src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/types.h>
  15 #include <net/if.h>
  16 #include <netlink/genl/genl.h>
  17 #include <netlink/genl/ctrl.h>
  18 #ifdef CONFIG_LIBNL3_ROUTE
  19 #include <netlink/route/neighbour.h>
  20 #endif /* CONFIG_LIBNL3_ROUTE */
  21 #include <linux/rtnetlink.h>
  22 #include <netpacket/packet.h>
  23 #include <linux/errqueue.h>
  24
  25 #include "common.h"
  26 #include "eloop.h"
  27 #include "common/qca-vendor.h"
  28 #include "common/qca-vendor-attr.h"
  29 #include "common/ieee802_11_defs.h"
  30 #include "common/ieee802_11_common.h"
  31 #include "l2_packet/l2_packet.h"
  32 #include "netlink.h"
  33 #include "linux_defines.h"
  34 #include "linux_ioctl.h"
  35 #include "radiotap.h"
  36 #include "radiotap_iter.h"
  37 #include "rfkill.h"
  38 #include "driver_nl80211.h"
  39
  40
  41 #ifndef CONFIG_LIBNL20
  42 /*
  43  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  44  * but when you free a socket again it will mess up its bitmap and
  45  * and use the wrong number the next time it needs a socket ID.
  46  * Therefore, we wrap the handle alloc/destroy and add our own pid
  47  * accounting.
  48  */
  49 static uint32_t port_bitmap[32] = { 0 };
  50
  51 static struct nl_handle *nl80211_handle_alloc(void *cb)
  52 {
  53         struct nl_handle *handle;
  54         uint32_t pid = getpid() & 0x3FFFFF;
  55         int i;
  56
  57         handle = nl_handle_alloc_cb(cb);
  58
  59         for (i = 0; i < 1024; i++) {
  60                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  61                         continue;
  62                 port_bitmap[i / 32] |= 1 << (i % 32);
  63                 pid += i << 22;
  64                 break;
  65         }
  66
  67         nl_socket_set_local_port(handle, pid);
  68
  69         return handle;
  70 }
  71
  72 static void nl80211_handle_destroy(struct nl_handle *handle)
  73 {
  74         uint32_t port = nl_socket_get_local_port(handle);
  75
  76         port >>= 22;
  77         port_bitmap[port / 32] &= ~(1 << (port % 32));
  78
  79         nl_handle_destroy(handle);
  80 }
  81 #endif /* CONFIG_LIBNL20 */
  82
  83
  84 #ifdef ANDROID
  85 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
  86 #undef nl_socket_set_nonblocking
  87 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
  88
  89 #define genl_ctrl_resolve android_genl_ctrl_resolve
  90 #endif /* ANDROID */
  91
  92
  93 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
  94 {
  95         struct nl_handle *handle;
  96
  97         handle = nl80211_handle_alloc(cb);
  98         if (handle == NULL) {
  99                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 100                            "callbacks (%s)", dbg);
 101                 return NULL;
 102         }
 103
 104         if (genl_connect(handle)) {
 105                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 106                            "netlink (%s)", dbg);
 107                 nl80211_handle_destroy(handle);
 108                 return NULL;
 109         }
 110
 111         return handle;
 112 }
 113
 114
 115 static void nl_destroy_handles(struct nl_handle **handle)
 116 {
 117         if (*handle == NULL)
 118                 return;
 119         nl80211_handle_destroy(*handle);
 120         *handle = NULL;
 121 }
 122
 123
 124 #if __WORDSIZE == 64
 125 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 126 #else
 127 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 128 #endif
 129
 130 static void nl80211_register_eloop_read(struct nl_handle **handle,
 131                                         eloop_sock_handler handler,
 132                                         void *eloop_data)
 133 {
 134         nl_socket_set_nonblocking(*handle);
 135         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 136                                  eloop_data, *handle);
 137         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 138 }
 139
 140
 141 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 142 {
 143         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 144         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 145         nl_destroy_handles(handle);
 146 }
 147
 148
 149 static void nl80211_global_deinit(void *priv);
 150
 151 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 152 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
 153                                             struct hostapd_freq_params *freq);
 154
 155 static int
 156 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 157                                    const u8 *set_addr, int first);
 158 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 159                                    const u8 *addr, int cmd, u16 reason_code,
 160                                    int local_state_change);
 161 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 162                                   unsigned int freq, unsigned int wait,
 163                                   const u8 *buf, size_t buf_len, u64 *cookie,
 164                                   int no_cck, int no_ack, int offchanok);
 165 static int nl80211_register_frame(struct i802_bss *bss,
 166                                   struct nl_handle *hl_handle,
 167                                   u16 type, const u8 *match, size_t match_len);
 168 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 169                                                int report);
 170
 171 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 172 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 173 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 174 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
 175                                         enum wpa_driver_if_type type,
 176                                         const char *ifname);
 177
 178 static int nl80211_set_channel(struct i802_bss *bss,
 179                                struct hostapd_freq_params *freq, int set_chan);
 180 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 181                                      int ifindex, int disabled);
 182
 183 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 184
 185 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
 186 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 187
 188
 189 /* Converts nl80211_chan_width to a common format */
 190 enum chan_width convert2width(int width)
 191 {
 192         switch (width) {
 193         case NL80211_CHAN_WIDTH_20_NOHT:
 194                 return CHAN_WIDTH_20_NOHT;
 195         case NL80211_CHAN_WIDTH_20:
 196                 return CHAN_WIDTH_20;
 197         case NL80211_CHAN_WIDTH_40:
 198                 return CHAN_WIDTH_40;
 199         case NL80211_CHAN_WIDTH_80:
 200                 return CHAN_WIDTH_80;
 201         case NL80211_CHAN_WIDTH_80P80:
 202                 return CHAN_WIDTH_80P80;
 203         case NL80211_CHAN_WIDTH_160:
 204                 return CHAN_WIDTH_160;
 205         }
 206         return CHAN_WIDTH_UNKNOWN;
 207 }
 208
 209
 210 int is_ap_interface(enum nl80211_iftype nlmode)
 211 {
 212         return nlmode == NL80211_IFTYPE_AP ||
 213                 nlmode == NL80211_IFTYPE_P2P_GO;
 214 }
 215
 216
 217 static int is_sta_interface(enum nl80211_iftype nlmode)
 218 {
 219         return nlmode == NL80211_IFTYPE_STATION ||
 220                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 221 }
 222
 223
 224 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 225 {
 226         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 227                 nlmode == NL80211_IFTYPE_P2P_GO;
 228 }
 229
 230
 231 struct i802_bss * get_bss_ifindex(struct wpa_driver_nl80211_data *drv,
 232                                   int ifindex)
 233 {
 234         struct i802_bss *bss;
 235
 236         for (bss = drv->first_bss; bss; bss = bss->next) {
 237                 if (bss->ifindex == ifindex)
 238                         return bss;
 239         }
 240
 241         return NULL;
 242 }
 243
 244
 245 static int is_mesh_interface(enum nl80211_iftype nlmode)
 246 {
 247         return nlmode == NL80211_IFTYPE_MESH_POINT;
 248 }
 249
 250
 251 void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 252 {
 253         if (drv->associated)
 254                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 255         drv->associated = 0;
 256         os_memset(drv->bssid, 0, ETH_ALEN);
 257 }
 258
 259
 260 struct nl80211_bss_info_arg {
 261         struct wpa_driver_nl80211_data *drv;
 262         struct wpa_scan_results *res;
 263         unsigned int assoc_freq;
 264         unsigned int ibss_freq;
 265         u8 assoc_bssid[ETH_ALEN];
 266 };
 267
 268 static int bss_info_handler(struct nl_msg *msg, void *arg);
 269
 270
 271 /* nl80211 code */
 272 static int ack_handler(struct nl_msg *msg, void *arg)
 273 {
 274         int *err = arg;
 275         *err = 0;
 276         return NL_STOP;
 277 }
 278
 279 static int finish_handler(struct nl_msg *msg, void *arg)
 280 {
 281         int *ret = arg;
 282         *ret = 0;
 283         return NL_SKIP;
 284 }
 285
 286 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 287                          void *arg)
 288 {
 289         int *ret = arg;
 290         *ret = err->error;
 291         return NL_SKIP;
 292 }
 293
 294
 295 static int no_seq_check(struct nl_msg *msg, void *arg)
 296 {
 297         return NL_OK;
 298 }
 299
 300
 301 static int send_and_recv(struct nl80211_global *global,
 302                          struct nl_handle *nl_handle, struct nl_msg *msg,
 303                          int (*valid_handler)(struct nl_msg *, void *),
 304                          void *valid_data)
 305 {
 306         struct nl_cb *cb;
 307         int err = -ENOMEM;
 308
 309         cb = nl_cb_clone(global->nl_cb);
 310         if (!cb)
 311                 goto out;
 312
 313         err = nl_send_auto_complete(nl_handle, msg);
 314         if (err < 0)
 315                 goto out;
 316
 317         err = 1;
 318
 319         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 320         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 321         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 322
 323         if (valid_handler)
 324                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 325                           valid_handler, valid_data);
 326
 327         while (err > 0) {
 328                 int res = nl_recvmsgs(nl_handle, cb);
 329                 if (res < 0) {
 330                         wpa_printf(MSG_INFO,
 331                                    "nl80211: %s->nl_recvmsgs failed: %d",
 332                                    __func__, res);
 333                 }
 334         }
 335  out:
 336         nl_cb_put(cb);
 337         nlmsg_free(msg);
 338         return err;
 339 }
 340
 341
 342 static int send_and_recv_msgs_global(struct nl80211_global *global,
 343                                      struct nl_msg *msg,
 344                                      int (*valid_handler)(struct nl_msg *, void *),
 345                                      void *valid_data)
 346 {
 347         return send_and_recv(global, global->nl, msg, valid_handler,
 348                              valid_data);
 349 }
 350
 351
 352 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 353                        struct nl_msg *msg,
 354                        int (*valid_handler)(struct nl_msg *, void *),
 355                        void *valid_data)
 356 {
 357         return send_and_recv(drv->global, drv->global->nl, msg,
 358                              valid_handler, valid_data);
 359 }
 360
 361
 362 struct family_data {
 363         const char *group;
 364         int id;
 365 };
 366
 367
 368 int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 369 {
 370         if (bss->wdev_id_set)
 371                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 372         else
 373                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 374         return 0;
 375
 376 nla_put_failure:
 377         return -1;
 378 }
 379
 380
 381 static int family_handler(struct nl_msg *msg, void *arg)
 382 {
 383         struct family_data *res = arg;
 384         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 385         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 386         struct nlattr *mcgrp;
 387         int i;
 388
 389         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 390                   genlmsg_attrlen(gnlh, 0), NULL);
 391         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 392                 return NL_SKIP;
 393
 394         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 395                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 396                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 397                           nla_len(mcgrp), NULL);
 398                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 399                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 400                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 401                                res->group,
 402                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 403                         continue;
 404                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 405                 break;
 406         };
 407
 408         return NL_SKIP;
 409 }
 410
 411
 412 static int nl_get_multicast_id(struct nl80211_global *global,
 413                                const char *family, const char *group)
 414 {
 415         struct nl_msg *msg;
 416         int ret = -1;
 417         struct family_data res = { group, -ENOENT };
 418
 419         msg = nlmsg_alloc();
 420         if (!msg)
 421                 return -ENOMEM;
 422         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 423                     0, 0, CTRL_CMD_GETFAMILY, 0);
 424         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 425
 426         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 427         msg = NULL;
 428         if (ret == 0)
 429                 ret = res.id;
 430
 431 nla_put_failure:
 432         nlmsg_free(msg);
 433         return ret;
 434 }
 435
 436
 437 void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 438                    struct nl_msg *msg, int flags, uint8_t cmd)
 439 {
 440         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 441                            0, flags, cmd, 0);
 442 }
 443
 444
 445 struct wiphy_idx_data {
 446         int wiphy_idx;
 447         enum nl80211_iftype nlmode;
 448         u8 *macaddr;
 449 };
 450
 451
 452 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 453 {
 454         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 455         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 456         struct wiphy_idx_data *info = arg;
 457
 458         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 459                   genlmsg_attrlen(gnlh, 0), NULL);
 460
 461         if (tb[NL80211_ATTR_WIPHY])
 462                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 463
 464         if (tb[NL80211_ATTR_IFTYPE])
 465                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 466
 467         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 468                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 469                           ETH_ALEN);
 470
 471         return NL_SKIP;
 472 }
 473
 474
 475 int nl80211_get_wiphy_index(struct i802_bss *bss)
 476 {
 477         struct nl_msg *msg;
 478         struct wiphy_idx_data data = {
 479                 .wiphy_idx = -1,
 480                 .macaddr = NULL,
 481         };
 482
 483         msg = nlmsg_alloc();
 484         if (!msg)
 485                 return NL80211_IFTYPE_UNSPECIFIED;
 486
 487         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 488
 489         if (nl80211_set_iface_id(msg, bss) < 0)
 490                 goto nla_put_failure;
 491
 492         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 493                 return data.wiphy_idx;
 494         msg = NULL;
 495 nla_put_failure:
 496         nlmsg_free(msg);
 497         return -1;
 498 }
 499
 500
 501 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 502 {
 503         struct nl_msg *msg;
 504         struct wiphy_idx_data data = {
 505                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 506                 .macaddr = NULL,
 507         };
 508
 509         msg = nlmsg_alloc();
 510         if (!msg)
 511                 return -1;
 512
 513         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 514
 515         if (nl80211_set_iface_id(msg, bss) < 0)
 516                 goto nla_put_failure;
 517
 518         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 519                 return data.nlmode;
 520         msg = NULL;
 521 nla_put_failure:
 522         nlmsg_free(msg);
 523         return NL80211_IFTYPE_UNSPECIFIED;
 524 }
 525
 526
 527 static int nl80211_get_macaddr(struct i802_bss *bss)
 528 {
 529         struct nl_msg *msg;
 530         struct wiphy_idx_data data = {
 531                 .macaddr = bss->addr,
 532         };
 533
 534         msg = nlmsg_alloc();
 535         if (!msg)
 536                 return NL80211_IFTYPE_UNSPECIFIED;
 537
 538         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 539         if (nl80211_set_iface_id(msg, bss) < 0)
 540                 goto nla_put_failure;
 541
 542         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 543
 544 nla_put_failure:
 545         nlmsg_free(msg);
 546         return NL80211_IFTYPE_UNSPECIFIED;
 547 }
 548
 549
 550 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 551                                     struct nl80211_wiphy_data *w)
 552 {
 553         struct nl_msg *msg;
 554         int ret = -1;
 555
 556         msg = nlmsg_alloc();
 557         if (!msg)
 558                 return -1;
 559
 560         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
 561
 562         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
 563
 564         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 565         msg = NULL;
 566         if (ret) {
 567                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 568                            "failed: ret=%d (%s)",
 569                            ret, strerror(-ret));
 570                 goto nla_put_failure;
 571         }
 572         ret = 0;
 573 nla_put_failure:
 574         nlmsg_free(msg);
 575         return ret;
 576 }
 577
 578
 579 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 580 {
 581         struct nl80211_wiphy_data *w = eloop_ctx;
 582         int res;
 583
 584         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 585
 586         res = nl_recvmsgs(handle, w->nl_cb);
 587         if (res < 0) {
 588                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 589                            __func__, res);
 590         }
 591 }
 592
 593
 594 static int process_beacon_event(struct nl_msg *msg, void *arg)
 595 {
 596         struct nl80211_wiphy_data *w = arg;
 597         struct wpa_driver_nl80211_data *drv;
 598         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 599         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 600         union wpa_event_data event;
 601
 602         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 603                   genlmsg_attrlen(gnlh, 0), NULL);
 604
 605         if (gnlh->cmd != NL80211_CMD_FRAME) {
 606                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 607                            gnlh->cmd);
 608                 return NL_SKIP;
 609         }
 610
 611         if (!tb[NL80211_ATTR_FRAME])
 612                 return NL_SKIP;
 613
 614         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 615                          wiphy_list) {
 616                 os_memset(&event, 0, sizeof(event));
 617                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 618                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 619                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 620         }
 621
 622         return NL_SKIP;
 623 }
 624
 625
 626 static struct nl80211_wiphy_data *
 627 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 628 {
 629         static DEFINE_DL_LIST(nl80211_wiphys);
 630         struct nl80211_wiphy_data *w;
 631         int wiphy_idx, found = 0;
 632         struct i802_bss *tmp_bss;
 633
 634         if (bss->wiphy_data != NULL)
 635                 return bss->wiphy_data;
 636
 637         wiphy_idx = nl80211_get_wiphy_index(bss);
 638
 639         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 640                 if (w->wiphy_idx == wiphy_idx)
 641                         goto add;
 642         }
 643
 644         /* alloc new one */
 645         w = os_zalloc(sizeof(*w));
 646         if (w == NULL)
 647                 return NULL;
 648         w->wiphy_idx = wiphy_idx;
 649         dl_list_init(&w->bsss);
 650         dl_list_init(&w->drvs);
 651
 652         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 653         if (!w->nl_cb) {
 654                 os_free(w);
 655                 return NULL;
 656         }
 657         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 658         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 659                   w);
 660
 661         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 662                                          "wiphy beacons");
 663         if (w->nl_beacons == NULL) {
 664                 os_free(w);
 665                 return NULL;
 666         }
 667
 668         if (nl80211_register_beacons(bss->drv, w)) {
 669                 nl_destroy_handles(&w->nl_beacons);
 670                 os_free(w);
 671                 return NULL;
 672         }
 673
 674         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 675
 676         dl_list_add(&nl80211_wiphys, &w->list);
 677
 678 add:
 679         /* drv entry for this bss already there? */
 680         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 681                 if (tmp_bss->drv == bss->drv) {
 682                         found = 1;
 683                         break;
 684                 }
 685         }
 686         /* if not add it */
 687         if (!found)
 688                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 689
 690         dl_list_add(&w->bsss, &bss->wiphy_list);
 691         bss->wiphy_data = w;
 692         return w;
 693 }
 694
 695
 696 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 697 {
 698         struct nl80211_wiphy_data *w = bss->wiphy_data;
 699         struct i802_bss *tmp_bss;
 700         int found = 0;
 701
 702         if (w == NULL)
 703                 return;
 704         bss->wiphy_data = NULL;
 705         dl_list_del(&bss->wiphy_list);
 706
 707         /* still any for this drv present? */
 708         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 709                 if (tmp_bss->drv == bss->drv) {
 710                         found = 1;
 711                         break;
 712                 }
 713         }
 714         /* if not remove it */
 715         if (!found)
 716                 dl_list_del(&bss->drv->wiphy_list);
 717
 718         if (!dl_list_empty(&w->bsss))
 719                 return;
 720
 721         nl80211_destroy_eloop_handle(&w->nl_beacons);
 722
 723         nl_cb_put(w->nl_cb);
 724         dl_list_del(&w->list);
 725         os_free(w);
 726 }
 727
 728
 729 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 730 {
 731         struct i802_bss *bss = priv;
 732         struct wpa_driver_nl80211_data *drv = bss->drv;
 733         if (!drv->associated)
 734                 return -1;
 735         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 736         return 0;
 737 }
 738
 739
 740 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 741 {
 742         struct i802_bss *bss = priv;
 743         struct wpa_driver_nl80211_data *drv = bss->drv;
 744         if (!drv->associated)
 745                 return -1;
 746         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 747         return drv->ssid_len;
 748 }
 749
 750
 751 static void wpa_driver_nl80211_event_newlink(
 752         struct wpa_driver_nl80211_data *drv, char *ifname)
 753 {
 754         union wpa_event_data event;
 755
 756         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 757                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
 758                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
 759                                    drv->first_bss->ifname);
 760                         return;
 761                 }
 762                 if (!drv->if_removed)
 763                         return;
 764                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
 765                            drv->first_bss->ifname);
 766                 drv->if_removed = 0;
 767         }
 768
 769         os_memset(&event, 0, sizeof(event));
 770         os_strlcpy(event.interface_status.ifname, ifname,
 771                    sizeof(event.interface_status.ifname));
 772         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
 773         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 774 }
 775
 776
 777 static void wpa_driver_nl80211_event_dellink(
 778         struct wpa_driver_nl80211_data *drv, char *ifname)
 779 {
 780         union wpa_event_data event;
 781
 782         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 783                 if (drv->if_removed) {
 784                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
 785                                    ifname);
 786                         return;
 787                 }
 788                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
 789                            ifname);
 790                 drv->if_removed = 1;
 791         } else {
 792                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
 793                            ifname);
 794         }
 795
 796         os_memset(&event, 0, sizeof(event));
 797         os_strlcpy(event.interface_status.ifname, ifname,
 798                    sizeof(event.interface_status.ifname));
 799         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
 800         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 801 }
 802
 803
 804 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 805                                          u8 *buf, size_t len)
 806 {
 807         int attrlen, rta_len;
 808         struct rtattr *attr;
 809
 810         attrlen = len;
 811         attr = (struct rtattr *) buf;
 812
 813         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 814         while (RTA_OK(attr, attrlen)) {
 815                 if (attr->rta_type == IFLA_IFNAME) {
 816                         if (os_strcmp(((char *) attr) + rta_len,
 817                                       drv->first_bss->ifname) == 0)
 818                                 return 1;
 819                         else
 820                                 break;
 821                 }
 822                 attr = RTA_NEXT(attr, attrlen);
 823         }
 824
 825         return 0;
 826 }
 827
 828
 829 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 830                                           int ifindex, u8 *buf, size_t len)
 831 {
 832         if (drv->ifindex == ifindex)
 833                 return 1;
 834
 835         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 836                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 837                            "interface");
 838                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0);
 839                 return 1;
 840         }
 841
 842         return 0;
 843 }
 844
 845
 846 static struct wpa_driver_nl80211_data *
 847 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 848 {
 849         struct wpa_driver_nl80211_data *drv;
 850         dl_list_for_each(drv, &global->interfaces,
 851                          struct wpa_driver_nl80211_data, list) {
 852                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 853                     have_ifidx(drv, idx))
 854                         return drv;
 855         }
 856         return NULL;
 857 }
 858
 859
 860 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 861                                                  struct ifinfomsg *ifi,
 862                                                  u8 *buf, size_t len)
 863 {
 864         struct nl80211_global *global = ctx;
 865         struct wpa_driver_nl80211_data *drv;
 866         int attrlen;
 867         struct rtattr *attr;
 868         u32 brid = 0;
 869         char namebuf[IFNAMSIZ];
 870         char ifname[IFNAMSIZ + 1];
 871         char extra[100], *pos, *end;
 872
 873         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 874         if (!drv) {
 875                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_NEWLINK event for foreign ifindex %d",
 876                            ifi->ifi_index);
 877                 return;
 878         }
 879
 880         extra[0] = '\0';
 881         pos = extra;
 882         end = pos + sizeof(extra);
 883         ifname[0] = '\0';
 884
 885         attrlen = len;
 886         attr = (struct rtattr *) buf;
 887         while (RTA_OK(attr, attrlen)) {
 888                 switch (attr->rta_type) {
 889                 case IFLA_IFNAME:
 890                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
 891                                 break;
 892                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
 893                         ifname[RTA_PAYLOAD(attr)] = '\0';
 894                         break;
 895                 case IFLA_MASTER:
 896                         brid = nla_get_u32((struct nlattr *) attr);
 897                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
 898                         break;
 899                 case IFLA_WIRELESS:
 900                         pos += os_snprintf(pos, end - pos, " wext");
 901                         break;
 902                 case IFLA_OPERSTATE:
 903                         pos += os_snprintf(pos, end - pos, " operstate=%u",
 904                                            nla_get_u32((struct nlattr *) attr));
 905                         break;
 906                 case IFLA_LINKMODE:
 907                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
 908                                            nla_get_u32((struct nlattr *) attr));
 909                         break;
 910                 }
 911                 attr = RTA_NEXT(attr, attrlen);
 912         }
 913         extra[sizeof(extra) - 1] = '\0';
 914
 915         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
 916                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
 917                    ifi->ifi_flags,
 918                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 919                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 920                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 921                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 922
 923         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 924                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 925                     linux_iface_up(drv->global->ioctl_sock,
 926                                    drv->first_bss->ifname) > 0) {
 927                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 928                                    "event since interface %s is up", namebuf);
 929                         return;
 930                 }
 931                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
 932                 if (drv->ignore_if_down_event) {
 933                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 934                                    "event generated by mode change");
 935                         drv->ignore_if_down_event = 0;
 936                 } else {
 937                         drv->if_disabled = 1;
 938                         wpa_supplicant_event(drv->ctx,
 939                                              EVENT_INTERFACE_DISABLED, NULL);
 940
 941                         /*
 942                          * Try to get drv again, since it may be removed as
 943                          * part of the EVENT_INTERFACE_DISABLED handling for
 944                          * dynamic interfaces
 945                          */
 946                         drv = nl80211_find_drv(global, ifi->ifi_index,
 947                                                buf, len);
 948                         if (!drv)
 949                                 return;
 950                 }
 951         }
 952
 953         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 954                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 955                     linux_iface_up(drv->global->ioctl_sock,
 956                                    drv->first_bss->ifname) == 0) {
 957                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 958                                    "event since interface %s is down",
 959                                    namebuf);
 960                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
 961                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 962                                    "event since interface %s does not exist",
 963                                    drv->first_bss->ifname);
 964                 } else if (drv->if_removed) {
 965                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 966                                    "event since interface %s is marked "
 967                                    "removed", drv->first_bss->ifname);
 968                 } else {
 969                         struct i802_bss *bss;
 970                         u8 addr[ETH_ALEN];
 971
 972                         /* Re-read MAC address as it may have changed */
 973                         bss = get_bss_ifindex(drv, ifi->ifi_index);
 974                         if (bss &&
 975                             linux_get_ifhwaddr(drv->global->ioctl_sock,
 976                                                bss->ifname, addr) < 0) {
 977                                 wpa_printf(MSG_DEBUG,
 978                                            "nl80211: %s: failed to re-read MAC address",
 979                                            bss->ifname);
 980                         } else if (bss &&
 981                                    os_memcmp(addr, bss->addr, ETH_ALEN) != 0) {
 982                                 wpa_printf(MSG_DEBUG,
 983                                            "nl80211: Own MAC address on ifindex %d (%s) changed from "
 984                                            MACSTR " to " MACSTR,
 985                                            ifi->ifi_index, bss->ifname,
 986                                            MAC2STR(bss->addr),
 987                                            MAC2STR(addr));
 988                                 os_memcpy(bss->addr, addr, ETH_ALEN);
 989                         }
 990
 991                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
 992                         drv->if_disabled = 0;
 993                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
 994                                              NULL);
 995                 }
 996         }
 997
 998         /*
 999          * Some drivers send the association event before the operup event--in
1000          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1001          * fails. This will hit us when wpa_supplicant does not need to do
1002          * IEEE 802.1X authentication
1003          */
1004         if (drv->operstate == 1 &&
1005             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1006             !(ifi->ifi_flags & IFF_RUNNING)) {
1007                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1008                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1009                                        -1, IF_OPER_UP);
1010         }
1011
1012         if (ifname[0])
1013                 wpa_driver_nl80211_event_newlink(drv, ifname);
1014
1015         if (ifi->ifi_family == AF_BRIDGE && brid) {
1016                 struct i802_bss *bss;
1017
1018                 /* device has been added to bridge */
1019                 if_indextoname(brid, namebuf);
1020                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1021                            brid, namebuf);
1022                 add_ifidx(drv, brid);
1023
1024                 for (bss = drv->first_bss; bss; bss = bss->next) {
1025                         if (os_strcmp(ifname, bss->ifname) == 0) {
1026                                 os_strlcpy(bss->brname, namebuf, IFNAMSIZ);
1027                                 break;
1028                         }
1029                 }
1030         }
1031 }
1032
1033
1034 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1035                                                  struct ifinfomsg *ifi,
1036                                                  u8 *buf, size_t len)
1037 {
1038         struct nl80211_global *global = ctx;
1039         struct wpa_driver_nl80211_data *drv;
1040         int attrlen;
1041         struct rtattr *attr;
1042         u32 brid = 0;
1043         char ifname[IFNAMSIZ + 1];
1044         char extra[100], *pos, *end;
1045
1046         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1047         if (!drv) {
1048                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_DELLINK event for foreign ifindex %d",
1049                            ifi->ifi_index);
1050                 return;
1051         }
1052
1053         extra[0] = '\0';
1054         pos = extra;
1055         end = pos + sizeof(extra);
1056         ifname[0] = '\0';
1057
1058         attrlen = len;
1059         attr = (struct rtattr *) buf;
1060         while (RTA_OK(attr, attrlen)) {
1061                 switch (attr->rta_type) {
1062                 case IFLA_IFNAME:
1063                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1064                                 break;
1065                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1066                         ifname[RTA_PAYLOAD(attr)] = '\0';
1067                         break;
1068                 case IFLA_MASTER:
1069                         brid = nla_get_u32((struct nlattr *) attr);
1070                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1071                         break;
1072                 case IFLA_OPERSTATE:
1073                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1074                                            nla_get_u32((struct nlattr *) attr));
1075                         break;
1076                 case IFLA_LINKMODE:
1077                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1078                                            nla_get_u32((struct nlattr *) attr));
1079                         break;
1080                 }
1081                 attr = RTA_NEXT(attr, attrlen);
1082         }
1083         extra[sizeof(extra) - 1] = '\0';
1084
1085         wpa_printf(MSG_DEBUG, "RTM_DELLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
1086                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
1087                    ifi->ifi_flags,
1088                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1089                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1090                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1091                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1092
1093         if (ifname[0] && (ifi->ifi_family != AF_BRIDGE || !brid))
1094                 wpa_driver_nl80211_event_dellink(drv, ifname);
1095
1096         if (ifi->ifi_family == AF_BRIDGE && brid) {
1097                 /* device has been removed from bridge */
1098                 char namebuf[IFNAMSIZ];
1099                 if_indextoname(brid, namebuf);
1100                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1101                            "%s", brid, namebuf);
1102                 del_ifidx(drv, brid);
1103         }
1104 }
1105
1106
1107 unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1108 {
1109         struct nl_msg *msg;
1110         int ret;
1111         struct nl80211_bss_info_arg arg;
1112
1113         os_memset(&arg, 0, sizeof(arg));
1114         msg = nlmsg_alloc();
1115         if (!msg)
1116                 goto nla_put_failure;
1117
1118         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1119         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1120
1121         arg.drv = drv;
1122         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1123         msg = NULL;
1124         if (ret == 0) {
1125                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1126                         arg.ibss_freq : arg.assoc_freq;
1127                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1128                            "associated BSS from scan results: %u MHz", freq);
1129                 if (freq)
1130                         drv->assoc_freq = freq;
1131                 return drv->assoc_freq;
1132         }
1133         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1134                    "(%s)", ret, strerror(-ret));
1135 nla_put_failure:
1136         nlmsg_free(msg);
1137         return drv->assoc_freq;
1138 }
1139
1140
1141 static int get_link_signal(struct nl_msg *msg, void *arg)
1142 {
1143         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1144         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1145         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1146         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1147                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1148                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
1149         };
1150         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1151         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1152                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1153                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1154                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1155                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1156         };
1157         struct wpa_signal_info *sig_change = arg;
1158
1159         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1160                   genlmsg_attrlen(gnlh, 0), NULL);
1161         if (!tb[NL80211_ATTR_STA_INFO] ||
1162             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1163                              tb[NL80211_ATTR_STA_INFO], policy))
1164                 return NL_SKIP;
1165         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1166                 return NL_SKIP;
1167
1168         sig_change->current_signal =
1169                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1170
1171         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
1172                 sig_change->avg_signal =
1173                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
1174         else
1175                 sig_change->avg_signal = 0;
1176
1177         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1178                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1179                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1180                                      rate_policy)) {
1181                         sig_change->current_txrate = 0;
1182                 } else {
1183                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1184                                 sig_change->current_txrate =
1185                                         nla_get_u16(rinfo[
1186                                              NL80211_RATE_INFO_BITRATE]) * 100;
1187                         }
1188                 }
1189         }
1190
1191         return NL_SKIP;
1192 }
1193
1194
1195 int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1196                             struct wpa_signal_info *sig)
1197 {
1198         struct nl_msg *msg;
1199
1200         sig->current_signal = -9999;
1201         sig->current_txrate = 0;
1202
1203         msg = nlmsg_alloc();
1204         if (!msg)
1205                 return -ENOMEM;
1206
1207         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
1208
1209         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1210         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
1211
1212         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1213  nla_put_failure:
1214         nlmsg_free(msg);
1215         return -ENOBUFS;
1216 }
1217
1218
1219 static int get_link_noise(struct nl_msg *msg, void *arg)
1220 {
1221         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1222         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1223         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1224         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1225                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1226                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1227         };
1228         struct wpa_signal_info *sig_change = arg;
1229
1230         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1231                   genlmsg_attrlen(gnlh, 0), NULL);
1232
1233         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1234                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1235                 return NL_SKIP;
1236         }
1237
1238         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1239                              tb[NL80211_ATTR_SURVEY_INFO],
1240                              survey_policy)) {
1241                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1242                            "attributes!");
1243                 return NL_SKIP;
1244         }
1245
1246         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1247                 return NL_SKIP;
1248
1249         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1250             sig_change->frequency)
1251                 return NL_SKIP;
1252
1253         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1254                 return NL_SKIP;
1255
1256         sig_change->current_noise =
1257                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1258
1259         return NL_SKIP;
1260 }
1261
1262
1263 int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1264                            struct wpa_signal_info *sig_change)
1265 {
1266         struct nl_msg *msg;
1267
1268         sig_change->current_noise = 9999;
1269         sig_change->frequency = drv->assoc_freq;
1270
1271         msg = nlmsg_alloc();
1272         if (!msg)
1273                 return -ENOMEM;
1274
1275         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1276
1277         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1278
1279         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1280  nla_put_failure:
1281         nlmsg_free(msg);
1282         return -ENOBUFS;
1283 }
1284
1285
1286 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
1287 {
1288         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1289         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1290         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1291         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1292                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1293                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1294         };
1295         struct wpa_scan_results *scan_results = arg;
1296         struct wpa_scan_res *scan_res;
1297         size_t i;
1298
1299         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1300                   genlmsg_attrlen(gnlh, 0), NULL);
1301
1302         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1303                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
1304                 return NL_SKIP;
1305         }
1306
1307         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1308                              tb[NL80211_ATTR_SURVEY_INFO],
1309                              survey_policy)) {
1310                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
1311                            "attributes");
1312                 return NL_SKIP;
1313         }
1314
1315         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1316                 return NL_SKIP;
1317
1318         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1319                 return NL_SKIP;
1320
1321         for (i = 0; i < scan_results->num; ++i) {
1322                 scan_res = scan_results->res[i];
1323                 if (!scan_res)
1324                         continue;
1325                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1326                     scan_res->freq)
1327                         continue;
1328                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
1329                         continue;
1330                 scan_res->noise = (s8)
1331                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1332                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
1333         }
1334
1335         return NL_SKIP;
1336 }
1337
1338
1339 static int nl80211_get_noise_for_scan_results(
1340         struct wpa_driver_nl80211_data *drv,
1341         struct wpa_scan_results *scan_res)
1342 {
1343         struct nl_msg *msg;
1344
1345         msg = nlmsg_alloc();
1346         if (!msg)
1347                 return -ENOMEM;
1348
1349         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1350
1351         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1352
1353         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
1354                                   scan_res);
1355  nla_put_failure:
1356         nlmsg_free(msg);
1357         return -ENOBUFS;
1358 }
1359
1360
1361 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1362                                              void *handle)
1363 {
1364         struct nl_cb *cb = eloop_ctx;
1365         int res;
1366
1367         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
1368
1369         res = nl_recvmsgs(handle, cb);
1370         if (res < 0) {
1371                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
1372                            __func__, res);
1373         }
1374 }
1375
1376
1377 /**
1378  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1379  * @priv: driver_nl80211 private data
1380  * @alpha2_arg: country to which to switch to
1381  * Returns: 0 on success, -1 on failure
1382  *
1383  * This asks nl80211 to set the regulatory domain for given
1384  * country ISO / IEC alpha2.
1385  */
1386 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1387 {
1388         struct i802_bss *bss = priv;
1389         struct wpa_driver_nl80211_data *drv = bss->drv;
1390         char alpha2[3];
1391         struct nl_msg *msg;
1392
1393         msg = nlmsg_alloc();
1394         if (!msg)
1395                 return -ENOMEM;
1396
1397         alpha2[0] = alpha2_arg[0];
1398         alpha2[1] = alpha2_arg[1];
1399         alpha2[2] = '\0';
1400
1401         nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
1402
1403         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
1404         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1405                 return -EINVAL;
1406         return 0;
1407 nla_put_failure:
1408         nlmsg_free(msg);
1409         return -EINVAL;
1410 }
1411
1412
1413 static int nl80211_get_country(struct nl_msg *msg, void *arg)
1414 {
1415         char *alpha2 = arg;
1416         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1417         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1418
1419         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1420                   genlmsg_attrlen(gnlh, 0), NULL);
1421         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
1422                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
1423                 return NL_SKIP;
1424         }
1425         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
1426         return NL_SKIP;
1427 }
1428
1429
1430 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
1431 {
1432         struct i802_bss *bss = priv;
1433         struct wpa_driver_nl80211_data *drv = bss->drv;
1434         struct nl_msg *msg;
1435         int ret;
1436
1437         msg = nlmsg_alloc();
1438         if (!msg)
1439                 return -ENOMEM;
1440
1441         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
1442         alpha2[0] = '\0';
1443         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
1444         if (!alpha2[0])
1445                 ret = -1;
1446
1447         return ret;
1448 }
1449
1450
1451 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
1452 {
1453         int ret;
1454
1455         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1456         if (global->nl_cb == NULL) {
1457                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1458                            "callbacks");
1459                 return -1;
1460         }
1461
1462         global->nl = nl_create_handle(global->nl_cb, "nl");
1463         if (global->nl == NULL)
1464                 goto err;
1465
1466         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
1467         if (global->nl80211_id < 0) {
1468                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1469                            "found");
1470                 goto err;
1471         }
1472
1473         global->nl_event = nl_create_handle(global->nl_cb, "event");
1474         if (global->nl_event == NULL)
1475                 goto err;
1476
1477         ret = nl_get_multicast_id(global, "nl80211", "scan");
1478         if (ret >= 0)
1479                 ret = nl_socket_add_membership(global->nl_event, ret);
1480         if (ret < 0) {
1481                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1482                            "membership for scan events: %d (%s)",
1483                            ret, strerror(-ret));
1484                 goto err;
1485         }
1486
1487         ret = nl_get_multicast_id(global, "nl80211", "mlme");
1488         if (ret >= 0)
1489                 ret = nl_socket_add_membership(global->nl_event, ret);
1490         if (ret < 0) {
1491                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1492                            "membership for mlme events: %d (%s)",
1493                            ret, strerror(-ret));
1494                 goto err;
1495         }
1496
1497         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
1498         if (ret >= 0)
1499                 ret = nl_socket_add_membership(global->nl_event, ret);
1500         if (ret < 0) {
1501                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1502                            "membership for regulatory events: %d (%s)",
1503                            ret, strerror(-ret));
1504                 /* Continue without regulatory events */
1505         }
1506
1507         ret = nl_get_multicast_id(global, "nl80211", "vendor");
1508         if (ret >= 0)
1509                 ret = nl_socket_add_membership(global->nl_event, ret);
1510         if (ret < 0) {
1511                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1512                            "membership for vendor events: %d (%s)",
1513                            ret, strerror(-ret));
1514                 /* Continue without vendor events */
1515         }
1516
1517         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1518                   no_seq_check, NULL);
1519         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1520                   process_global_event, global);
1521
1522         nl80211_register_eloop_read(&global->nl_event,
1523                                     wpa_driver_nl80211_event_receive,
1524                                     global->nl_cb);
1525
1526         return 0;
1527
1528 err:
1529         nl_destroy_handles(&global->nl_event);
1530         nl_destroy_handles(&global->nl);
1531         nl_cb_put(global->nl_cb);
1532         global->nl_cb = NULL;
1533         return -1;
1534 }
1535
1536
1537 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
1538 {
1539         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1540         if (!drv->nl_cb) {
1541                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
1542                 return -1;
1543         }
1544
1545         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1546                   no_seq_check, NULL);
1547         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1548                   process_drv_event, drv);
1549
1550         return 0;
1551 }
1552
1553
1554 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1555 {
1556         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1557         /*
1558          * This may be for any interface; use ifdown event to disable
1559          * interface.
1560          */
1561 }
1562
1563
1564 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1565 {
1566         struct wpa_driver_nl80211_data *drv = ctx;
1567         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1568         if (i802_set_iface_flags(drv->first_bss, 1)) {
1569                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1570                            "after rfkill unblock");
1571                 return;
1572         }
1573         /* rtnetlink ifup handler will report interface as enabled */
1574 }
1575
1576
1577 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
1578                                                       void *eloop_ctx,
1579                                                       void *handle)
1580 {
1581         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1582         u8 data[2048];
1583         struct msghdr msg;
1584         struct iovec entry;
1585         u8 control[512];
1586         struct cmsghdr *cmsg;
1587         int res, found_ee = 0, found_wifi = 0, acked = 0;
1588         union wpa_event_data event;
1589
1590         memset(&msg, 0, sizeof(msg));
1591         msg.msg_iov = &entry;
1592         msg.msg_iovlen = 1;
1593         entry.iov_base = data;
1594         entry.iov_len = sizeof(data);
1595         msg.msg_control = &control;
1596         msg.msg_controllen = sizeof(control);
1597
1598         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
1599         /* if error or not fitting 802.3 header, return */
1600         if (res < 14)
1601                 return;
1602
1603         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
1604         {
1605                 if (cmsg->cmsg_level == SOL_SOCKET &&
1606                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
1607                         int *ack;
1608
1609                         found_wifi = 1;
1610                         ack = (void *)CMSG_DATA(cmsg);
1611                         acked = *ack;
1612                 }
1613
1614                 if (cmsg->cmsg_level == SOL_PACKET &&
1615                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
1616                         struct sock_extended_err *err =
1617                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
1618
1619                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
1620                                 found_ee = 1;
1621                 }
1622         }
1623
1624         if (!found_ee || !found_wifi)
1625                 return;
1626
1627         memset(&event, 0, sizeof(event));
1628         event.eapol_tx_status.dst = data;
1629         event.eapol_tx_status.data = data + 14;
1630         event.eapol_tx_status.data_len = res - 14;
1631         event.eapol_tx_status.ack = acked;
1632         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
1633 }
1634
1635
1636 static int nl80211_init_bss(struct i802_bss *bss)
1637 {
1638         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1639         if (!bss->nl_cb)
1640                 return -1;
1641
1642         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1643                   no_seq_check, NULL);
1644         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1645                   process_bss_event, bss);
1646
1647         return 0;
1648 }
1649
1650
1651 static void nl80211_destroy_bss(struct i802_bss *bss)
1652 {
1653         nl_cb_put(bss->nl_cb);
1654         bss->nl_cb = NULL;
1655 }
1656
1657
1658 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
1659                                           void *global_priv, int hostapd,
1660                                           const u8 *set_addr)
1661 {
1662         struct wpa_driver_nl80211_data *drv;
1663         struct rfkill_config *rcfg;
1664         struct i802_bss *bss;
1665
1666         if (global_priv == NULL)
1667                 return NULL;
1668         drv = os_zalloc(sizeof(*drv));
1669         if (drv == NULL)
1670                 return NULL;
1671         drv->global = global_priv;
1672         drv->ctx = ctx;
1673         drv->hostapd = !!hostapd;
1674         drv->eapol_sock = -1;
1675         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
1676         drv->if_indices = drv->default_if_indices;
1677
1678         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
1679         if (!drv->first_bss) {
1680                 os_free(drv);
1681                 return NULL;
1682         }
1683         bss = drv->first_bss;
1684         bss->drv = drv;
1685         bss->ctx = ctx;
1686
1687         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1688         drv->monitor_ifidx = -1;
1689         drv->monitor_sock = -1;
1690         drv->eapol_tx_sock = -1;
1691         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
1692
1693         if (wpa_driver_nl80211_init_nl(drv)) {
1694                 os_free(drv);
1695                 return NULL;
1696         }
1697
1698         if (nl80211_init_bss(bss))
1699                 goto failed;
1700
1701         rcfg = os_zalloc(sizeof(*rcfg));
1702         if (rcfg == NULL)
1703                 goto failed;
1704         rcfg->ctx = drv;
1705         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
1706         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1707         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1708         drv->rfkill = rfkill_init(rcfg);
1709         if (drv->rfkill == NULL) {
1710                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1711                 os_free(rcfg);
1712         }
1713
1714         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
1715                 drv->start_iface_up = 1;
1716
1717         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1))
1718                 goto failed;
1719
1720         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
1721         if (drv->eapol_tx_sock < 0)
1722                 goto failed;
1723
1724         if (drv->data_tx_status) {
1725                 int enabled = 1;
1726
1727                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
1728                                &enabled, sizeof(enabled)) < 0) {
1729                         wpa_printf(MSG_DEBUG,
1730                                 "nl80211: wifi status sockopt failed\n");
1731                         drv->data_tx_status = 0;
1732                         if (!drv->use_monitor)
1733                                 drv->capa.flags &=
1734                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1735                 } else {
1736                         eloop_register_read_sock(drv->eapol_tx_sock,
1737                                 wpa_driver_nl80211_handle_eapol_tx_status,
1738                                 drv, NULL);
1739                 }
1740         }
1741
1742         if (drv->global) {
1743                 dl_list_add(&drv->global->interfaces, &drv->list);
1744                 drv->in_interface_list = 1;
1745         }
1746
1747         return bss;
1748
1749 failed:
1750         wpa_driver_nl80211_deinit(bss);
1751         return NULL;
1752 }
1753
1754
1755 /**
1756  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1757  * @ctx: context to be used when calling wpa_supplicant functions,
1758  * e.g., wpa_supplicant_event()
1759  * @ifname: interface name, e.g., wlan0
1760  * @global_priv: private driver global data from global_init()
1761  * Returns: Pointer to private data, %NULL on failure
1762  */
1763 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
1764                                       void *global_priv)
1765 {
1766         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL);
1767 }
1768
1769
1770 static int nl80211_register_frame(struct i802_bss *bss,
1771                                   struct nl_handle *nl_handle,
1772                                   u16 type, const u8 *match, size_t match_len)
1773 {
1774         struct wpa_driver_nl80211_data *drv = bss->drv;
1775         struct nl_msg *msg;
1776         int ret = -1;
1777         char buf[30];
1778
1779         msg = nlmsg_alloc();
1780         if (!msg)
1781                 return -1;
1782
1783         buf[0] = '\0';
1784         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
1785         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
1786                    type, fc2str(type), nl_handle, buf);
1787
1788         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
1789
1790         if (nl80211_set_iface_id(msg, bss) < 0)
1791                 goto nla_put_failure;
1792
1793         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
1794         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
1795
1796         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
1797         msg = NULL;
1798         if (ret) {
1799                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
1800                            "failed (type=%u): ret=%d (%s)",
1801                            type, ret, strerror(-ret));
1802                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
1803                             match, match_len);
1804                 goto nla_put_failure;
1805         }
1806         ret = 0;
1807 nla_put_failure:
1808         nlmsg_free(msg);
1809         return ret;
1810 }
1811
1812
1813 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
1814 {
1815         struct wpa_driver_nl80211_data *drv = bss->drv;
1816
1817         if (bss->nl_mgmt) {
1818                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
1819                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
1820                 return -1;
1821         }
1822
1823         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
1824         if (bss->nl_mgmt == NULL)
1825                 return -1;
1826
1827         return 0;
1828 }
1829
1830
1831 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
1832 {
1833         nl80211_register_eloop_read(&bss->nl_mgmt,
1834                                     wpa_driver_nl80211_event_receive,
1835                                     bss->nl_cb);
1836 }
1837
1838
1839 static int nl80211_register_action_frame(struct i802_bss *bss,
1840                                          const u8 *match, size_t match_len)
1841 {
1842         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
1843         return nl80211_register_frame(bss, bss->nl_mgmt,
1844                                       type, match, match_len);
1845 }
1846
1847
1848 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
1849 {
1850         struct wpa_driver_nl80211_data *drv = bss->drv;
1851         int ret = 0;
1852
1853         if (nl80211_alloc_mgmt_handle(bss))
1854                 return -1;
1855         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
1856                    "handle %p", bss->nl_mgmt);
1857
1858         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
1859                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
1860
1861                 /* register for any AUTH message */
1862                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
1863         }
1864
1865 #ifdef CONFIG_INTERWORKING
1866         /* QoS Map Configure */
1867         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
1868                 ret = -1;
1869 #endif /* CONFIG_INTERWORKING */
1870 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
1871         /* GAS Initial Request */
1872         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
1873                 ret = -1;
1874         /* GAS Initial Response */
1875         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
1876                 ret = -1;
1877         /* GAS Comeback Request */
1878         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
1879                 ret = -1;
1880         /* GAS Comeback Response */
1881         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
1882                 ret = -1;
1883         /* Protected GAS Initial Request */
1884         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
1885                 ret = -1;
1886         /* Protected GAS Initial Response */
1887         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
1888                 ret = -1;
1889         /* Protected GAS Comeback Request */
1890         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
1891                 ret = -1;
1892         /* Protected GAS Comeback Response */
1893         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
1894                 ret = -1;
1895 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
1896 #ifdef CONFIG_P2P
1897         /* P2P Public Action */
1898         if (nl80211_register_action_frame(bss,
1899                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
1900                                           6) < 0)
1901                 ret = -1;
1902         /* P2P Action */
1903         if (nl80211_register_action_frame(bss,
1904                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
1905                                           5) < 0)
1906                 ret = -1;
1907 #endif /* CONFIG_P2P */
1908 #ifdef CONFIG_IEEE80211W
1909         /* SA Query Response */
1910         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
1911                 ret = -1;
1912 #endif /* CONFIG_IEEE80211W */
1913 #ifdef CONFIG_TDLS
1914         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
1915                 /* TDLS Discovery Response */
1916                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
1917                     0)
1918                         ret = -1;
1919         }
1920 #endif /* CONFIG_TDLS */
1921
1922         /* FT Action frames */
1923         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
1924                 ret = -1;
1925         else
1926                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1927                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1928
1929         /* WNM - BSS Transition Management Request */
1930         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
1931                 ret = -1;
1932         /* WNM-Sleep Mode Response */
1933         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
1934                 ret = -1;
1935
1936 #ifdef CONFIG_HS20
1937         /* WNM-Notification */
1938         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
1939                 ret = -1;
1940 #endif /* CONFIG_HS20 */
1941
1942         nl80211_mgmt_handle_register_eloop(bss);
1943
1944         return ret;
1945 }
1946
1947
1948 static int nl80211_mgmt_subscribe_mesh(struct i802_bss *bss)
1949 {
1950         int ret = 0;
1951
1952         if (nl80211_alloc_mgmt_handle(bss))
1953                 return -1;
1954
1955         wpa_printf(MSG_DEBUG,
1956                    "nl80211: Subscribe to mgmt frames with mesh handle %p",
1957                    bss->nl_mgmt);
1958
1959         /* Auth frames for mesh SAE */
1960         if (nl80211_register_frame(bss, bss->nl_mgmt,
1961                                    (WLAN_FC_TYPE_MGMT << 2) |
1962                                    (WLAN_FC_STYPE_AUTH << 4),
1963                                    NULL, 0) < 0)
1964                 ret = -1;
1965
1966         /* Mesh peering open */
1967         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x01", 2) < 0)
1968                 ret = -1;
1969         /* Mesh peering confirm */
1970         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x02", 2) < 0)
1971                 ret = -1;
1972         /* Mesh peering close */
1973         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x03", 2) < 0)
1974                 ret = -1;
1975
1976         nl80211_mgmt_handle_register_eloop(bss);
1977
1978         return ret;
1979 }
1980
1981
1982 static int nl80211_register_spurious_class3(struct i802_bss *bss)
1983 {
1984         struct wpa_driver_nl80211_data *drv = bss->drv;
1985         struct nl_msg *msg;
1986         int ret = -1;
1987
1988         msg = nlmsg_alloc();
1989         if (!msg)
1990                 return -1;
1991
1992         nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
1993
1994         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
1995
1996         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
1997         msg = NULL;
1998         if (ret) {
1999                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
2000                            "failed: ret=%d (%s)",
2001                            ret, strerror(-ret));
2002                 goto nla_put_failure;
2003         }
2004         ret = 0;
2005 nla_put_failure:
2006         nlmsg_free(msg);
2007         return ret;
2008 }
2009
2010
2011 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
2012 {
2013         static const int stypes[] = {
2014                 WLAN_FC_STYPE_AUTH,
2015                 WLAN_FC_STYPE_ASSOC_REQ,
2016                 WLAN_FC_STYPE_REASSOC_REQ,
2017                 WLAN_FC_STYPE_DISASSOC,
2018                 WLAN_FC_STYPE_DEAUTH,
2019                 WLAN_FC_STYPE_ACTION,
2020                 WLAN_FC_STYPE_PROBE_REQ,
2021 /* Beacon doesn't work as mac80211 doesn't currently allow
2022  * it, but it wouldn't really be the right thing anyway as
2023  * it isn't per interface ... maybe just dump the scan
2024  * results periodically for OLBC?
2025  */
2026                 /* WLAN_FC_STYPE_BEACON, */
2027         };
2028         unsigned int i;
2029
2030         if (nl80211_alloc_mgmt_handle(bss))
2031                 return -1;
2032         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2033                    "handle %p", bss->nl_mgmt);
2034
2035         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
2036                 if (nl80211_register_frame(bss, bss->nl_mgmt,
2037                                            (WLAN_FC_TYPE_MGMT << 2) |
2038                                            (stypes[i] << 4),
2039                                            NULL, 0) < 0) {
2040                         goto out_err;
2041                 }
2042         }
2043
2044         if (nl80211_register_spurious_class3(bss))
2045                 goto out_err;
2046
2047         if (nl80211_get_wiphy_data_ap(bss) == NULL)
2048                 goto out_err;
2049
2050         nl80211_mgmt_handle_register_eloop(bss);
2051         return 0;
2052
2053 out_err:
2054         nl_destroy_handles(&bss->nl_mgmt);
2055         return -1;
2056 }
2057
2058
2059 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
2060 {
2061         if (nl80211_alloc_mgmt_handle(bss))
2062                 return -1;
2063         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2064                    "handle %p (device SME)", bss->nl_mgmt);
2065
2066         if (nl80211_register_frame(bss, bss->nl_mgmt,
2067                                    (WLAN_FC_TYPE_MGMT << 2) |
2068                                    (WLAN_FC_STYPE_ACTION << 4),
2069                                    NULL, 0) < 0)
2070                 goto out_err;
2071
2072         nl80211_mgmt_handle_register_eloop(bss);
2073         return 0;
2074
2075 out_err:
2076         nl_destroy_handles(&bss->nl_mgmt);
2077         return -1;
2078 }
2079
2080
2081 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
2082 {
2083         if (bss->nl_mgmt == NULL)
2084                 return;
2085         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
2086                    "(%s)", bss->nl_mgmt, reason);
2087         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
2088
2089         nl80211_put_wiphy_data_ap(bss);
2090 }
2091
2092
2093 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
2094 {
2095         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
2096 }
2097
2098
2099 static void nl80211_del_p2pdev(struct i802_bss *bss)
2100 {
2101         struct wpa_driver_nl80211_data *drv = bss->drv;
2102         struct nl_msg *msg;
2103         int ret;
2104
2105         msg = nlmsg_alloc();
2106         if (!msg)
2107                 return;
2108
2109         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
2110         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
2111
2112         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2113         msg = NULL;
2114
2115         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
2116                    bss->ifname, (long long unsigned int) bss->wdev_id,
2117                    strerror(-ret));
2118
2119 nla_put_failure:
2120         nlmsg_free(msg);
2121 }
2122
2123
2124 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
2125 {
2126         struct wpa_driver_nl80211_data *drv = bss->drv;
2127         struct nl_msg *msg;
2128         int ret = -1;
2129
2130         msg = nlmsg_alloc();
2131         if (!msg)
2132                 return -1;
2133
2134         if (start)
2135                 nl80211_cmd(drv, msg, 0, NL80211_CMD_START_P2P_DEVICE);
2136         else
2137                 nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_P2P_DEVICE);
2138
2139         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
2140
2141         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2142         msg = NULL;
2143
2144         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
2145                    start ? "Start" : "Stop",
2146                    bss->ifname, (long long unsigned int) bss->wdev_id,
2147                    strerror(-ret));
2148
2149 nla_put_failure:
2150         nlmsg_free(msg);
2151         return ret;
2152 }
2153
2154
2155 static int i802_set_iface_flags(struct i802_bss *bss, int up)
2156 {
2157         enum nl80211_iftype nlmode;
2158
2159         nlmode = nl80211_get_ifmode(bss);
2160         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2161                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
2162                                              bss->ifname, up);
2163         }
2164
2165         /* P2P Device has start/stop which is equivalent */
2166         return nl80211_set_p2pdev(bss, up);
2167 }
2168
2169
2170 static int
2171 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
2172                                    const u8 *set_addr, int first)
2173 {
2174         struct i802_bss *bss = drv->first_bss;
2175         int send_rfkill_event = 0;
2176         enum nl80211_iftype nlmode;
2177
2178         drv->ifindex = if_nametoindex(bss->ifname);
2179         bss->ifindex = drv->ifindex;
2180         bss->wdev_id = drv->global->if_add_wdevid;
2181         bss->wdev_id_set = drv->global->if_add_wdevid_set;
2182
2183         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
2184         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
2185         drv->global->if_add_wdevid_set = 0;
2186
2187         if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2188                 bss->static_ap = 1;
2189
2190         if (wpa_driver_nl80211_capa(drv))
2191                 return -1;
2192
2193         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2194                    bss->ifname, drv->phyname);
2195
2196         if (set_addr &&
2197             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
2198              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2199                                 set_addr)))
2200                 return -1;
2201
2202         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2203                 drv->start_mode_ap = 1;
2204
2205         if (drv->hostapd || bss->static_ap)
2206                 nlmode = NL80211_IFTYPE_AP;
2207         else if (bss->if_dynamic)
2208                 nlmode = nl80211_get_ifmode(bss);
2209         else
2210                 nlmode = NL80211_IFTYPE_STATION;
2211
2212         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
2213                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
2214                 return -1;
2215         }
2216
2217         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2218                 nl80211_get_macaddr(bss);
2219
2220         if (!rfkill_is_blocked(drv->rfkill)) {
2221                 int ret = i802_set_iface_flags(bss, 1);
2222                 if (ret) {
2223                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
2224                                    "interface '%s' UP", bss->ifname);
2225                         return ret;
2226                 }
2227                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2228                         return ret;
2229         } else {
2230                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
2231                            "interface '%s' due to rfkill", bss->ifname);
2232                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2233                         return 0;
2234                 drv->if_disabled = 1;
2235                 send_rfkill_event = 1;
2236         }
2237
2238         if (!drv->hostapd)
2239                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
2240                                        1, IF_OPER_DORMANT);
2241
2242         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2243                                bss->addr))
2244                 return -1;
2245         os_memcpy(drv->perm_addr, bss->addr, ETH_ALEN);
2246
2247         if (send_rfkill_event) {
2248                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
2249                                        drv, drv->ctx);
2250         }
2251
2252         return 0;
2253 }
2254
2255
2256 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
2257 {
2258         struct nl_msg *msg;
2259
2260         msg = nlmsg_alloc();
2261         if (!msg)
2262                 return -ENOMEM;
2263
2264         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
2265                    drv->ifindex);
2266         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
2267         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2268
2269         return send_and_recv_msgs(drv, msg, NULL, NULL);
2270  nla_put_failure:
2271         nlmsg_free(msg);
2272         return -ENOBUFS;
2273 }
2274
2275
2276 /**
2277  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
2278  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
2279  *
2280  * Shut down driver interface and processing of driver events. Free
2281  * private data buffer if one was allocated in wpa_driver_nl80211_init().
2282  */
2283 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
2284 {
2285         struct wpa_driver_nl80211_data *drv = bss->drv;
2286
2287         bss->in_deinit = 1;
2288         if (drv->data_tx_status)
2289                 eloop_unregister_read_sock(drv->eapol_tx_sock);
2290         if (drv->eapol_tx_sock >= 0)
2291                 close(drv->eapol_tx_sock);
2292
2293         if (bss->nl_preq)
2294                 wpa_driver_nl80211_probe_req_report(bss, 0);
2295         if (bss->added_if_into_bridge) {
2296                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
2297                                     bss->ifname) < 0)
2298                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2299                                    "interface %s from bridge %s: %s",
2300                                    bss->ifname, bss->brname, strerror(errno));
2301                 if (drv->rtnl_sk)
2302                         nl80211_handle_destroy(drv->rtnl_sk);
2303         }
2304         if (bss->added_bridge) {
2305                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
2306                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2307                                    "bridge %s: %s",
2308                                    bss->brname, strerror(errno));
2309         }
2310
2311         nl80211_remove_monitor_interface(drv);
2312
2313         if (is_ap_interface(drv->nlmode))
2314                 wpa_driver_nl80211_del_beacon(drv);
2315
2316         if (drv->eapol_sock >= 0) {
2317                 eloop_unregister_read_sock(drv->eapol_sock);
2318                 close(drv->eapol_sock);
2319         }
2320
2321         if (drv->if_indices != drv->default_if_indices)
2322                 os_free(drv->if_indices);
2323
2324         if (drv->disabled_11b_rates)
2325                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2326
2327         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
2328                                IF_OPER_UP);
2329         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
2330         rfkill_deinit(drv->rfkill);
2331
2332         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2333
2334         if (!drv->start_iface_up)
2335                 (void) i802_set_iface_flags(bss, 0);
2336
2337         if (drv->addr_changed) {
2338                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
2339                                           0) < 0) {
2340                         wpa_printf(MSG_DEBUG,
2341                                    "nl80211: Could not set interface down to restore permanent MAC address");
2342                 }
2343                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2344                                        drv->perm_addr) < 0) {
2345                         wpa_printf(MSG_DEBUG,
2346                                    "nl80211: Could not restore permanent MAC address");
2347                 }
2348         }
2349
2350         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2351                 if (!drv->hostapd || !drv->start_mode_ap)
2352                         wpa_driver_nl80211_set_mode(bss,
2353                                                     NL80211_IFTYPE_STATION);
2354                 nl80211_mgmt_unsubscribe(bss, "deinit");
2355         } else {
2356                 nl80211_mgmt_unsubscribe(bss, "deinit");
2357                 nl80211_del_p2pdev(bss);
2358         }
2359         nl_cb_put(drv->nl_cb);
2360
2361         nl80211_destroy_bss(drv->first_bss);
2362
2363         os_free(drv->filter_ssids);
2364
2365         os_free(drv->auth_ie);
2366
2367         if (drv->in_interface_list)
2368                 dl_list_del(&drv->list);
2369
2370         os_free(drv->extended_capa);
2371         os_free(drv->extended_capa_mask);
2372         os_free(drv->first_bss);
2373         os_free(drv);
2374 }
2375
2376
2377 /**
2378  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
2379  * @eloop_ctx: Driver private data
2380  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
2381  *
2382  * This function can be used as registered timeout when starting a scan to
2383  * generate a scan completed event if the driver does not report this.
2384  */
2385 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
2386 {
2387         struct wpa_driver_nl80211_data *drv = eloop_ctx;
2388         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
2389                 wpa_driver_nl80211_set_mode(drv->first_bss,
2390                                             drv->ap_scan_as_station);
2391                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2392         }
2393         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
2394         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
2395 }
2396
2397
2398 static struct nl_msg *
2399 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
2400                     struct wpa_driver_scan_params *params, u64 *wdev_id)
2401 {
2402         struct nl_msg *msg;
2403         size_t i;
2404         u32 scan_flags = 0;
2405
2406         msg = nlmsg_alloc();
2407         if (!msg)
2408                 return NULL;
2409
2410         nl80211_cmd(drv, msg, 0, cmd);
2411
2412         if (!wdev_id)
2413                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2414         else
2415                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, *wdev_id);
2416
2417         if (params->num_ssids) {
2418                 struct nlattr *ssids;
2419
2420                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
2421                 if (ssids == NULL)
2422                         goto fail;
2423                 for (i = 0; i < params->num_ssids; i++) {
2424                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
2425                                           params->ssids[i].ssid,
2426                                           params->ssids[i].ssid_len);
2427                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
2428                                     params->ssids[i].ssid) < 0)
2429                                 goto fail;
2430                 }
2431                 nla_nest_end(msg, ssids);
2432         }
2433
2434         if (params->extra_ies) {
2435                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
2436                             params->extra_ies, params->extra_ies_len);
2437                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
2438                             params->extra_ies) < 0)
2439                         goto fail;
2440         }
2441
2442         if (params->freqs) {
2443                 struct nlattr *freqs;
2444                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
2445                 if (freqs == NULL)
2446                         goto fail;
2447                 for (i = 0; params->freqs[i]; i++) {
2448                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
2449                                    "MHz", params->freqs[i]);
2450                         if (nla_put_u32(msg, i + 1, params->freqs[i]) < 0)
2451                                 goto fail;
2452                 }
2453                 nla_nest_end(msg, freqs);
2454         }
2455
2456         os_free(drv->filter_ssids);
2457         drv->filter_ssids = params->filter_ssids;
2458         params->filter_ssids = NULL;
2459         drv->num_filter_ssids = params->num_filter_ssids;
2460
2461         if (params->only_new_results) {
2462                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
2463                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
2464         }
2465
2466         if (params->low_priority && drv->have_low_prio_scan) {
2467                 wpa_printf(MSG_DEBUG,
2468                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
2469                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
2470         }
2471
2472         if (scan_flags)
2473                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags);
2474
2475         return msg;
2476
2477 fail:
2478 nla_put_failure:
2479         nlmsg_free(msg);
2480         return NULL;
2481 }
2482
2483
2484 /**
2485  * wpa_driver_nl80211_scan - Request the driver to initiate scan
2486  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
2487  * @params: Scan parameters
2488  * Returns: 0 on success, -1 on failure
2489  */
2490 static int wpa_driver_nl80211_scan(struct i802_bss *bss,
2491                                    struct wpa_driver_scan_params *params)
2492 {
2493         struct wpa_driver_nl80211_data *drv = bss->drv;
2494         int ret = -1, timeout;
2495         struct nl_msg *msg = NULL;
2496
2497         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
2498         drv->scan_for_auth = 0;
2499
2500         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params,
2501                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
2502         if (!msg)
2503                 return -1;
2504
2505         if (params->p2p_probe) {
2506                 struct nlattr *rates;
2507
2508                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
2509
2510                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
2511                 if (rates == NULL)
2512                         goto nla_put_failure;
2513
2514                 /*
2515                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
2516                  * by masking out everything else apart from the OFDM rates 6,
2517                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
2518                  * rates are left enabled.
2519                  */
2520                 NLA_PUT(msg, NL80211_BAND_2GHZ, 8,
2521                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
2522                 nla_nest_end(msg, rates);
2523
2524                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
2525         }
2526
2527         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2528         msg = NULL;
2529         if (ret) {
2530                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
2531                            "(%s)", ret, strerror(-ret));
2532                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
2533                         enum nl80211_iftype old_mode = drv->nlmode;
2534
2535                         /*
2536                          * mac80211 does not allow scan requests in AP mode, so
2537                          * try to do this in station mode.
2538                          */
2539                         if (wpa_driver_nl80211_set_mode(
2540                                     bss, NL80211_IFTYPE_STATION))
2541                                 goto nla_put_failure;
2542
2543                         if (wpa_driver_nl80211_scan(bss, params)) {
2544                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
2545                                 goto nla_put_failure;
2546                         }
2547
2548                         /* Restore AP mode when processing scan results */
2549                         drv->ap_scan_as_station = old_mode;
2550                         ret = 0;
2551                 } else
2552                         goto nla_put_failure;
2553         }
2554
2555         drv->scan_state = SCAN_REQUESTED;
2556         /* Not all drivers generate "scan completed" wireless event, so try to
2557          * read results after a timeout. */
2558         timeout = 10;
2559         if (drv->scan_complete_events) {
2560                 /*
2561                  * The driver seems to deliver events to notify when scan is
2562                  * complete, so use longer timeout to avoid race conditions
2563                  * with scanning and following association request.
2564                  */
2565                 timeout = 30;
2566         }
2567         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
2568                    "seconds", ret, timeout);
2569         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2570         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
2571                                drv, drv->ctx);
2572
2573 nla_put_failure:
2574         nlmsg_free(msg);
2575         return ret;
2576 }
2577
2578
2579 /**
2580  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
2581  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
2582  * @params: Scan parameters
2583  * @interval: Interval between scan cycles in milliseconds
2584  * Returns: 0 on success, -1 on failure or if not supported
2585  */
2586 static int wpa_driver_nl80211_sched_scan(void *priv,
2587                                          struct wpa_driver_scan_params *params,
2588                                          u32 interval)
2589 {
2590         struct i802_bss *bss = priv;
2591         struct wpa_driver_nl80211_data *drv = bss->drv;
2592         int ret = -1;
2593         struct nl_msg *msg;
2594         size_t i;
2595
2596         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
2597
2598 #ifdef ANDROID
2599         if (!drv->capa.sched_scan_supported)
2600                 return android_pno_start(bss, params);
2601 #endif /* ANDROID */
2602
2603         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params,
2604                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
2605         if (!msg)
2606                 goto nla_put_failure;
2607
2608         NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
2609
2610         if ((drv->num_filter_ssids &&
2611             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
2612             params->filter_rssi) {
2613                 struct nlattr *match_sets;
2614                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
2615                 if (match_sets == NULL)
2616                         goto nla_put_failure;
2617
2618                 for (i = 0; i < drv->num_filter_ssids; i++) {
2619                         struct nlattr *match_set_ssid;
2620                         wpa_hexdump_ascii(MSG_MSGDUMP,
2621                                           "nl80211: Sched scan filter SSID",
2622                                           drv->filter_ssids[i].ssid,
2623                                           drv->filter_ssids[i].ssid_len);
2624
2625                         match_set_ssid = nla_nest_start(msg, i + 1);
2626                         if (match_set_ssid == NULL)
2627                                 goto nla_put_failure;
2628                         NLA_PUT(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
2629                                 drv->filter_ssids[i].ssid_len,
2630                                 drv->filter_ssids[i].ssid);
2631                         if (params->filter_rssi)
2632                                 NLA_PUT_U32(msg,
2633                                             NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
2634                                             params->filter_rssi);
2635
2636                         nla_nest_end(msg, match_set_ssid);
2637                 }
2638
2639                 /*
2640                  * Due to backward compatibility code, newer kernels treat this
2641                  * matchset (with only an RSSI filter) as the default for all
2642                  * other matchsets, unless it's the only one, in which case the
2643                  * matchset will actually allow all SSIDs above the RSSI.
2644                  */
2645                 if (params->filter_rssi) {
2646                         struct nlattr *match_set_rssi;
2647                         match_set_rssi = nla_nest_start(msg, 0);
2648                         if (match_set_rssi == NULL)
2649                                 goto nla_put_failure;
2650                         NLA_PUT_U32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
2651                                     params->filter_rssi);
2652                         wpa_printf(MSG_MSGDUMP,
2653                                    "nl80211: Sched scan RSSI filter %d dBm",
2654                                    params->filter_rssi);
2655                         nla_nest_end(msg, match_set_rssi);
2656                 }
2657
2658                 nla_nest_end(msg, match_sets);
2659         }
2660
2661         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2662
2663         /* TODO: if we get an error here, we should fall back to normal scan */
2664
2665         msg = NULL;
2666         if (ret) {
2667                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
2668                            "ret=%d (%s)", ret, strerror(-ret));
2669                 goto nla_put_failure;
2670         }
2671
2672         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
2673                    "scan interval %d msec", ret, interval);
2674
2675 nla_put_failure:
2676         nlmsg_free(msg);
2677         return ret;
2678 }
2679
2680
2681 /**
2682  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
2683  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
2684  * Returns: 0 on success, -1 on failure or if not supported
2685  */
2686 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
2687 {
2688         struct i802_bss *bss = priv;
2689         struct wpa_driver_nl80211_data *drv = bss->drv;
2690         int ret = 0;
2691         struct nl_msg *msg;
2692
2693 #ifdef ANDROID
2694         if (!drv->capa.sched_scan_supported)
2695                 return android_pno_stop(bss);
2696 #endif /* ANDROID */
2697
2698         msg = nlmsg_alloc();
2699         if (!msg)
2700                 return -1;
2701
2702         nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
2703
2704         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2705
2706         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2707         msg = NULL;
2708         if (ret) {
2709                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
2710                            "ret=%d (%s)", ret, strerror(-ret));
2711                 goto nla_put_failure;
2712         }
2713
2714         wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
2715
2716 nla_put_failure:
2717         nlmsg_free(msg);
2718         return ret;
2719 }
2720
2721
2722 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
2723 {
2724         const u8 *end, *pos;
2725
2726         if (ies == NULL)
2727                 return NULL;
2728
2729         pos = ies;
2730         end = ies + ies_len;
2731
2732         while (pos + 1 < end) {
2733                 if (pos + 2 + pos[1] > end)
2734                         break;
2735                 if (pos[0] == ie)
2736                         return pos;
2737                 pos += 2 + pos[1];
2738         }
2739
2740         return NULL;
2741 }
2742
2743
2744 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
2745                                  const u8 *ie, size_t ie_len)
2746 {
2747         const u8 *ssid;
2748         size_t i;
2749
2750         if (drv->filter_ssids == NULL)
2751                 return 0;
2752
2753         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
2754         if (ssid == NULL)
2755                 return 1;
2756
2757         for (i = 0; i < drv->num_filter_ssids; i++) {
2758                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
2759                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
2760                     0)
2761                         return 0;
2762         }
2763
2764         return 1;
2765 }
2766
2767
2768 static int bss_info_handler(struct nl_msg *msg, void *arg)
2769 {
2770         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2771         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2772         struct nlattr *bss[NL80211_BSS_MAX + 1];
2773         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
2774                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
2775                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
2776                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
2777                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
2778                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
2779                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
2780                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
2781                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
2782                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
2783                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
2784                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
2785         };
2786         struct nl80211_bss_info_arg *_arg = arg;
2787         struct wpa_scan_results *res = _arg->res;
2788         struct wpa_scan_res **tmp;
2789         struct wpa_scan_res *r;
2790         const u8 *ie, *beacon_ie;
2791         size_t ie_len, beacon_ie_len;
2792         u8 *pos;
2793         size_t i;
2794
2795         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2796                   genlmsg_attrlen(gnlh, 0), NULL);
2797         if (!tb[NL80211_ATTR_BSS])
2798                 return NL_SKIP;
2799         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
2800                              bss_policy))
2801                 return NL_SKIP;
2802         if (bss[NL80211_BSS_STATUS]) {
2803                 enum nl80211_bss_status status;
2804                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
2805                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
2806                     bss[NL80211_BSS_FREQUENCY]) {
2807                         _arg->assoc_freq =
2808                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2809                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
2810                                    _arg->assoc_freq);
2811                 }
2812                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
2813                     bss[NL80211_BSS_FREQUENCY]) {
2814                         _arg->ibss_freq =
2815                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2816                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
2817                                    _arg->ibss_freq);
2818                 }
2819                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
2820                     bss[NL80211_BSS_BSSID]) {
2821                         os_memcpy(_arg->assoc_bssid,
2822                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
2823                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
2824                                    MACSTR, MAC2STR(_arg->assoc_bssid));
2825                 }
2826         }
2827         if (!res)
2828                 return NL_SKIP;
2829         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
2830                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
2831                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
2832         } else {
2833                 ie = NULL;
2834                 ie_len = 0;
2835         }
2836         if (bss[NL80211_BSS_BEACON_IES]) {
2837                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
2838                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
2839         } else {
2840                 beacon_ie = NULL;
2841                 beacon_ie_len = 0;
2842         }
2843
2844         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
2845                                   ie ? ie_len : beacon_ie_len))
2846                 return NL_SKIP;
2847
2848         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
2849         if (r == NULL)
2850                 return NL_SKIP;
2851         if (bss[NL80211_BSS_BSSID])
2852                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
2853                           ETH_ALEN);
2854         if (bss[NL80211_BSS_FREQUENCY])
2855                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2856         if (bss[NL80211_BSS_BEACON_INTERVAL])
2857                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
2858         if (bss[NL80211_BSS_CAPABILITY])
2859                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
2860         r->flags |= WPA_SCAN_NOISE_INVALID;
2861         if (bss[NL80211_BSS_SIGNAL_MBM]) {
2862                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
2863                 r->level /= 100; /* mBm to dBm */
2864                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
2865         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
2866                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
2867                 r->flags |= WPA_SCAN_QUAL_INVALID;
2868         } else
2869                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
2870         if (bss[NL80211_BSS_TSF])
2871                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
2872         if (bss[NL80211_BSS_SEEN_MS_AGO])
2873                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
2874         r->ie_len = ie_len;
2875         pos = (u8 *) (r + 1);
2876         if (ie) {
2877                 os_memcpy(pos, ie, ie_len);
2878                 pos += ie_len;
2879         }
2880         r->beacon_ie_len = beacon_ie_len;
2881         if (beacon_ie)
2882                 os_memcpy(pos, beacon_ie, beacon_ie_len);
2883
2884         if (bss[NL80211_BSS_STATUS]) {
2885                 enum nl80211_bss_status status;
2886                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
2887                 switch (status) {
2888                 case NL80211_BSS_STATUS_AUTHENTICATED:
2889                         r->flags |= WPA_SCAN_AUTHENTICATED;
2890                         break;
2891                 case NL80211_BSS_STATUS_ASSOCIATED:
2892                         r->flags |= WPA_SCAN_ASSOCIATED;
2893                         break;
2894                 default:
2895                         break;
2896                 }
2897         }
2898
2899         /*
2900          * cfg80211 maintains separate BSS table entries for APs if the same
2901          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
2902          * not use frequency as a separate key in the BSS table, so filter out
2903          * duplicated entries. Prefer associated BSS entry in such a case in
2904          * order to get the correct frequency into the BSS table. Similarly,
2905          * prefer newer entries over older.
2906          */
2907         for (i = 0; i < res->num; i++) {
2908                 const u8 *s1, *s2;
2909                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
2910                         continue;
2911
2912                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
2913                                     res->res[i]->ie_len, WLAN_EID_SSID);
2914                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
2915                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
2916                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
2917                         continue;
2918
2919                 /* Same BSSID,SSID was already included in scan results */
2920                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
2921                            "for " MACSTR, MAC2STR(r->bssid));
2922
2923                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
2924                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
2925                     r->age < res->res[i]->age) {
2926                         os_free(res->res[i]);
2927                         res->res[i] = r;
2928                 } else
2929                         os_free(r);
2930                 return NL_SKIP;
2931         }
2932
2933         tmp = os_realloc_array(res->res, res->num + 1,
2934                                sizeof(struct wpa_scan_res *));
2935         if (tmp == NULL) {
2936                 os_free(r);
2937                 return NL_SKIP;
2938         }
2939         tmp[res->num++] = r;
2940         res->res = tmp;
2941
2942         return NL_SKIP;
2943 }
2944
2945
2946 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
2947                                  const u8 *addr)
2948 {
2949         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
2950                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
2951                            "mismatch (" MACSTR ")", MAC2STR(addr));
2952                 wpa_driver_nl80211_mlme(drv, addr,
2953                                         NL80211_CMD_DEAUTHENTICATE,
2954                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
2955         }
2956 }
2957
2958
2959 static void wpa_driver_nl80211_check_bss_status(
2960         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
2961 {
2962         size_t i;
2963
2964         for (i = 0; i < res->num; i++) {
2965                 struct wpa_scan_res *r = res->res[i];
2966                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
2967                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
2968                                    "indicates BSS status with " MACSTR
2969                                    " as authenticated",
2970                                    MAC2STR(r->bssid));
2971                         if (is_sta_interface(drv->nlmode) &&
2972                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
2973                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
2974                             0) {
2975                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
2976                                            " in local state (auth=" MACSTR
2977                                            " assoc=" MACSTR ")",
2978                                            MAC2STR(drv->auth_bssid),
2979                                            MAC2STR(drv->bssid));
2980                                 clear_state_mismatch(drv, r->bssid);
2981                         }
2982                 }
2983
2984                 if (r->flags & WPA_SCAN_ASSOCIATED) {
2985                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
2986                                    "indicate BSS status with " MACSTR
2987                                    " as associated",
2988                                    MAC2STR(r->bssid));
2989                         if (is_sta_interface(drv->nlmode) &&
2990                             !drv->associated) {
2991                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
2992                                            "(not associated) does not match "
2993                                            "with BSS state");
2994                                 clear_state_mismatch(drv, r->bssid);
2995                         } else if (is_sta_interface(drv->nlmode) &&
2996                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
2997                                    0) {
2998                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
2999                                            "(associated with " MACSTR ") does "
3000                                            "not match with BSS state",
3001                                            MAC2STR(drv->bssid));
3002                                 clear_state_mismatch(drv, r->bssid);
3003                                 clear_state_mismatch(drv, drv->bssid);
3004                         }
3005                 }
3006         }
3007 }
3008
3009
3010 static struct wpa_scan_results *
3011 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
3012 {
3013         struct nl_msg *msg;
3014         struct wpa_scan_results *res;
3015         int ret;
3016         struct nl80211_bss_info_arg arg;
3017
3018         res = os_zalloc(sizeof(*res));
3019         if (res == NULL)
3020                 return NULL;
3021         msg = nlmsg_alloc();
3022         if (!msg)
3023                 goto nla_put_failure;
3024
3025         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
3026         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
3027                 goto nla_put_failure;
3028
3029         arg.drv = drv;
3030         arg.res = res;
3031         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
3032         msg = NULL;
3033         if (ret == 0) {
3034                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
3035                            "BSSes)", (unsigned long) res->num);
3036                 nl80211_get_noise_for_scan_results(drv, res);
3037                 return res;
3038         }
3039         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
3040                    "(%s)", ret, strerror(-ret));
3041 nla_put_failure:
3042         nlmsg_free(msg);
3043         wpa_scan_results_free(res);
3044         return NULL;
3045 }
3046
3047
3048 /**
3049  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
3050  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
3051  * Returns: Scan results on success, -1 on failure
3052  */
3053 static struct wpa_scan_results *
3054 wpa_driver_nl80211_get_scan_results(void *priv)
3055 {
3056         struct i802_bss *bss = priv;
3057         struct wpa_driver_nl80211_data *drv = bss->drv;
3058         struct wpa_scan_results *res;
3059
3060         res = nl80211_get_scan_results(drv);
3061         if (res)
3062                 wpa_driver_nl80211_check_bss_status(drv, res);
3063         return res;
3064 }
3065
3066
3067 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
3068 {
3069         struct wpa_scan_results *res;
3070         size_t i;
3071
3072         res = nl80211_get_scan_results(drv);
3073         if (res == NULL) {
3074                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
3075                 return;
3076         }
3077
3078         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
3079         for (i = 0; i < res->num; i++) {
3080                 struct wpa_scan_res *r = res->res[i];
3081                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
3082                            (int) i, (int) res->num, MAC2STR(r->bssid),
3083                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
3084                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
3085         }
3086
3087         wpa_scan_results_free(res);
3088 }
3089
3090
3091 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
3092 {
3093         switch (alg) {
3094         case WPA_ALG_WEP:
3095                 if (key_len == 5)
3096                         return WLAN_CIPHER_SUITE_WEP40;
3097                 return WLAN_CIPHER_SUITE_WEP104;
3098         case WPA_ALG_TKIP:
3099                 return WLAN_CIPHER_SUITE_TKIP;
3100         case WPA_ALG_CCMP:
3101                 return WLAN_CIPHER_SUITE_CCMP;
3102         case WPA_ALG_GCMP:
3103                 return WLAN_CIPHER_SUITE_GCMP;
3104         case WPA_ALG_CCMP_256:
3105                 return WLAN_CIPHER_SUITE_CCMP_256;
3106         case WPA_ALG_GCMP_256:
3107                 return WLAN_CIPHER_SUITE_GCMP_256;
3108         case WPA_ALG_IGTK:
3109                 return WLAN_CIPHER_SUITE_AES_CMAC;
3110         case WPA_ALG_BIP_GMAC_128:
3111                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
3112         case WPA_ALG_BIP_GMAC_256:
3113                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
3114         case WPA_ALG_BIP_CMAC_256:
3115                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
3116         case WPA_ALG_SMS4:
3117                 return WLAN_CIPHER_SUITE_SMS4;
3118         case WPA_ALG_KRK:
3119                 return WLAN_CIPHER_SUITE_KRK;
3120         case WPA_ALG_NONE:
3121         case WPA_ALG_PMK:
3122                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
3123                            alg);
3124                 return 0;
3125         }
3126
3127         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
3128                    alg);
3129         return 0;
3130 }
3131
3132
3133 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
3134 {
3135         switch (cipher) {
3136         case WPA_CIPHER_CCMP_256:
3137                 return WLAN_CIPHER_SUITE_CCMP_256;
3138         case WPA_CIPHER_GCMP_256:
3139                 return WLAN_CIPHER_SUITE_GCMP_256;
3140         case WPA_CIPHER_CCMP:
3141                 return WLAN_CIPHER_SUITE_CCMP;
3142         case WPA_CIPHER_GCMP:
3143                 return WLAN_CIPHER_SUITE_GCMP;
3144         case WPA_CIPHER_TKIP:
3145                 return WLAN_CIPHER_SUITE_TKIP;
3146         case WPA_CIPHER_WEP104:
3147                 return WLAN_CIPHER_SUITE_WEP104;
3148         case WPA_CIPHER_WEP40:
3149                 return WLAN_CIPHER_SUITE_WEP40;
3150         case WPA_CIPHER_GTK_NOT_USED:
3151                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
3152         }
3153
3154         return 0;
3155 }
3156
3157
3158 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
3159                                        int max_suites)
3160 {
3161         int num_suites = 0;
3162
3163         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
3164                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
3165         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
3166                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
3167         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
3168                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
3169         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
3170                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
3171         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
3172                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
3173         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
3174                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
3175         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
3176                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
3177
3178         return num_suites;
3179 }
3180
3181
3182 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
3183                                   const u8 *key, size_t key_len)
3184 {
3185         struct nl_msg *msg;
3186         int ret = 0;
3187
3188         if (!drv->key_mgmt_set_key_vendor_cmd_avail)
3189                 return 0;
3190
3191         msg = nlmsg_alloc();
3192         if (!msg)
3193                 return -1;
3194
3195         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
3196         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3197         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA);
3198         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD,
3199                     QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_SET_KEY);
3200         NLA_PUT(msg, NL80211_ATTR_VENDOR_DATA, key_len, key);
3201         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3202         msg = NULL;
3203         if (ret) {
3204                 wpa_printf(MSG_DEBUG,
3205                            "nl80211: Key management set key failed: ret=%d (%s)",
3206                            ret, strerror(-ret));
3207         }
3208
3209 nla_put_failure:
3210         nlmsg_free(msg);
3211         return ret;
3212 }
3213
3214
3215 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
3216                                       enum wpa_alg alg, const u8 *addr,
3217                                       int key_idx, int set_tx,
3218                                       const u8 *seq, size_t seq_len,
3219                                       const u8 *key, size_t key_len)
3220 {
3221         struct wpa_driver_nl80211_data *drv = bss->drv;
3222         int ifindex;
3223         struct nl_msg *msg;
3224         int ret;
3225         int tdls = 0;
3226
3227         /* Ignore for P2P Device */
3228         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
3229                 return 0;
3230
3231         ifindex = if_nametoindex(ifname);
3232         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
3233                    "set_tx=%d seq_len=%lu key_len=%lu",
3234                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
3235                    (unsigned long) seq_len, (unsigned long) key_len);
3236 #ifdef CONFIG_TDLS
3237         if (key_idx == -1) {
3238                 key_idx = 0;
3239                 tdls = 1;
3240         }
3241 #endif /* CONFIG_TDLS */
3242
3243         if (alg == WPA_ALG_PMK && drv->key_mgmt_set_key_vendor_cmd_avail) {
3244                 wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
3245                            __func__);
3246                 ret = issue_key_mgmt_set_key(drv, key, key_len);
3247                 return ret;
3248         }
3249
3250         msg = nlmsg_alloc();
3251         if (!msg)
3252                 return -ENOMEM;
3253
3254         if (alg == WPA_ALG_NONE) {
3255                 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
3256         } else {
3257                 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
3258                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
3259                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
3260                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
3261                             wpa_alg_to_cipher_suite(alg, key_len));
3262         }
3263
3264         if (seq && seq_len) {
3265                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
3266                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
3267         }
3268
3269         if (addr && !is_broadcast_ether_addr(addr)) {
3270                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
3271                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3272
3273                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
3274                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
3275                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
3276                                     NL80211_KEYTYPE_GROUP);
3277                 }
3278         } else if (addr && is_broadcast_ether_addr(addr)) {
3279                 struct nlattr *types;
3280
3281                 wpa_printf(MSG_DEBUG, "   broadcast key");
3282
3283                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3284                 if (!types)
3285                         goto nla_put_failure;
3286                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
3287                 nla_nest_end(msg, types);
3288         }
3289         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
3290         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
3291
3292         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3293         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
3294                 ret = 0;
3295         if (ret)
3296                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
3297                            ret, strerror(-ret));
3298
3299         /*
3300          * If we failed or don't need to set the default TX key (below),
3301          * we're done here.
3302          */
3303         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
3304                 return ret;
3305         if (is_ap_interface(drv->nlmode) && addr &&
3306             !is_broadcast_ether_addr(addr))
3307                 return ret;
3308
3309         msg = nlmsg_alloc();
3310         if (!msg)
3311                 return -ENOMEM;
3312
3313         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
3314         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
3315         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
3316         if (alg == WPA_ALG_IGTK)
3317                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
3318         else
3319                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
3320         if (addr && is_broadcast_ether_addr(addr)) {
3321                 struct nlattr *types;
3322
3323                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3324                 if (!types)
3325                         goto nla_put_failure;
3326                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
3327                 nla_nest_end(msg, types);
3328         } else if (addr) {
3329                 struct nlattr *types;
3330
3331                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3332                 if (!types)
3333                         goto nla_put_failure;
3334                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST);
3335                 nla_nest_end(msg, types);
3336         }
3337
3338         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3339         if (ret == -ENOENT)
3340                 ret = 0;
3341         if (ret)
3342                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
3343                            "err=%d %s)", ret, strerror(-ret));
3344         return ret;
3345
3346 nla_put_failure:
3347         nlmsg_free(msg);
3348         return -ENOBUFS;
3349 }
3350
3351
3352 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
3353                       int key_idx, int defkey,
3354                       const u8 *seq, size_t seq_len,
3355                       const u8 *key, size_t key_len)
3356 {
3357         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
3358         if (!key_attr)
3359                 return -1;
3360
3361         if (defkey && alg == WPA_ALG_IGTK)
3362                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
3363         else if (defkey)
3364                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
3365
3366         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
3367
3368         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
3369                     wpa_alg_to_cipher_suite(alg, key_len));
3370
3371         if (seq && seq_len)
3372                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
3373
3374         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
3375
3376         nla_nest_end(msg, key_attr);
3377
3378         return 0;
3379  nla_put_failure:
3380         return -1;
3381 }
3382
3383
3384 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
3385                                  struct nl_msg *msg)
3386 {
3387         int i, privacy = 0;
3388         struct nlattr *nl_keys, *nl_key;
3389
3390         for (i = 0; i < 4; i++) {
3391                 if (!params->wep_key[i])
3392                         continue;
3393                 privacy = 1;
3394                 break;
3395         }
3396         if (params->wps == WPS_MODE_PRIVACY)
3397                 privacy = 1;
3398         if (params->pairwise_suite &&
3399             params->pairwise_suite != WPA_CIPHER_NONE)
3400                 privacy = 1;
3401
3402         if (!privacy)
3403                 return 0;
3404
3405         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
3406
3407         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
3408         if (!nl_keys)
3409                 goto nla_put_failure;
3410
3411         for (i = 0; i < 4; i++) {
3412                 if (!params->wep_key[i])
3413                         continue;
3414
3415                 nl_key = nla_nest_start(msg, i);
3416                 if (!nl_key)
3417                         goto nla_put_failure;
3418
3419                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
3420                         params->wep_key[i]);
3421                 if (params->wep_key_len[i] == 5)
3422                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
3423                                     WLAN_CIPHER_SUITE_WEP40);
3424                 else
3425                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
3426                                     WLAN_CIPHER_SUITE_WEP104);
3427
3428                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
3429
3430                 if (i == params->wep_tx_keyidx)
3431                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
3432
3433                 nla_nest_end(msg, nl_key);
3434         }
3435         nla_nest_end(msg, nl_keys);
3436
3437         return 0;
3438
3439 nla_put_failure:
3440         return -ENOBUFS;
3441 }
3442
3443
3444 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
3445                                    const u8 *addr, int cmd, u16 reason_code,
3446                                    int local_state_change)
3447 {
3448         int ret = -1;
3449         struct nl_msg *msg;
3450
3451         msg = nlmsg_alloc();
3452         if (!msg)
3453                 return -1;
3454
3455         nl80211_cmd(drv, msg, 0, cmd);
3456
3457         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3458         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
3459         if (addr)
3460                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3461         if (local_state_change)
3462                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
3463
3464         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3465         msg = NULL;
3466         if (ret) {
3467                 wpa_dbg(drv->ctx, MSG_DEBUG,
3468                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
3469                         reason_code, ret, strerror(-ret));
3470                 goto nla_put_failure;
3471         }
3472         ret = 0;
3473
3474 nla_put_failure:
3475         nlmsg_free(msg);
3476         return ret;
3477 }
3478
3479
3480 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
3481                                          int reason_code)
3482 {
3483         int ret;
3484
3485         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
3486         nl80211_mark_disconnected(drv);
3487         /* Disconnect command doesn't need BSSID - it uses cached value */
3488         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
3489                                       reason_code, 0);
3490         /*
3491          * For locally generated disconnect, supplicant already generates a
3492          * DEAUTH event, so ignore the event from NL80211.
3493          */
3494         drv->ignore_next_local_disconnect = ret == 0;
3495
3496         return ret;
3497 }
3498
3499
3500 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
3501                                              const u8 *addr, int reason_code)
3502 {
3503         struct wpa_driver_nl80211_data *drv = bss->drv;
3504         int ret;
3505
3506         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
3507                 nl80211_mark_disconnected(drv);
3508                 return nl80211_leave_ibss(drv);
3509         }
3510         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
3511                 return wpa_driver_nl80211_disconnect(drv, reason_code);
3512         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
3513                    __func__, MAC2STR(addr), reason_code);
3514         nl80211_mark_disconnected(drv);
3515         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
3516                                       reason_code, 0);
3517         /*
3518          * For locally generated deauthenticate, supplicant already generates a
3519          * DEAUTH event, so ignore the event from NL80211.
3520          */
3521         drv->ignore_next_local_deauth = ret == 0;
3522         return ret;
3523 }
3524
3525
3526 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
3527                                      struct wpa_driver_auth_params *params)
3528 {
3529         int i;
3530
3531         drv->auth_freq = params->freq;
3532         drv->auth_alg = params->auth_alg;
3533         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
3534         drv->auth_local_state_change = params->local_state_change;
3535         drv->auth_p2p = params->p2p;
3536
3537         if (params->bssid)
3538                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
3539         else
3540                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
3541
3542         if (params->ssid) {
3543                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
3544                 drv->auth_ssid_len = params->ssid_len;
3545         } else
3546                 drv->auth_ssid_len = 0;
3547
3548
3549         os_free(drv->auth_ie);
3550         drv->auth_ie = NULL;
3551         drv->auth_ie_len = 0;
3552         if (params->ie) {
3553                 drv->auth_ie = os_malloc(params->ie_len);
3554                 if (drv->auth_ie) {
3555                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
3556                         drv->auth_ie_len = params->ie_len;
3557                 }
3558         }
3559
3560         for (i = 0; i < 4; i++) {
3561                 if (params->wep_key[i] && params->wep_key_len[i] &&
3562                     params->wep_key_len[i] <= 16) {
3563                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
3564                                   params->wep_key_len[i]);
3565                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
3566                 } else
3567                         drv->auth_wep_key_len[i] = 0;
3568         }
3569 }
3570
3571
3572 static int wpa_driver_nl80211_authenticate(
3573         struct i802_bss *bss, struct wpa_driver_auth_params *params)
3574 {
3575         struct wpa_driver_nl80211_data *drv = bss->drv;
3576         int ret = -1, i;
3577         struct nl_msg *msg;
3578         enum nl80211_auth_type type;
3579         enum nl80211_iftype nlmode;
3580         int count = 0;
3581         int is_retry;
3582
3583         is_retry = drv->retry_auth;
3584         drv->retry_auth = 0;
3585         drv->ignore_deauth_event = 0;
3586
3587         nl80211_mark_disconnected(drv);
3588         os_memset(drv->auth_bssid, 0, ETH_ALEN);
3589         if (params->bssid)
3590                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
3591         else
3592                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
3593         /* FIX: IBSS mode */
3594         nlmode = params->p2p ?
3595                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
3596         if (drv->nlmode != nlmode &&
3597             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
3598                 return -1;
3599
3600 retry:
3601         msg = nlmsg_alloc();
3602         if (!msg)
3603                 return -1;
3604
3605         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
3606                    drv->ifindex);
3607
3608         nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
3609
3610         for (i = 0; i < 4; i++) {
3611                 if (!params->wep_key[i])
3612                         continue;
3613                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
3614                                            NULL, i,
3615                                            i == params->wep_tx_keyidx, NULL, 0,
3616                                            params->wep_key[i],
3617                                            params->wep_key_len[i]);
3618                 if (params->wep_tx_keyidx != i)
3619                         continue;
3620                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
3621                                params->wep_key[i], params->wep_key_len[i])) {
3622                         nlmsg_free(msg);
3623                         return -1;
3624                 }
3625         }
3626
3627         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3628         if (params->bssid) {
3629                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
3630                            MAC2STR(params->bssid));
3631                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
3632         }
3633         if (params->freq) {
3634                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
3635                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
3636         }
3637         if (params->ssid) {
3638                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
3639                                   params->ssid, params->ssid_len);
3640                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
3641                         params->ssid);
3642         }
3643         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
3644         if (params->ie)
3645                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
3646         if (params->sae_data) {
3647                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
3648                             params->sae_data_len);
3649                 NLA_PUT(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
3650                         params->sae_data);
3651         }
3652         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
3653                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3654         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
3655                 type = NL80211_AUTHTYPE_SHARED_KEY;
3656         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
3657                 type = NL80211_AUTHTYPE_NETWORK_EAP;
3658         else if (params->auth_alg & WPA_AUTH_ALG_FT)
3659                 type = NL80211_AUTHTYPE_FT;
3660         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
3661                 type = NL80211_AUTHTYPE_SAE;
3662         else
3663                 goto nla_put_failure;
3664         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
3665         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
3666         if (params->local_state_change) {
3667                 wpa_printf(MSG_DEBUG, "  * Local state change only");
3668                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
3669         }
3670
3671         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3672         msg = NULL;
3673         if (ret) {
3674                 wpa_dbg(drv->ctx, MSG_DEBUG,
3675                         "nl80211: MLME command failed (auth): ret=%d (%s)",
3676                         ret, strerror(-ret));
3677                 count++;
3678                 if (ret == -EALREADY && count == 1 && params->bssid &&
3679                     !params->local_state_change) {
3680                         /*
3681                          * mac80211 does not currently accept new
3682                          * authentication if we are already authenticated. As a
3683                          * workaround, force deauthentication and try again.
3684                          */
3685                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
3686                                    "after forced deauthentication");
3687                         drv->ignore_deauth_event = 1;
3688                         wpa_driver_nl80211_deauthenticate(
3689                                 bss, params->bssid,
3690                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
3691                         nlmsg_free(msg);
3692                         goto retry;
3693                 }
3694
3695                 if (ret == -ENOENT && params->freq && !is_retry) {
3696                         /*
3697                          * cfg80211 has likely expired the BSS entry even
3698                          * though it was previously available in our internal
3699                          * BSS table. To recover quickly, start a single
3700                          * channel scan on the specified channel.
3701                          */
3702                         struct wpa_driver_scan_params scan;
3703                         int freqs[2];
3704
3705                         os_memset(&scan, 0, sizeof(scan));
3706                         scan.num_ssids = 1;
3707                         if (params->ssid) {
3708                                 scan.ssids[0].ssid = params->ssid;
3709                                 scan.ssids[0].ssid_len = params->ssid_len;
3710                         }
3711                         freqs[0] = params->freq;
3712                         freqs[1] = 0;
3713                         scan.freqs = freqs;
3714                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
3715                                    "channel scan to refresh cfg80211 BSS "
3716                                    "entry");
3717                         ret = wpa_driver_nl80211_scan(bss, &scan);
3718                         if (ret == 0) {
3719                                 nl80211_copy_auth_params(drv, params);
3720                                 drv->scan_for_auth = 1;
3721                         }
3722                 } else if (is_retry) {
3723                         /*
3724                          * Need to indicate this with an event since the return
3725                          * value from the retry is not delivered to core code.
3726                          */
3727                         union wpa_event_data event;
3728                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
3729                                    "failed");
3730                         os_memset(&event, 0, sizeof(event));
3731                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
3732                                   ETH_ALEN);
3733                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
3734                                              &event);
3735                 }
3736
3737                 goto nla_put_failure;
3738         }
3739         ret = 0;
3740         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
3741                    "successfully");
3742
3743 nla_put_failure:
3744         nlmsg_free(msg);
3745         return ret;
3746 }
3747
3748
3749 int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
3750 {
3751         struct wpa_driver_auth_params params;
3752         struct i802_bss *bss = drv->first_bss;
3753         int i;
3754
3755         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
3756
3757         os_memset(&params, 0, sizeof(params));
3758         params.freq = drv->auth_freq;
3759         params.auth_alg = drv->auth_alg;
3760         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
3761         params.local_state_change = drv->auth_local_state_change;
3762         params.p2p = drv->auth_p2p;
3763
3764         if (!is_zero_ether_addr(drv->auth_bssid_))
3765                 params.bssid = drv->auth_bssid_;
3766
3767         if (drv->auth_ssid_len) {
3768                 params.ssid = drv->auth_ssid;
3769                 params.ssid_len = drv->auth_ssid_len;
3770         }
3771
3772         params.ie = drv->auth_ie;
3773         params.ie_len = drv->auth_ie_len;
3774
3775         for (i = 0; i < 4; i++) {
3776                 if (drv->auth_wep_key_len[i]) {
3777                         params.wep_key[i] = drv->auth_wep_key[i];
3778                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
3779                 }
3780         }
3781
3782         drv->retry_auth = 1;
3783         return wpa_driver_nl80211_authenticate(bss, &params);
3784 }
3785
3786
3787 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
3788                                          const void *data, size_t len,
3789                                          int encrypt, int noack,
3790                                          unsigned int freq, int no_cck,
3791                                          int offchanok, unsigned int wait_time)
3792 {
3793         struct wpa_driver_nl80211_data *drv = bss->drv;
3794         u64 cookie;
3795         int res;
3796
3797         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
3798                 freq = nl80211_get_assoc_freq(drv);
3799                 wpa_printf(MSG_DEBUG,
3800                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
3801                            freq);
3802         }
3803         if (freq == 0) {
3804                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
3805                            bss->freq);
3806                 freq = bss->freq;
3807         }
3808
3809         if (drv->use_monitor) {
3810                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
3811                            freq, bss->freq);
3812                 return nl80211_send_monitor(drv, data, len, encrypt, noack);
3813         }
3814
3815         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
3816         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
3817                                      &cookie, no_cck, noack, offchanok);
3818         if (res == 0 && !noack) {
3819                 const struct ieee80211_mgmt *mgmt;
3820                 u16 fc;
3821
3822                 mgmt = (const struct ieee80211_mgmt *) data;
3823                 fc = le_to_host16(mgmt->frame_control);
3824                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3825                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
3826                         wpa_printf(MSG_MSGDUMP,
3827                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
3828                                    (long long unsigned int)
3829                                    drv->send_action_cookie,
3830                                    (long long unsigned int) cookie);
3831                         drv->send_action_cookie = cookie;
3832                 }
3833         }
3834
3835         return res;
3836 }
3837
3838
3839 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
3840                                         size_t data_len, int noack,
3841                                         unsigned int freq, int no_cck,
3842                                         int offchanok,
3843                                         unsigned int wait_time)
3844 {
3845         struct wpa_driver_nl80211_data *drv = bss->drv;
3846         struct ieee80211_mgmt *mgmt;
3847         int encrypt = 1;
3848         u16 fc;
3849
3850         mgmt = (struct ieee80211_mgmt *) data;
3851         fc = le_to_host16(mgmt->frame_control);
3852         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
3853                    " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
3854                    MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
3855                    fc, fc2str(fc), drv->nlmode);
3856
3857         if ((is_sta_interface(drv->nlmode) ||
3858              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
3859             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3860             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
3861                 /*
3862                  * The use of last_mgmt_freq is a bit of a hack,
3863                  * but it works due to the single-threaded nature
3864                  * of wpa_supplicant.
3865                  */
3866                 if (freq == 0) {
3867                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
3868                                    drv->last_mgmt_freq);
3869                         freq = drv->last_mgmt_freq;
3870                 }
3871                 return nl80211_send_frame_cmd(bss, freq, 0,
3872                                               data, data_len, NULL, 1, noack,
3873                                               1);
3874         }
3875
3876         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
3877                 if (freq == 0) {
3878                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
3879                                    bss->freq);
3880                         freq = bss->freq;
3881                 }
3882                 return nl80211_send_frame_cmd(bss, freq,
3883                                               (int) freq == bss->freq ? 0 :
3884                                               wait_time,
3885                                               data, data_len,
3886                                               &drv->send_action_cookie,
3887                                               no_cck, noack, offchanok);
3888         }
3889
3890         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3891             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
3892                 /*
3893                  * Only one of the authentication frame types is encrypted.
3894                  * In order for static WEP encryption to work properly (i.e.,
3895                  * to not encrypt the frame), we need to tell mac80211 about
3896                  * the frames that must not be encrypted.
3897                  */
3898                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3899                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
3900                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
3901                         encrypt = 0;
3902         }
3903
3904         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
3905         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
3906                                              noack, freq, no_cck, offchanok,
3907                                              wait_time);
3908 }
3909
3910
3911 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
3912                            int slot, int ht_opmode, int ap_isolate,
3913                            int *basic_rates)
3914 {
3915         struct wpa_driver_nl80211_data *drv = bss->drv;
3916         struct nl_msg *msg;
3917
3918         msg = nlmsg_alloc();
3919         if (!msg)
3920                 return -ENOMEM;
3921
3922         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
3923
3924         if (cts >= 0)
3925                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
3926         if (preamble >= 0)
3927                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
3928         if (slot >= 0)
3929                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
3930         if (ht_opmode >= 0)
3931                 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
3932         if (ap_isolate >= 0)
3933                 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
3934
3935         if (basic_rates) {
3936                 u8 rates[NL80211_MAX_SUPP_RATES];
3937                 u8 rates_len = 0;
3938                 int i;
3939
3940                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
3941                      i++)
3942                         rates[rates_len++] = basic_rates[i] / 5;
3943
3944                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3945         }
3946
3947         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
3948
3949         return send_and_recv_msgs(drv, msg, NULL, NULL);
3950  nla_put_failure:
3951         nlmsg_free(msg);
3952         return -ENOBUFS;
3953 }
3954
3955
3956 static int wpa_driver_nl80211_set_acl(void *priv,
3957                                       struct hostapd_acl_params *params)
3958 {
3959         struct i802_bss *bss = priv;
3960         struct wpa_driver_nl80211_data *drv = bss->drv;
3961         struct nl_msg *msg;
3962         struct nlattr *acl;
3963         unsigned int i;
3964         int ret = 0;
3965
3966         if (!(drv->capa.max_acl_mac_addrs))
3967                 return -ENOTSUP;
3968
3969         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
3970                 return -ENOTSUP;
3971
3972         msg = nlmsg_alloc();
3973         if (!msg)
3974                 return -ENOMEM;
3975
3976         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
3977                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
3978
3979         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_MAC_ACL);
3980
3981         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3982
3983         NLA_PUT_U32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
3984                     NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
3985                     NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED);
3986
3987         acl = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
3988         if (acl == NULL)
3989                 goto nla_put_failure;
3990
3991         for (i = 0; i < params->num_mac_acl; i++)
3992                 NLA_PUT(msg, i + 1, ETH_ALEN, params->mac_acl[i].addr);
3993
3994         nla_nest_end(msg, acl);
3995
3996         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3997         msg = NULL;
3998         if (ret) {
3999                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
4000                            ret, strerror(-ret));
4001         }
4002
4003 nla_put_failure:
4004         nlmsg_free(msg);
4005
4006         return ret;
4007 }
4008
4009
4010 static int wpa_driver_nl80211_set_ap(void *priv,
4011                                      struct wpa_driver_ap_params *params)
4012 {
4013         struct i802_bss *bss = priv;
4014         struct wpa_driver_nl80211_data *drv = bss->drv;
4015         struct nl_msg *msg;
4016         u8 cmd = NL80211_CMD_NEW_BEACON;
4017         int ret;
4018         int beacon_set;
4019         int ifindex = if_nametoindex(bss->ifname);
4020         int num_suites;
4021         int smps_mode;
4022         u32 suites[10], suite;
4023         u32 ver;
4024
4025         beacon_set = bss->beacon_set;
4026
4027         msg = nlmsg_alloc();
4028         if (!msg)
4029                 return -ENOMEM;
4030
4031         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
4032                    beacon_set);
4033         if (beacon_set)
4034                 cmd = NL80211_CMD_SET_BEACON;
4035
4036         nl80211_cmd(drv, msg, 0, cmd);
4037         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
4038                     params->head, params->head_len);
4039         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
4040         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
4041                     params->tail, params->tail_len);
4042         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
4043         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", ifindex);
4044         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4045         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
4046         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
4047         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
4048         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
4049         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
4050                           params->ssid, params->ssid_len);
4051         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
4052                 params->ssid);
4053         if (params->proberesp && params->proberesp_len) {
4054                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
4055                             params->proberesp, params->proberesp_len);
4056                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
4057                         params->proberesp);
4058         }
4059         switch (params->hide_ssid) {
4060         case NO_SSID_HIDING:
4061                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
4062                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
4063                             NL80211_HIDDEN_SSID_NOT_IN_USE);
4064                 break;
4065         case HIDDEN_SSID_ZERO_LEN:
4066                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
4067                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
4068                             NL80211_HIDDEN_SSID_ZERO_LEN);
4069                 break;
4070         case HIDDEN_SSID_ZERO_CONTENTS:
4071                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
4072                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
4073                             NL80211_HIDDEN_SSID_ZERO_CONTENTS);
4074                 break;
4075         }
4076         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
4077         if (params->privacy)
4078                 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
4079         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
4080         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
4081             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
4082                 /* Leave out the attribute */
4083         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
4084                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
4085                             NL80211_AUTHTYPE_SHARED_KEY);
4086         else
4087                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
4088                             NL80211_AUTHTYPE_OPEN_SYSTEM);
4089
4090         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
4091         ver = 0;
4092         if (params->wpa_version & WPA_PROTO_WPA)
4093                 ver |= NL80211_WPA_VERSION_1;
4094         if (params->wpa_version & WPA_PROTO_RSN)
4095                 ver |= NL80211_WPA_VERSION_2;
4096         if (ver)
4097                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
4098
4099         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
4100                    params->key_mgmt_suites);
4101         num_suites = 0;
4102         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
4103                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
4104         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
4105                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
4106         if (num_suites) {
4107                 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
4108                         num_suites * sizeof(u32), suites);
4109         }
4110
4111         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
4112             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
4113                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
4114
4115         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
4116                    params->pairwise_ciphers);
4117         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
4118                                                  suites, ARRAY_SIZE(suites));
4119         if (num_suites) {
4120                 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
4121                         num_suites * sizeof(u32), suites);
4122         }
4123
4124         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
4125                    params->group_cipher);
4126         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
4127         if (suite)
4128                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite);
4129
4130         switch (params->smps_mode) {
4131         case HT_CAP_INFO_SMPS_DYNAMIC:
4132                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
4133                 smps_mode = NL80211_SMPS_DYNAMIC;
4134                 break;
4135         case HT_CAP_INFO_SMPS_STATIC:
4136                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
4137                 smps_mode = NL80211_SMPS_STATIC;
4138                 break;
4139         default:
4140                 /* invalid - fallback to smps off */
4141         case HT_CAP_INFO_SMPS_DISABLED:
4142                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
4143                 smps_mode = NL80211_SMPS_OFF;
4144                 break;
4145         }
4146         NLA_PUT_U32(msg, NL80211_ATTR_SMPS_MODE, smps_mode);
4147
4148         if (params->beacon_ies) {
4149                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
4150                                 params->beacon_ies);
4151                 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
4152                         wpabuf_head(params->beacon_ies));
4153         }
4154         if (params->proberesp_ies) {
4155                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
4156                                 params->proberesp_ies);
4157                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
4158                         wpabuf_len(params->proberesp_ies),
4159                         wpabuf_head(params->proberesp_ies));
4160         }
4161         if (params->assocresp_ies) {
4162                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
4163                                 params->assocresp_ies);
4164                 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
4165                         wpabuf_len(params->assocresp_ies),
4166                         wpabuf_head(params->assocresp_ies));
4167         }
4168
4169         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
4170                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
4171                            params->ap_max_inactivity);
4172                 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
4173                             params->ap_max_inactivity);
4174         }
4175
4176         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4177         if (ret) {
4178                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
4179                            ret, strerror(-ret));
4180         } else {
4181                 bss->beacon_set = 1;
4182                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
4183                                 params->short_slot_time, params->ht_opmode,
4184                                 params->isolate, params->basic_rates);
4185                 if (beacon_set && params->freq &&
4186                     params->freq->bandwidth != bss->bandwidth) {
4187                         wpa_printf(MSG_DEBUG,
4188                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
4189                                    bss->ifname, bss->bandwidth,
4190                                    params->freq->bandwidth);
4191                         ret = nl80211_set_channel(bss, params->freq, 1);
4192                         if (ret) {
4193                                 wpa_printf(MSG_DEBUG,
4194                                            "nl80211: Frequency set failed: %d (%s)",
4195                                            ret, strerror(-ret));
4196                         } else {
4197                                 wpa_printf(MSG_DEBUG,
4198                                            "nl80211: Frequency set succeeded for ht2040 coex");
4199                                 bss->bandwidth = params->freq->bandwidth;
4200                         }
4201                 } else if (!beacon_set) {
4202                         /*
4203                          * cfg80211 updates the driver on frequence change in AP
4204                          * mode only at the point when beaconing is started, so
4205                          * set the initial value here.
4206                          */
4207                         bss->bandwidth = params->freq->bandwidth;
4208                 }
4209         }
4210         return ret;
4211  nla_put_failure:
4212         nlmsg_free(msg);
4213         return -ENOBUFS;
4214 }
4215
4216
4217 static int nl80211_put_freq_params(struct nl_msg *msg,
4218                                    struct hostapd_freq_params *freq)
4219 {
4220         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
4221         if (freq->vht_enabled) {
4222                 switch (freq->bandwidth) {
4223                 case 20:
4224                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4225                                     NL80211_CHAN_WIDTH_20);
4226                         break;
4227                 case 40:
4228                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4229                                     NL80211_CHAN_WIDTH_40);
4230                         break;
4231                 case 80:
4232                         if (freq->center_freq2)
4233                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4234                                             NL80211_CHAN_WIDTH_80P80);
4235                         else
4236                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4237                                             NL80211_CHAN_WIDTH_80);
4238                         break;
4239                 case 160:
4240                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4241                                     NL80211_CHAN_WIDTH_160);
4242                         break;
4243                 default:
4244                         return -EINVAL;
4245                 }
4246                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
4247                 if (freq->center_freq2)
4248                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
4249                                     freq->center_freq2);
4250         } else if (freq->ht_enabled) {
4251                 switch (freq->sec_channel_offset) {
4252                 case -1:
4253                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4254                                     NL80211_CHAN_HT40MINUS);
4255                         break;
4256                 case 1:
4257                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4258                                     NL80211_CHAN_HT40PLUS);
4259                         break;
4260                 default:
4261                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4262                                     NL80211_CHAN_HT20);
4263                         break;
4264                 }
4265         }
4266         return 0;
4267
4268 nla_put_failure:
4269         return -ENOBUFS;
4270 }
4271
4272
4273 static int nl80211_set_channel(struct i802_bss *bss,
4274                                struct hostapd_freq_params *freq, int set_chan)
4275 {
4276         struct wpa_driver_nl80211_data *drv = bss->drv;
4277         struct nl_msg *msg;
4278         int ret;
4279
4280         wpa_printf(MSG_DEBUG,
4281                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
4282                    freq->freq, freq->ht_enabled, freq->vht_enabled,
4283                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
4284         msg = nlmsg_alloc();
4285         if (!msg)
4286                 return -1;
4287
4288         nl80211_cmd(drv, msg, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
4289                     NL80211_CMD_SET_WIPHY);
4290
4291         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4292         if (nl80211_put_freq_params(msg, freq) < 0)
4293                 goto nla_put_failure;
4294
4295         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4296         msg = NULL;
4297         if (ret == 0) {
4298                 bss->freq = freq->freq;
4299                 return 0;
4300         }
4301         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
4302                    "%d (%s)", freq->freq, ret, strerror(-ret));
4303 nla_put_failure:
4304         nlmsg_free(msg);
4305         return -1;
4306 }
4307
4308
4309 static u32 sta_flags_nl80211(int flags)
4310 {
4311         u32 f = 0;
4312
4313         if (flags & WPA_STA_AUTHORIZED)
4314                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
4315         if (flags & WPA_STA_WMM)
4316                 f |= BIT(NL80211_STA_FLAG_WME);
4317         if (flags & WPA_STA_SHORT_PREAMBLE)
4318                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
4319         if (flags & WPA_STA_MFP)
4320                 f |= BIT(NL80211_STA_FLAG_MFP);
4321         if (flags & WPA_STA_TDLS_PEER)
4322                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
4323         if (flags & WPA_STA_AUTHENTICATED)
4324                 f |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
4325
4326         return f;
4327 }
4328
4329
4330 #ifdef CONFIG_MESH
4331 static u32 sta_plink_state_nl80211(enum mesh_plink_state state)
4332 {
4333         switch (state) {
4334         case PLINK_LISTEN:
4335                 return NL80211_PLINK_LISTEN;
4336         case PLINK_OPEN_SENT:
4337                 return NL80211_PLINK_OPN_SNT;
4338         case PLINK_OPEN_RCVD:
4339                 return NL80211_PLINK_OPN_RCVD;
4340         case PLINK_CNF_RCVD:
4341                 return NL80211_PLINK_CNF_RCVD;
4342         case PLINK_ESTAB:
4343                 return NL80211_PLINK_ESTAB;
4344         case PLINK_HOLDING:
4345                 return NL80211_PLINK_HOLDING;
4346         case PLINK_BLOCKED:
4347                 return NL80211_PLINK_BLOCKED;
4348         default:
4349                 wpa_printf(MSG_ERROR, "nl80211: Invalid mesh plink state %d",
4350                            state);
4351         }
4352         return -1;
4353 }
4354 #endif /* CONFIG_MESH */
4355
4356
4357 static int wpa_driver_nl80211_sta_add(void *priv,
4358                                       struct hostapd_sta_add_params *params)
4359 {
4360         struct i802_bss *bss = priv;
4361         struct wpa_driver_nl80211_data *drv = bss->drv;
4362         struct nl_msg *msg;
4363         struct nl80211_sta_flag_update upd;
4364         int ret = -ENOBUFS;
4365
4366         if ((params->flags & WPA_STA_TDLS_PEER) &&
4367             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
4368                 return -EOPNOTSUPP;
4369
4370         msg = nlmsg_alloc();
4371         if (!msg)
4372                 return -ENOMEM;
4373
4374         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
4375                    params->set ? "Set" : "Add", MAC2STR(params->addr));
4376         nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
4377                     NL80211_CMD_NEW_STATION);
4378
4379         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
4380         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
4381
4382         if (!params->set || (params->flags & WPA_STA_TDLS_PEER)) {
4383                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES,
4384                         params->supp_rates_len, params->supp_rates);
4385                 wpa_hexdump(MSG_DEBUG, "  * supported rates",
4386                             params->supp_rates, params->supp_rates_len);
4387         }
4388         if (!params->set) {
4389                 if (params->aid) {
4390                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
4391                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
4392                 } else {
4393                         /*
4394                          * cfg80211 validates that AID is non-zero, so we have
4395                          * to make this a non-zero value for the TDLS case where
4396                          * a dummy STA entry is used for now.
4397                          */
4398                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
4399                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, 1);
4400                 }
4401                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
4402                            params->listen_interval);
4403                 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
4404                             params->listen_interval);
4405         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
4406                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
4407                 NLA_PUT_U16(msg, NL80211_ATTR_PEER_AID, params->aid);
4408         }
4409         if (params->ht_capabilities) {
4410                 wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
4411                             (u8 *) params->ht_capabilities,
4412                             sizeof(*params->ht_capabilities));
4413                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
4414                         sizeof(*params->ht_capabilities),
4415                         params->ht_capabilities);
4416         }
4417
4418         if (params->vht_capabilities) {
4419                 wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
4420                             (u8 *) params->vht_capabilities,
4421                             sizeof(*params->vht_capabilities));
4422                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY,
4423                         sizeof(*params->vht_capabilities),
4424                         params->vht_capabilities);
4425         }
4426
4427         if (params->vht_opmode_enabled) {
4428                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
4429                 NLA_PUT_U8(msg, NL80211_ATTR_OPMODE_NOTIF,
4430                            params->vht_opmode);
4431         }
4432
4433         wpa_printf(MSG_DEBUG, "  * capability=0x%x", params->capability);
4434         NLA_PUT_U16(msg, NL80211_ATTR_STA_CAPABILITY, params->capability);
4435
4436         if (params->ext_capab) {
4437                 wpa_hexdump(MSG_DEBUG, "  * ext_capab",
4438                             params->ext_capab, params->ext_capab_len);
4439                 NLA_PUT(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
4440                         params->ext_capab_len, params->ext_capab);
4441         }
4442
4443         if (params->supp_channels) {
4444                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
4445                             params->supp_channels, params->supp_channels_len);
4446                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
4447                         params->supp_channels_len, params->supp_channels);
4448         }
4449
4450         if (params->supp_oper_classes) {
4451                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
4452                             params->supp_oper_classes,
4453                             params->supp_oper_classes_len);
4454                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
4455                         params->supp_oper_classes_len,
4456                         params->supp_oper_classes);
4457         }
4458
4459         os_memset(&upd, 0, sizeof(upd));
4460         upd.set = sta_flags_nl80211(params->flags);
4461         upd.mask = upd.set | sta_flags_nl80211(params->flags_mask);
4462         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
4463                    upd.set, upd.mask);
4464         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
4465
4466 #ifdef CONFIG_MESH
4467         if (params->plink_state)
4468                 NLA_PUT_U8(msg, NL80211_ATTR_STA_PLINK_STATE,
4469                            sta_plink_state_nl80211(params->plink_state));
4470 #endif /* CONFIG_MESH */
4471
4472         if (params->flags & WPA_STA_WMM) {
4473                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
4474
4475                 if (!wme)
4476                         goto nla_put_failure;
4477
4478                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
4479                 NLA_PUT_U8(msg, NL80211_STA_WME_UAPSD_QUEUES,
4480                                 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
4481                 NLA_PUT_U8(msg, NL80211_STA_WME_MAX_SP,
4482                                 (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
4483                                 WMM_QOSINFO_STA_SP_MASK);
4484                 nla_nest_end(msg, wme);
4485         }
4486
4487         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4488         msg = NULL;
4489         if (ret)
4490                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
4491                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
4492                            strerror(-ret));
4493         if (ret == -EEXIST)
4494                 ret = 0;
4495  nla_put_failure:
4496         nlmsg_free(msg);
4497         return ret;
4498 }
4499
4500
4501 static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
4502 {
4503 #ifdef CONFIG_LIBNL3_ROUTE
4504         struct wpa_driver_nl80211_data *drv = bss->drv;
4505         struct rtnl_neigh *rn;
4506         struct nl_addr *nl_addr;
4507         int err;
4508
4509         rn = rtnl_neigh_alloc();
4510         if (!rn)
4511                 return;
4512
4513         rtnl_neigh_set_family(rn, AF_BRIDGE);
4514         rtnl_neigh_set_ifindex(rn, bss->ifindex);
4515         nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
4516         if (!nl_addr) {
4517                 rtnl_neigh_put(rn);
4518                 return;
4519         }
4520         rtnl_neigh_set_lladdr(rn, nl_addr);
4521
4522         err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
4523         if (err < 0) {
4524                 wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
4525                            MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
4526                            bss->ifindex, nl_geterror(err));
4527         } else {
4528                 wpa_printf(MSG_DEBUG, "nl80211: deleted bridge FDB entry for "
4529                            MACSTR, MAC2STR(addr));
4530         }
4531
4532         nl_addr_put(nl_addr);
4533         rtnl_neigh_put(rn);
4534 #endif /* CONFIG_LIBNL3_ROUTE */
4535 }
4536
4537
4538 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr,
4539                                          int deauth, u16 reason_code)
4540 {
4541         struct wpa_driver_nl80211_data *drv = bss->drv;
4542         struct nl_msg *msg;
4543         int ret;
4544
4545         msg = nlmsg_alloc();
4546         if (!msg)
4547                 return -ENOMEM;
4548
4549         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
4550
4551         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
4552                     if_nametoindex(bss->ifname));
4553         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4554         if (deauth == 0)
4555                 NLA_PUT_U8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4556                            WLAN_FC_STYPE_DISASSOC);
4557         else if (deauth == 1)
4558                 NLA_PUT_U8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4559                            WLAN_FC_STYPE_DEAUTH);
4560         if (reason_code)
4561                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
4562
4563         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4564         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
4565                    " --> %d (%s)",
4566                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
4567
4568         if (drv->rtnl_sk)
4569                 rtnl_neigh_delete_fdb_entry(bss, addr);
4570
4571         if (ret == -ENOENT)
4572                 return 0;
4573         return ret;
4574  nla_put_failure:
4575         nlmsg_free(msg);
4576         return -ENOBUFS;
4577 }
4578
4579
4580 void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx)
4581 {
4582         struct nl_msg *msg;
4583         struct wpa_driver_nl80211_data *drv2;
4584
4585         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
4586
4587         /* stop listening for EAPOL on this interface */
4588         dl_list_for_each(drv2, &drv->global->interfaces,
4589                          struct wpa_driver_nl80211_data, list)
4590                 del_ifidx(drv2, ifidx);
4591
4592         msg = nlmsg_alloc();
4593         if (!msg)
4594                 goto nla_put_failure;
4595
4596         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
4597         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
4598
4599         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
4600                 return;
4601         msg = NULL;
4602  nla_put_failure:
4603         nlmsg_free(msg);
4604         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
4605 }
4606
4607
4608 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
4609 {
4610         switch (mode) {
4611         case NL80211_IFTYPE_ADHOC:
4612                 return "ADHOC";
4613         case NL80211_IFTYPE_STATION:
4614                 return "STATION";
4615         case NL80211_IFTYPE_AP:
4616                 return "AP";
4617         case NL80211_IFTYPE_AP_VLAN:
4618                 return "AP_VLAN";
4619         case NL80211_IFTYPE_WDS:
4620                 return "WDS";
4621         case NL80211_IFTYPE_MONITOR:
4622                 return "MONITOR";
4623         case NL80211_IFTYPE_MESH_POINT:
4624                 return "MESH_POINT";
4625         case NL80211_IFTYPE_P2P_CLIENT:
4626                 return "P2P_CLIENT";
4627         case NL80211_IFTYPE_P2P_GO:
4628                 return "P2P_GO";
4629         case NL80211_IFTYPE_P2P_DEVICE:
4630                 return "P2P_DEVICE";
4631         default:
4632                 return "unknown";
4633         }
4634 }
4635
4636
4637 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
4638                                      const char *ifname,
4639                                      enum nl80211_iftype iftype,
4640                                      const u8 *addr, int wds,
4641                                      int (*handler)(struct nl_msg *, void *),
4642                                      void *arg)
4643 {
4644         struct nl_msg *msg;
4645         int ifidx;
4646         int ret = -ENOBUFS;
4647
4648         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
4649                    iftype, nl80211_iftype_str(iftype));
4650
4651         msg = nlmsg_alloc();
4652         if (!msg)
4653                 return -1;
4654
4655         nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
4656         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
4657                 goto nla_put_failure;
4658         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
4659         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
4660
4661         if (iftype == NL80211_IFTYPE_MONITOR) {
4662                 struct nlattr *flags;
4663
4664                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
4665                 if (!flags)
4666                         goto nla_put_failure;
4667
4668                 NLA_PUT_FLAG(msg, NL80211_MNTR_FLAG_COOK_FRAMES);
4669
4670                 nla_nest_end(msg, flags);
4671         } else if (wds) {
4672                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
4673         }
4674
4675         /*
4676          * Tell cfg80211 that the interface belongs to the socket that created
4677          * it, and the interface should be deleted when the socket is closed.
4678          */
4679         NLA_PUT_FLAG(msg, NL80211_ATTR_IFACE_SOCKET_OWNER);
4680
4681         ret = send_and_recv_msgs(drv, msg, handler, arg);
4682         msg = NULL;
4683         if (ret) {
4684  nla_put_failure:
4685                 nlmsg_free(msg);
4686                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
4687                            ifname, ret, strerror(-ret));
4688                 return ret;
4689         }
4690
4691         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
4692                 return 0;
4693
4694         ifidx = if_nametoindex(ifname);
4695         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
4696                    ifname, ifidx);
4697
4698         if (ifidx <= 0)
4699                 return -1;
4700
4701         /*
4702          * Some virtual interfaces need to process EAPOL packets and events on
4703          * the parent interface. This is used mainly with hostapd.
4704          */
4705         if (drv->hostapd ||
4706             iftype == NL80211_IFTYPE_AP_VLAN ||
4707             iftype == NL80211_IFTYPE_WDS ||
4708             iftype == NL80211_IFTYPE_MONITOR) {
4709                 /* start listening for EAPOL on this interface */
4710                 add_ifidx(drv, ifidx);
4711         }
4712
4713         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4714             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
4715                 nl80211_remove_iface(drv, ifidx);
4716                 return -1;
4717         }
4718
4719         return ifidx;
4720 }
4721
4722
4723 int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
4724                          const char *ifname, enum nl80211_iftype iftype,
4725                          const u8 *addr, int wds,
4726                          int (*handler)(struct nl_msg *, void *),
4727                          void *arg, int use_existing)
4728 {
4729         int ret;
4730
4731         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
4732                                         arg);
4733
4734         /* if error occurred and interface exists already */
4735         if (ret == -ENFILE && if_nametoindex(ifname)) {
4736                 if (use_existing) {
4737                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
4738                                    ifname);
4739                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4740                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4741                                                addr) < 0 &&
4742                             (linux_set_iface_flags(drv->global->ioctl_sock,
4743                                                    ifname, 0) < 0 ||
4744                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4745                                                 addr) < 0 ||
4746                              linux_set_iface_flags(drv->global->ioctl_sock,
4747                                                    ifname, 1) < 0))
4748                                         return -1;
4749                         return -ENFILE;
4750                 }
4751                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
4752
4753                 /* Try to remove the interface that was already there. */
4754                 nl80211_remove_iface(drv, if_nametoindex(ifname));
4755
4756                 /* Try to create the interface again */
4757                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
4758                                                 wds, handler, arg);
4759         }
4760
4761         if (ret >= 0 && is_p2p_net_interface(iftype))
4762                 nl80211_disable_11b_rates(drv, ret, 1);
4763
4764         return ret;
4765 }
4766
4767
4768 static int nl80211_setup_ap(struct i802_bss *bss)
4769 {
4770         struct wpa_driver_nl80211_data *drv = bss->drv;
4771
4772         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
4773                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4774
4775         /*
4776          * Disable Probe Request reporting unless we need it in this way for
4777          * devices that include the AP SME, in the other case (unless using
4778          * monitor iface) we'll get it through the nl_mgmt socket instead.
4779          */
4780         if (!drv->device_ap_sme)
4781                 wpa_driver_nl80211_probe_req_report(bss, 0);
4782
4783         if (!drv->device_ap_sme && !drv->use_monitor)
4784                 if (nl80211_mgmt_subscribe_ap(bss))
4785                         return -1;
4786
4787         if (drv->device_ap_sme && !drv->use_monitor)
4788                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
4789                         return -1;
4790
4791         if (!drv->device_ap_sme && drv->use_monitor &&
4792             nl80211_create_monitor_interface(drv) &&
4793             !drv->device_ap_sme)
4794                 return -1;
4795
4796         if (drv->device_ap_sme &&
4797             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
4798                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
4799                            "Probe Request frame reporting in AP mode");
4800                 /* Try to survive without this */
4801         }
4802
4803         return 0;
4804 }
4805
4806
4807 static void nl80211_teardown_ap(struct i802_bss *bss)
4808 {
4809         struct wpa_driver_nl80211_data *drv = bss->drv;
4810
4811         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
4812                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4813         if (drv->device_ap_sme) {
4814                 wpa_driver_nl80211_probe_req_report(bss, 0);
4815                 if (!drv->use_monitor)
4816                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
4817         } else if (drv->use_monitor)
4818                 nl80211_remove_monitor_interface(drv);
4819         else
4820                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
4821
4822         bss->beacon_set = 0;
4823 }
4824
4825
4826 static int nl80211_send_eapol_data(struct i802_bss *bss,
4827                                    const u8 *addr, const u8 *data,
4828                                    size_t data_len)
4829 {
4830         struct sockaddr_ll ll;
4831         int ret;
4832
4833         if (bss->drv->eapol_tx_sock < 0) {
4834                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
4835                 return -1;
4836         }
4837
4838         os_memset(&ll, 0, sizeof(ll));
4839         ll.sll_family = AF_PACKET;
4840         ll.sll_ifindex = bss->ifindex;
4841         ll.sll_protocol = htons(ETH_P_PAE);
4842         ll.sll_halen = ETH_ALEN;
4843         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
4844         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
4845                      (struct sockaddr *) &ll, sizeof(ll));
4846         if (ret < 0)
4847                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
4848                            strerror(errno));
4849
4850         return ret;
4851 }
4852
4853
4854 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
4855
4856 static int wpa_driver_nl80211_hapd_send_eapol(
4857         void *priv, const u8 *addr, const u8 *data,
4858         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
4859 {
4860         struct i802_bss *bss = priv;
4861         struct wpa_driver_nl80211_data *drv = bss->drv;
4862         struct ieee80211_hdr *hdr;
4863         size_t len;
4864         u8 *pos;
4865         int res;
4866         int qos = flags & WPA_STA_WMM;
4867
4868         if (drv->device_ap_sme || !drv->use_monitor)
4869                 return nl80211_send_eapol_data(bss, addr, data, data_len);
4870
4871         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
4872                 data_len;
4873         hdr = os_zalloc(len);
4874         if (hdr == NULL) {
4875                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
4876                            (unsigned long) len);
4877                 return -1;
4878         }
4879
4880         hdr->frame_control =
4881                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
4882         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
4883         if (encrypt)
4884                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
4885         if (qos) {
4886                 hdr->frame_control |=
4887                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
4888         }
4889
4890         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
4891         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
4892         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
4893         pos = (u8 *) (hdr + 1);
4894
4895         if (qos) {
4896                 /* Set highest priority in QoS header */
4897                 pos[0] = 7;
4898                 pos[1] = 0;
4899                 pos += 2;
4900         }
4901
4902         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
4903         pos += sizeof(rfc1042_header);
4904         WPA_PUT_BE16(pos, ETH_P_PAE);
4905         pos += 2;
4906         memcpy(pos, data, data_len);
4907
4908         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
4909                                             0, 0, 0, 0);
4910         if (res < 0) {
4911                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
4912                            "failed: %d (%s)",
4913                            (unsigned long) len, errno, strerror(errno));
4914         }
4915         os_free(hdr);
4916
4917         return res;
4918 }
4919
4920
4921 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
4922                                             int total_flags,
4923                                             int flags_or, int flags_and)
4924 {
4925         struct i802_bss *bss = priv;
4926         struct wpa_driver_nl80211_data *drv = bss->drv;
4927         struct nl_msg *msg;
4928         struct nlattr *flags;
4929         struct nl80211_sta_flag_update upd;
4930
4931         wpa_printf(MSG_DEBUG, "nl80211: Set STA flags - ifname=%s addr=" MACSTR
4932                    " total_flags=0x%x flags_or=0x%x flags_and=0x%x authorized=%d",
4933                    bss->ifname, MAC2STR(addr), total_flags, flags_or, flags_and,
4934                    !!(total_flags & WPA_STA_AUTHORIZED));
4935
4936         msg = nlmsg_alloc();
4937         if (!msg)
4938                 return -ENOMEM;
4939
4940         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
4941
4942         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
4943                     if_nametoindex(bss->ifname));
4944         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4945
4946         /*
4947          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
4948          * can be removed eventually.
4949          */
4950         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
4951         if (!flags)
4952                 goto nla_put_failure;
4953         if (total_flags & WPA_STA_AUTHORIZED)
4954                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_AUTHORIZED);
4955
4956         if (total_flags & WPA_STA_WMM)
4957                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_WME);
4958
4959         if (total_flags & WPA_STA_SHORT_PREAMBLE)
4960                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_SHORT_PREAMBLE);
4961
4962         if (total_flags & WPA_STA_MFP)
4963                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_MFP);
4964
4965         if (total_flags & WPA_STA_TDLS_PEER)
4966                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_TDLS_PEER);
4967
4968         nla_nest_end(msg, flags);
4969
4970         os_memset(&upd, 0, sizeof(upd));
4971         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
4972         upd.set = sta_flags_nl80211(flags_or);
4973         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
4974
4975         return send_and_recv_msgs(drv, msg, NULL, NULL);
4976  nla_put_failure:
4977         nlmsg_free(msg);
4978         return -ENOBUFS;
4979 }
4980
4981
4982 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
4983                                  struct wpa_driver_associate_params *params)
4984 {
4985         enum nl80211_iftype nlmode, old_mode;
4986
4987         if (params->p2p) {
4988                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
4989                            "group (GO)");
4990                 nlmode = NL80211_IFTYPE_P2P_GO;
4991         } else
4992                 nlmode = NL80211_IFTYPE_AP;
4993
4994         old_mode = drv->nlmode;
4995         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
4996                 nl80211_remove_monitor_interface(drv);
4997                 return -1;
4998         }
4999
5000         if (nl80211_set_channel(drv->first_bss, &params->freq, 0)) {
5001                 if (old_mode != nlmode)
5002                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
5003                 nl80211_remove_monitor_interface(drv);
5004                 return -1;
5005         }
5006
5007         return 0;
5008 }
5009
5010
5011 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
5012 {
5013         struct nl_msg *msg;
5014         int ret = -1;
5015
5016         msg = nlmsg_alloc();
5017         if (!msg)
5018                 return -1;
5019
5020         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
5021         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5022         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5023         msg = NULL;
5024         if (ret) {
5025                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
5026                            "(%s)", ret, strerror(-ret));
5027                 goto nla_put_failure;
5028         }
5029
5030         ret = 0;
5031         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
5032
5033 nla_put_failure:
5034         if (wpa_driver_nl80211_set_mode(drv->first_bss,
5035                                         NL80211_IFTYPE_STATION)) {
5036                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
5037                            "station mode");
5038         }
5039
5040         nlmsg_free(msg);
5041         return ret;
5042 }
5043
5044
5045 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
5046                                    struct wpa_driver_associate_params *params)
5047 {
5048         struct nl_msg *msg;
5049         int ret = -1;
5050         int count = 0;
5051
5052         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
5053
5054         if (wpa_driver_nl80211_set_mode_ibss(drv->first_bss, &params->freq)) {
5055                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
5056                            "IBSS mode");
5057                 return -1;
5058         }
5059
5060 retry:
5061         msg = nlmsg_alloc();
5062         if (!msg)
5063                 return -1;
5064
5065         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
5066         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5067
5068         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
5069                 goto nla_put_failure;
5070
5071         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
5072                           params->ssid, params->ssid_len);
5073         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5074                 params->ssid);
5075         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
5076         drv->ssid_len = params->ssid_len;
5077
5078         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
5079         wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", params->freq.ht_enabled);
5080         wpa_printf(MSG_DEBUG, "  * sec_channel_offset=%d",
5081                    params->freq.sec_channel_offset);
5082         wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", params->freq.vht_enabled);
5083         wpa_printf(MSG_DEBUG, "  * center_freq1=%d", params->freq.center_freq1);
5084         wpa_printf(MSG_DEBUG, "  * center_freq2=%d", params->freq.center_freq2);
5085         wpa_printf(MSG_DEBUG, "  * bandwidth=%d", params->freq.bandwidth);
5086         if (nl80211_put_freq_params(msg, &params->freq) < 0)
5087                 goto nla_put_failure;
5088
5089         if (params->beacon_int > 0) {
5090                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", params->beacon_int);
5091                 NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL,
5092                             params->beacon_int);
5093         }
5094
5095         ret = nl80211_set_conn_keys(params, msg);
5096         if (ret)
5097                 goto nla_put_failure;
5098
5099         if (params->bssid && params->fixed_bssid) {
5100                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
5101                            MAC2STR(params->bssid));
5102                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
5103         }
5104
5105         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
5106             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5107             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
5108             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
5109                 wpa_printf(MSG_DEBUG, "  * control port");
5110                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
5111         }
5112
5113         if (params->wpa_ie) {
5114                 wpa_hexdump(MSG_DEBUG,
5115                             "  * Extra IEs for Beacon/Probe Response frames",
5116                             params->wpa_ie, params->wpa_ie_len);
5117                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
5118                         params->wpa_ie);
5119         }
5120
5121         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5122         msg = NULL;
5123         if (ret) {
5124                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
5125                            ret, strerror(-ret));
5126                 count++;
5127                 if (ret == -EALREADY && count == 1) {
5128                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
5129                                    "forced leave");
5130                         nl80211_leave_ibss(drv);
5131                         nlmsg_free(msg);
5132                         goto retry;
5133                 }
5134
5135                 goto nla_put_failure;
5136         }
5137         ret = 0;
5138         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
5139
5140 nla_put_failure:
5141         nlmsg_free(msg);
5142         return ret;
5143 }
5144
5145
5146 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
5147                                   struct wpa_driver_associate_params *params,
5148                                   struct nl_msg *msg)
5149 {
5150         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5151
5152         if (params->bssid) {
5153                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
5154                            MAC2STR(params->bssid));
5155                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
5156         }
5157
5158         if (params->bssid_hint) {
5159                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
5160                            MAC2STR(params->bssid_hint));
5161                 NLA_PUT(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
5162                         params->bssid_hint);
5163         }
5164
5165         if (params->freq.freq) {
5166                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
5167                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq.freq);
5168                 drv->assoc_freq = params->freq.freq;
5169         } else
5170                 drv->assoc_freq = 0;
5171
5172         if (params->freq_hint) {
5173                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
5174                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
5175                             params->freq_hint);
5176         }
5177
5178         if (params->bg_scan_period >= 0) {
5179                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
5180                            params->bg_scan_period);
5181                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
5182                             params->bg_scan_period);
5183         }
5184
5185         if (params->ssid) {
5186                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
5187                                   params->ssid, params->ssid_len);
5188                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5189                         params->ssid);
5190                 if (params->ssid_len > sizeof(drv->ssid))
5191                         goto nla_put_failure;
5192                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
5193                 drv->ssid_len = params->ssid_len;
5194         }
5195
5196         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
5197         if (params->wpa_ie)
5198                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
5199                         params->wpa_ie);
5200
5201         if (params->wpa_proto) {
5202                 enum nl80211_wpa_versions ver = 0;
5203
5204                 if (params->wpa_proto & WPA_PROTO_WPA)
5205                         ver |= NL80211_WPA_VERSION_1;
5206                 if (params->wpa_proto & WPA_PROTO_RSN)
5207                         ver |= NL80211_WPA_VERSION_2;
5208
5209                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
5210                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
5211         }
5212
5213         if (params->pairwise_suite != WPA_CIPHER_NONE) {
5214                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
5215                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
5216                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
5217         }
5218
5219         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
5220             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
5221                 /*
5222                  * This is likely to work even though many drivers do not
5223                  * advertise support for operations without GTK.
5224                  */
5225                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
5226         } else if (params->group_suite != WPA_CIPHER_NONE) {
5227                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
5228                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
5229                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
5230         }
5231
5232         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
5233             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5234             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
5235             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
5236             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
5237             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
5238             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
5239             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
5240                 int mgmt = WLAN_AKM_SUITE_PSK;
5241
5242                 switch (params->key_mgmt_suite) {
5243                 case WPA_KEY_MGMT_CCKM:
5244                         mgmt = WLAN_AKM_SUITE_CCKM;
5245                         break;
5246                 case WPA_KEY_MGMT_IEEE8021X:
5247                         mgmt = WLAN_AKM_SUITE_8021X;
5248                         break;
5249                 case WPA_KEY_MGMT_FT_IEEE8021X:
5250                         mgmt = WLAN_AKM_SUITE_FT_8021X;
5251                         break;
5252                 case WPA_KEY_MGMT_FT_PSK:
5253                         mgmt = WLAN_AKM_SUITE_FT_PSK;
5254                         break;
5255                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
5256                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
5257                         break;
5258                 case WPA_KEY_MGMT_PSK_SHA256:
5259                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
5260                         break;
5261                 case WPA_KEY_MGMT_OSEN:
5262                         mgmt = WLAN_AKM_SUITE_OSEN;
5263                         break;
5264                 case WPA_KEY_MGMT_PSK:
5265                 default:
5266                         mgmt = WLAN_AKM_SUITE_PSK;
5267                         break;
5268                 }
5269                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
5270                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
5271         }
5272
5273         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
5274
5275         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
5276                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
5277
5278         if (params->disable_ht)
5279                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
5280
5281         if (params->htcaps && params->htcaps_mask) {
5282                 int sz = sizeof(struct ieee80211_ht_capabilities);
5283                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
5284                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
5285                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
5286                             params->htcaps_mask, sz);
5287                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
5288                         params->htcaps_mask);
5289         }
5290
5291 #ifdef CONFIG_VHT_OVERRIDES
5292         if (params->disable_vht) {
5293                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
5294                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
5295         }
5296
5297         if (params->vhtcaps && params->vhtcaps_mask) {
5298                 int sz = sizeof(struct ieee80211_vht_capabilities);
5299                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
5300                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
5301                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
5302                             params->vhtcaps_mask, sz);
5303                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
5304                         params->vhtcaps_mask);
5305         }
5306 #endif /* CONFIG_VHT_OVERRIDES */
5307
5308         if (params->p2p)
5309                 wpa_printf(MSG_DEBUG, "  * P2P group");
5310
5311         return 0;
5312 nla_put_failure:
5313         return -1;
5314 }
5315
5316
5317 static int wpa_driver_nl80211_try_connect(
5318         struct wpa_driver_nl80211_data *drv,
5319         struct wpa_driver_associate_params *params)
5320 {
5321         struct nl_msg *msg;
5322         enum nl80211_auth_type type;
5323         int ret;
5324         int algs;
5325
5326         if (params->req_key_mgmt_offload && params->psk &&
5327             (params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5328              params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
5329              params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
5330                 wpa_printf(MSG_DEBUG, "nl80211: Key management set PSK");
5331                 ret = issue_key_mgmt_set_key(drv, params->psk, 32);
5332                 if (ret)
5333                         return ret;
5334         }
5335
5336         msg = nlmsg_alloc();
5337         if (!msg)
5338                 return -1;
5339
5340         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
5341         nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
5342
5343         ret = nl80211_connect_common(drv, params, msg);
5344         if (ret)
5345                 goto nla_put_failure;
5346
5347         algs = 0;
5348         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5349                 algs++;
5350         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5351                 algs++;
5352         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5353                 algs++;
5354         if (algs > 1) {
5355                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
5356                            "selection");
5357                 goto skip_auth_type;
5358         }
5359
5360         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5361                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
5362         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5363                 type = NL80211_AUTHTYPE_SHARED_KEY;
5364         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5365                 type = NL80211_AUTHTYPE_NETWORK_EAP;
5366         else if (params->auth_alg & WPA_AUTH_ALG_FT)
5367                 type = NL80211_AUTHTYPE_FT;
5368         else
5369                 goto nla_put_failure;
5370
5371         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
5372         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
5373
5374 skip_auth_type:
5375         ret = nl80211_set_conn_keys(params, msg);
5376         if (ret)
5377                 goto nla_put_failure;
5378
5379         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5380         msg = NULL;
5381         if (ret) {
5382                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
5383                            "(%s)", ret, strerror(-ret));
5384                 goto nla_put_failure;
5385         }
5386         ret = 0;
5387         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
5388
5389 nla_put_failure:
5390         nlmsg_free(msg);
5391         return ret;
5392
5393 }
5394
5395
5396 static int wpa_driver_nl80211_connect(
5397         struct wpa_driver_nl80211_data *drv,
5398         struct wpa_driver_associate_params *params)
5399 {
5400         int ret = wpa_driver_nl80211_try_connect(drv, params);
5401         if (ret == -EALREADY) {
5402                 /*
5403                  * cfg80211 does not currently accept new connections if
5404                  * we are already connected. As a workaround, force
5405                  * disconnection and try again.
5406                  */
5407                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
5408                            "disconnecting before reassociation "
5409                            "attempt");
5410                 if (wpa_driver_nl80211_disconnect(
5411                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
5412                         return -1;
5413                 ret = wpa_driver_nl80211_try_connect(drv, params);
5414         }
5415         return ret;
5416 }
5417
5418
5419 static int wpa_driver_nl80211_associate(
5420         void *priv, struct wpa_driver_associate_params *params)
5421 {
5422         struct i802_bss *bss = priv;
5423         struct wpa_driver_nl80211_data *drv = bss->drv;
5424         int ret;
5425         struct nl_msg *msg;
5426
5427         if (params->mode == IEEE80211_MODE_AP)
5428                 return wpa_driver_nl80211_ap(drv, params);
5429
5430         if (params->mode == IEEE80211_MODE_IBSS)
5431                 return wpa_driver_nl80211_ibss(drv, params);
5432
5433         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
5434                 enum nl80211_iftype nlmode = params->p2p ?
5435                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
5436
5437                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
5438                         return -1;
5439                 return wpa_driver_nl80211_connect(drv, params);
5440         }
5441
5442         nl80211_mark_disconnected(drv);
5443
5444         msg = nlmsg_alloc();
5445         if (!msg)
5446                 return -1;
5447
5448         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
5449                    drv->ifindex);
5450         nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
5451
5452         ret = nl80211_connect_common(drv, params, msg);
5453         if (ret)
5454                 goto nla_put_failure;
5455
5456         if (params->prev_bssid) {
5457                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
5458                            MAC2STR(params->prev_bssid));
5459                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
5460                         params->prev_bssid);
5461         }
5462
5463         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5464         msg = NULL;
5465         if (ret) {
5466                 wpa_dbg(drv->ctx, MSG_DEBUG,
5467                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
5468                         ret, strerror(-ret));
5469                 nl80211_dump_scan(drv);
5470                 goto nla_put_failure;
5471         }
5472         ret = 0;
5473         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
5474                    "successfully");
5475
5476 nla_put_failure:
5477         nlmsg_free(msg);
5478         return ret;
5479 }
5480
5481
5482 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
5483                             int ifindex, enum nl80211_iftype mode)
5484 {
5485         struct nl_msg *msg;
5486         int ret = -ENOBUFS;
5487
5488         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
5489                    ifindex, mode, nl80211_iftype_str(mode));
5490
5491         msg = nlmsg_alloc();
5492         if (!msg)
5493                 return -ENOMEM;
5494
5495         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
5496         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
5497                 goto nla_put_failure;
5498         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
5499
5500         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5501         msg = NULL;
5502         if (!ret)
5503                 return 0;
5504 nla_put_failure:
5505         nlmsg_free(msg);
5506         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
5507                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
5508         return ret;
5509 }
5510
5511
5512 static int wpa_driver_nl80211_set_mode_impl(
5513                 struct i802_bss *bss,
5514                 enum nl80211_iftype nlmode,
5515                 struct hostapd_freq_params *desired_freq_params)
5516 {
5517         struct wpa_driver_nl80211_data *drv = bss->drv;
5518         int ret = -1;
5519         int i;
5520         int was_ap = is_ap_interface(drv->nlmode);
5521         int res;
5522         int mode_switch_res;
5523
5524         mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5525         if (mode_switch_res && nlmode == nl80211_get_ifmode(bss))
5526                 mode_switch_res = 0;
5527
5528         if (mode_switch_res == 0) {
5529                 drv->nlmode = nlmode;
5530                 ret = 0;
5531                 goto done;
5532         }
5533
5534         if (mode_switch_res == -ENODEV)
5535                 return -1;
5536
5537         if (nlmode == drv->nlmode) {
5538                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
5539                            "requested mode - ignore error");
5540                 ret = 0;
5541                 goto done; /* Already in the requested mode */
5542         }
5543
5544         /* mac80211 doesn't allow mode changes while the device is up, so
5545          * take the device down, try to set the mode again, and bring the
5546          * device back up.
5547          */
5548         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
5549                    "interface down");
5550         for (i = 0; i < 10; i++) {
5551                 res = i802_set_iface_flags(bss, 0);
5552                 if (res == -EACCES || res == -ENODEV)
5553                         break;
5554                 if (res != 0) {
5555                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
5556                                    "interface down");
5557                         os_sleep(0, 100000);
5558                         continue;
5559                 }
5560
5561                 /*
5562                  * Setting the mode will fail for some drivers if the phy is
5563                  * on a frequency that the mode is disallowed in.
5564                  */
5565                 if (desired_freq_params) {
5566                         res = i802_set_freq(bss, desired_freq_params);
5567                         if (res) {
5568                                 wpa_printf(MSG_DEBUG,
5569                                            "nl80211: Failed to set frequency on interface");
5570                         }
5571                 }
5572
5573                 /* Try to set the mode again while the interface is down */
5574                 mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5575                 if (mode_switch_res == -EBUSY) {
5576                         wpa_printf(MSG_DEBUG,
5577                                    "nl80211: Delaying mode set while interface going down");
5578                         os_sleep(0, 100000);
5579                         continue;
5580                 }
5581                 ret = mode_switch_res;
5582                 break;
5583         }
5584
5585         if (!ret) {
5586                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
5587                            "interface is down");
5588                 drv->nlmode = nlmode;
5589                 drv->ignore_if_down_event = 1;
5590         }
5591
5592         /* Bring the interface back up */
5593         res = linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1);
5594         if (res != 0) {
5595                 wpa_printf(MSG_DEBUG,
5596                            "nl80211: Failed to set interface up after switching mode");
5597                 ret = -1;
5598         }
5599
5600 done:
5601         if (ret) {
5602                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
5603                            "from %d failed", nlmode, drv->nlmode);
5604                 return ret;
5605         }
5606
5607         if (is_p2p_net_interface(nlmode))
5608                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
5609         else if (drv->disabled_11b_rates)
5610                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
5611
5612         if (is_ap_interface(nlmode)) {
5613                 nl80211_mgmt_unsubscribe(bss, "start AP");
5614                 /* Setup additional AP mode functionality if needed */
5615                 if (nl80211_setup_ap(bss))
5616                         return -1;
5617         } else if (was_ap) {
5618                 /* Remove additional AP mode functionality */
5619                 nl80211_teardown_ap(bss);
5620         } else {
5621                 nl80211_mgmt_unsubscribe(bss, "mode change");
5622         }
5623
5624         if (is_mesh_interface(nlmode) &&
5625             nl80211_mgmt_subscribe_mesh(bss))
5626                 return -1;
5627
5628         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
5629             !is_mesh_interface(nlmode) &&
5630             nl80211_mgmt_subscribe_non_ap(bss) < 0)
5631                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
5632                            "frame processing - ignore for now");
5633
5634         return 0;
5635 }
5636
5637
5638 int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
5639                                 enum nl80211_iftype nlmode)
5640 {
5641         return wpa_driver_nl80211_set_mode_impl(bss, nlmode, NULL);
5642 }
5643
5644
5645 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
5646                                             struct hostapd_freq_params *freq)
5647 {
5648         return wpa_driver_nl80211_set_mode_impl(bss, NL80211_IFTYPE_ADHOC,
5649                                                 freq);
5650 }
5651
5652
5653 static int wpa_driver_nl80211_get_capa(void *priv,
5654                                        struct wpa_driver_capa *capa)
5655 {
5656         struct i802_bss *bss = priv;
5657         struct wpa_driver_nl80211_data *drv = bss->drv;
5658
5659         if (!drv->has_capability)
5660                 return -1;
5661         os_memcpy(capa, &drv->capa, sizeof(*capa));
5662         if (drv->extended_capa && drv->extended_capa_mask) {
5663                 capa->extended_capa = drv->extended_capa;
5664                 capa->extended_capa_mask = drv->extended_capa_mask;
5665                 capa->extended_capa_len = drv->extended_capa_len;
5666         }
5667
5668         return 0;
5669 }
5670
5671
5672 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
5673 {
5674         struct i802_bss *bss = priv;
5675         struct wpa_driver_nl80211_data *drv = bss->drv;
5676
5677         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
5678                    bss->ifname, drv->operstate, state,
5679                    state ? "UP" : "DORMANT");
5680         drv->operstate = state;
5681         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
5682                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
5683 }
5684
5685
5686 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
5687 {
5688         struct i802_bss *bss = priv;
5689         struct wpa_driver_nl80211_data *drv = bss->drv;
5690         struct nl_msg *msg;
5691         struct nl80211_sta_flag_update upd;
5692         int ret = -ENOBUFS;
5693
5694         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
5695                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
5696                 return 0;
5697         }
5698
5699         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
5700                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
5701
5702         msg = nlmsg_alloc();
5703         if (!msg)
5704                 return -ENOMEM;
5705
5706         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
5707
5708         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
5709                     if_nametoindex(bss->ifname));
5710         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
5711
5712         os_memset(&upd, 0, sizeof(upd));
5713         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
5714         if (authorized)
5715                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
5716         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
5717
5718         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5719         msg = NULL;
5720         if (!ret)
5721                 return 0;
5722  nla_put_failure:
5723         nlmsg_free(msg);
5724         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
5725                    ret, strerror(-ret));
5726         return ret;
5727 }
5728
5729
5730 /* Set kernel driver on given frequency (MHz) */
5731 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
5732 {
5733         struct i802_bss *bss = priv;
5734         return nl80211_set_channel(bss, freq, 0);
5735 }
5736
5737
5738 static inline int min_int(int a, int b)
5739 {
5740         if (a < b)
5741                 return a;
5742         return b;
5743 }
5744
5745
5746 static int get_key_handler(struct nl_msg *msg, void *arg)
5747 {
5748         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5749         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5750
5751         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5752                   genlmsg_attrlen(gnlh, 0), NULL);
5753
5754         /*
5755          * TODO: validate the key index and mac address!
5756          * Otherwise, there's a race condition as soon as
5757          * the kernel starts sending key notifications.
5758          */
5759
5760         if (tb[NL80211_ATTR_KEY_SEQ])
5761                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
5762                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
5763         return NL_SKIP;
5764 }
5765
5766
5767 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
5768                            int idx, u8 *seq)
5769 {
5770         struct i802_bss *bss = priv;
5771         struct wpa_driver_nl80211_data *drv = bss->drv;
5772         struct nl_msg *msg;
5773
5774         msg = nlmsg_alloc();
5775         if (!msg)
5776                 return -ENOMEM;
5777
5778         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
5779
5780         if (addr)
5781                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5782         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
5783         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
5784
5785         memset(seq, 0, 6);
5786
5787         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
5788  nla_put_failure:
5789         nlmsg_free(msg);
5790         return -ENOBUFS;
5791 }
5792
5793
5794 static int i802_set_rts(void *priv, int rts)
5795 {
5796         struct i802_bss *bss = priv;
5797         struct wpa_driver_nl80211_data *drv = bss->drv;
5798         struct nl_msg *msg;
5799         int ret = -ENOBUFS;
5800         u32 val;
5801
5802         msg = nlmsg_alloc();
5803         if (!msg)
5804                 return -ENOMEM;
5805
5806         if (rts >= 2347)
5807                 val = (u32) -1;
5808         else
5809                 val = rts;
5810
5811         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
5812         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5813         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
5814
5815         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5816         msg = NULL;
5817         if (!ret)
5818                 return 0;
5819 nla_put_failure:
5820         nlmsg_free(msg);
5821         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
5822                    "%d (%s)", rts, ret, strerror(-ret));
5823         return ret;
5824 }
5825
5826
5827 static int i802_set_frag(void *priv, int frag)
5828 {
5829         struct i802_bss *bss = priv;
5830         struct wpa_driver_nl80211_data *drv = bss->drv;
5831         struct nl_msg *msg;
5832         int ret = -ENOBUFS;
5833         u32 val;
5834
5835         msg = nlmsg_alloc();
5836         if (!msg)
5837                 return -ENOMEM;
5838
5839         if (frag >= 2346)
5840                 val = (u32) -1;
5841         else
5842                 val = frag;
5843
5844         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
5845         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5846         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
5847
5848         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5849         msg = NULL;
5850         if (!ret)
5851                 return 0;
5852 nla_put_failure:
5853         nlmsg_free(msg);
5854         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
5855                    "%d: %d (%s)", frag, ret, strerror(-ret));
5856         return ret;
5857 }
5858
5859
5860 static int i802_flush(void *priv)
5861 {
5862         struct i802_bss *bss = priv;
5863         struct wpa_driver_nl80211_data *drv = bss->drv;
5864         struct nl_msg *msg;
5865         int res;
5866
5867         msg = nlmsg_alloc();
5868         if (!msg)
5869                 return -1;
5870
5871         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
5872                    bss->ifname);
5873         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
5874
5875         /*
5876          * XXX: FIX! this needs to flush all VLANs too
5877          */
5878         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
5879                     if_nametoindex(bss->ifname));
5880
5881         res = send_and_recv_msgs(drv, msg, NULL, NULL);
5882         if (res) {
5883                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
5884                            "(%s)", res, strerror(-res));
5885         }
5886         return res;
5887  nla_put_failure:
5888         nlmsg_free(msg);
5889         return -ENOBUFS;
5890 }
5891
5892
5893 static int get_sta_handler(struct nl_msg *msg, void *arg)
5894 {
5895         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5896         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5897         struct hostap_sta_driver_data *data = arg;
5898         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
5899         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
5900                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
5901                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
5902                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
5903                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
5904                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
5905                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
5906         };
5907
5908         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5909                   genlmsg_attrlen(gnlh, 0), NULL);
5910
5911         /*
5912          * TODO: validate the interface and mac address!
5913          * Otherwise, there's a race condition as soon as
5914          * the kernel starts sending station notifications.
5915          */
5916
5917         if (!tb[NL80211_ATTR_STA_INFO]) {
5918                 wpa_printf(MSG_DEBUG, "sta stats missing!");
5919                 return NL_SKIP;
5920         }
5921         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
5922                              tb[NL80211_ATTR_STA_INFO],
5923                              stats_policy)) {
5924                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
5925                 return NL_SKIP;
5926         }
5927
5928         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
5929                 data->inactive_msec =
5930                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
5931         if (stats[NL80211_STA_INFO_RX_BYTES])
5932                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
5933         if (stats[NL80211_STA_INFO_TX_BYTES])
5934                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
5935         if (stats[NL80211_STA_INFO_RX_PACKETS])
5936                 data->rx_packets =
5937                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
5938         if (stats[NL80211_STA_INFO_TX_PACKETS])
5939                 data->tx_packets =
5940                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
5941         if (stats[NL80211_STA_INFO_TX_FAILED])
5942                 data->tx_retry_failed =
5943                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
5944
5945         return NL_SKIP;
5946 }
5947
5948 static int i802_read_sta_data(struct i802_bss *bss,
5949                               struct hostap_sta_driver_data *data,
5950                               const u8 *addr)
5951 {
5952         struct wpa_driver_nl80211_data *drv = bss->drv;
5953         struct nl_msg *msg;
5954
5955         os_memset(data, 0, sizeof(*data));
5956         msg = nlmsg_alloc();
5957         if (!msg)
5958                 return -ENOMEM;
5959
5960         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
5961
5962         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5963         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
5964
5965         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
5966  nla_put_failure:
5967         nlmsg_free(msg);
5968         return -ENOBUFS;
5969 }
5970
5971
5972 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
5973                                     int cw_min, int cw_max, int burst_time)
5974 {
5975         struct i802_bss *bss = priv;
5976         struct wpa_driver_nl80211_data *drv = bss->drv;
5977         struct nl_msg *msg;
5978         struct nlattr *txq, *params;
5979
5980         msg = nlmsg_alloc();
5981         if (!msg)
5982                 return -1;
5983
5984         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
5985
5986         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
5987
5988         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
5989         if (!txq)
5990                 goto nla_put_failure;
5991
5992         /* We are only sending parameters for a single TXQ at a time */
5993         params = nla_nest_start(msg, 1);
5994         if (!params)
5995                 goto nla_put_failure;
5996
5997         switch (queue) {
5998         case 0:
5999                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
6000                 break;
6001         case 1:
6002                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
6003                 break;
6004         case 2:
6005                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
6006                 break;
6007         case 3:
6008                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
6009                 break;
6010         }
6011         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
6012          * 32 usec, so need to convert the value here. */
6013         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
6014         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
6015         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
6016         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
6017
6018         nla_nest_end(msg, params);
6019
6020         nla_nest_end(msg, txq);
6021
6022         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
6023                 return 0;
6024         msg = NULL;
6025  nla_put_failure:
6026         nlmsg_free(msg);
6027         return -1;
6028 }
6029
6030
6031 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
6032                              const char *ifname, int vlan_id)
6033 {
6034         struct wpa_driver_nl80211_data *drv = bss->drv;
6035         struct nl_msg *msg;
6036         int ret = -ENOBUFS;
6037
6038         msg = nlmsg_alloc();
6039         if (!msg)
6040                 return -ENOMEM;
6041
6042         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
6043                    ", ifname=%s[%d], vlan_id=%d)",
6044                    bss->ifname, if_nametoindex(bss->ifname),
6045                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
6046         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
6047
6048         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
6049                     if_nametoindex(bss->ifname));
6050         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6051         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
6052                     if_nametoindex(ifname));
6053
6054         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6055         msg = NULL;
6056         if (ret < 0) {
6057                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
6058                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
6059                            MAC2STR(addr), ifname, vlan_id, ret,
6060                            strerror(-ret));
6061         }
6062  nla_put_failure:
6063         nlmsg_free(msg);
6064         return ret;
6065 }
6066
6067
6068 static int i802_get_inact_sec(void *priv, const u8 *addr)
6069 {
6070         struct hostap_sta_driver_data data;
6071         int ret;
6072
6073         data.inactive_msec = (unsigned long) -1;
6074         ret = i802_read_sta_data(priv, &data, addr);
6075         if (ret || data.inactive_msec == (unsigned long) -1)
6076                 return -1;
6077         return data.inactive_msec / 1000;
6078 }
6079
6080
6081 static int i802_sta_clear_stats(void *priv, const u8 *addr)
6082 {
6083 #if 0
6084         /* TODO */
6085 #endif
6086         return 0;
6087 }
6088
6089
6090 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
6091                            int reason)
6092 {
6093         struct i802_bss *bss = priv;
6094         struct wpa_driver_nl80211_data *drv = bss->drv;
6095         struct ieee80211_mgmt mgmt;
6096
6097         if (is_mesh_interface(drv->nlmode))
6098                 return -1;
6099
6100         if (drv->device_ap_sme)
6101                 return wpa_driver_nl80211_sta_remove(bss, addr, 1, reason);
6102
6103         memset(&mgmt, 0, sizeof(mgmt));
6104         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
6105                                           WLAN_FC_STYPE_DEAUTH);
6106         memcpy(mgmt.da, addr, ETH_ALEN);
6107         memcpy(mgmt.sa, own_addr, ETH_ALEN);
6108         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
6109         mgmt.u.deauth.reason_code = host_to_le16(reason);
6110         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
6111                                             IEEE80211_HDRLEN +
6112                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
6113                                             0);
6114 }
6115
6116
6117 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
6118                              int reason)
6119 {
6120         struct i802_bss *bss = priv;
6121         struct wpa_driver_nl80211_data *drv = bss->drv;
6122         struct ieee80211_mgmt mgmt;
6123
6124         if (is_mesh_interface(drv->nlmode))
6125                 return -1;
6126
6127         if (drv->device_ap_sme)
6128                 return wpa_driver_nl80211_sta_remove(bss, addr, 0, reason);
6129
6130         memset(&mgmt, 0, sizeof(mgmt));
6131         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
6132                                           WLAN_FC_STYPE_DISASSOC);
6133         memcpy(mgmt.da, addr, ETH_ALEN);
6134         memcpy(mgmt.sa, own_addr, ETH_ALEN);
6135         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
6136         mgmt.u.disassoc.reason_code = host_to_le16(reason);
6137         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
6138                                             IEEE80211_HDRLEN +
6139                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
6140                                             0);
6141 }
6142
6143
6144 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
6145 {
6146         char buf[200], *pos, *end;
6147         int i, res;
6148
6149         pos = buf;
6150         end = pos + sizeof(buf);
6151
6152         for (i = 0; i < drv->num_if_indices; i++) {
6153                 if (!drv->if_indices[i])
6154                         continue;
6155                 res = os_snprintf(pos, end - pos, " %d", drv->if_indices[i]);
6156                 if (res < 0 || res >= end - pos)
6157                         break;
6158                 pos += res;
6159         }
6160         *pos = '\0';
6161
6162         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
6163                    drv->num_if_indices, buf);
6164 }
6165
6166
6167 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6168 {
6169         int i;
6170         int *old;
6171
6172         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
6173                    ifidx);
6174         if (have_ifidx(drv, ifidx)) {
6175                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
6176                            ifidx);
6177                 return;
6178         }
6179         for (i = 0; i < drv->num_if_indices; i++) {
6180                 if (drv->if_indices[i] == 0) {
6181                         drv->if_indices[i] = ifidx;
6182                         dump_ifidx(drv);
6183                         return;
6184                 }
6185         }
6186
6187         if (drv->if_indices != drv->default_if_indices)
6188                 old = drv->if_indices;
6189         else
6190                 old = NULL;
6191
6192         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
6193                                            sizeof(int));
6194         if (!drv->if_indices) {
6195                 if (!old)
6196                         drv->if_indices = drv->default_if_indices;
6197                 else
6198                         drv->if_indices = old;
6199                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
6200                            "interfaces");
6201                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
6202                 return;
6203         } else if (!old)
6204                 os_memcpy(drv->if_indices, drv->default_if_indices,
6205                           sizeof(drv->default_if_indices));
6206         drv->if_indices[drv->num_if_indices] = ifidx;
6207         drv->num_if_indices++;
6208         dump_ifidx(drv);
6209 }
6210
6211
6212 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6213 {
6214         int i;
6215
6216         for (i = 0; i < drv->num_if_indices; i++) {
6217                 if (drv->if_indices[i] == ifidx) {
6218                         drv->if_indices[i] = 0;
6219                         break;
6220                 }
6221         }
6222         dump_ifidx(drv);
6223 }
6224
6225
6226 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6227 {
6228         int i;
6229
6230         for (i = 0; i < drv->num_if_indices; i++)
6231                 if (drv->if_indices[i] == ifidx)
6232                         return 1;
6233
6234         return 0;
6235 }
6236
6237
6238 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
6239                             const char *bridge_ifname, char *ifname_wds)
6240 {
6241         struct i802_bss *bss = priv;
6242         struct wpa_driver_nl80211_data *drv = bss->drv;
6243         char name[IFNAMSIZ + 1];
6244
6245         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
6246         if (ifname_wds)
6247                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
6248
6249         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
6250                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
6251         if (val) {
6252                 if (!if_nametoindex(name)) {
6253                         if (nl80211_create_iface(drv, name,
6254                                                  NL80211_IFTYPE_AP_VLAN,
6255                                                  bss->addr, 1, NULL, NULL, 0) <
6256                             0)
6257                                 return -1;
6258                         if (bridge_ifname &&
6259                             linux_br_add_if(drv->global->ioctl_sock,
6260                                             bridge_ifname, name) < 0)
6261                                 return -1;
6262                 }
6263                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
6264                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
6265                                    "interface %s up", name);
6266                 }
6267                 return i802_set_sta_vlan(priv, addr, name, 0);
6268         } else {
6269                 if (bridge_ifname)
6270                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
6271                                         name);
6272
6273                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
6274                 nl80211_remove_iface(drv, if_nametoindex(name));
6275                 return 0;
6276         }
6277 }
6278
6279
6280 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
6281 {
6282         struct wpa_driver_nl80211_data *drv = eloop_ctx;
6283         struct sockaddr_ll lladdr;
6284         unsigned char buf[3000];
6285         int len;
6286         socklen_t fromlen = sizeof(lladdr);
6287
6288         len = recvfrom(sock, buf, sizeof(buf), 0,
6289                        (struct sockaddr *)&lladdr, &fromlen);
6290         if (len < 0) {
6291                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
6292                            strerror(errno));
6293                 return;
6294         }
6295
6296         if (have_ifidx(drv, lladdr.sll_ifindex))
6297                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
6298 }
6299
6300
6301 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
6302                              struct i802_bss *bss,
6303                              const char *brname, const char *ifname)
6304 {
6305         int ifindex;
6306         char in_br[IFNAMSIZ];
6307
6308         os_strlcpy(bss->brname, brname, IFNAMSIZ);
6309         ifindex = if_nametoindex(brname);
6310         if (ifindex == 0) {
6311                 /*
6312                  * Bridge was configured, but the bridge device does
6313                  * not exist. Try to add it now.
6314                  */
6315                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
6316                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
6317                                    "bridge interface %s: %s",
6318                                    brname, strerror(errno));
6319                         return -1;
6320                 }
6321                 bss->added_bridge = 1;
6322                 add_ifidx(drv, if_nametoindex(brname));
6323         }
6324
6325         if (linux_br_get(in_br, ifname) == 0) {
6326                 if (os_strcmp(in_br, brname) == 0)
6327                         return 0; /* already in the bridge */
6328
6329                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
6330                            "bridge %s", ifname, in_br);
6331                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
6332                     0) {
6333                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
6334                                    "remove interface %s from bridge "
6335                                    "%s: %s",
6336                                    ifname, brname, strerror(errno));
6337                         return -1;
6338                 }
6339         }
6340
6341         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
6342                    ifname, brname);
6343         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
6344                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
6345                            "into bridge %s: %s",
6346                            ifname, brname, strerror(errno));
6347                 return -1;
6348         }
6349         bss->added_if_into_bridge = 1;
6350
6351         return 0;
6352 }
6353
6354
6355 static void *i802_init(struct hostapd_data *hapd,
6356                        struct wpa_init_params *params)
6357 {
6358         struct wpa_driver_nl80211_data *drv;
6359         struct i802_bss *bss;
6360         size_t i;
6361         char brname[IFNAMSIZ];
6362         int ifindex, br_ifindex;
6363         int br_added = 0;
6364
6365         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
6366                                           params->global_priv, 1,
6367                                           params->bssid);
6368         if (bss == NULL)
6369                 return NULL;
6370
6371         drv = bss->drv;
6372
6373         if (linux_br_get(brname, params->ifname) == 0) {
6374                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
6375                            params->ifname, brname);
6376                 br_ifindex = if_nametoindex(brname);
6377                 os_strlcpy(bss->brname, brname, IFNAMSIZ);
6378         } else {
6379                 brname[0] = '\0';
6380                 br_ifindex = 0;
6381         }
6382
6383         for (i = 0; i < params->num_bridge; i++) {
6384                 if (params->bridge[i]) {
6385                         ifindex = if_nametoindex(params->bridge[i]);
6386                         if (ifindex)
6387                                 add_ifidx(drv, ifindex);
6388                         if (ifindex == br_ifindex)
6389                                 br_added = 1;
6390                 }
6391         }
6392         if (!br_added && br_ifindex &&
6393             (params->num_bridge == 0 || !params->bridge[0]))
6394                 add_ifidx(drv, br_ifindex);
6395
6396         /* start listening for EAPOL on the default AP interface */
6397         add_ifidx(drv, drv->ifindex);
6398
6399         if (params->num_bridge && params->bridge[0] &&
6400             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
6401                 goto failed;
6402
6403 #ifdef CONFIG_LIBNL3_ROUTE
6404         if (bss->added_if_into_bridge) {
6405                 drv->rtnl_sk = nl_socket_alloc();
6406                 if (drv->rtnl_sk == NULL) {
6407                         wpa_printf(MSG_ERROR, "nl80211: Failed to allocate nl_sock");
6408                         goto failed;
6409                 }
6410
6411                 if (nl_connect(drv->rtnl_sk, NETLINK_ROUTE)) {
6412                         wpa_printf(MSG_ERROR, "nl80211: Failed to connect nl_sock to NETLINK_ROUTE: %s",
6413                                    strerror(errno));
6414                         goto failed;
6415                 }
6416         }
6417 #endif /* CONFIG_LIBNL3_ROUTE */
6418
6419         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
6420         if (drv->eapol_sock < 0) {
6421                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
6422                            strerror(errno));
6423                 goto failed;
6424         }
6425
6426         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
6427         {
6428                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
6429                 goto failed;
6430         }
6431
6432         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
6433                                params->own_addr))
6434                 goto failed;
6435         os_memcpy(drv->perm_addr, params->own_addr, ETH_ALEN);
6436
6437         memcpy(bss->addr, params->own_addr, ETH_ALEN);
6438
6439         return bss;
6440
6441 failed:
6442         wpa_driver_nl80211_deinit(bss);
6443         return NULL;
6444 }
6445
6446
6447 static void i802_deinit(void *priv)
6448 {
6449         struct i802_bss *bss = priv;
6450         wpa_driver_nl80211_deinit(bss);
6451 }
6452
6453
6454 static enum nl80211_iftype wpa_driver_nl80211_if_type(
6455         enum wpa_driver_if_type type)
6456 {
6457         switch (type) {
6458         case WPA_IF_STATION:
6459                 return NL80211_IFTYPE_STATION;
6460         case WPA_IF_P2P_CLIENT:
6461         case WPA_IF_P2P_GROUP:
6462                 return NL80211_IFTYPE_P2P_CLIENT;
6463         case WPA_IF_AP_VLAN:
6464                 return NL80211_IFTYPE_AP_VLAN;
6465         case WPA_IF_AP_BSS:
6466                 return NL80211_IFTYPE_AP;
6467         case WPA_IF_P2P_GO:
6468                 return NL80211_IFTYPE_P2P_GO;
6469         case WPA_IF_P2P_DEVICE:
6470                 return NL80211_IFTYPE_P2P_DEVICE;
6471         }
6472         return -1;
6473 }
6474
6475
6476 #ifdef CONFIG_P2P
6477
6478 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
6479 {
6480         struct wpa_driver_nl80211_data *drv;
6481         dl_list_for_each(drv, &global->interfaces,
6482                          struct wpa_driver_nl80211_data, list) {
6483                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
6484                         return 1;
6485         }
6486         return 0;
6487 }
6488
6489
6490 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
6491                                       u8 *new_addr)
6492 {
6493         unsigned int idx;
6494
6495         if (!drv->global)
6496                 return -1;
6497
6498         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
6499         for (idx = 0; idx < 64; idx++) {
6500                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
6501                 new_addr[0] ^= idx << 2;
6502                 if (!nl80211_addr_in_use(drv->global, new_addr))
6503                         break;
6504         }
6505         if (idx == 64)
6506                 return -1;
6507
6508         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
6509                    MACSTR, MAC2STR(new_addr));
6510
6511         return 0;
6512 }
6513
6514 #endif /* CONFIG_P2P */
6515
6516
6517 struct wdev_info {
6518         u64 wdev_id;
6519         int wdev_id_set;
6520         u8 macaddr[ETH_ALEN];
6521 };
6522
6523 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
6524 {
6525         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6526         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6527         struct wdev_info *wi = arg;
6528
6529         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6530                   genlmsg_attrlen(gnlh, 0), NULL);
6531         if (tb[NL80211_ATTR_WDEV]) {
6532                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
6533                 wi->wdev_id_set = 1;
6534         }
6535
6536         if (tb[NL80211_ATTR_MAC])
6537                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
6538                           ETH_ALEN);
6539
6540         return NL_SKIP;
6541 }
6542
6543
6544 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
6545                                      const char *ifname, const u8 *addr,
6546                                      void *bss_ctx, void **drv_priv,
6547                                      char *force_ifname, u8 *if_addr,
6548                                      const char *bridge, int use_existing)
6549 {
6550         enum nl80211_iftype nlmode;
6551         struct i802_bss *bss = priv;
6552         struct wpa_driver_nl80211_data *drv = bss->drv;
6553         int ifidx;
6554         int added = 1;
6555
6556         if (addr)
6557                 os_memcpy(if_addr, addr, ETH_ALEN);
6558         nlmode = wpa_driver_nl80211_if_type(type);
6559         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
6560                 struct wdev_info p2pdev_info;
6561
6562                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
6563                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6564                                              0, nl80211_wdev_handler,
6565                                              &p2pdev_info, use_existing);
6566                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
6567                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
6568                                    ifname);
6569                         return -1;
6570                 }
6571
6572                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
6573                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
6574                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
6575                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
6576                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
6577                            ifname,
6578                            (long long unsigned int) p2pdev_info.wdev_id);
6579         } else {
6580                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6581                                              0, NULL, NULL, use_existing);
6582                 if (use_existing && ifidx == -ENFILE) {
6583                         added = 0;
6584                         ifidx = if_nametoindex(ifname);
6585                 } else if (ifidx < 0) {
6586                         return -1;
6587                 }
6588         }
6589
6590         if (!addr) {
6591                 if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
6592                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
6593                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
6594                                             bss->ifname, if_addr) < 0) {
6595                         if (added)
6596                                 nl80211_remove_iface(drv, ifidx);
6597                         return -1;
6598                 }
6599         }
6600
6601 #ifdef CONFIG_P2P
6602         if (!addr &&
6603             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
6604              type == WPA_IF_P2P_GO)) {
6605                 /* Enforce unique P2P Interface Address */
6606                 u8 new_addr[ETH_ALEN];
6607
6608                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
6609                                        new_addr) < 0) {
6610                         if (added)
6611                                 nl80211_remove_iface(drv, ifidx);
6612                         return -1;
6613                 }
6614                 if (nl80211_addr_in_use(drv->global, new_addr)) {
6615                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
6616                                    "for P2P group interface");
6617                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
6618                                 if (added)
6619                                         nl80211_remove_iface(drv, ifidx);
6620                                 return -1;
6621                         }
6622                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
6623                                                new_addr) < 0) {
6624                                 if (added)
6625                                         nl80211_remove_iface(drv, ifidx);
6626                                 return -1;
6627                         }
6628                 }
6629                 os_memcpy(if_addr, new_addr, ETH_ALEN);
6630         }
6631 #endif /* CONFIG_P2P */
6632
6633         if (type == WPA_IF_AP_BSS) {
6634                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
6635                 if (new_bss == NULL) {
6636                         if (added)
6637                                 nl80211_remove_iface(drv, ifidx);
6638                         return -1;
6639                 }
6640
6641                 if (bridge &&
6642                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
6643                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
6644                                    "interface %s to a bridge %s",
6645                                    ifname, bridge);
6646                         if (added)
6647                                 nl80211_remove_iface(drv, ifidx);
6648                         os_free(new_bss);
6649                         return -1;
6650                 }
6651
6652                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
6653                 {
6654                         if (added)
6655                                 nl80211_remove_iface(drv, ifidx);
6656                         os_free(new_bss);
6657                         return -1;
6658                 }
6659                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
6660                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
6661                 new_bss->ifindex = ifidx;
6662                 new_bss->drv = drv;
6663                 new_bss->next = drv->first_bss->next;
6664                 new_bss->freq = drv->first_bss->freq;
6665                 new_bss->ctx = bss_ctx;
6666                 new_bss->added_if = added;
6667                 drv->first_bss->next = new_bss;
6668                 if (drv_priv)
6669                         *drv_priv = new_bss;
6670                 nl80211_init_bss(new_bss);
6671
6672                 /* Subscribe management frames for this WPA_IF_AP_BSS */
6673                 if (nl80211_setup_ap(new_bss))
6674                         return -1;
6675         }
6676
6677         if (drv->global)
6678                 drv->global->if_add_ifindex = ifidx;
6679
6680         /*
6681          * Some virtual interfaces need to process EAPOL packets and events on
6682          * the parent interface. This is used mainly with hostapd.
6683          */
6684         if (ifidx > 0 &&
6685             (drv->hostapd ||
6686              nlmode == NL80211_IFTYPE_AP_VLAN ||
6687              nlmode == NL80211_IFTYPE_WDS ||
6688              nlmode == NL80211_IFTYPE_MONITOR))
6689                 add_ifidx(drv, ifidx);
6690
6691         return 0;
6692 }
6693
6694
6695 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
6696                                         enum wpa_driver_if_type type,
6697                                         const char *ifname)
6698 {
6699         struct wpa_driver_nl80211_data *drv = bss->drv;
6700         int ifindex = if_nametoindex(ifname);
6701
6702         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
6703                    __func__, type, ifname, ifindex, bss->added_if);
6704         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
6705                 nl80211_remove_iface(drv, ifindex);
6706         else if (ifindex > 0 && !bss->added_if) {
6707                 struct wpa_driver_nl80211_data *drv2;
6708                 dl_list_for_each(drv2, &drv->global->interfaces,
6709                                  struct wpa_driver_nl80211_data, list)
6710                         del_ifidx(drv2, ifindex);
6711         }
6712
6713         if (type != WPA_IF_AP_BSS)
6714                 return 0;
6715
6716         if (bss->added_if_into_bridge) {
6717                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
6718                                     bss->ifname) < 0)
6719                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6720                                    "interface %s from bridge %s: %s",
6721                                    bss->ifname, bss->brname, strerror(errno));
6722         }
6723         if (bss->added_bridge) {
6724                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
6725                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6726                                    "bridge %s: %s",
6727                                    bss->brname, strerror(errno));
6728         }
6729
6730         if (bss != drv->first_bss) {
6731                 struct i802_bss *tbss;
6732
6733                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
6734                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
6735                         if (tbss->next == bss) {
6736                                 tbss->next = bss->next;
6737                                 /* Unsubscribe management frames */
6738                                 nl80211_teardown_ap(bss);
6739                                 nl80211_destroy_bss(bss);
6740                                 if (!bss->added_if)
6741                                         i802_set_iface_flags(bss, 0);
6742                                 os_free(bss);
6743                                 bss = NULL;
6744                                 break;
6745                         }
6746                 }
6747                 if (bss)
6748                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
6749                                    "BSS %p in the list", __func__, bss);
6750         } else {
6751                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
6752                 nl80211_teardown_ap(bss);
6753                 if (!bss->added_if && !drv->first_bss->next)
6754                         wpa_driver_nl80211_del_beacon(drv);
6755                 nl80211_destroy_bss(bss);
6756                 if (!bss->added_if)
6757                         i802_set_iface_flags(bss, 0);
6758                 if (drv->first_bss->next) {
6759                         drv->first_bss = drv->first_bss->next;
6760                         drv->ctx = drv->first_bss->ctx;
6761                         os_free(bss);
6762                 } else {
6763                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
6764                 }
6765         }
6766
6767         return 0;
6768 }
6769
6770
6771 static int cookie_handler(struct nl_msg *msg, void *arg)
6772 {
6773         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6774         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6775         u64 *cookie = arg;
6776         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6777                   genlmsg_attrlen(gnlh, 0), NULL);
6778         if (tb[NL80211_ATTR_COOKIE])
6779                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
6780         return NL_SKIP;
6781 }
6782
6783
6784 static int nl80211_send_frame_cmd(struct i802_bss *bss,
6785                                   unsigned int freq, unsigned int wait,
6786                                   const u8 *buf, size_t buf_len,
6787                                   u64 *cookie_out, int no_cck, int no_ack,
6788                                   int offchanok)
6789 {
6790         struct wpa_driver_nl80211_data *drv = bss->drv;
6791         struct nl_msg *msg;
6792         u64 cookie;
6793         int ret = -1;
6794
6795         msg = nlmsg_alloc();
6796         if (!msg)
6797                 return -1;
6798
6799         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
6800                    "no_ack=%d offchanok=%d",
6801                    freq, wait, no_cck, no_ack, offchanok);
6802         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
6803         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
6804
6805         if (nl80211_set_iface_id(msg, bss) < 0)
6806                 goto nla_put_failure;
6807         if (freq)
6808                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
6809         if (wait)
6810                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
6811         if (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6812                           drv->test_use_roc_tx))
6813                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
6814         if (no_cck)
6815                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
6816         if (no_ack)
6817                 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
6818
6819         NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
6820
6821         cookie = 0;
6822         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6823         msg = NULL;
6824         if (ret) {
6825                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
6826                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
6827                            freq, wait);
6828                 goto nla_put_failure;
6829         }
6830         wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
6831                    "cookie 0x%llx", no_ack ? " (no ACK)" : "",
6832                    (long long unsigned int) cookie);
6833
6834         if (cookie_out)
6835                 *cookie_out = no_ack ? (u64) -1 : cookie;
6836
6837 nla_put_failure:
6838         nlmsg_free(msg);
6839         return ret;
6840 }
6841
6842
6843 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
6844                                           unsigned int freq,
6845                                           unsigned int wait_time,
6846                                           const u8 *dst, const u8 *src,
6847                                           const u8 *bssid,
6848                                           const u8 *data, size_t data_len,
6849                                           int no_cck)
6850 {
6851         struct wpa_driver_nl80211_data *drv = bss->drv;
6852         int ret = -1;
6853         u8 *buf;
6854         struct ieee80211_hdr *hdr;
6855
6856         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
6857                    "freq=%u MHz wait=%d ms no_cck=%d)",
6858                    drv->ifindex, freq, wait_time, no_cck);
6859
6860         buf = os_zalloc(24 + data_len);
6861         if (buf == NULL)
6862                 return ret;
6863         os_memcpy(buf + 24, data, data_len);
6864         hdr = (struct ieee80211_hdr *) buf;
6865         hdr->frame_control =
6866                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
6867         os_memcpy(hdr->addr1, dst, ETH_ALEN);
6868         os_memcpy(hdr->addr2, src, ETH_ALEN);
6869         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
6870
6871         if (is_ap_interface(drv->nlmode) &&
6872             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6873              (int) freq == bss->freq || drv->device_ap_sme ||
6874              !drv->use_monitor))
6875                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
6876                                                    0, freq, no_cck, 1,
6877                                                    wait_time);
6878         else
6879                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
6880                                              24 + data_len,
6881                                              &drv->send_action_cookie,
6882                                              no_cck, 0, 1);
6883
6884         os_free(buf);
6885         return ret;
6886 }
6887
6888
6889 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
6890 {
6891         struct i802_bss *bss = priv;
6892         struct wpa_driver_nl80211_data *drv = bss->drv;
6893         struct nl_msg *msg;
6894         int ret;
6895
6896         msg = nlmsg_alloc();
6897         if (!msg)
6898                 return;
6899
6900         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
6901                    (long long unsigned int) drv->send_action_cookie);
6902         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
6903
6904         if (nl80211_set_iface_id(msg, bss) < 0)
6905                 goto nla_put_failure;
6906         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
6907
6908         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6909         msg = NULL;
6910         if (ret)
6911                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
6912                            "(%s)", ret, strerror(-ret));
6913
6914  nla_put_failure:
6915         nlmsg_free(msg);
6916 }
6917
6918
6919 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
6920                                                 unsigned int duration)
6921 {
6922         struct i802_bss *bss = priv;
6923         struct wpa_driver_nl80211_data *drv = bss->drv;
6924         struct nl_msg *msg;
6925         int ret;
6926         u64 cookie;
6927
6928         msg = nlmsg_alloc();
6929         if (!msg)
6930                 return -1;
6931
6932         nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
6933
6934         if (nl80211_set_iface_id(msg, bss) < 0)
6935                 goto nla_put_failure;
6936
6937         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
6938         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
6939
6940         cookie = 0;
6941         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6942         msg = NULL;
6943         if (ret == 0) {
6944                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
6945                            "0x%llx for freq=%u MHz duration=%u",
6946                            (long long unsigned int) cookie, freq, duration);
6947                 drv->remain_on_chan_cookie = cookie;
6948                 drv->pending_remain_on_chan = 1;
6949                 return 0;
6950         }
6951         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
6952                    "(freq=%d duration=%u): %d (%s)",
6953                    freq, duration, ret, strerror(-ret));
6954 nla_put_failure:
6955         nlmsg_free(msg);
6956         return -1;
6957 }
6958
6959
6960 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
6961 {
6962         struct i802_bss *bss = priv;
6963         struct wpa_driver_nl80211_data *drv = bss->drv;
6964         struct nl_msg *msg;
6965         int ret;
6966
6967         if (!drv->pending_remain_on_chan) {
6968                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
6969                            "to cancel");
6970                 return -1;
6971         }
6972
6973         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
6974                    "0x%llx",
6975                    (long long unsigned int) drv->remain_on_chan_cookie);
6976
6977         msg = nlmsg_alloc();
6978         if (!msg)
6979                 return -1;
6980
6981         nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
6982
6983         if (nl80211_set_iface_id(msg, bss) < 0)
6984                 goto nla_put_failure;
6985
6986         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
6987
6988         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6989         msg = NULL;
6990         if (ret == 0)
6991                 return 0;
6992         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
6993                    "%d (%s)", ret, strerror(-ret));
6994 nla_put_failure:
6995         nlmsg_free(msg);
6996         return -1;
6997 }
6998
6999
7000 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
7001 {
7002         struct wpa_driver_nl80211_data *drv = bss->drv;
7003
7004         if (!report) {
7005                 if (bss->nl_preq && drv->device_ap_sme &&
7006                     is_ap_interface(drv->nlmode) && !bss->in_deinit &&
7007                     !bss->static_ap) {
7008                         /*
7009                          * Do not disable Probe Request reporting that was
7010                          * enabled in nl80211_setup_ap().
7011                          */
7012                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
7013                                    "Probe Request reporting nl_preq=%p while "
7014                                    "in AP mode", bss->nl_preq);
7015                 } else if (bss->nl_preq) {
7016                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
7017                                    "reporting nl_preq=%p", bss->nl_preq);
7018                         nl80211_destroy_eloop_handle(&bss->nl_preq);
7019                 }
7020                 return 0;
7021         }
7022
7023         if (bss->nl_preq) {
7024                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
7025                            "already on! nl_preq=%p", bss->nl_preq);
7026                 return 0;
7027         }
7028
7029         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
7030         if (bss->nl_preq == NULL)
7031                 return -1;
7032         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
7033                    "reporting nl_preq=%p", bss->nl_preq);
7034
7035         if (nl80211_register_frame(bss, bss->nl_preq,
7036                                    (WLAN_FC_TYPE_MGMT << 2) |
7037                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
7038                                    NULL, 0) < 0)
7039                 goto out_err;
7040
7041         nl80211_register_eloop_read(&bss->nl_preq,
7042                                     wpa_driver_nl80211_event_receive,
7043                                     bss->nl_cb);
7044
7045         return 0;
7046
7047  out_err:
7048         nl_destroy_handles(&bss->nl_preq);
7049         return -1;
7050 }
7051
7052
7053 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
7054                                      int ifindex, int disabled)
7055 {
7056         struct nl_msg *msg;
7057         struct nlattr *bands, *band;
7058         int ret;
7059
7060         msg = nlmsg_alloc();
7061         if (!msg)
7062                 return -1;
7063
7064         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
7065         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
7066
7067         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
7068         if (!bands)
7069                 goto nla_put_failure;
7070
7071         /*
7072          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
7073          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
7074          * rates. All 5 GHz rates are left enabled.
7075          */
7076         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
7077         if (!band)
7078                 goto nla_put_failure;
7079         if (disabled) {
7080                 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
7081                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
7082         }
7083         nla_nest_end(msg, band);
7084
7085         nla_nest_end(msg, bands);
7086
7087         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7088         msg = NULL;
7089         if (ret) {
7090                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
7091                            "(%s)", ret, strerror(-ret));
7092         } else
7093                 drv->disabled_11b_rates = disabled;
7094
7095         return ret;
7096
7097 nla_put_failure:
7098         nlmsg_free(msg);
7099         return -1;
7100 }
7101
7102
7103 static int wpa_driver_nl80211_deinit_ap(void *priv)
7104 {
7105         struct i802_bss *bss = priv;
7106         struct wpa_driver_nl80211_data *drv = bss->drv;
7107         if (!is_ap_interface(drv->nlmode))
7108                 return -1;
7109         wpa_driver_nl80211_del_beacon(drv);
7110         bss->beacon_set = 0;
7111
7112         /*
7113          * If the P2P GO interface was dynamically added, then it is
7114          * possible that the interface change to station is not possible.
7115          */
7116         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
7117                 return 0;
7118
7119         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
7120 }
7121
7122
7123 static int wpa_driver_nl80211_stop_ap(void *priv)
7124 {
7125         struct i802_bss *bss = priv;
7126         struct wpa_driver_nl80211_data *drv = bss->drv;
7127         if (!is_ap_interface(drv->nlmode))
7128                 return -1;
7129         wpa_driver_nl80211_del_beacon(drv);
7130         bss->beacon_set = 0;
7131         return 0;
7132 }
7133
7134
7135 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
7136 {
7137         struct i802_bss *bss = priv;
7138         struct wpa_driver_nl80211_data *drv = bss->drv;
7139         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
7140                 return -1;
7141
7142         /*
7143          * If the P2P Client interface was dynamically added, then it is
7144          * possible that the interface change to station is not possible.
7145          */
7146         if (bss->if_dynamic)
7147                 return 0;
7148
7149         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
7150 }
7151
7152
7153 static void wpa_driver_nl80211_resume(void *priv)
7154 {
7155         struct i802_bss *bss = priv;
7156
7157         if (i802_set_iface_flags(bss, 1))
7158                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
7159 }
7160
7161
7162 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
7163                                   const u8 *ies, size_t ies_len)
7164 {
7165         struct i802_bss *bss = priv;
7166         struct wpa_driver_nl80211_data *drv = bss->drv;
7167         int ret;
7168         u8 *data, *pos;
7169         size_t data_len;
7170         const u8 *own_addr = bss->addr;
7171
7172         if (action != 1) {
7173                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
7174                            "action %d", action);
7175                 return -1;
7176         }
7177
7178         /*
7179          * Action frame payload:
7180          * Category[1] = 6 (Fast BSS Transition)
7181          * Action[1] = 1 (Fast BSS Transition Request)
7182          * STA Address
7183          * Target AP Address
7184          * FT IEs
7185          */
7186
7187         data_len = 2 + 2 * ETH_ALEN + ies_len;
7188         data = os_malloc(data_len);
7189         if (data == NULL)
7190                 return -1;
7191         pos = data;
7192         *pos++ = 0x06; /* FT Action category */
7193         *pos++ = action;
7194         os_memcpy(pos, own_addr, ETH_ALEN);
7195         pos += ETH_ALEN;
7196         os_memcpy(pos, target_ap, ETH_ALEN);
7197         pos += ETH_ALEN;
7198         os_memcpy(pos, ies, ies_len);
7199
7200         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
7201                                              drv->bssid, own_addr, drv->bssid,
7202                                              data, data_len, 0);
7203         os_free(data);
7204
7205         return ret;
7206 }
7207
7208
7209 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
7210 {
7211         struct i802_bss *bss = priv;
7212         struct wpa_driver_nl80211_data *drv = bss->drv;
7213         struct nl_msg *msg;
7214         struct nlattr *cqm;
7215         int ret = -1;
7216
7217         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
7218                    "hysteresis=%d", threshold, hysteresis);
7219
7220         msg = nlmsg_alloc();
7221         if (!msg)
7222                 return -1;
7223
7224         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
7225
7226         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7227
7228         cqm = nla_nest_start(msg, NL80211_ATTR_CQM);
7229         if (cqm == NULL)
7230                 goto nla_put_failure;
7231
7232         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
7233         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
7234         nla_nest_end(msg, cqm);
7235
7236         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7237         msg = NULL;
7238
7239 nla_put_failure:
7240         nlmsg_free(msg);
7241         return ret;
7242 }
7243
7244
7245 static int get_channel_width(struct nl_msg *msg, void *arg)
7246 {
7247         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7248         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7249         struct wpa_signal_info *sig_change = arg;
7250
7251         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7252                   genlmsg_attrlen(gnlh, 0), NULL);
7253
7254         sig_change->center_frq1 = -1;
7255         sig_change->center_frq2 = -1;
7256         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
7257
7258         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
7259                 sig_change->chanwidth = convert2width(
7260                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
7261                 if (tb[NL80211_ATTR_CENTER_FREQ1])
7262                         sig_change->center_frq1 =
7263                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
7264                 if (tb[NL80211_ATTR_CENTER_FREQ2])
7265                         sig_change->center_frq2 =
7266                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
7267         }
7268
7269         return NL_SKIP;
7270 }
7271
7272
7273 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
7274                                      struct wpa_signal_info *sig)
7275 {
7276         struct nl_msg *msg;
7277
7278         msg = nlmsg_alloc();
7279         if (!msg)
7280                 return -ENOMEM;
7281
7282         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_INTERFACE);
7283         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7284
7285         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
7286
7287 nla_put_failure:
7288         nlmsg_free(msg);
7289         return -ENOBUFS;
7290 }
7291
7292
7293 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
7294 {
7295         struct i802_bss *bss = priv;
7296         struct wpa_driver_nl80211_data *drv = bss->drv;
7297         int res;
7298
7299         os_memset(si, 0, sizeof(*si));
7300         res = nl80211_get_link_signal(drv, si);
7301         if (res != 0)
7302                 return res;
7303
7304         res = nl80211_get_channel_width(drv, si);
7305         if (res != 0)
7306                 return res;
7307
7308         return nl80211_get_link_noise(drv, si);
7309 }
7310
7311
7312 static int wpa_driver_nl80211_shared_freq(void *priv)
7313 {
7314         struct i802_bss *bss = priv;
7315         struct wpa_driver_nl80211_data *drv = bss->drv;
7316         struct wpa_driver_nl80211_data *driver;
7317         int freq = 0;
7318
7319         /*
7320          * If the same PHY is in connected state with some other interface,
7321          * then retrieve the assoc freq.
7322          */
7323         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
7324                    drv->phyname);
7325
7326         dl_list_for_each(driver, &drv->global->interfaces,
7327                          struct wpa_driver_nl80211_data, list) {
7328                 if (drv == driver ||
7329                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
7330                     !driver->associated)
7331                         continue;
7332
7333                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
7334                            MACSTR,
7335                            driver->phyname, driver->first_bss->ifname,
7336                            MAC2STR(driver->first_bss->addr));
7337                 if (is_ap_interface(driver->nlmode))
7338                         freq = driver->first_bss->freq;
7339                 else
7340                         freq = nl80211_get_assoc_freq(driver);
7341                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
7342                            drv->phyname, freq);
7343         }
7344
7345         if (!freq)
7346                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
7347                            "PHY (%s) in associated state", drv->phyname);
7348
7349         return freq;
7350 }
7351
7352
7353 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
7354                               int encrypt)
7355 {
7356         struct i802_bss *bss = priv;
7357         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
7358                                              0, 0, 0, 0);
7359 }
7360
7361
7362 static int nl80211_set_param(void *priv, const char *param)
7363 {
7364         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
7365         if (param == NULL)
7366                 return 0;
7367
7368 #ifdef CONFIG_P2P
7369         if (os_strstr(param, "use_p2p_group_interface=1")) {
7370                 struct i802_bss *bss = priv;
7371                 struct wpa_driver_nl80211_data *drv = bss->drv;
7372
7373                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
7374                            "interface");
7375                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
7376                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
7377         }
7378 #endif /* CONFIG_P2P */
7379
7380         if (os_strstr(param, "use_monitor=1")) {
7381                 struct i802_bss *bss = priv;
7382                 struct wpa_driver_nl80211_data *drv = bss->drv;
7383                 drv->use_monitor = 1;
7384         }
7385
7386         if (os_strstr(param, "force_connect_cmd=1")) {
7387                 struct i802_bss *bss = priv;
7388                 struct wpa_driver_nl80211_data *drv = bss->drv;
7389                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
7390                 drv->force_connect_cmd = 1;
7391         }
7392
7393         if (os_strstr(param, "no_offchannel_tx=1")) {
7394                 struct i802_bss *bss = priv;
7395                 struct wpa_driver_nl80211_data *drv = bss->drv;
7396                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
7397                 drv->test_use_roc_tx = 1;
7398         }
7399
7400         return 0;
7401 }
7402
7403
7404 static void * nl80211_global_init(void)
7405 {
7406         struct nl80211_global *global;
7407         struct netlink_config *cfg;
7408
7409         global = os_zalloc(sizeof(*global));
7410         if (global == NULL)
7411                 return NULL;
7412         global->ioctl_sock = -1;
7413         dl_list_init(&global->interfaces);
7414         global->if_add_ifindex = -1;
7415
7416         cfg = os_zalloc(sizeof(*cfg));
7417         if (cfg == NULL)
7418                 goto err;
7419
7420         cfg->ctx = global;
7421         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
7422         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
7423         global->netlink = netlink_init(cfg);
7424         if (global->netlink == NULL) {
7425                 os_free(cfg);
7426                 goto err;
7427         }
7428
7429         if (wpa_driver_nl80211_init_nl_global(global) < 0)
7430                 goto err;
7431
7432         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
7433         if (global->ioctl_sock < 0) {
7434                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
7435                            strerror(errno));
7436                 goto err;
7437         }
7438
7439         return global;
7440
7441 err:
7442         nl80211_global_deinit(global);
7443         return NULL;
7444 }
7445
7446
7447 static void nl80211_global_deinit(void *priv)
7448 {
7449         struct nl80211_global *global = priv;
7450         if (global == NULL)
7451                 return;
7452         if (!dl_list_empty(&global->interfaces)) {
7453                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
7454                            "nl80211_global_deinit",
7455                            dl_list_len(&global->interfaces));
7456         }
7457
7458         if (global->netlink)
7459                 netlink_deinit(global->netlink);
7460
7461         nl_destroy_handles(&global->nl);
7462
7463         if (global->nl_event)
7464                 nl80211_destroy_eloop_handle(&global->nl_event);
7465
7466         nl_cb_put(global->nl_cb);
7467
7468         if (global->ioctl_sock >= 0)
7469                 close(global->ioctl_sock);
7470
7471         os_free(global);
7472 }
7473
7474
7475 static const char * nl80211_get_radio_name(void *priv)
7476 {
7477         struct i802_bss *bss = priv;
7478         struct wpa_driver_nl80211_data *drv = bss->drv;
7479         return drv->phyname;
7480 }
7481
7482
7483 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
7484                          const u8 *pmkid)
7485 {
7486         struct nl_msg *msg;
7487
7488         msg = nlmsg_alloc();
7489         if (!msg)
7490                 return -ENOMEM;
7491
7492         nl80211_cmd(bss->drv, msg, 0, cmd);
7493
7494         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7495         if (pmkid)
7496                 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
7497         if (bssid)
7498                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7499
7500         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7501  nla_put_failure:
7502         nlmsg_free(msg);
7503         return -ENOBUFS;
7504 }
7505
7506
7507 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7508 {
7509         struct i802_bss *bss = priv;
7510         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
7511         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
7512 }
7513
7514
7515 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7516 {
7517         struct i802_bss *bss = priv;
7518         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
7519                    MAC2STR(bssid));
7520         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
7521 }
7522
7523
7524 static int nl80211_flush_pmkid(void *priv)
7525 {
7526         struct i802_bss *bss = priv;
7527         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
7528         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
7529 }
7530
7531
7532 static void clean_survey_results(struct survey_results *survey_results)
7533 {
7534         struct freq_survey *survey, *tmp;
7535
7536         if (dl_list_empty(&survey_results->survey_list))
7537                 return;
7538
7539         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
7540                               struct freq_survey, list) {
7541                 dl_list_del(&survey->list);
7542                 os_free(survey);
7543         }
7544 }
7545
7546
7547 static void add_survey(struct nlattr **sinfo, u32 ifidx,
7548                        struct dl_list *survey_list)
7549 {
7550         struct freq_survey *survey;
7551
7552         survey = os_zalloc(sizeof(struct freq_survey));
7553         if  (!survey)
7554                 return;
7555
7556         survey->ifidx = ifidx;
7557         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7558         survey->filled = 0;
7559
7560         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
7561                 survey->nf = (int8_t)
7562                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
7563                 survey->filled |= SURVEY_HAS_NF;
7564         }
7565
7566         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
7567                 survey->channel_time =
7568                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
7569                 survey->filled |= SURVEY_HAS_CHAN_TIME;
7570         }
7571
7572         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
7573                 survey->channel_time_busy =
7574                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
7575                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
7576         }
7577
7578         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
7579                 survey->channel_time_rx =
7580                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
7581                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
7582         }
7583
7584         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
7585                 survey->channel_time_tx =
7586                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
7587                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
7588         }
7589
7590         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
7591                    survey->freq,
7592                    survey->nf,
7593                    (unsigned long int) survey->channel_time,
7594                    (unsigned long int) survey->channel_time_busy,
7595                    (unsigned long int) survey->channel_time_tx,
7596                    (unsigned long int) survey->channel_time_rx,
7597                    survey->filled);
7598
7599         dl_list_add_tail(survey_list, &survey->list);
7600 }
7601
7602
7603 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
7604                            unsigned int freq_filter)
7605 {
7606         if (!freq_filter)
7607                 return 1;
7608
7609         return freq_filter == surveyed_freq;
7610 }
7611
7612
7613 static int survey_handler(struct nl_msg *msg, void *arg)
7614 {
7615         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7616         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7617         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
7618         struct survey_results *survey_results;
7619         u32 surveyed_freq = 0;
7620         u32 ifidx;
7621
7622         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
7623                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
7624                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
7625         };
7626
7627         survey_results = (struct survey_results *) arg;
7628
7629         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7630                   genlmsg_attrlen(gnlh, 0), NULL);
7631
7632         if (!tb[NL80211_ATTR_IFINDEX])
7633                 return NL_SKIP;
7634
7635         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
7636
7637         if (!tb[NL80211_ATTR_SURVEY_INFO])
7638                 return NL_SKIP;
7639
7640         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
7641                              tb[NL80211_ATTR_SURVEY_INFO],
7642                              survey_policy))
7643                 return NL_SKIP;
7644
7645         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
7646                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
7647                 return NL_SKIP;
7648         }
7649
7650         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7651
7652         if (!check_survey_ok(sinfo, surveyed_freq,
7653                              survey_results->freq_filter))
7654                 return NL_SKIP;
7655
7656         if (survey_results->freq_filter &&
7657             survey_results->freq_filter != surveyed_freq) {
7658                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
7659                            surveyed_freq);
7660                 return NL_SKIP;
7661         }
7662
7663         add_survey(sinfo, ifidx, &survey_results->survey_list);
7664
7665         return NL_SKIP;
7666 }
7667
7668
7669 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
7670 {
7671         struct i802_bss *bss = priv;
7672         struct wpa_driver_nl80211_data *drv = bss->drv;
7673         struct nl_msg *msg;
7674         int err = -ENOBUFS;
7675         union wpa_event_data data;
7676         struct survey_results *survey_results;
7677
7678         os_memset(&data, 0, sizeof(data));
7679         survey_results = &data.survey_results;
7680
7681         dl_list_init(&survey_results->survey_list);
7682
7683         msg = nlmsg_alloc();
7684         if (!msg)
7685                 goto nla_put_failure;
7686
7687         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
7688
7689         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7690
7691         if (freq)
7692                 data.survey_results.freq_filter = freq;
7693
7694         do {
7695                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
7696                 err = send_and_recv_msgs(drv, msg, survey_handler,
7697                                          survey_results);
7698         } while (err > 0);
7699
7700         if (err) {
7701                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
7702                 goto out_clean;
7703         }
7704
7705         wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
7706
7707 out_clean:
7708         clean_survey_results(survey_results);
7709 nla_put_failure:
7710         return err;
7711 }
7712
7713
7714 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
7715                                    const u8 *replay_ctr)
7716 {
7717         struct i802_bss *bss = priv;
7718         struct wpa_driver_nl80211_data *drv = bss->drv;
7719         struct nlattr *replay_nested;
7720         struct nl_msg *msg;
7721
7722         msg = nlmsg_alloc();
7723         if (!msg)
7724                 return;
7725
7726         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7727
7728         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7729
7730         replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7731         if (!replay_nested)
7732                 goto nla_put_failure;
7733
7734         NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
7735         NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
7736         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
7737                 replay_ctr);
7738
7739         nla_nest_end(msg, replay_nested);
7740
7741         send_and_recv_msgs(drv, msg, NULL, NULL);
7742         return;
7743  nla_put_failure:
7744         nlmsg_free(msg);
7745 }
7746
7747
7748 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
7749                                     const u8 *addr, int qos)
7750 {
7751         /* send data frame to poll STA and check whether
7752          * this frame is ACKed */
7753         struct {
7754                 struct ieee80211_hdr hdr;
7755                 u16 qos_ctl;
7756         } STRUCT_PACKED nulldata;
7757         size_t size;
7758
7759         /* Send data frame to poll STA and check whether this frame is ACKed */
7760
7761         os_memset(&nulldata, 0, sizeof(nulldata));
7762
7763         if (qos) {
7764                 nulldata.hdr.frame_control =
7765                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7766                                      WLAN_FC_STYPE_QOS_NULL);
7767                 size = sizeof(nulldata);
7768         } else {
7769                 nulldata.hdr.frame_control =
7770                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7771                                      WLAN_FC_STYPE_NULLFUNC);
7772                 size = sizeof(struct ieee80211_hdr);
7773         }
7774
7775         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
7776         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
7777         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
7778         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
7779
7780         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
7781                                          0, 0) < 0)
7782                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
7783                            "send poll frame");
7784 }
7785
7786 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
7787                                 int qos)
7788 {
7789         struct i802_bss *bss = priv;
7790         struct wpa_driver_nl80211_data *drv = bss->drv;
7791         struct nl_msg *msg;
7792
7793         if (!drv->poll_command_supported) {
7794                 nl80211_send_null_frame(bss, own_addr, addr, qos);
7795                 return;
7796         }
7797
7798         msg = nlmsg_alloc();
7799         if (!msg)
7800                 return;
7801
7802         nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
7803
7804         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7805         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7806
7807         send_and_recv_msgs(drv, msg, NULL, NULL);
7808         return;
7809  nla_put_failure:
7810         nlmsg_free(msg);
7811 }
7812
7813
7814 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
7815 {
7816         struct nl_msg *msg;
7817
7818         msg = nlmsg_alloc();
7819         if (!msg)
7820                 return -ENOMEM;
7821
7822         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
7823         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7824         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
7825                     enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
7826         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7827 nla_put_failure:
7828         nlmsg_free(msg);
7829         return -ENOBUFS;
7830 }
7831
7832
7833 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
7834                                      int ctwindow)
7835 {
7836         struct i802_bss *bss = priv;
7837
7838         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
7839                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
7840
7841         if (opp_ps != -1 || ctwindow != -1) {
7842 #ifdef ANDROID_P2P
7843                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
7844 #else /* ANDROID_P2P */
7845                 return -1; /* Not yet supported */
7846 #endif /* ANDROID_P2P */
7847         }
7848
7849         if (legacy_ps == -1)
7850                 return 0;
7851         if (legacy_ps != 0 && legacy_ps != 1)
7852                 return -1; /* Not yet supported */
7853
7854         return nl80211_set_power_save(bss, legacy_ps);
7855 }
7856
7857
7858 static int nl80211_start_radar_detection(void *priv,
7859                                          struct hostapd_freq_params *freq)
7860 {
7861         struct i802_bss *bss = priv;
7862         struct wpa_driver_nl80211_data *drv = bss->drv;
7863         struct nl_msg *msg;
7864         int ret;
7865
7866         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7867                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7868                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7869
7870         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
7871                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
7872                            "detection");
7873                 return -1;
7874         }
7875
7876         msg = nlmsg_alloc();
7877         if (!msg)
7878                 return -1;
7879
7880         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_RADAR_DETECT);
7881         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7882
7883         if (nl80211_put_freq_params(msg, freq) < 0)
7884                 goto nla_put_failure;
7885
7886         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7887         msg = NULL;
7888         if (ret == 0)
7889                 return 0;
7890         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
7891                    "%d (%s)", ret, strerror(-ret));
7892 nla_put_failure:
7893         nlmsg_free(msg);
7894         return -1;
7895 }
7896
7897 #ifdef CONFIG_TDLS
7898
7899 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
7900                                   u8 dialog_token, u16 status_code,
7901                                   u32 peer_capab, int initiator, const u8 *buf,
7902                                   size_t len)
7903 {
7904         struct i802_bss *bss = priv;
7905         struct wpa_driver_nl80211_data *drv = bss->drv;
7906         struct nl_msg *msg;
7907
7908         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7909                 return -EOPNOTSUPP;
7910
7911         if (!dst)
7912                 return -EINVAL;
7913
7914         msg = nlmsg_alloc();
7915         if (!msg)
7916                 return -ENOMEM;
7917
7918         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
7919         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7920         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
7921         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
7922         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
7923         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
7924         if (peer_capab) {
7925                 /*
7926                  * The internal enum tdls_peer_capability definition is
7927                  * currently identical with the nl80211 enum
7928                  * nl80211_tdls_peer_capability, so no conversion is needed
7929                  * here.
7930                  */
7931                 NLA_PUT_U32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY, peer_capab);
7932         }
7933         if (initiator)
7934                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_INITIATOR);
7935         NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
7936
7937         return send_and_recv_msgs(drv, msg, NULL, NULL);
7938
7939 nla_put_failure:
7940         nlmsg_free(msg);
7941         return -ENOBUFS;
7942 }
7943
7944
7945 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
7946 {
7947         struct i802_bss *bss = priv;
7948         struct wpa_driver_nl80211_data *drv = bss->drv;
7949         struct nl_msg *msg;
7950         enum nl80211_tdls_operation nl80211_oper;
7951
7952         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7953                 return -EOPNOTSUPP;
7954
7955         switch (oper) {
7956         case TDLS_DISCOVERY_REQ:
7957                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
7958                 break;
7959         case TDLS_SETUP:
7960                 nl80211_oper = NL80211_TDLS_SETUP;
7961                 break;
7962         case TDLS_TEARDOWN:
7963                 nl80211_oper = NL80211_TDLS_TEARDOWN;
7964                 break;
7965         case TDLS_ENABLE_LINK:
7966                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
7967                 break;
7968         case TDLS_DISABLE_LINK:
7969                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
7970                 break;
7971         case TDLS_ENABLE:
7972                 return 0;
7973         case TDLS_DISABLE:
7974                 return 0;
7975         default:
7976                 return -EINVAL;
7977         }
7978
7979         msg = nlmsg_alloc();
7980         if (!msg)
7981                 return -ENOMEM;
7982
7983         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
7984         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
7985         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7986         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7987
7988         return send_and_recv_msgs(drv, msg, NULL, NULL);
7989
7990 nla_put_failure:
7991         nlmsg_free(msg);
7992         return -ENOBUFS;
7993 }
7994
7995 #endif /* CONFIG TDLS */
7996
7997
7998 static int driver_nl80211_set_key(const char *ifname, void *priv,
7999                                   enum wpa_alg alg, const u8 *addr,
8000                                   int key_idx, int set_tx,
8001                                   const u8 *seq, size_t seq_len,
8002                                   const u8 *key, size_t key_len)
8003 {
8004         struct i802_bss *bss = priv;
8005         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
8006                                           set_tx, seq, seq_len, key, key_len);
8007 }
8008
8009
8010 static int driver_nl80211_scan2(void *priv,
8011                                 struct wpa_driver_scan_params *params)
8012 {
8013         struct i802_bss *bss = priv;
8014         return wpa_driver_nl80211_scan(bss, params);
8015 }
8016
8017
8018 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
8019                                          int reason_code)
8020 {
8021         struct i802_bss *bss = priv;
8022         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
8023 }
8024
8025
8026 static int driver_nl80211_authenticate(void *priv,
8027                                        struct wpa_driver_auth_params *params)
8028 {
8029         struct i802_bss *bss = priv;
8030         return wpa_driver_nl80211_authenticate(bss, params);
8031 }
8032
8033
8034 static void driver_nl80211_deinit(void *priv)
8035 {
8036         struct i802_bss *bss = priv;
8037         wpa_driver_nl80211_deinit(bss);
8038 }
8039
8040
8041 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
8042                                     const char *ifname)
8043 {
8044         struct i802_bss *bss = priv;
8045         return wpa_driver_nl80211_if_remove(bss, type, ifname);
8046 }
8047
8048
8049 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
8050                                     size_t data_len, int noack)
8051 {
8052         struct i802_bss *bss = priv;
8053         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
8054                                             0, 0, 0, 0);
8055 }
8056
8057
8058 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
8059 {
8060         struct i802_bss *bss = priv;
8061         return wpa_driver_nl80211_sta_remove(bss, addr, -1, 0);
8062 }
8063
8064
8065 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
8066                                        const char *ifname, int vlan_id)
8067 {
8068         struct i802_bss *bss = priv;
8069         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
8070 }
8071
8072
8073 static int driver_nl80211_read_sta_data(void *priv,
8074                                         struct hostap_sta_driver_data *data,
8075                                         const u8 *addr)
8076 {
8077         struct i802_bss *bss = priv;
8078         return i802_read_sta_data(bss, data, addr);
8079 }
8080
8081
8082 static int driver_nl80211_send_action(void *priv, unsigned int freq,
8083                                       unsigned int wait_time,
8084                                       const u8 *dst, const u8 *src,
8085                                       const u8 *bssid,
8086                                       const u8 *data, size_t data_len,
8087                                       int no_cck)
8088 {
8089         struct i802_bss *bss = priv;
8090         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
8091                                               bssid, data, data_len, no_cck);
8092 }
8093
8094
8095 static int driver_nl80211_probe_req_report(void *priv, int report)
8096 {
8097         struct i802_bss *bss = priv;
8098         return wpa_driver_nl80211_probe_req_report(bss, report);
8099 }
8100
8101
8102 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
8103                                             const u8 *ies, size_t ies_len)
8104 {
8105         int ret;
8106         struct nl_msg *msg;
8107         struct i802_bss *bss = priv;
8108         struct wpa_driver_nl80211_data *drv = bss->drv;
8109         u16 mdid = WPA_GET_LE16(md);
8110
8111         msg = nlmsg_alloc();
8112         if (!msg)
8113                 return -ENOMEM;
8114
8115         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
8116         nl80211_cmd(drv, msg, 0, NL80211_CMD_UPDATE_FT_IES);
8117         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8118         NLA_PUT(msg, NL80211_ATTR_IE, ies_len, ies);
8119         NLA_PUT_U16(msg, NL80211_ATTR_MDID, mdid);
8120
8121         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8122         if (ret) {
8123                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
8124                            "err=%d (%s)", ret, strerror(-ret));
8125         }
8126
8127         return ret;
8128
8129 nla_put_failure:
8130         nlmsg_free(msg);
8131         return -ENOBUFS;
8132 }
8133
8134
8135 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
8136 {
8137         struct i802_bss *bss = priv;
8138         struct wpa_driver_nl80211_data *drv = bss->drv;
8139
8140         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
8141                 return NULL;
8142
8143         return bss->addr;
8144 }
8145
8146
8147 static const char * scan_state_str(enum scan_states scan_state)
8148 {
8149         switch (scan_state) {
8150         case NO_SCAN:
8151                 return "NO_SCAN";
8152         case SCAN_REQUESTED:
8153                 return "SCAN_REQUESTED";
8154         case SCAN_STARTED:
8155                 return "SCAN_STARTED";
8156         case SCAN_COMPLETED:
8157                 return "SCAN_COMPLETED";
8158         case SCAN_ABORTED:
8159                 return "SCAN_ABORTED";
8160         case SCHED_SCAN_STARTED:
8161                 return "SCHED_SCAN_STARTED";
8162         case SCHED_SCAN_STOPPED:
8163                 return "SCHED_SCAN_STOPPED";
8164         case SCHED_SCAN_RESULTS:
8165                 return "SCHED_SCAN_RESULTS";
8166         }
8167
8168         return "??";
8169 }
8170
8171
8172 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
8173 {
8174         struct i802_bss *bss = priv;
8175         struct wpa_driver_nl80211_data *drv = bss->drv;
8176         int res;
8177         char *pos, *end;
8178
8179         pos = buf;
8180         end = buf + buflen;
8181
8182         res = os_snprintf(pos, end - pos,
8183                           "ifindex=%d\n"
8184                           "ifname=%s\n"
8185                           "brname=%s\n"
8186                           "addr=" MACSTR "\n"
8187                           "freq=%d\n"
8188                           "%s%s%s%s%s",
8189                           bss->ifindex,
8190                           bss->ifname,
8191                           bss->brname,
8192                           MAC2STR(bss->addr),
8193                           bss->freq,
8194                           bss->beacon_set ? "beacon_set=1\n" : "",
8195                           bss->added_if_into_bridge ?
8196                           "added_if_into_bridge=1\n" : "",
8197                           bss->added_bridge ? "added_bridge=1\n" : "",
8198                           bss->in_deinit ? "in_deinit=1\n" : "",
8199                           bss->if_dynamic ? "if_dynamic=1\n" : "");
8200         if (res < 0 || res >= end - pos)
8201                 return pos - buf;
8202         pos += res;
8203
8204         if (bss->wdev_id_set) {
8205                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
8206                                   (unsigned long long) bss->wdev_id);
8207                 if (res < 0 || res >= end - pos)
8208                         return pos - buf;
8209                 pos += res;
8210         }
8211
8212         res = os_snprintf(pos, end - pos,
8213                           "phyname=%s\n"
8214                           "perm_addr=" MACSTR "\n"
8215                           "drv_ifindex=%d\n"
8216                           "operstate=%d\n"
8217                           "scan_state=%s\n"
8218                           "auth_bssid=" MACSTR "\n"
8219                           "auth_attempt_bssid=" MACSTR "\n"
8220                           "bssid=" MACSTR "\n"
8221                           "prev_bssid=" MACSTR "\n"
8222                           "associated=%d\n"
8223                           "assoc_freq=%u\n"
8224                           "monitor_sock=%d\n"
8225                           "monitor_ifidx=%d\n"
8226                           "monitor_refcount=%d\n"
8227                           "last_mgmt_freq=%u\n"
8228                           "eapol_tx_sock=%d\n"
8229                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
8230                           drv->phyname,
8231                           MAC2STR(drv->perm_addr),
8232                           drv->ifindex,
8233                           drv->operstate,
8234                           scan_state_str(drv->scan_state),
8235                           MAC2STR(drv->auth_bssid),
8236                           MAC2STR(drv->auth_attempt_bssid),
8237                           MAC2STR(drv->bssid),
8238                           MAC2STR(drv->prev_bssid),
8239                           drv->associated,
8240                           drv->assoc_freq,
8241                           drv->monitor_sock,
8242                           drv->monitor_ifidx,
8243                           drv->monitor_refcount,
8244                           drv->last_mgmt_freq,
8245                           drv->eapol_tx_sock,
8246                           drv->ignore_if_down_event ?
8247                           "ignore_if_down_event=1\n" : "",
8248                           drv->scan_complete_events ?
8249                           "scan_complete_events=1\n" : "",
8250                           drv->disabled_11b_rates ?
8251                           "disabled_11b_rates=1\n" : "",
8252                           drv->pending_remain_on_chan ?
8253                           "pending_remain_on_chan=1\n" : "",
8254                           drv->in_interface_list ? "in_interface_list=1\n" : "",
8255                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
8256                           drv->poll_command_supported ?
8257                           "poll_command_supported=1\n" : "",
8258                           drv->data_tx_status ? "data_tx_status=1\n" : "",
8259                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
8260                           drv->retry_auth ? "retry_auth=1\n" : "",
8261                           drv->use_monitor ? "use_monitor=1\n" : "",
8262                           drv->ignore_next_local_disconnect ?
8263                           "ignore_next_local_disconnect=1\n" : "",
8264                           drv->ignore_next_local_deauth ?
8265                           "ignore_next_local_deauth=1\n" : "");
8266         if (res < 0 || res >= end - pos)
8267                 return pos - buf;
8268         pos += res;
8269
8270         if (drv->has_capability) {
8271                 res = os_snprintf(pos, end - pos,
8272                                   "capa.key_mgmt=0x%x\n"
8273                                   "capa.enc=0x%x\n"
8274                                   "capa.auth=0x%x\n"
8275                                   "capa.flags=0x%llx\n"
8276                                   "capa.max_scan_ssids=%d\n"
8277                                   "capa.max_sched_scan_ssids=%d\n"
8278                                   "capa.sched_scan_supported=%d\n"
8279                                   "capa.max_match_sets=%d\n"
8280                                   "capa.max_remain_on_chan=%u\n"
8281                                   "capa.max_stations=%u\n"
8282                                   "capa.probe_resp_offloads=0x%x\n"
8283                                   "capa.max_acl_mac_addrs=%u\n"
8284                                   "capa.num_multichan_concurrent=%u\n",
8285                                   drv->capa.key_mgmt,
8286                                   drv->capa.enc,
8287                                   drv->capa.auth,
8288                                   (unsigned long long) drv->capa.flags,
8289                                   drv->capa.max_scan_ssids,
8290                                   drv->capa.max_sched_scan_ssids,
8291                                   drv->capa.sched_scan_supported,
8292                                   drv->capa.max_match_sets,
8293                                   drv->capa.max_remain_on_chan,
8294                                   drv->capa.max_stations,
8295                                   drv->capa.probe_resp_offloads,
8296                                   drv->capa.max_acl_mac_addrs,
8297                                   drv->capa.num_multichan_concurrent);
8298                 if (res < 0 || res >= end - pos)
8299                         return pos - buf;
8300                 pos += res;
8301         }
8302
8303         return pos - buf;
8304 }
8305
8306
8307 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
8308 {
8309         if (settings->head)
8310                 NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD,
8311                         settings->head_len, settings->head);
8312
8313         if (settings->tail)
8314                 NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL,
8315                         settings->tail_len, settings->tail);
8316
8317         if (settings->beacon_ies)
8318                 NLA_PUT(msg, NL80211_ATTR_IE,
8319                         settings->beacon_ies_len, settings->beacon_ies);
8320
8321         if (settings->proberesp_ies)
8322                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
8323                         settings->proberesp_ies_len, settings->proberesp_ies);
8324
8325         if (settings->assocresp_ies)
8326                 NLA_PUT(msg,
8327                         NL80211_ATTR_IE_ASSOC_RESP,
8328                         settings->assocresp_ies_len, settings->assocresp_ies);
8329
8330         if (settings->probe_resp)
8331                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP,
8332                         settings->probe_resp_len, settings->probe_resp);
8333
8334         return 0;
8335
8336 nla_put_failure:
8337         return -ENOBUFS;
8338 }
8339
8340
8341 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
8342 {
8343         struct nl_msg *msg;
8344         struct i802_bss *bss = priv;
8345         struct wpa_driver_nl80211_data *drv = bss->drv;
8346         struct nlattr *beacon_csa;
8347         int ret = -ENOBUFS;
8348
8349         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
8350                    settings->cs_count, settings->block_tx,
8351                    settings->freq_params.freq, settings->freq_params.bandwidth,
8352                    settings->freq_params.center_freq1,
8353                    settings->freq_params.center_freq2);
8354
8355         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
8356                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
8357                 return -EOPNOTSUPP;
8358         }
8359
8360         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
8361             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
8362                 return -EOPNOTSUPP;
8363
8364         /* check settings validity */
8365         if (!settings->beacon_csa.tail ||
8366             ((settings->beacon_csa.tail_len <=
8367               settings->counter_offset_beacon) ||
8368              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
8369               settings->cs_count)))
8370                 return -EINVAL;
8371
8372         if (settings->beacon_csa.probe_resp &&
8373             ((settings->beacon_csa.probe_resp_len <=
8374               settings->counter_offset_presp) ||
8375              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
8376               settings->cs_count)))
8377                 return -EINVAL;
8378
8379         msg = nlmsg_alloc();
8380         if (!msg)
8381                 return -ENOMEM;
8382
8383         nl80211_cmd(drv, msg, 0, NL80211_CMD_CHANNEL_SWITCH);
8384         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8385         NLA_PUT_U32(msg, NL80211_ATTR_CH_SWITCH_COUNT, settings->cs_count);
8386         ret = nl80211_put_freq_params(msg, &settings->freq_params);
8387         if (ret)
8388                 goto error;
8389
8390         if (settings->block_tx)
8391                 NLA_PUT_FLAG(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX);
8392
8393         /* beacon_after params */
8394         ret = set_beacon_data(msg, &settings->beacon_after);
8395         if (ret)
8396                 goto error;
8397
8398         /* beacon_csa params */
8399         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
8400         if (!beacon_csa)
8401                 goto nla_put_failure;
8402
8403         ret = set_beacon_data(msg, &settings->beacon_csa);
8404         if (ret)
8405                 goto error;
8406
8407         NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
8408                     settings->counter_offset_beacon);
8409
8410         if (settings->beacon_csa.probe_resp)
8411                 NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
8412                             settings->counter_offset_presp);
8413
8414         nla_nest_end(msg, beacon_csa);
8415         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8416         if (ret) {
8417                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
8418                            ret, strerror(-ret));
8419         }
8420         return ret;
8421
8422 nla_put_failure:
8423         ret = -ENOBUFS;
8424 error:
8425         nlmsg_free(msg);
8426         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
8427         return ret;
8428 }
8429
8430
8431 #ifdef CONFIG_TESTING_OPTIONS
8432 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
8433 {
8434         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8435         struct wpabuf *buf = arg;
8436
8437         if (!buf)
8438                 return NL_SKIP;
8439
8440         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
8441                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
8442                 return NL_SKIP;
8443         }
8444
8445         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
8446                         genlmsg_attrlen(gnlh, 0));
8447
8448         return NL_SKIP;
8449 }
8450 #endif /* CONFIG_TESTING_OPTIONS */
8451
8452
8453 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
8454 {
8455         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8456         struct nlattr *nl_vendor_reply, *nl;
8457         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8458         struct wpabuf *buf = arg;
8459         int rem;
8460
8461         if (!buf)
8462                 return NL_SKIP;
8463
8464         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8465                   genlmsg_attrlen(gnlh, 0), NULL);
8466         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
8467
8468         if (!nl_vendor_reply)
8469                 return NL_SKIP;
8470
8471         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
8472                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
8473                 return NL_SKIP;
8474         }
8475
8476         nla_for_each_nested(nl, nl_vendor_reply, rem) {
8477                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
8478         }
8479
8480         return NL_SKIP;
8481 }
8482
8483
8484 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
8485                               unsigned int subcmd, const u8 *data,
8486                               size_t data_len, struct wpabuf *buf)
8487 {
8488         struct i802_bss *bss = priv;
8489         struct wpa_driver_nl80211_data *drv = bss->drv;
8490         struct nl_msg *msg;
8491         int ret;
8492
8493         msg = nlmsg_alloc();
8494         if (!msg)
8495                 return -ENOMEM;
8496
8497 #ifdef CONFIG_TESTING_OPTIONS
8498         if (vendor_id == 0xffffffff) {
8499                 nl80211_cmd(drv, msg, 0, subcmd);
8500                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
8501                     0)
8502                         goto nla_put_failure;
8503                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
8504                 if (ret)
8505                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
8506                                    ret);
8507                 return ret;
8508         }
8509 #endif /* CONFIG_TESTING_OPTIONS */
8510
8511         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
8512         if (nl80211_set_iface_id(msg, bss) < 0)
8513                 goto nla_put_failure;
8514         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, vendor_id);
8515         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd);
8516         if (data)
8517                 NLA_PUT(msg, NL80211_ATTR_VENDOR_DATA, data_len, data);
8518
8519         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
8520         if (ret)
8521                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
8522                            ret);
8523         return ret;
8524
8525 nla_put_failure:
8526         nlmsg_free(msg);
8527         return -ENOBUFS;
8528 }
8529
8530
8531 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
8532                                u8 qos_map_set_len)
8533 {
8534         struct i802_bss *bss = priv;
8535         struct wpa_driver_nl80211_data *drv = bss->drv;
8536         struct nl_msg *msg;
8537         int ret;
8538
8539         msg = nlmsg_alloc();
8540         if (!msg)
8541                 return -ENOMEM;
8542
8543         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
8544                     qos_map_set, qos_map_set_len);
8545
8546         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_QOS_MAP);
8547         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8548         NLA_PUT(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set);
8549
8550         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8551         if (ret)
8552                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
8553
8554         return ret;
8555
8556 nla_put_failure:
8557         nlmsg_free(msg);
8558         return -ENOBUFS;
8559 }
8560
8561
8562 static int nl80211_set_wowlan(void *priv,
8563                               const struct wowlan_triggers *triggers)
8564 {
8565         struct i802_bss *bss = priv;
8566         struct wpa_driver_nl80211_data *drv = bss->drv;
8567         struct nl_msg *msg;
8568         struct nlattr *wowlan_triggers;
8569         int ret;
8570
8571         msg = nlmsg_alloc();
8572         if (!msg)
8573                 return -ENOMEM;
8574
8575         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
8576
8577         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WOWLAN);
8578         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8579
8580         wowlan_triggers = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8581         if (!wowlan_triggers)
8582                 goto nla_put_failure;
8583
8584         if (triggers->any)
8585                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
8586         if (triggers->disconnect)
8587                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
8588         if (triggers->magic_pkt)
8589                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
8590         if (triggers->gtk_rekey_failure)
8591                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
8592         if (triggers->eap_identity_req)
8593                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
8594         if (triggers->four_way_handshake)
8595                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
8596         if (triggers->rfkill_release)
8597                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
8598
8599         nla_nest_end(msg, wowlan_triggers);
8600
8601         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8602         if (ret)
8603                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
8604
8605         return ret;
8606
8607 nla_put_failure:
8608         nlmsg_free(msg);
8609         return -ENOBUFS;
8610 }
8611
8612
8613 static int nl80211_roaming(void *priv, int allowed, const u8 *bssid)
8614 {
8615         struct i802_bss *bss = priv;
8616         struct wpa_driver_nl80211_data *drv = bss->drv;
8617         struct nl_msg *msg;
8618         struct nlattr *params;
8619
8620         wpa_printf(MSG_DEBUG, "nl80211: Roaming policy: allowed=%d", allowed);
8621
8622         if (!drv->roaming_vendor_cmd_avail) {
8623                 wpa_printf(MSG_DEBUG,
8624                            "nl80211: Ignore roaming policy change since driver does not provide command for setting it");
8625                 return -1;
8626         }
8627
8628         msg = nlmsg_alloc();
8629         if (!msg)
8630                 return -ENOMEM;
8631
8632         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
8633
8634         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8635         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA);
8636         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8637                     QCA_NL80211_VENDOR_SUBCMD_ROAMING);
8638
8639         params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
8640         if (!params)
8641                 goto nla_put_failure;
8642         NLA_PUT_U32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY,
8643                     allowed ? QCA_ROAMING_ALLOWED_WITHIN_ESS :
8644                     QCA_ROAMING_NOT_ALLOWED);
8645         if (bssid)
8646                 NLA_PUT(msg, QCA_WLAN_VENDOR_ATTR_MAC_ADDR, ETH_ALEN, bssid);
8647         nla_nest_end(msg, params);
8648
8649         return send_and_recv_msgs(drv, msg, NULL, NULL);
8650
8651  nla_put_failure:
8652         nlmsg_free(msg);
8653         return -1;
8654 }
8655
8656
8657 static int nl80211_set_mac_addr(void *priv, const u8 *addr)
8658 {
8659         struct i802_bss *bss = priv;
8660         struct wpa_driver_nl80211_data *drv = bss->drv;
8661         int new_addr = addr != NULL;
8662
8663         if (!addr)
8664                 addr = drv->perm_addr;
8665
8666         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) < 0)
8667                 return -1;
8668
8669         if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname, addr) < 0)
8670         {
8671                 wpa_printf(MSG_DEBUG,
8672                            "nl80211: failed to set_mac_addr for %s to " MACSTR,
8673                            bss->ifname, MAC2STR(addr));
8674                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
8675                                           1) < 0) {
8676                         wpa_printf(MSG_DEBUG,
8677                                    "nl80211: Could not restore interface UP after failed set_mac_addr");
8678                 }
8679                 return -1;
8680         }
8681
8682         wpa_printf(MSG_DEBUG, "nl80211: set_mac_addr for %s to " MACSTR,
8683                    bss->ifname, MAC2STR(addr));
8684         drv->addr_changed = new_addr;
8685         os_memcpy(bss->addr, addr, ETH_ALEN);
8686
8687         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1) < 0)
8688         {
8689                 wpa_printf(MSG_DEBUG,
8690                            "nl80211: Could not restore interface UP after set_mac_addr");
8691         }
8692
8693         return 0;
8694 }
8695
8696
8697 #ifdef CONFIG_MESH
8698
8699 static int wpa_driver_nl80211_init_mesh(void *priv)
8700 {
8701         if (wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_MESH_POINT)) {
8702                 wpa_printf(MSG_INFO,
8703                            "nl80211: Failed to set interface into mesh mode");
8704                 return -1;
8705         }
8706         return 0;
8707 }
8708
8709
8710 static int
8711 wpa_driver_nl80211_join_mesh(void *priv,
8712                              struct wpa_driver_mesh_join_params *params)
8713 {
8714         struct i802_bss *bss = priv;
8715         struct wpa_driver_nl80211_data *drv = bss->drv;
8716         struct nl_msg *msg;
8717         struct nlattr *container;
8718         int ret = 0;
8719
8720         msg = nlmsg_alloc();
8721         if (!msg)
8722                 return -1;
8723
8724         wpa_printf(MSG_DEBUG, "nl80211: mesh join (ifindex=%d)", drv->ifindex);
8725         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_MESH);
8726
8727         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8728         /* XXX: need chtype too in case we want HT */
8729         if (params->freq) {
8730                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8731                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
8732         }
8733
8734         if (params->basic_rates) {
8735                 u8 rates[NL80211_MAX_SUPP_RATES];
8736                 u8 rates_len = 0;
8737                 int i;
8738
8739                 for (i = 0; i < NL80211_MAX_SUPP_RATES; i++) {
8740                         if (params->basic_rates[i] < 0)
8741                                 break;
8742                         rates[rates_len++] = params->basic_rates[i] / 5;
8743                 }
8744
8745                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
8746         }
8747
8748         if (params->meshid) {
8749                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8750                                   params->meshid, params->meshid_len);
8751                 NLA_PUT(msg, NL80211_ATTR_MESH_ID, params->meshid_len,
8752                         params->meshid);
8753         }
8754
8755         wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
8756
8757         container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
8758         if (!container)
8759                 goto nla_put_failure;
8760
8761         if (params->ies) {
8762                 wpa_hexdump(MSG_DEBUG, "  * IEs", params->ies, params->ie_len);
8763                 NLA_PUT(msg, NL80211_MESH_SETUP_IE, params->ie_len,
8764                         params->ies);
8765         }
8766         /* WPA_DRIVER_MESH_FLAG_OPEN_AUTH is treated as default by nl80211 */
8767         if (params->flags & WPA_DRIVER_MESH_FLAG_SAE_AUTH) {
8768                 NLA_PUT_U8(msg, NL80211_MESH_SETUP_AUTH_PROTOCOL, 0x1);
8769                 NLA_PUT_FLAG(msg, NL80211_MESH_SETUP_USERSPACE_AUTH);
8770         }
8771         if (params->flags & WPA_DRIVER_MESH_FLAG_AMPE)
8772                 NLA_PUT_FLAG(msg, NL80211_MESH_SETUP_USERSPACE_AMPE);
8773         if (params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM)
8774                 NLA_PUT_FLAG(msg, NL80211_MESH_SETUP_USERSPACE_MPM);
8775         nla_nest_end(msg, container);
8776
8777         container = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
8778         if (!container)
8779                 goto nla_put_failure;
8780
8781         if (!(params->conf.flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS))
8782                 NLA_PUT_U32(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 0);
8783         nla_nest_end(msg, container);
8784
8785         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8786         msg = NULL;
8787         if (ret) {
8788                 wpa_printf(MSG_DEBUG, "nl80211: mesh join failed: ret=%d (%s)",
8789                            ret, strerror(-ret));
8790                 goto nla_put_failure;
8791         }
8792         ret = 0;
8793         bss->freq = params->freq;
8794         wpa_printf(MSG_DEBUG, "nl80211: mesh join request send successfully");
8795
8796
8797 nla_put_failure:
8798         nlmsg_free(msg);
8799         return ret;
8800 }
8801
8802
8803 static int wpa_driver_nl80211_leave_mesh(void *priv)
8804 {
8805         struct i802_bss *bss = priv;
8806         struct wpa_driver_nl80211_data *drv = bss->drv;
8807         struct nl_msg *msg;
8808         int ret = 0;
8809
8810         msg = nlmsg_alloc();
8811         if (!msg)
8812                 return -1;
8813
8814         wpa_printf(MSG_DEBUG, "nl80211: mesh leave (ifindex=%d)", drv->ifindex);
8815         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_MESH);
8816         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8817
8818         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8819         msg = NULL;
8820         if (ret) {
8821                 wpa_printf(MSG_DEBUG, "nl80211: mesh leave failed: ret=%d (%s)",
8822                            ret, strerror(-ret));
8823                 goto nla_put_failure;
8824         }
8825         ret = 0;
8826         wpa_printf(MSG_DEBUG, "nl80211: mesh leave request send successfully");
8827
8828 nla_put_failure:
8829         nlmsg_free(msg);
8830         return ret;
8831 }
8832
8833 #endif /* CONFIG_MESH */
8834
8835
8836 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
8837         .name = "nl80211",
8838         .desc = "Linux nl80211/cfg80211",
8839         .get_bssid = wpa_driver_nl80211_get_bssid,
8840         .get_ssid = wpa_driver_nl80211_get_ssid,
8841         .set_key = driver_nl80211_set_key,
8842         .scan2 = driver_nl80211_scan2,
8843         .sched_scan = wpa_driver_nl80211_sched_scan,
8844         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
8845         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
8846         .deauthenticate = driver_nl80211_deauthenticate,
8847         .authenticate = driver_nl80211_authenticate,
8848         .associate = wpa_driver_nl80211_associate,
8849         .global_init = nl80211_global_init,
8850         .global_deinit = nl80211_global_deinit,
8851         .init2 = wpa_driver_nl80211_init,
8852         .deinit = driver_nl80211_deinit,
8853         .get_capa = wpa_driver_nl80211_get_capa,
8854         .set_operstate = wpa_driver_nl80211_set_operstate,
8855         .set_supp_port = wpa_driver_nl80211_set_supp_port,
8856         .set_country = wpa_driver_nl80211_set_country,
8857         .get_country = wpa_driver_nl80211_get_country,
8858         .set_ap = wpa_driver_nl80211_set_ap,
8859         .set_acl = wpa_driver_nl80211_set_acl,
8860         .if_add = wpa_driver_nl80211_if_add,
8861         .if_remove = driver_nl80211_if_remove,
8862         .send_mlme = driver_nl80211_send_mlme,
8863         .get_hw_feature_data = nl80211_get_hw_feature_data,
8864         .sta_add = wpa_driver_nl80211_sta_add,
8865         .sta_remove = driver_nl80211_sta_remove,
8866         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
8867         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
8868         .hapd_init = i802_init,
8869         .hapd_deinit = i802_deinit,
8870         .set_wds_sta = i802_set_wds_sta,
8871         .get_seqnum = i802_get_seqnum,
8872         .flush = i802_flush,
8873         .get_inact_sec = i802_get_inact_sec,
8874         .sta_clear_stats = i802_sta_clear_stats,
8875         .set_rts = i802_set_rts,
8876         .set_frag = i802_set_frag,
8877         .set_tx_queue_params = i802_set_tx_queue_params,
8878         .set_sta_vlan = driver_nl80211_set_sta_vlan,
8879         .sta_deauth = i802_sta_deauth,
8880         .sta_disassoc = i802_sta_disassoc,
8881         .read_sta_data = driver_nl80211_read_sta_data,
8882         .set_freq = i802_set_freq,
8883         .send_action = driver_nl80211_send_action,
8884         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
8885         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
8886         .cancel_remain_on_channel =
8887         wpa_driver_nl80211_cancel_remain_on_channel,
8888         .probe_req_report = driver_nl80211_probe_req_report,
8889         .deinit_ap = wpa_driver_nl80211_deinit_ap,
8890         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
8891         .resume = wpa_driver_nl80211_resume,
8892         .send_ft_action = nl80211_send_ft_action,
8893         .signal_monitor = nl80211_signal_monitor,
8894         .signal_poll = nl80211_signal_poll,
8895         .send_frame = nl80211_send_frame,
8896         .shared_freq = wpa_driver_nl80211_shared_freq,
8897         .set_param = nl80211_set_param,
8898         .get_radio_name = nl80211_get_radio_name,
8899         .add_pmkid = nl80211_add_pmkid,
8900         .remove_pmkid = nl80211_remove_pmkid,
8901         .flush_pmkid = nl80211_flush_pmkid,
8902         .set_rekey_info = nl80211_set_rekey_info,
8903         .poll_client = nl80211_poll_client,
8904         .set_p2p_powersave = nl80211_set_p2p_powersave,
8905         .start_dfs_cac = nl80211_start_radar_detection,
8906         .stop_ap = wpa_driver_nl80211_stop_ap,
8907 #ifdef CONFIG_TDLS
8908         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
8909         .tdls_oper = nl80211_tdls_oper,
8910 #endif /* CONFIG_TDLS */
8911         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
8912         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
8913         .get_survey = wpa_driver_nl80211_get_survey,
8914         .status = wpa_driver_nl80211_status,
8915         .switch_channel = nl80211_switch_channel,
8916 #ifdef ANDROID_P2P
8917         .set_noa = wpa_driver_set_p2p_noa,
8918         .get_noa = wpa_driver_get_p2p_noa,
8919         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
8920 #endif /* ANDROID_P2P */
8921 #ifdef ANDROID
8922         .driver_cmd = wpa_driver_nl80211_driver_cmd,
8923 #endif /* ANDROID */
8924         .vendor_cmd = nl80211_vendor_cmd,
8925         .set_qos_map = nl80211_set_qos_map,
8926         .set_wowlan = nl80211_set_wowlan,
8927         .roaming = nl80211_roaming,
8928         .set_mac_addr = nl80211_set_mac_addr,
8929 #ifdef CONFIG_MESH
8930         .init_mesh = wpa_driver_nl80211_init_mesh,
8931         .join_mesh = wpa_driver_nl80211_join_mesh,
8932         .leave_mesh = wpa_driver_nl80211_leave_mesh,
8933 #endif /* CONFIG_MESH */
8934 };