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
9807                 nl80211_remove_iface(drv, if_nametoindex(name));
9808                 return 0;
9809         }
9810 }
9811
9812
9813 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
9814 {
9815         struct wpa_driver_nl80211_data *drv = eloop_ctx;
9816         struct sockaddr_ll lladdr;
9817         unsigned char buf[3000];
9818         int len;
9819         socklen_t fromlen = sizeof(lladdr);
9820
9821         len = recvfrom(sock, buf, sizeof(buf), 0,
9822                        (struct sockaddr *)&lladdr, &fromlen);
9823         if (len < 0) {
9824                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
9825                            strerror(errno));
9826                 return;
9827         }
9828
9829         if (have_ifidx(drv, lladdr.sll_ifindex))
9830                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
9831 }
9832
9833
9834 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
9835                              struct i802_bss *bss,
9836                              const char *brname, const char *ifname)
9837 {
9838         int ifindex;
9839         char in_br[IFNAMSIZ];
9840
9841         os_strlcpy(bss->brname, brname, IFNAMSIZ);
9842         ifindex = if_nametoindex(brname);
9843         if (ifindex == 0) {
9844                 /*
9845                  * Bridge was configured, but the bridge device does
9846                  * not exist. Try to add it now.
9847                  */
9848                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
9849                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
9850                                    "bridge interface %s: %s",
9851                                    brname, strerror(errno));
9852                         return -1;
9853                 }
9854                 bss->added_bridge = 1;
9855                 add_ifidx(drv, if_nametoindex(brname));
9856         }
9857
9858         if (linux_br_get(in_br, ifname) == 0) {
9859                 if (os_strcmp(in_br, brname) == 0)
9860                         return 0; /* already in the bridge */
9861
9862                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
9863                            "bridge %s", ifname, in_br);
9864                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
9865                     0) {
9866                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
9867                                    "remove interface %s from bridge "
9868                                    "%s: %s",
9869                                    ifname, brname, strerror(errno));
9870                         return -1;
9871                 }
9872         }
9873
9874         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
9875                    ifname, brname);
9876         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
9877                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
9878                            "into bridge %s: %s",
9879                            ifname, brname, strerror(errno));
9880                 return -1;
9881         }
9882         bss->added_if_into_bridge = 1;
9883
9884         return 0;
9885 }
9886
9887
9888 static void *i802_init(struct hostapd_data *hapd,
9889                        struct wpa_init_params *params)
9890 {
9891         struct wpa_driver_nl80211_data *drv;
9892         struct i802_bss *bss;
9893         size_t i;
9894         char brname[IFNAMSIZ];
9895         int ifindex, br_ifindex;
9896         int br_added = 0;
9897
9898         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
9899                                           params->global_priv, 1,
9900                                           params->bssid);
9901         if (bss == NULL)
9902                 return NULL;
9903
9904         drv = bss->drv;
9905
9906         if (linux_br_get(brname, params->ifname) == 0) {
9907                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
9908                            params->ifname, brname);
9909                 br_ifindex = if_nametoindex(brname);
9910         } else {
9911                 brname[0] = '\0';
9912                 br_ifindex = 0;
9913         }
9914
9915         for (i = 0; i < params->num_bridge; i++) {
9916                 if (params->bridge[i]) {
9917                         ifindex = if_nametoindex(params->bridge[i]);
9918                         if (ifindex)
9919                                 add_ifidx(drv, ifindex);
9920                         if (ifindex == br_ifindex)
9921                                 br_added = 1;
9922                 }
9923         }
9924         if (!br_added && br_ifindex &&
9925             (params->num_bridge == 0 || !params->bridge[0]))
9926                 add_ifidx(drv, br_ifindex);
9927
9928         /* start listening for EAPOL on the default AP interface */
9929         add_ifidx(drv, drv->ifindex);
9930
9931         if (params->num_bridge && params->bridge[0] &&
9932             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
9933                 goto failed;
9934
9935         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
9936         if (drv->eapol_sock < 0) {
9937                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
9938                            strerror(errno));
9939                 goto failed;
9940         }
9941
9942         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
9943         {
9944                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
9945                 goto failed;
9946         }
9947
9948         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
9949                                params->own_addr))
9950                 goto failed;
9951
9952         memcpy(bss->addr, params->own_addr, ETH_ALEN);
9953
9954         return bss;
9955
9956 failed:
9957         wpa_driver_nl80211_deinit(bss);
9958         return NULL;
9959 }
9960
9961
9962 static void i802_deinit(void *priv)
9963 {
9964         struct i802_bss *bss = priv;
9965         wpa_driver_nl80211_deinit(bss);
9966 }
9967
9968
9969 static enum nl80211_iftype wpa_driver_nl80211_if_type(
9970         enum wpa_driver_if_type type)
9971 {
9972         switch (type) {
9973         case WPA_IF_STATION:
9974                 return NL80211_IFTYPE_STATION;
9975         case WPA_IF_P2P_CLIENT:
9976         case WPA_IF_P2P_GROUP:
9977                 return NL80211_IFTYPE_P2P_CLIENT;
9978         case WPA_IF_AP_VLAN:
9979                 return NL80211_IFTYPE_AP_VLAN;
9980         case WPA_IF_AP_BSS:
9981                 return NL80211_IFTYPE_AP;
9982         case WPA_IF_P2P_GO:
9983                 return NL80211_IFTYPE_P2P_GO;
9984         case WPA_IF_P2P_DEVICE:
9985                 return NL80211_IFTYPE_P2P_DEVICE;
9986         }
9987         return -1;
9988 }
9989
9990
9991 #ifdef CONFIG_P2P
9992
9993 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
9994 {
9995         struct wpa_driver_nl80211_data *drv;
9996         dl_list_for_each(drv, &global->interfaces,
9997                          struct wpa_driver_nl80211_data, list) {
9998                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
9999                         return 1;
10000         }
10001         return 0;
10002 }
10003
10004
10005 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
10006                                       u8 *new_addr)
10007 {
10008         unsigned int idx;
10009
10010         if (!drv->global)
10011                 return -1;
10012
10013         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
10014         for (idx = 0; idx < 64; idx++) {
10015                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
10016                 new_addr[0] ^= idx << 2;
10017                 if (!nl80211_addr_in_use(drv->global, new_addr))
10018                         break;
10019         }
10020         if (idx == 64)
10021                 return -1;
10022
10023         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
10024                    MACSTR, MAC2STR(new_addr));
10025
10026         return 0;
10027 }
10028
10029 #endif /* CONFIG_P2P */
10030
10031
10032 struct wdev_info {
10033         u64 wdev_id;
10034         int wdev_id_set;
10035         u8 macaddr[ETH_ALEN];
10036 };
10037
10038 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
10039 {
10040         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10041         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10042         struct wdev_info *wi = arg;
10043
10044         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10045                   genlmsg_attrlen(gnlh, 0), NULL);
10046         if (tb[NL80211_ATTR_WDEV]) {
10047                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
10048                 wi->wdev_id_set = 1;
10049         }
10050
10051         if (tb[NL80211_ATTR_MAC])
10052                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
10053                           ETH_ALEN);
10054
10055         return NL_SKIP;
10056 }
10057
10058
10059 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
10060                                      const char *ifname, const u8 *addr,
10061                                      void *bss_ctx, void **drv_priv,
10062                                      char *force_ifname, u8 *if_addr,
10063                                      const char *bridge, int use_existing)
10064 {
10065         enum nl80211_iftype nlmode;
10066         struct i802_bss *bss = priv;
10067         struct wpa_driver_nl80211_data *drv = bss->drv;
10068         int ifidx;
10069         int added = 1;
10070
10071         if (addr)
10072                 os_memcpy(if_addr, addr, ETH_ALEN);
10073         nlmode = wpa_driver_nl80211_if_type(type);
10074         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
10075                 struct wdev_info p2pdev_info;
10076
10077                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
10078                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
10079                                              0, nl80211_wdev_handler,
10080                                              &p2pdev_info, use_existing);
10081                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
10082                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
10083                                    ifname);
10084                         return -1;
10085                 }
10086
10087                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
10088                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
10089                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
10090                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
10091                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
10092                            ifname,
10093                            (long long unsigned int) p2pdev_info.wdev_id);
10094         } else {
10095                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
10096                                              0, NULL, NULL, use_existing);
10097                 if (use_existing && ifidx == -ENFILE) {
10098                         added = 0;
10099                         ifidx = if_nametoindex(ifname);
10100                 } else if (ifidx < 0) {
10101                         return -1;
10102                 }
10103         }
10104
10105         if (!addr) {
10106                 if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
10107                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
10108                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
10109                                             bss->ifname, if_addr) < 0) {
10110                         if (added)
10111                                 nl80211_remove_iface(drv, ifidx);
10112                         return -1;
10113                 }
10114         }
10115
10116 #ifdef CONFIG_P2P
10117         if (!addr &&
10118             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
10119              type == WPA_IF_P2P_GO)) {
10120                 /* Enforce unique P2P Interface Address */
10121                 u8 new_addr[ETH_ALEN];
10122
10123                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
10124                                        new_addr) < 0) {
10125                         if (added)
10126                                 nl80211_remove_iface(drv, ifidx);
10127                         return -1;
10128                 }
10129                 if (nl80211_addr_in_use(drv->global, new_addr)) {
10130                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
10131                                    "for P2P group interface");
10132                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
10133                                 if (added)
10134                                         nl80211_remove_iface(drv, ifidx);
10135                                 return -1;
10136                         }
10137                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
10138                                                new_addr) < 0) {
10139                                 if (added)
10140                                         nl80211_remove_iface(drv, ifidx);
10141                                 return -1;
10142                         }
10143                 }
10144                 os_memcpy(if_addr, new_addr, ETH_ALEN);
10145         }
10146 #endif /* CONFIG_P2P */
10147
10148         if (type == WPA_IF_AP_BSS) {
10149                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
10150                 if (new_bss == NULL) {
10151                         if (added)
10152                                 nl80211_remove_iface(drv, ifidx);
10153                         return -1;
10154                 }
10155
10156                 if (bridge &&
10157                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
10158                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
10159                                    "interface %s to a bridge %s",
10160                                    ifname, bridge);
10161                         if (added)
10162                                 nl80211_remove_iface(drv, ifidx);
10163                         os_free(new_bss);
10164                         return -1;
10165                 }
10166
10167                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
10168                 {
10169                         if (added)
10170                                 nl80211_remove_iface(drv, ifidx);
10171                         os_free(new_bss);
10172                         return -1;
10173                 }
10174                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
10175                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
10176                 new_bss->ifindex = ifidx;
10177                 new_bss->drv = drv;
10178                 new_bss->next = drv->first_bss->next;
10179                 new_bss->freq = drv->first_bss->freq;
10180                 new_bss->ctx = bss_ctx;
10181                 new_bss->added_if = added;
10182                 drv->first_bss->next = new_bss;
10183                 if (drv_priv)
10184                         *drv_priv = new_bss;
10185                 nl80211_init_bss(new_bss);
10186
10187                 /* Subscribe management frames for this WPA_IF_AP_BSS */
10188                 if (nl80211_setup_ap(new_bss))
10189                         return -1;
10190         }
10191
10192         if (drv->global)
10193                 drv->global->if_add_ifindex = ifidx;
10194
10195         /*
10196          * Some virtual interfaces need to process EAPOL packets and events on
10197          * the parent interface. This is used mainly with hostapd.
10198          */
10199         if (ifidx > 0 &&
10200             (drv->hostapd ||
10201              nlmode == NL80211_IFTYPE_AP_VLAN ||
10202              nlmode == NL80211_IFTYPE_WDS ||
10203              nlmode == NL80211_IFTYPE_MONITOR))
10204                 add_ifidx(drv, ifidx);
10205
10206         return 0;
10207 }
10208
10209
10210 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
10211                                         enum wpa_driver_if_type type,
10212                                         const char *ifname)
10213 {
10214         struct wpa_driver_nl80211_data *drv = bss->drv;
10215         int ifindex = if_nametoindex(ifname);
10216
10217         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
10218                    __func__, type, ifname, ifindex, bss->added_if);
10219         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
10220                 nl80211_remove_iface(drv, ifindex);
10221         else if (ifindex > 0 && !bss->added_if) {
10222                 struct wpa_driver_nl80211_data *drv2;
10223                 dl_list_for_each(drv2, &drv->global->interfaces,
10224                                  struct wpa_driver_nl80211_data, list)
10225                         del_ifidx(drv2, ifindex);
10226         }
10227
10228         if (type != WPA_IF_AP_BSS)
10229                 return 0;
10230
10231         if (bss->added_if_into_bridge) {
10232                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
10233                                     bss->ifname) < 0)
10234                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
10235                                    "interface %s from bridge %s: %s",
10236                                    bss->ifname, bss->brname, strerror(errno));
10237         }
10238         if (bss->added_bridge) {
10239                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
10240                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
10241                                    "bridge %s: %s",
10242                                    bss->brname, strerror(errno));
10243         }
10244
10245         if (bss != drv->first_bss) {
10246                 struct i802_bss *tbss;
10247
10248                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
10249                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
10250                         if (tbss->next == bss) {
10251                                 tbss->next = bss->next;
10252                                 /* Unsubscribe management frames */
10253                                 nl80211_teardown_ap(bss);
10254                                 nl80211_destroy_bss(bss);
10255                                 if (!bss->added_if)
10256                                         i802_set_iface_flags(bss, 0);
10257                                 os_free(bss);
10258                                 bss = NULL;
10259                                 break;
10260                         }
10261                 }
10262                 if (bss)
10263                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
10264                                    "BSS %p in the list", __func__, bss);
10265         } else {
10266                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
10267                 nl80211_teardown_ap(bss);
10268                 if (!bss->added_if && !drv->first_bss->next)
10269                         wpa_driver_nl80211_del_beacon(drv);
10270                 nl80211_destroy_bss(bss);
10271                 if (!bss->added_if)
10272                         i802_set_iface_flags(bss, 0);
10273                 if (drv->first_bss->next) {
10274                         drv->first_bss = drv->first_bss->next;
10275                         drv->ctx = drv->first_bss->ctx;
10276                         os_free(bss);
10277                 } else {
10278                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
10279                 }
10280         }
10281
10282         return 0;
10283 }
10284
10285
10286 static int cookie_handler(struct nl_msg *msg, void *arg)
10287 {
10288         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10289         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10290         u64 *cookie = arg;
10291         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10292                   genlmsg_attrlen(gnlh, 0), NULL);
10293         if (tb[NL80211_ATTR_COOKIE])
10294                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
10295         return NL_SKIP;
10296 }
10297
10298
10299 static int nl80211_send_frame_cmd(struct i802_bss *bss,
10300                                   unsigned int freq, unsigned int wait,
10301                                   const u8 *buf, size_t buf_len,
10302                                   u64 *cookie_out, int no_cck, int no_ack,
10303                                   int offchanok)
10304 {
10305         struct wpa_driver_nl80211_data *drv = bss->drv;
10306         struct nl_msg *msg;
10307         u64 cookie;
10308         int ret = -1;
10309
10310         msg = nlmsg_alloc();
10311         if (!msg)
10312                 return -1;
10313
10314         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
10315                    "no_ack=%d offchanok=%d",
10316                    freq, wait, no_cck, no_ack, offchanok);
10317         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
10318         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
10319
10320         if (nl80211_set_iface_id(msg, bss) < 0)
10321                 goto nla_put_failure;
10322         if (freq)
10323                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
10324         if (wait)
10325                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
10326         if (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
10327                           drv->test_use_roc_tx))
10328                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
10329         if (no_cck)
10330                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
10331         if (no_ack)
10332                 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
10333
10334         NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
10335
10336         cookie = 0;
10337         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
10338         msg = NULL;
10339         if (ret) {
10340                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
10341                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
10342                            freq, wait);
10343                 goto nla_put_failure;
10344         }
10345         wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
10346                    "cookie 0x%llx", no_ack ? " (no ACK)" : "",
10347                    (long long unsigned int) cookie);
10348
10349         if (cookie_out)
10350                 *cookie_out = no_ack ? (u64) -1 : cookie;
10351
10352 nla_put_failure:
10353         nlmsg_free(msg);
10354         return ret;
10355 }
10356
10357
10358 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
10359                                           unsigned int freq,
10360                                           unsigned int wait_time,
10361                                           const u8 *dst, const u8 *src,
10362                                           const u8 *bssid,
10363                                           const u8 *data, size_t data_len,
10364                                           int no_cck)
10365 {
10366         struct wpa_driver_nl80211_data *drv = bss->drv;
10367         int ret = -1;
10368         u8 *buf;
10369         struct ieee80211_hdr *hdr;
10370
10371         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
10372                    "freq=%u MHz wait=%d ms no_cck=%d)",
10373                    drv->ifindex, freq, wait_time, no_cck);
10374
10375         buf = os_zalloc(24 + data_len);
10376         if (buf == NULL)
10377                 return ret;
10378         os_memcpy(buf + 24, data, data_len);
10379         hdr = (struct ieee80211_hdr *) buf;
10380         hdr->frame_control =
10381                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
10382         os_memcpy(hdr->addr1, dst, ETH_ALEN);
10383         os_memcpy(hdr->addr2, src, ETH_ALEN);
10384         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
10385
10386         if (is_ap_interface(drv->nlmode) &&
10387             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
10388              (int) freq == bss->freq || drv->device_ap_sme ||
10389              !drv->use_monitor))
10390                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
10391                                                    0, freq, no_cck, 1,
10392                                                    wait_time);
10393         else
10394                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
10395                                              24 + data_len,
10396                                              &drv->send_action_cookie,
10397                                              no_cck, 0, 1);
10398
10399         os_free(buf);
10400         return ret;
10401 }
10402
10403
10404 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
10405 {
10406         struct i802_bss *bss = priv;
10407         struct wpa_driver_nl80211_data *drv = bss->drv;
10408         struct nl_msg *msg;
10409         int ret;
10410
10411         msg = nlmsg_alloc();
10412         if (!msg)
10413                 return;
10414
10415         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
10416                    (long long unsigned int) drv->send_action_cookie);
10417         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
10418
10419         if (nl80211_set_iface_id(msg, bss) < 0)
10420                 goto nla_put_failure;
10421         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
10422
10423         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10424         msg = NULL;
10425         if (ret)
10426                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
10427                            "(%s)", ret, strerror(-ret));
10428
10429  nla_put_failure:
10430         nlmsg_free(msg);
10431 }
10432
10433
10434 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
10435                                                 unsigned int duration)
10436 {
10437         struct i802_bss *bss = priv;
10438         struct wpa_driver_nl80211_data *drv = bss->drv;
10439         struct nl_msg *msg;
10440         int ret;
10441         u64 cookie;
10442
10443         msg = nlmsg_alloc();
10444         if (!msg)
10445                 return -1;
10446
10447         nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
10448
10449         if (nl80211_set_iface_id(msg, bss) < 0)
10450                 goto nla_put_failure;
10451
10452         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
10453         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
10454
10455         cookie = 0;
10456         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
10457         msg = NULL;
10458         if (ret == 0) {
10459                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
10460                            "0x%llx for freq=%u MHz duration=%u",
10461                            (long long unsigned int) cookie, freq, duration);
10462                 drv->remain_on_chan_cookie = cookie;
10463                 drv->pending_remain_on_chan = 1;
10464                 return 0;
10465         }
10466         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
10467                    "(freq=%d duration=%u): %d (%s)",
10468                    freq, duration, ret, strerror(-ret));
10469 nla_put_failure:
10470         nlmsg_free(msg);
10471         return -1;
10472 }
10473
10474
10475 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
10476 {
10477         struct i802_bss *bss = priv;
10478         struct wpa_driver_nl80211_data *drv = bss->drv;
10479         struct nl_msg *msg;
10480         int ret;
10481
10482         if (!drv->pending_remain_on_chan) {
10483                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
10484                            "to cancel");
10485                 return -1;
10486         }
10487
10488         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
10489                    "0x%llx",
10490                    (long long unsigned int) drv->remain_on_chan_cookie);
10491
10492         msg = nlmsg_alloc();
10493         if (!msg)
10494                 return -1;
10495
10496         nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
10497
10498         if (nl80211_set_iface_id(msg, bss) < 0)
10499                 goto nla_put_failure;
10500
10501         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
10502
10503         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10504         msg = NULL;
10505         if (ret == 0)
10506                 return 0;
10507         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
10508                    "%d (%s)", ret, strerror(-ret));
10509 nla_put_failure:
10510         nlmsg_free(msg);
10511         return -1;
10512 }
10513
10514
10515 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
10516 {
10517         struct wpa_driver_nl80211_data *drv = bss->drv;
10518
10519         if (!report) {
10520                 if (bss->nl_preq && drv->device_ap_sme &&
10521                     is_ap_interface(drv->nlmode)) {
10522                         /*
10523                          * Do not disable Probe Request reporting that was
10524                          * enabled in nl80211_setup_ap().
10525                          */
10526                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
10527                                    "Probe Request reporting nl_preq=%p while "
10528                                    "in AP mode", bss->nl_preq);
10529                 } else if (bss->nl_preq) {
10530                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
10531                                    "reporting nl_preq=%p", bss->nl_preq);
10532                         nl80211_destroy_eloop_handle(&bss->nl_preq);
10533                 }
10534                 return 0;
10535         }
10536
10537         if (bss->nl_preq) {
10538                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
10539                            "already on! nl_preq=%p", bss->nl_preq);
10540                 return 0;
10541         }
10542
10543         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
10544         if (bss->nl_preq == NULL)
10545                 return -1;
10546         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
10547                    "reporting nl_preq=%p", bss->nl_preq);
10548
10549         if (nl80211_register_frame(bss, bss->nl_preq,
10550                                    (WLAN_FC_TYPE_MGMT << 2) |
10551                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
10552                                    NULL, 0) < 0)
10553                 goto out_err;
10554
10555         nl80211_register_eloop_read(&bss->nl_preq,
10556                                     wpa_driver_nl80211_event_receive,
10557                                     bss->nl_cb);
10558
10559         return 0;
10560
10561  out_err:
10562         nl_destroy_handles(&bss->nl_preq);
10563         return -1;
10564 }
10565
10566
10567 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
10568                                      int ifindex, int disabled)
10569 {
10570         struct nl_msg *msg;
10571         struct nlattr *bands, *band;
10572         int ret;
10573
10574         msg = nlmsg_alloc();
10575         if (!msg)
10576                 return -1;
10577
10578         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
10579         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
10580
10581         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
10582         if (!bands)
10583                 goto nla_put_failure;
10584
10585         /*
10586          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
10587          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
10588          * rates. All 5 GHz rates are left enabled.
10589          */
10590         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
10591         if (!band)
10592                 goto nla_put_failure;
10593         if (disabled) {
10594                 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
10595                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
10596         }
10597         nla_nest_end(msg, band);
10598
10599         nla_nest_end(msg, bands);
10600
10601         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10602         msg = NULL;
10603         if (ret) {
10604                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
10605                            "(%s)", ret, strerror(-ret));
10606         } else
10607                 drv->disabled_11b_rates = disabled;
10608
10609         return ret;
10610
10611 nla_put_failure:
10612         nlmsg_free(msg);
10613         return -1;
10614 }
10615
10616
10617 static int wpa_driver_nl80211_deinit_ap(void *priv)
10618 {
10619         struct i802_bss *bss = priv;
10620         struct wpa_driver_nl80211_data *drv = bss->drv;
10621         if (!is_ap_interface(drv->nlmode))
10622                 return -1;
10623         wpa_driver_nl80211_del_beacon(drv);
10624
10625         /*
10626          * If the P2P GO interface was dynamically added, then it is
10627          * possible that the interface change to station is not possible.
10628          */
10629         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
10630                 return 0;
10631
10632         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
10633 }
10634
10635
10636 static int wpa_driver_nl80211_stop_ap(void *priv)
10637 {
10638         struct i802_bss *bss = priv;
10639         struct wpa_driver_nl80211_data *drv = bss->drv;
10640         if (!is_ap_interface(drv->nlmode))
10641                 return -1;
10642         wpa_driver_nl80211_del_beacon(drv);
10643         bss->beacon_set = 0;
10644         return 0;
10645 }
10646
10647
10648 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
10649 {
10650         struct i802_bss *bss = priv;
10651         struct wpa_driver_nl80211_data *drv = bss->drv;
10652         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
10653                 return -1;
10654
10655         /*
10656          * If the P2P Client interface was dynamically added, then it is
10657          * possible that the interface change to station is not possible.
10658          */
10659         if (bss->if_dynamic)
10660                 return 0;
10661
10662         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
10663 }
10664
10665
10666 static void wpa_driver_nl80211_resume(void *priv)
10667 {
10668         struct i802_bss *bss = priv;
10669
10670         if (i802_set_iface_flags(bss, 1))
10671                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
10672 }
10673
10674
10675 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
10676                                   const u8 *ies, size_t ies_len)
10677 {
10678         struct i802_bss *bss = priv;
10679         struct wpa_driver_nl80211_data *drv = bss->drv;
10680         int ret;
10681         u8 *data, *pos;
10682         size_t data_len;
10683         const u8 *own_addr = bss->addr;
10684
10685         if (action != 1) {
10686                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
10687                            "action %d", action);
10688                 return -1;
10689         }
10690
10691         /*
10692          * Action frame payload:
10693          * Category[1] = 6 (Fast BSS Transition)
10694          * Action[1] = 1 (Fast BSS Transition Request)
10695          * STA Address
10696          * Target AP Address
10697          * FT IEs
10698          */
10699
10700         data_len = 2 + 2 * ETH_ALEN + ies_len;
10701         data = os_malloc(data_len);
10702         if (data == NULL)
10703                 return -1;
10704         pos = data;
10705         *pos++ = 0x06; /* FT Action category */
10706         *pos++ = action;
10707         os_memcpy(pos, own_addr, ETH_ALEN);
10708         pos += ETH_ALEN;
10709         os_memcpy(pos, target_ap, ETH_ALEN);
10710         pos += ETH_ALEN;
10711         os_memcpy(pos, ies, ies_len);
10712
10713         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
10714                                              drv->bssid, own_addr, drv->bssid,
10715                                              data, data_len, 0);
10716         os_free(data);
10717
10718         return ret;
10719 }
10720
10721
10722 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
10723 {
10724         struct i802_bss *bss = priv;
10725         struct wpa_driver_nl80211_data *drv = bss->drv;
10726         struct nl_msg *msg;
10727         struct nlattr *cqm;
10728         int ret = -1;
10729
10730         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
10731                    "hysteresis=%d", threshold, hysteresis);
10732
10733         msg = nlmsg_alloc();
10734         if (!msg)
10735                 return -1;
10736
10737         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
10738
10739         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
10740
10741         cqm = nla_nest_start(msg, NL80211_ATTR_CQM);
10742         if (cqm == NULL)
10743                 goto nla_put_failure;
10744
10745         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
10746         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
10747         nla_nest_end(msg, cqm);
10748
10749         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10750         msg = NULL;
10751
10752 nla_put_failure:
10753         nlmsg_free(msg);
10754         return ret;
10755 }
10756
10757
10758 static int get_channel_width(struct nl_msg *msg, void *arg)
10759 {
10760         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10761         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10762         struct wpa_signal_info *sig_change = arg;
10763
10764         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10765                   genlmsg_attrlen(gnlh, 0), NULL);
10766
10767         sig_change->center_frq1 = -1;
10768         sig_change->center_frq2 = -1;
10769         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
10770
10771         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
10772                 sig_change->chanwidth = convert2width(
10773                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
10774                 if (tb[NL80211_ATTR_CENTER_FREQ1])
10775                         sig_change->center_frq1 =
10776                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
10777                 if (tb[NL80211_ATTR_CENTER_FREQ2])
10778                         sig_change->center_frq2 =
10779                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
10780         }
10781
10782         return NL_SKIP;
10783 }
10784
10785
10786 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
10787                                      struct wpa_signal_info *sig)
10788 {
10789         struct nl_msg *msg;
10790
10791         msg = nlmsg_alloc();
10792         if (!msg)
10793                 return -ENOMEM;
10794
10795         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_INTERFACE);
10796         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
10797
10798         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
10799
10800 nla_put_failure:
10801         nlmsg_free(msg);
10802         return -ENOBUFS;
10803 }
10804
10805
10806 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
10807 {
10808         struct i802_bss *bss = priv;
10809         struct wpa_driver_nl80211_data *drv = bss->drv;
10810         int res;
10811
10812         os_memset(si, 0, sizeof(*si));
10813         res = nl80211_get_link_signal(drv, si);
10814         if (res != 0)
10815                 return res;
10816
10817         res = nl80211_get_channel_width(drv, si);
10818         if (res != 0)
10819                 return res;
10820
10821         return nl80211_get_link_noise(drv, si);
10822 }
10823
10824
10825 static int wpa_driver_nl80211_shared_freq(void *priv)
10826 {
10827         struct i802_bss *bss = priv;
10828         struct wpa_driver_nl80211_data *drv = bss->drv;
10829         struct wpa_driver_nl80211_data *driver;
10830         int freq = 0;
10831
10832         /*
10833          * If the same PHY is in connected state with some other interface,
10834          * then retrieve the assoc freq.
10835          */
10836         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
10837                    drv->phyname);
10838
10839         dl_list_for_each(driver, &drv->global->interfaces,
10840                          struct wpa_driver_nl80211_data, list) {
10841                 if (drv == driver ||
10842                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
10843                     !driver->associated)
10844                         continue;
10845
10846                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
10847                            MACSTR,
10848                            driver->phyname, driver->first_bss->ifname,
10849                            MAC2STR(driver->first_bss->addr));
10850                 if (is_ap_interface(driver->nlmode))
10851                         freq = driver->first_bss->freq;
10852                 else
10853                         freq = nl80211_get_assoc_freq(driver);
10854                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
10855                            drv->phyname, freq);
10856         }
10857
10858         if (!freq)
10859                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
10860                            "PHY (%s) in associated state", drv->phyname);
10861
10862         return freq;
10863 }
10864
10865
10866 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
10867                               int encrypt)
10868 {
10869         struct i802_bss *bss = priv;
10870         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
10871                                              0, 0, 0, 0);
10872 }
10873
10874
10875 static int nl80211_set_param(void *priv, const char *param)
10876 {
10877         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
10878         if (param == NULL)
10879                 return 0;
10880
10881 #ifdef CONFIG_P2P
10882         if (os_strstr(param, "use_p2p_group_interface=1")) {
10883                 struct i802_bss *bss = priv;
10884                 struct wpa_driver_nl80211_data *drv = bss->drv;
10885
10886                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
10887                            "interface");
10888                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
10889                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
10890         }
10891
10892         if (os_strstr(param, "p2p_device=1")) {
10893                 struct i802_bss *bss = priv;
10894                 struct wpa_driver_nl80211_data *drv = bss->drv;
10895                 drv->allow_p2p_device = 1;
10896         }
10897 #endif /* CONFIG_P2P */
10898
10899         if (os_strstr(param, "use_monitor=1")) {
10900                 struct i802_bss *bss = priv;
10901                 struct wpa_driver_nl80211_data *drv = bss->drv;
10902                 drv->use_monitor = 1;
10903         }
10904
10905         if (os_strstr(param, "force_connect_cmd=1")) {
10906                 struct i802_bss *bss = priv;
10907                 struct wpa_driver_nl80211_data *drv = bss->drv;
10908                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
10909         }
10910
10911         if (os_strstr(param, "no_offchannel_tx=1")) {
10912                 struct i802_bss *bss = priv;
10913                 struct wpa_driver_nl80211_data *drv = bss->drv;
10914                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
10915                 drv->test_use_roc_tx = 1;
10916         }
10917
10918         return 0;
10919 }
10920
10921
10922 static void * nl80211_global_init(void)
10923 {
10924         struct nl80211_global *global;
10925         struct netlink_config *cfg;
10926
10927         global = os_zalloc(sizeof(*global));
10928         if (global == NULL)
10929                 return NULL;
10930         global->ioctl_sock = -1;
10931         dl_list_init(&global->interfaces);
10932         global->if_add_ifindex = -1;
10933
10934         cfg = os_zalloc(sizeof(*cfg));
10935         if (cfg == NULL)
10936                 goto err;
10937
10938         cfg->ctx = global;
10939         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
10940         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
10941         global->netlink = netlink_init(cfg);
10942         if (global->netlink == NULL) {
10943                 os_free(cfg);
10944                 goto err;
10945         }
10946
10947         if (wpa_driver_nl80211_init_nl_global(global) < 0)
10948                 goto err;
10949
10950         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
10951         if (global->ioctl_sock < 0) {
10952                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
10953                            strerror(errno));
10954                 goto err;
10955         }
10956
10957         return global;
10958
10959 err:
10960         nl80211_global_deinit(global);
10961         return NULL;
10962 }
10963
10964
10965 static void nl80211_global_deinit(void *priv)
10966 {
10967         struct nl80211_global *global = priv;
10968         if (global == NULL)
10969                 return;
10970         if (!dl_list_empty(&global->interfaces)) {
10971                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
10972                            "nl80211_global_deinit",
10973                            dl_list_len(&global->interfaces));
10974         }
10975
10976         if (global->netlink)
10977                 netlink_deinit(global->netlink);
10978
10979         nl_destroy_handles(&global->nl);
10980
10981         if (global->nl_event)
10982                 nl80211_destroy_eloop_handle(&global->nl_event);
10983
10984         nl_cb_put(global->nl_cb);
10985
10986         if (global->ioctl_sock >= 0)
10987                 close(global->ioctl_sock);
10988
10989         os_free(global);
10990 }
10991
10992
10993 static const char * nl80211_get_radio_name(void *priv)
10994 {
10995         struct i802_bss *bss = priv;
10996         struct wpa_driver_nl80211_data *drv = bss->drv;
10997         return drv->phyname;
10998 }
10999
11000
11001 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
11002                          const u8 *pmkid)
11003 {
11004         struct nl_msg *msg;
11005
11006         msg = nlmsg_alloc();
11007         if (!msg)
11008                 return -ENOMEM;
11009
11010         nl80211_cmd(bss->drv, msg, 0, cmd);
11011
11012         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
11013         if (pmkid)
11014                 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
11015         if (bssid)
11016                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
11017
11018         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
11019  nla_put_failure:
11020         nlmsg_free(msg);
11021         return -ENOBUFS;
11022 }
11023
11024
11025 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
11026 {
11027         struct i802_bss *bss = priv;
11028         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
11029         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
11030 }
11031
11032
11033 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
11034 {
11035         struct i802_bss *bss = priv;
11036         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
11037                    MAC2STR(bssid));
11038         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
11039 }
11040
11041
11042 static int nl80211_flush_pmkid(void *priv)
11043 {
11044         struct i802_bss *bss = priv;
11045         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
11046         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
11047 }
11048
11049
11050 static void clean_survey_results(struct survey_results *survey_results)
11051 {
11052         struct freq_survey *survey, *tmp;
11053
11054         if (dl_list_empty(&survey_results->survey_list))
11055                 return;
11056
11057         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
11058                               struct freq_survey, list) {
11059                 dl_list_del(&survey->list);
11060                 os_free(survey);
11061         }
11062 }
11063
11064
11065 static void add_survey(struct nlattr **sinfo, u32 ifidx,
11066                        struct dl_list *survey_list)
11067 {
11068         struct freq_survey *survey;
11069
11070         survey = os_zalloc(sizeof(struct freq_survey));
11071         if  (!survey)
11072                 return;
11073
11074         survey->ifidx = ifidx;
11075         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
11076         survey->filled = 0;
11077
11078         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
11079                 survey->nf = (int8_t)
11080                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
11081                 survey->filled |= SURVEY_HAS_NF;
11082         }
11083
11084         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
11085                 survey->channel_time =
11086                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
11087                 survey->filled |= SURVEY_HAS_CHAN_TIME;
11088         }
11089
11090         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
11091                 survey->channel_time_busy =
11092                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
11093                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
11094         }
11095
11096         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
11097                 survey->channel_time_rx =
11098                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
11099                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
11100         }
11101
11102         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
11103                 survey->channel_time_tx =
11104                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
11105                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
11106         }
11107
11108         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
11109                    survey->freq,
11110                    survey->nf,
11111                    (unsigned long int) survey->channel_time,
11112                    (unsigned long int) survey->channel_time_busy,
11113                    (unsigned long int) survey->channel_time_tx,
11114                    (unsigned long int) survey->channel_time_rx,
11115                    survey->filled);
11116
11117         dl_list_add_tail(survey_list, &survey->list);
11118 }
11119
11120
11121 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
11122                            unsigned int freq_filter)
11123 {
11124         if (!freq_filter)
11125                 return 1;
11126
11127         return freq_filter == surveyed_freq;
11128 }
11129
11130
11131 static int survey_handler(struct nl_msg *msg, void *arg)
11132 {
11133         struct nlattr *tb[NL80211_ATTR_MAX + 1];
11134         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
11135         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
11136         struct survey_results *survey_results;
11137         u32 surveyed_freq = 0;
11138         u32 ifidx;
11139
11140         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
11141                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
11142                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
11143         };
11144
11145         survey_results = (struct survey_results *) arg;
11146
11147         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
11148                   genlmsg_attrlen(gnlh, 0), NULL);
11149
11150         if (!tb[NL80211_ATTR_IFINDEX])
11151                 return NL_SKIP;
11152
11153         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
11154
11155         if (!tb[NL80211_ATTR_SURVEY_INFO])
11156                 return NL_SKIP;
11157
11158         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
11159                              tb[NL80211_ATTR_SURVEY_INFO],
11160                              survey_policy))
11161                 return NL_SKIP;
11162
11163         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
11164                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
11165                 return NL_SKIP;
11166         }
11167
11168         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
11169
11170         if (!check_survey_ok(sinfo, surveyed_freq,
11171                              survey_results->freq_filter))
11172                 return NL_SKIP;
11173
11174         if (survey_results->freq_filter &&
11175             survey_results->freq_filter != surveyed_freq) {
11176                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
11177                            surveyed_freq);
11178                 return NL_SKIP;
11179         }
11180
11181         add_survey(sinfo, ifidx, &survey_results->survey_list);
11182
11183         return NL_SKIP;
11184 }
11185
11186
11187 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
11188 {
11189         struct i802_bss *bss = priv;
11190         struct wpa_driver_nl80211_data *drv = bss->drv;
11191         struct nl_msg *msg;
11192         int err = -ENOBUFS;
11193         union wpa_event_data data;
11194         struct survey_results *survey_results;
11195
11196         os_memset(&data, 0, sizeof(data));
11197         survey_results = &data.survey_results;
11198
11199         dl_list_init(&survey_results->survey_list);
11200
11201         msg = nlmsg_alloc();
11202         if (!msg)
11203                 goto nla_put_failure;
11204
11205         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
11206
11207         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11208
11209         if (freq)
11210                 data.survey_results.freq_filter = freq;
11211
11212         do {
11213                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
11214                 err = send_and_recv_msgs(drv, msg, survey_handler,
11215                                          survey_results);
11216         } while (err > 0);
11217
11218         if (err) {
11219                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
11220                 goto out_clean;
11221         }
11222
11223         wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
11224
11225 out_clean:
11226         clean_survey_results(survey_results);
11227 nla_put_failure:
11228         return err;
11229 }
11230
11231
11232 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
11233                                    const u8 *replay_ctr)
11234 {
11235         struct i802_bss *bss = priv;
11236         struct wpa_driver_nl80211_data *drv = bss->drv;
11237         struct nlattr *replay_nested;
11238         struct nl_msg *msg;
11239
11240         msg = nlmsg_alloc();
11241         if (!msg)
11242                 return;
11243
11244         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11245
11246         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
11247
11248         replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11249         if (!replay_nested)
11250                 goto nla_put_failure;
11251
11252         NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
11253         NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
11254         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
11255                 replay_ctr);
11256
11257         nla_nest_end(msg, replay_nested);
11258
11259         send_and_recv_msgs(drv, msg, NULL, NULL);
11260         return;
11261  nla_put_failure:
11262         nlmsg_free(msg);
11263 }
11264
11265
11266 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
11267                                     const u8 *addr, int qos)
11268 {
11269         /* send data frame to poll STA and check whether
11270          * this frame is ACKed */
11271         struct {
11272                 struct ieee80211_hdr hdr;
11273                 u16 qos_ctl;
11274         } STRUCT_PACKED nulldata;
11275         size_t size;
11276
11277         /* Send data frame to poll STA and check whether this frame is ACKed */
11278
11279         os_memset(&nulldata, 0, sizeof(nulldata));
11280
11281         if (qos) {
11282                 nulldata.hdr.frame_control =
11283                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
11284                                      WLAN_FC_STYPE_QOS_NULL);
11285                 size = sizeof(nulldata);
11286         } else {
11287                 nulldata.hdr.frame_control =
11288                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
11289                                      WLAN_FC_STYPE_NULLFUNC);
11290                 size = sizeof(struct ieee80211_hdr);
11291         }
11292
11293         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
11294         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
11295         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
11296         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
11297
11298         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
11299                                          0, 0) < 0)
11300                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
11301                            "send poll frame");
11302 }
11303
11304 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
11305                                 int qos)
11306 {
11307         struct i802_bss *bss = priv;
11308         struct wpa_driver_nl80211_data *drv = bss->drv;
11309         struct nl_msg *msg;
11310
11311         if (!drv->poll_command_supported) {
11312                 nl80211_send_null_frame(bss, own_addr, addr, qos);
11313                 return;
11314         }
11315
11316         msg = nlmsg_alloc();
11317         if (!msg)
11318                 return;
11319
11320         nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
11321
11322         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
11323         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
11324
11325         send_and_recv_msgs(drv, msg, NULL, NULL);
11326         return;
11327  nla_put_failure:
11328         nlmsg_free(msg);
11329 }
11330
11331
11332 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
11333 {
11334         struct nl_msg *msg;
11335
11336         msg = nlmsg_alloc();
11337         if (!msg)
11338                 return -ENOMEM;
11339
11340         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
11341         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
11342         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
11343                     enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
11344         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
11345 nla_put_failure:
11346         nlmsg_free(msg);
11347         return -ENOBUFS;
11348 }
11349
11350
11351 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
11352                                      int ctwindow)
11353 {
11354         struct i802_bss *bss = priv;
11355
11356         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
11357                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
11358
11359         if (opp_ps != -1 || ctwindow != -1) {
11360 #ifdef ANDROID_P2P
11361                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
11362 #else /* ANDROID_P2P */
11363                 return -1; /* Not yet supported */
11364 #endif /* ANDROID_P2P */
11365         }
11366
11367         if (legacy_ps == -1)
11368                 return 0;
11369         if (legacy_ps != 0 && legacy_ps != 1)
11370                 return -1; /* Not yet supported */
11371
11372         return nl80211_set_power_save(bss, legacy_ps);
11373 }
11374
11375
11376 static int nl80211_start_radar_detection(void *priv,
11377                                          struct hostapd_freq_params *freq)
11378 {
11379         struct i802_bss *bss = priv;
11380         struct wpa_driver_nl80211_data *drv = bss->drv;
11381         struct nl_msg *msg;
11382         int ret;
11383
11384         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
11385                    freq->freq, freq->ht_enabled, freq->vht_enabled,
11386                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
11387
11388         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
11389                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
11390                            "detection");
11391                 return -1;
11392         }
11393
11394         msg = nlmsg_alloc();
11395         if (!msg)
11396                 return -1;
11397
11398         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_RADAR_DETECT);
11399         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11400         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
11401
11402         if (freq->vht_enabled) {
11403                 switch (freq->bandwidth) {
11404                 case 20:
11405                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11406                                     NL80211_CHAN_WIDTH_20);
11407                         break;
11408                 case 40:
11409                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11410                                     NL80211_CHAN_WIDTH_40);
11411                         break;
11412                 case 80:
11413                         if (freq->center_freq2)
11414                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11415                                             NL80211_CHAN_WIDTH_80P80);
11416                         else
11417                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11418                                             NL80211_CHAN_WIDTH_80);
11419                         break;
11420                 case 160:
11421                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11422                                     NL80211_CHAN_WIDTH_160);
11423                         break;
11424                 default:
11425                         return -1;
11426                 }
11427                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
11428                 if (freq->center_freq2)
11429                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
11430                                     freq->center_freq2);
11431         } else if (freq->ht_enabled) {
11432                 switch (freq->sec_channel_offset) {
11433                 case -1:
11434                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11435                                     NL80211_CHAN_HT40MINUS);
11436                         break;
11437                 case 1:
11438                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11439                                     NL80211_CHAN_HT40PLUS);
11440                         break;
11441                 default:
11442                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11443                                     NL80211_CHAN_HT20);
11444                         break;
11445                 }
11446         }
11447
11448         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
11449         if (ret == 0)
11450                 return 0;
11451         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
11452                    "%d (%s)", ret, strerror(-ret));
11453 nla_put_failure:
11454         return -1;
11455 }
11456
11457 #ifdef CONFIG_TDLS
11458
11459 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
11460                                   u8 dialog_token, u16 status_code,
11461                                   u32 peer_capab, const u8 *buf, size_t len)
11462 {
11463         struct i802_bss *bss = priv;
11464         struct wpa_driver_nl80211_data *drv = bss->drv;
11465         struct nl_msg *msg;
11466
11467         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
11468                 return -EOPNOTSUPP;
11469
11470         if (!dst)
11471                 return -EINVAL;
11472
11473         msg = nlmsg_alloc();
11474         if (!msg)
11475                 return -ENOMEM;
11476
11477         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
11478         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11479         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
11480         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
11481         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
11482         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
11483         if (peer_capab) {
11484                 /*
11485                  * The internal enum tdls_peer_capability definition is
11486                  * currently identical with the nl80211 enum
11487                  * nl80211_tdls_peer_capability, so no conversion is needed
11488                  * here.
11489                  */
11490                 NLA_PUT_U32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY, peer_capab);
11491         }
11492         NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
11493
11494         return send_and_recv_msgs(drv, msg, NULL, NULL);
11495
11496 nla_put_failure:
11497         nlmsg_free(msg);
11498         return -ENOBUFS;
11499 }
11500
11501
11502 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
11503 {
11504         struct i802_bss *bss = priv;
11505         struct wpa_driver_nl80211_data *drv = bss->drv;
11506         struct nl_msg *msg;
11507         enum nl80211_tdls_operation nl80211_oper;
11508
11509         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
11510                 return -EOPNOTSUPP;
11511
11512         switch (oper) {
11513         case TDLS_DISCOVERY_REQ:
11514                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
11515                 break;
11516         case TDLS_SETUP:
11517                 nl80211_oper = NL80211_TDLS_SETUP;
11518                 break;
11519         case TDLS_TEARDOWN:
11520                 nl80211_oper = NL80211_TDLS_TEARDOWN;
11521                 break;
11522         case TDLS_ENABLE_LINK:
11523                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
11524                 break;
11525         case TDLS_DISABLE_LINK:
11526                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
11527                 break;
11528         case TDLS_ENABLE:
11529                 return 0;
11530         case TDLS_DISABLE:
11531                 return 0;
11532         default:
11533                 return -EINVAL;
11534         }
11535
11536         msg = nlmsg_alloc();
11537         if (!msg)
11538                 return -ENOMEM;
11539
11540         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
11541         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
11542         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11543         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
11544
11545         return send_and_recv_msgs(drv, msg, NULL, NULL);
11546
11547 nla_put_failure:
11548         nlmsg_free(msg);
11549         return -ENOBUFS;
11550 }
11551
11552 #endif /* CONFIG TDLS */
11553
11554
11555 #ifdef ANDROID
11556
11557 typedef struct android_wifi_priv_cmd {
11558         char *buf;
11559         int used_len;
11560         int total_len;
11561 } android_wifi_priv_cmd;
11562
11563 static int drv_errors = 0;
11564
11565 static void wpa_driver_send_hang_msg(struct wpa_driver_nl80211_data *drv)
11566 {
11567         drv_errors++;
11568         if (drv_errors > DRV_NUMBER_SEQUENTIAL_ERRORS) {
11569                 drv_errors = 0;
11570                 wpa_msg(drv->ctx, MSG_INFO, WPA_EVENT_DRIVER_STATE "HANGED");
11571         }
11572 }
11573
11574
11575 static int android_priv_cmd(struct i802_bss *bss, const char *cmd)
11576 {
11577         struct wpa_driver_nl80211_data *drv = bss->drv;
11578         struct ifreq ifr;
11579         android_wifi_priv_cmd priv_cmd;
11580         char buf[MAX_DRV_CMD_SIZE];
11581         int ret;
11582
11583         os_memset(&ifr, 0, sizeof(ifr));
11584         os_memset(&priv_cmd, 0, sizeof(priv_cmd));
11585         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
11586
11587         os_memset(buf, 0, sizeof(buf));
11588         os_strlcpy(buf, cmd, sizeof(buf));
11589
11590         priv_cmd.buf = buf;
11591         priv_cmd.used_len = sizeof(buf);
11592         priv_cmd.total_len = sizeof(buf);
11593         ifr.ifr_data = &priv_cmd;
11594
11595         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
11596         if (ret < 0) {
11597                 wpa_printf(MSG_ERROR, "%s: failed to issue private commands",
11598                            __func__);
11599                 wpa_driver_send_hang_msg(drv);
11600                 return ret;
11601         }
11602
11603         drv_errors = 0;
11604         return 0;
11605 }
11606
11607
11608 static int android_pno_start(struct i802_bss *bss,
11609                              struct wpa_driver_scan_params *params)
11610 {
11611         struct wpa_driver_nl80211_data *drv = bss->drv;
11612         struct ifreq ifr;
11613         android_wifi_priv_cmd priv_cmd;
11614         int ret = 0, i = 0, bp;
11615         char buf[WEXT_PNO_MAX_COMMAND_SIZE];
11616
11617         bp = WEXT_PNOSETUP_HEADER_SIZE;
11618         os_memcpy(buf, WEXT_PNOSETUP_HEADER, bp);
11619         buf[bp++] = WEXT_PNO_TLV_PREFIX;
11620         buf[bp++] = WEXT_PNO_TLV_VERSION;
11621         buf[bp++] = WEXT_PNO_TLV_SUBVERSION;
11622         buf[bp++] = WEXT_PNO_TLV_RESERVED;
11623
11624         while (i < WEXT_PNO_AMOUNT && (size_t) i < params->num_ssids) {
11625                 /* Check that there is enough space needed for 1 more SSID, the
11626                  * other sections and null termination */
11627                 if ((bp + WEXT_PNO_SSID_HEADER_SIZE + MAX_SSID_LEN +
11628                      WEXT_PNO_NONSSID_SECTIONS_SIZE + 1) >= (int) sizeof(buf))
11629                         break;
11630                 wpa_hexdump_ascii(MSG_DEBUG, "For PNO Scan",
11631                                   params->ssids[i].ssid,
11632                                   params->ssids[i].ssid_len);
11633                 buf[bp++] = WEXT_PNO_SSID_SECTION;
11634                 buf[bp++] = params->ssids[i].ssid_len;
11635                 os_memcpy(&buf[bp], params->ssids[i].ssid,
11636                           params->ssids[i].ssid_len);
11637                 bp += params->ssids[i].ssid_len;
11638                 i++;
11639         }
11640
11641         buf[bp++] = WEXT_PNO_SCAN_INTERVAL_SECTION;
11642         os_snprintf(&buf[bp], WEXT_PNO_SCAN_INTERVAL_LENGTH + 1, "%x",
11643                     WEXT_PNO_SCAN_INTERVAL);
11644         bp += WEXT_PNO_SCAN_INTERVAL_LENGTH;
11645
11646         buf[bp++] = WEXT_PNO_REPEAT_SECTION;
11647         os_snprintf(&buf[bp], WEXT_PNO_REPEAT_LENGTH + 1, "%x",
11648                     WEXT_PNO_REPEAT);
11649         bp += WEXT_PNO_REPEAT_LENGTH;
11650
11651         buf[bp++] = WEXT_PNO_MAX_REPEAT_SECTION;
11652         os_snprintf(&buf[bp], WEXT_PNO_MAX_REPEAT_LENGTH + 1, "%x",
11653                     WEXT_PNO_MAX_REPEAT);
11654         bp += WEXT_PNO_MAX_REPEAT_LENGTH + 1;
11655
11656         memset(&ifr, 0, sizeof(ifr));
11657         memset(&priv_cmd, 0, sizeof(priv_cmd));
11658         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
11659
11660         priv_cmd.buf = buf;
11661         priv_cmd.used_len = bp;
11662         priv_cmd.total_len = bp;
11663         ifr.ifr_data = &priv_cmd;
11664
11665         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
11666
11667         if (ret < 0) {
11668                 wpa_printf(MSG_ERROR, "ioctl[SIOCSIWPRIV] (pnosetup): %d",
11669                            ret);
11670                 wpa_driver_send_hang_msg(drv);
11671                 return ret;
11672         }
11673
11674         drv_errors = 0;
11675
11676         return android_priv_cmd(bss, "PNOFORCE 1");
11677 }
11678
11679
11680 static int android_pno_stop(struct i802_bss *bss)
11681 {
11682         return android_priv_cmd(bss, "PNOFORCE 0");
11683 }
11684
11685 #endif /* ANDROID */
11686
11687
11688 static int driver_nl80211_set_key(const char *ifname, void *priv,
11689                                   enum wpa_alg alg, const u8 *addr,
11690                                   int key_idx, int set_tx,
11691                                   const u8 *seq, size_t seq_len,
11692                                   const u8 *key, size_t key_len)
11693 {
11694         struct i802_bss *bss = priv;
11695         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
11696                                           set_tx, seq, seq_len, key, key_len);
11697 }
11698
11699
11700 static int driver_nl80211_scan2(void *priv,
11701                                 struct wpa_driver_scan_params *params)
11702 {
11703         struct i802_bss *bss = priv;
11704         return wpa_driver_nl80211_scan(bss, params);
11705 }
11706
11707
11708 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
11709                                          int reason_code)
11710 {
11711         struct i802_bss *bss = priv;
11712         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
11713 }
11714
11715
11716 static int driver_nl80211_authenticate(void *priv,
11717                                        struct wpa_driver_auth_params *params)
11718 {
11719         struct i802_bss *bss = priv;
11720         return wpa_driver_nl80211_authenticate(bss, params);
11721 }
11722
11723
11724 static void driver_nl80211_deinit(void *priv)
11725 {
11726         struct i802_bss *bss = priv;
11727         wpa_driver_nl80211_deinit(bss);
11728 }
11729
11730
11731 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
11732                                     const char *ifname)
11733 {
11734         struct i802_bss *bss = priv;
11735         return wpa_driver_nl80211_if_remove(bss, type, ifname);
11736 }
11737
11738
11739 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
11740                                     size_t data_len, int noack)
11741 {
11742         struct i802_bss *bss = priv;
11743         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
11744                                             0, 0, 0, 0);
11745 }
11746
11747
11748 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
11749 {
11750         struct i802_bss *bss = priv;
11751         return wpa_driver_nl80211_sta_remove(bss, addr);
11752 }
11753
11754
11755 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
11756                                        const char *ifname, int vlan_id)
11757 {
11758         struct i802_bss *bss = priv;
11759         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
11760 }
11761
11762
11763 static int driver_nl80211_read_sta_data(void *priv,
11764                                         struct hostap_sta_driver_data *data,
11765                                         const u8 *addr)
11766 {
11767         struct i802_bss *bss = priv;
11768         return i802_read_sta_data(bss, data, addr);
11769 }
11770
11771
11772 static int driver_nl80211_send_action(void *priv, unsigned int freq,
11773                                       unsigned int wait_time,
11774                                       const u8 *dst, const u8 *src,
11775                                       const u8 *bssid,
11776                                       const u8 *data, size_t data_len,
11777                                       int no_cck)
11778 {
11779         struct i802_bss *bss = priv;
11780         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
11781                                               bssid, data, data_len, no_cck);
11782 }
11783
11784
11785 static int driver_nl80211_probe_req_report(void *priv, int report)
11786 {
11787         struct i802_bss *bss = priv;
11788         return wpa_driver_nl80211_probe_req_report(bss, report);
11789 }
11790
11791
11792 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
11793                                             const u8 *ies, size_t ies_len)
11794 {
11795         int ret;
11796         struct nl_msg *msg;
11797         struct i802_bss *bss = priv;
11798         struct wpa_driver_nl80211_data *drv = bss->drv;
11799         u16 mdid = WPA_GET_LE16(md);
11800
11801         msg = nlmsg_alloc();
11802         if (!msg)
11803                 return -ENOMEM;
11804
11805         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
11806         nl80211_cmd(drv, msg, 0, NL80211_CMD_UPDATE_FT_IES);
11807         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11808         NLA_PUT(msg, NL80211_ATTR_IE, ies_len, ies);
11809         NLA_PUT_U16(msg, NL80211_ATTR_MDID, mdid);
11810
11811         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
11812         if (ret) {
11813                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
11814                            "err=%d (%s)", ret, strerror(-ret));
11815         }
11816
11817         return ret;
11818
11819 nla_put_failure:
11820         nlmsg_free(msg);
11821         return -ENOBUFS;
11822 }
11823
11824
11825 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
11826 {
11827         struct i802_bss *bss = priv;
11828         struct wpa_driver_nl80211_data *drv = bss->drv;
11829
11830         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
11831                 return NULL;
11832
11833         return bss->addr;
11834 }
11835
11836
11837 static const char * scan_state_str(enum scan_states scan_state)
11838 {
11839         switch (scan_state) {
11840         case NO_SCAN:
11841                 return "NO_SCAN";
11842         case SCAN_REQUESTED:
11843                 return "SCAN_REQUESTED";
11844         case SCAN_STARTED:
11845                 return "SCAN_STARTED";
11846         case SCAN_COMPLETED:
11847                 return "SCAN_COMPLETED";
11848         case SCAN_ABORTED:
11849                 return "SCAN_ABORTED";
11850         case SCHED_SCAN_STARTED:
11851                 return "SCHED_SCAN_STARTED";
11852         case SCHED_SCAN_STOPPED:
11853                 return "SCHED_SCAN_STOPPED";
11854         case SCHED_SCAN_RESULTS:
11855                 return "SCHED_SCAN_RESULTS";
11856         }
11857
11858         return "??";
11859 }
11860
11861
11862 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
11863 {
11864         struct i802_bss *bss = priv;
11865         struct wpa_driver_nl80211_data *drv = bss->drv;
11866         int res;
11867         char *pos, *end;
11868
11869         pos = buf;
11870         end = buf + buflen;
11871
11872         res = os_snprintf(pos, end - pos,
11873                           "ifindex=%d\n"
11874                           "ifname=%s\n"
11875                           "brname=%s\n"
11876                           "addr=" MACSTR "\n"
11877                           "freq=%d\n"
11878                           "%s%s%s%s%s",
11879                           bss->ifindex,
11880                           bss->ifname,
11881                           bss->brname,
11882                           MAC2STR(bss->addr),
11883                           bss->freq,
11884                           bss->beacon_set ? "beacon_set=1\n" : "",
11885                           bss->added_if_into_bridge ?
11886                           "added_if_into_bridge=1\n" : "",
11887                           bss->added_bridge ? "added_bridge=1\n" : "",
11888                           bss->in_deinit ? "in_deinit=1\n" : "",
11889                           bss->if_dynamic ? "if_dynamic=1\n" : "");
11890         if (res < 0 || res >= end - pos)
11891                 return pos - buf;
11892         pos += res;
11893
11894         if (bss->wdev_id_set) {
11895                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
11896                                   (unsigned long long) bss->wdev_id);
11897                 if (res < 0 || res >= end - pos)
11898                         return pos - buf;
11899                 pos += res;
11900         }
11901
11902         res = os_snprintf(pos, end - pos,
11903                           "phyname=%s\n"
11904                           "drv_ifindex=%d\n"
11905                           "operstate=%d\n"
11906                           "scan_state=%s\n"
11907                           "auth_bssid=" MACSTR "\n"
11908                           "auth_attempt_bssid=" MACSTR "\n"
11909                           "bssid=" MACSTR "\n"
11910                           "prev_bssid=" MACSTR "\n"
11911                           "associated=%d\n"
11912                           "assoc_freq=%u\n"
11913                           "monitor_sock=%d\n"
11914                           "monitor_ifidx=%d\n"
11915                           "monitor_refcount=%d\n"
11916                           "last_mgmt_freq=%u\n"
11917                           "eapol_tx_sock=%d\n"
11918                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
11919                           drv->phyname,
11920                           drv->ifindex,
11921                           drv->operstate,
11922                           scan_state_str(drv->scan_state),
11923                           MAC2STR(drv->auth_bssid),
11924                           MAC2STR(drv->auth_attempt_bssid),
11925                           MAC2STR(drv->bssid),
11926                           MAC2STR(drv->prev_bssid),
11927                           drv->associated,
11928                           drv->assoc_freq,
11929                           drv->monitor_sock,
11930                           drv->monitor_ifidx,
11931                           drv->monitor_refcount,
11932                           drv->last_mgmt_freq,
11933                           drv->eapol_tx_sock,
11934                           drv->ignore_if_down_event ?
11935                           "ignore_if_down_event=1\n" : "",
11936                           drv->scan_complete_events ?
11937                           "scan_complete_events=1\n" : "",
11938                           drv->disabled_11b_rates ?
11939                           "disabled_11b_rates=1\n" : "",
11940                           drv->pending_remain_on_chan ?
11941                           "pending_remain_on_chan=1\n" : "",
11942                           drv->in_interface_list ? "in_interface_list=1\n" : "",
11943                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
11944                           drv->poll_command_supported ?
11945                           "poll_command_supported=1\n" : "",
11946                           drv->data_tx_status ? "data_tx_status=1\n" : "",
11947                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
11948                           drv->retry_auth ? "retry_auth=1\n" : "",
11949                           drv->use_monitor ? "use_monitor=1\n" : "",
11950                           drv->ignore_next_local_disconnect ?
11951                           "ignore_next_local_disconnect=1\n" : "",
11952                           drv->ignore_next_local_deauth ?
11953                           "ignore_next_local_deauth=1\n" : "",
11954                           drv->allow_p2p_device ? "allow_p2p_device=1\n" : "");
11955         if (res < 0 || res >= end - pos)
11956                 return pos - buf;
11957         pos += res;
11958
11959         if (drv->has_capability) {
11960                 res = os_snprintf(pos, end - pos,
11961                                   "capa.key_mgmt=0x%x\n"
11962                                   "capa.enc=0x%x\n"
11963                                   "capa.auth=0x%x\n"
11964                                   "capa.flags=0x%x\n"
11965                                   "capa.max_scan_ssids=%d\n"
11966                                   "capa.max_sched_scan_ssids=%d\n"
11967                                   "capa.sched_scan_supported=%d\n"
11968                                   "capa.max_match_sets=%d\n"
11969                                   "capa.max_remain_on_chan=%u\n"
11970                                   "capa.max_stations=%u\n"
11971                                   "capa.probe_resp_offloads=0x%x\n"
11972                                   "capa.max_acl_mac_addrs=%u\n"
11973                                   "capa.num_multichan_concurrent=%u\n",
11974                                   drv->capa.key_mgmt,
11975                                   drv->capa.enc,
11976                                   drv->capa.auth,
11977                                   drv->capa.flags,
11978                                   drv->capa.max_scan_ssids,
11979                                   drv->capa.max_sched_scan_ssids,
11980                                   drv->capa.sched_scan_supported,
11981                                   drv->capa.max_match_sets,
11982                                   drv->capa.max_remain_on_chan,
11983                                   drv->capa.max_stations,
11984                                   drv->capa.probe_resp_offloads,
11985                                   drv->capa.max_acl_mac_addrs,
11986                                   drv->capa.num_multichan_concurrent);
11987                 if (res < 0 || res >= end - pos)
11988                         return pos - buf;
11989                 pos += res;
11990         }
11991
11992         return pos - buf;
11993 }
11994
11995
11996 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
11997 {
11998         if (settings->head)
11999                 NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD,
12000                         settings->head_len, settings->head);
12001
12002         if (settings->tail)
12003                 NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL,
12004                         settings->tail_len, settings->tail);
12005
12006         if (settings->beacon_ies)
12007                 NLA_PUT(msg, NL80211_ATTR_IE,
12008                         settings->beacon_ies_len, settings->beacon_ies);
12009
12010         if (settings->proberesp_ies)
12011                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
12012                         settings->proberesp_ies_len, settings->proberesp_ies);
12013
12014         if (settings->assocresp_ies)
12015                 NLA_PUT(msg,
12016                         NL80211_ATTR_IE_ASSOC_RESP,
12017                         settings->assocresp_ies_len, settings->assocresp_ies);
12018
12019         if (settings->probe_resp)
12020                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP,
12021                         settings->probe_resp_len, settings->probe_resp);
12022
12023         return 0;
12024
12025 nla_put_failure:
12026         return -ENOBUFS;
12027 }
12028
12029
12030 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
12031 {
12032         struct nl_msg *msg;
12033         struct i802_bss *bss = priv;
12034         struct wpa_driver_nl80211_data *drv = bss->drv;
12035         struct nlattr *beacon_csa;
12036         int ret = -ENOBUFS;
12037
12038         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
12039                    settings->cs_count, settings->block_tx,
12040                    settings->freq_params.freq, settings->freq_params.bandwidth,
12041                    settings->freq_params.center_freq1,
12042                    settings->freq_params.center_freq2);
12043
12044         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
12045                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
12046                 return -EOPNOTSUPP;
12047         }
12048
12049         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
12050             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
12051                 return -EOPNOTSUPP;
12052
12053         /* check settings validity */
12054         if (!settings->beacon_csa.tail ||
12055             ((settings->beacon_csa.tail_len <=
12056               settings->counter_offset_beacon) ||
12057              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
12058               settings->cs_count)))
12059                 return -EINVAL;
12060
12061         if (settings->beacon_csa.probe_resp &&
12062             ((settings->beacon_csa.probe_resp_len <=
12063               settings->counter_offset_presp) ||
12064              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
12065               settings->cs_count)))
12066                 return -EINVAL;
12067
12068         msg = nlmsg_alloc();
12069         if (!msg)
12070                 return -ENOMEM;
12071
12072         nl80211_cmd(drv, msg, 0, NL80211_CMD_CHANNEL_SWITCH);
12073         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
12074         NLA_PUT_U32(msg, NL80211_ATTR_CH_SWITCH_COUNT, settings->cs_count);
12075         ret = nl80211_put_freq_params(msg, &settings->freq_params);
12076         if (ret)
12077                 goto error;
12078
12079         if (settings->block_tx)
12080                 NLA_PUT_FLAG(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX);
12081
12082         /* beacon_after params */
12083         ret = set_beacon_data(msg, &settings->beacon_after);
12084         if (ret)
12085                 goto error;
12086
12087         /* beacon_csa params */
12088         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
12089         if (!beacon_csa)
12090                 goto nla_put_failure;
12091
12092         ret = set_beacon_data(msg, &settings->beacon_csa);
12093         if (ret)
12094                 goto error;
12095
12096         NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
12097                     settings->counter_offset_beacon);
12098
12099         if (settings->beacon_csa.probe_resp)
12100                 NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
12101                             settings->counter_offset_presp);
12102
12103         nla_nest_end(msg, beacon_csa);
12104         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
12105         if (ret) {
12106                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
12107                            ret, strerror(-ret));
12108         }
12109         return ret;
12110
12111 nla_put_failure:
12112         ret = -ENOBUFS;
12113 error:
12114         nlmsg_free(msg);
12115         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
12116         return ret;
12117 }
12118
12119
12120 #ifdef CONFIG_TESTING_OPTIONS
12121 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
12122 {
12123         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
12124         struct wpabuf *buf = arg;
12125
12126         if (!buf)
12127                 return NL_SKIP;
12128
12129         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
12130                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
12131                 return NL_SKIP;
12132         }
12133
12134         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
12135                         genlmsg_attrlen(gnlh, 0));
12136
12137         return NL_SKIP;
12138 }
12139 #endif /* CONFIG_TESTING_OPTIONS */
12140
12141
12142 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
12143 {
12144         struct nlattr *tb[NL80211_ATTR_MAX + 1];
12145         struct nlattr *nl_vendor_reply, *nl;
12146         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
12147         struct wpabuf *buf = arg;
12148         int rem;
12149
12150         if (!buf)
12151                 return NL_SKIP;
12152
12153         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
12154                   genlmsg_attrlen(gnlh, 0), NULL);
12155         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
12156
12157         if (!nl_vendor_reply)
12158                 return NL_SKIP;
12159
12160         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
12161                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
12162                 return NL_SKIP;
12163         }
12164
12165         nla_for_each_nested(nl, nl_vendor_reply, rem) {
12166                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
12167         }
12168
12169         return NL_SKIP;
12170 }
12171
12172
12173 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
12174                               unsigned int subcmd, const u8 *data,
12175                               size_t data_len, struct wpabuf *buf)
12176 {
12177         struct i802_bss *bss = priv;
12178         struct wpa_driver_nl80211_data *drv = bss->drv;
12179         struct nl_msg *msg;
12180         int ret;
12181
12182         msg = nlmsg_alloc();
12183         if (!msg)
12184                 return -ENOMEM;
12185
12186 #ifdef CONFIG_TESTING_OPTIONS
12187         if (vendor_id == 0xffffffff) {
12188                 nl80211_cmd(drv, msg, 0, subcmd);
12189                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
12190                     0)
12191                         goto nla_put_failure;
12192                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
12193                 if (ret)
12194                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
12195                                    ret);
12196                 return ret;
12197         }
12198 #endif /* CONFIG_TESTING_OPTIONS */
12199
12200         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
12201         if (nl80211_set_iface_id(msg, bss) < 0)
12202                 goto nla_put_failure;
12203         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, vendor_id);
12204         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd);
12205         if (data)
12206                 NLA_PUT(msg, NL80211_ATTR_VENDOR_DATA, data_len, data);
12207
12208         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
12209         if (ret)
12210                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
12211                            ret);
12212         return ret;
12213
12214 nla_put_failure:
12215         nlmsg_free(msg);
12216         return -ENOBUFS;
12217 }
12218
12219
12220 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
12221                                u8 qos_map_set_len)
12222 {
12223         struct i802_bss *bss = priv;
12224         struct wpa_driver_nl80211_data *drv = bss->drv;
12225         struct nl_msg *msg;
12226         int ret;
12227
12228         msg = nlmsg_alloc();
12229         if (!msg)
12230                 return -ENOMEM;
12231
12232         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
12233                     qos_map_set, qos_map_set_len);
12234
12235         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_QOS_MAP);
12236         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
12237         NLA_PUT(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set);
12238
12239         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
12240         if (ret)
12241                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
12242
12243         return ret;
12244
12245 nla_put_failure:
12246         nlmsg_free(msg);
12247         return -ENOBUFS;
12248 }
12249
12250
12251 static int nl80211_set_wowlan(void *priv,
12252                               const struct wowlan_triggers *triggers)
12253 {
12254         struct i802_bss *bss = priv;
12255         struct wpa_driver_nl80211_data *drv = bss->drv;
12256         struct nl_msg *msg;
12257         struct nlattr *wowlan_triggers;
12258         int ret;
12259
12260         msg = nlmsg_alloc();
12261         if (!msg)
12262                 return -ENOMEM;
12263
12264         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
12265
12266         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WOWLAN);
12267         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
12268
12269         wowlan_triggers = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12270         if (!wowlan_triggers)
12271                 goto nla_put_failure;
12272
12273         if (triggers->any)
12274                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
12275         if (triggers->disconnect)
12276                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
12277         if (triggers->magic_pkt)
12278                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
12279         if (triggers->gtk_rekey_failure)
12280                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
12281         if (triggers->eap_identity_req)
12282                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
12283         if (triggers->four_way_handshake)
12284                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
12285         if (triggers->rfkill_release)
12286                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
12287
12288         nla_nest_end(msg, wowlan_triggers);
12289
12290         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
12291         if (ret)
12292                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
12293
12294         return ret;
12295
12296 nla_put_failure:
12297         nlmsg_free(msg);
12298         return -ENOBUFS;
12299 }
12300
12301
12302 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
12303         .name = "nl80211",
12304         .desc = "Linux nl80211/cfg80211",
12305         .get_bssid = wpa_driver_nl80211_get_bssid,
12306         .get_ssid = wpa_driver_nl80211_get_ssid,
12307         .set_key = driver_nl80211_set_key,
12308         .scan2 = driver_nl80211_scan2,
12309         .sched_scan = wpa_driver_nl80211_sched_scan,
12310         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
12311         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
12312         .deauthenticate = driver_nl80211_deauthenticate,
12313         .authenticate = driver_nl80211_authenticate,
12314         .associate = wpa_driver_nl80211_associate,
12315         .global_init = nl80211_global_init,
12316         .global_deinit = nl80211_global_deinit,
12317         .init2 = wpa_driver_nl80211_init,
12318         .deinit = driver_nl80211_deinit,
12319         .get_capa = wpa_driver_nl80211_get_capa,
12320         .set_operstate = wpa_driver_nl80211_set_operstate,
12321         .set_supp_port = wpa_driver_nl80211_set_supp_port,
12322         .set_country = wpa_driver_nl80211_set_country,
12323         .get_country = wpa_driver_nl80211_get_country,
12324         .set_ap = wpa_driver_nl80211_set_ap,
12325         .set_acl = wpa_driver_nl80211_set_acl,
12326         .if_add = wpa_driver_nl80211_if_add,
12327         .if_remove = driver_nl80211_if_remove,
12328         .send_mlme = driver_nl80211_send_mlme,
12329         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
12330         .sta_add = wpa_driver_nl80211_sta_add,
12331         .sta_remove = driver_nl80211_sta_remove,
12332         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
12333         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
12334         .hapd_init = i802_init,
12335         .hapd_deinit = i802_deinit,
12336         .set_wds_sta = i802_set_wds_sta,
12337         .get_seqnum = i802_get_seqnum,
12338         .flush = i802_flush,
12339         .get_inact_sec = i802_get_inact_sec,
12340         .sta_clear_stats = i802_sta_clear_stats,
12341         .set_rts = i802_set_rts,
12342         .set_frag = i802_set_frag,
12343         .set_tx_queue_params = i802_set_tx_queue_params,
12344         .set_sta_vlan = driver_nl80211_set_sta_vlan,
12345         .sta_deauth = i802_sta_deauth,
12346         .sta_disassoc = i802_sta_disassoc,
12347         .read_sta_data = driver_nl80211_read_sta_data,
12348         .set_freq = i802_set_freq,
12349         .send_action = driver_nl80211_send_action,
12350         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
12351         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
12352         .cancel_remain_on_channel =
12353         wpa_driver_nl80211_cancel_remain_on_channel,
12354         .probe_req_report = driver_nl80211_probe_req_report,
12355         .deinit_ap = wpa_driver_nl80211_deinit_ap,
12356         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
12357         .resume = wpa_driver_nl80211_resume,
12358         .send_ft_action = nl80211_send_ft_action,
12359         .signal_monitor = nl80211_signal_monitor,
12360         .signal_poll = nl80211_signal_poll,
12361         .send_frame = nl80211_send_frame,
12362         .shared_freq = wpa_driver_nl80211_shared_freq,
12363         .set_param = nl80211_set_param,
12364         .get_radio_name = nl80211_get_radio_name,
12365         .add_pmkid = nl80211_add_pmkid,
12366         .remove_pmkid = nl80211_remove_pmkid,
12367         .flush_pmkid = nl80211_flush_pmkid,
12368         .set_rekey_info = nl80211_set_rekey_info,
12369         .poll_client = nl80211_poll_client,
12370         .set_p2p_powersave = nl80211_set_p2p_powersave,
12371         .start_dfs_cac = nl80211_start_radar_detection,
12372         .stop_ap = wpa_driver_nl80211_stop_ap,
12373 #ifdef CONFIG_TDLS
12374         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
12375         .tdls_oper = nl80211_tdls_oper,
12376 #endif /* CONFIG_TDLS */
12377         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
12378         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
12379         .get_survey = wpa_driver_nl80211_get_survey,
12380         .status = wpa_driver_nl80211_status,
12381         .switch_channel = nl80211_switch_channel,
12382 #ifdef ANDROID_P2P
12383         .set_noa = wpa_driver_set_p2p_noa,
12384         .get_noa = wpa_driver_get_p2p_noa,
12385         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
12386 #endif /* ANDROID_P2P */
12387 #ifdef ANDROID
12388         .driver_cmd = wpa_driver_nl80211_driver_cmd,
12389 #endif /* ANDROID */
12390         .vendor_cmd = nl80211_vendor_cmd,
12391         .set_qos_map = nl80211_set_qos_map,
12392         .set_wowlan = nl80211_set_wowlan,
12393 };