src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/ioctl.h>
  15 #include <sys/types.h>
  16 #include <sys/stat.h>
  17 #include <fcntl.h>
  18 #include <net/if.h>
  19 #include <netlink/genl/genl.h>
  20 #include <netlink/genl/family.h>
  21 #include <netlink/genl/ctrl.h>
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/filter.h>
  25 #include <linux/errqueue.h>
  26 #include "nl80211_copy.h"
  27
  28 #include "common.h"
  29 #include "eloop.h"
  30 #include "utils/list.h"
  31 #include "common/qca-vendor.h"
  32 #include "common/qca-vendor-attr.h"
  33 #include "common/ieee802_11_defs.h"
  34 #include "common/ieee802_11_common.h"
  35 #include "l2_packet/l2_packet.h"
  36 #include "netlink.h"
  37 #include "linux_ioctl.h"
  38 #include "radiotap.h"
  39 #include "radiotap_iter.h"
  40 #include "rfkill.h"
  41 #include "driver.h"
  42
  43 #ifndef SO_WIFI_STATUS
  44 # if defined(__sparc__)
  45 #  define SO_WIFI_STATUS        0x0025
  46 # elif defined(__parisc__)
  47 #  define SO_WIFI_STATUS        0x4022
  48 # else
  49 #  define SO_WIFI_STATUS        41
  50 # endif
  51
  52 # define SCM_WIFI_STATUS        SO_WIFI_STATUS
  53 #endif
  54
  55 #ifndef SO_EE_ORIGIN_TXSTATUS
  56 #define SO_EE_ORIGIN_TXSTATUS   4
  57 #endif
  58
  59 #ifndef PACKET_TX_TIMESTAMP
  60 #define PACKET_TX_TIMESTAMP     16
  61 #endif
  62
  63 #ifdef ANDROID
  64 #include "android_drv.h"
  65 #endif /* ANDROID */
  66 #ifdef CONFIG_LIBNL20
  67 /* libnl 2.0 compatibility code */
  68 #define nl_handle nl_sock
  69 #define nl80211_handle_alloc nl_socket_alloc_cb
  70 #define nl80211_handle_destroy nl_socket_free
  71 #else
  72 /*
  73  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  74  * but when you free a socket again it will mess up its bitmap and
  75  * and use the wrong number the next time it needs a socket ID.
  76  * Therefore, we wrap the handle alloc/destroy and add our own pid
  77  * accounting.
  78  */
  79 static uint32_t port_bitmap[32] = { 0 };
  80
  81 static struct nl_handle *nl80211_handle_alloc(void *cb)
  82 {
  83         struct nl_handle *handle;
  84         uint32_t pid = getpid() & 0x3FFFFF;
  85         int i;
  86
  87         handle = nl_handle_alloc_cb(cb);
  88
  89         for (i = 0; i < 1024; i++) {
  90                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  91                         continue;
  92                 port_bitmap[i / 32] |= 1 << (i % 32);
  93                 pid += i << 22;
  94                 break;
  95         }
  96
  97         nl_socket_set_local_port(handle, pid);
  98
  99         return handle;
 100 }
 101
 102 static void nl80211_handle_destroy(struct nl_handle *handle)
 103 {
 104         uint32_t port = nl_socket_get_local_port(handle);
 105
 106         port >>= 22;
 107         port_bitmap[port / 32] &= ~(1 << (port % 32));
 108
 109         nl_handle_destroy(handle);
 110 }
 111 #endif /* CONFIG_LIBNL20 */
 112
 113
 114 #ifdef ANDROID
 115 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
 116 static int android_nl_socket_set_nonblocking(struct nl_handle *handle)
 117 {
 118         return fcntl(nl_socket_get_fd(handle), F_SETFL, O_NONBLOCK);
 119 }
 120 #undef nl_socket_set_nonblocking
 121 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
 122 #endif /* ANDROID */
 123
 124
 125 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
 126 {
 127         struct nl_handle *handle;
 128
 129         handle = nl80211_handle_alloc(cb);
 130         if (handle == NULL) {
 131                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 132                            "callbacks (%s)", dbg);
 133                 return NULL;
 134         }
 135
 136         if (genl_connect(handle)) {
 137                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 138                            "netlink (%s)", dbg);
 139                 nl80211_handle_destroy(handle);
 140                 return NULL;
 141         }
 142
 143         return handle;
 144 }
 145
 146
 147 static void nl_destroy_handles(struct nl_handle **handle)
 148 {
 149         if (*handle == NULL)
 150                 return;
 151         nl80211_handle_destroy(*handle);
 152         *handle = NULL;
 153 }
 154
 155
 156 #if __WORDSIZE == 64
 157 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 158 #else
 159 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 160 #endif
 161
 162 static void nl80211_register_eloop_read(struct nl_handle **handle,
 163                                         eloop_sock_handler handler,
 164                                         void *eloop_data)
 165 {
 166         nl_socket_set_nonblocking(*handle);
 167         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 168                                  eloop_data, *handle);
 169         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 170 }
 171
 172
 173 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 174 {
 175         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 176         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 177         nl_destroy_handles(handle);
 178 }
 179
 180
 181 #ifndef IFF_LOWER_UP
 182 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
 183 #endif
 184 #ifndef IFF_DORMANT
 185 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
 186 #endif
 187
 188 #ifndef IF_OPER_DORMANT
 189 #define IF_OPER_DORMANT 5
 190 #endif
 191 #ifndef IF_OPER_UP
 192 #define IF_OPER_UP 6
 193 #endif
 194
 195 struct nl80211_global {
 196         struct dl_list interfaces;
 197         int if_add_ifindex;
 198         u64 if_add_wdevid;
 199         int if_add_wdevid_set;
 200         struct netlink_data *netlink;
 201         struct nl_cb *nl_cb;
 202         struct nl_handle *nl;
 203         int nl80211_id;
 204         int ioctl_sock; /* socket for ioctl() use */
 205
 206         struct nl_handle *nl_event;
 207 };
 208
 209 struct nl80211_wiphy_data {
 210         struct dl_list list;
 211         struct dl_list bsss;
 212         struct dl_list drvs;
 213
 214         struct nl_handle *nl_beacons;
 215         struct nl_cb *nl_cb;
 216
 217         int wiphy_idx;
 218 };
 219
 220 static void nl80211_global_deinit(void *priv);
 221
 222 struct i802_bss {
 223         struct wpa_driver_nl80211_data *drv;
 224         struct i802_bss *next;
 225         int ifindex;
 226         u64 wdev_id;
 227         char ifname[IFNAMSIZ + 1];
 228         char brname[IFNAMSIZ];
 229         unsigned int beacon_set:1;
 230         unsigned int added_if_into_bridge:1;
 231         unsigned int added_bridge:1;
 232         unsigned int in_deinit:1;
 233         unsigned int wdev_id_set:1;
 234         unsigned int added_if:1;
 235
 236         u8 addr[ETH_ALEN];
 237
 238         int freq;
 239         int bandwidth;
 240         int if_dynamic;
 241
 242         void *ctx;
 243         struct nl_handle *nl_preq, *nl_mgmt;
 244         struct nl_cb *nl_cb;
 245
 246         struct nl80211_wiphy_data *wiphy_data;
 247         struct dl_list wiphy_list;
 248 };
 249
 250 struct wpa_driver_nl80211_data {
 251         struct nl80211_global *global;
 252         struct dl_list list;
 253         struct dl_list wiphy_list;
 254         char phyname[32];
 255         void *ctx;
 256         int ifindex;
 257         int if_removed;
 258         int if_disabled;
 259         int ignore_if_down_event;
 260         struct rfkill_data *rfkill;
 261         struct wpa_driver_capa capa;
 262         u8 *extended_capa, *extended_capa_mask;
 263         unsigned int extended_capa_len;
 264         int has_capability;
 265
 266         int operstate;
 267
 268         int scan_complete_events;
 269         enum scan_states {
 270                 NO_SCAN, SCAN_REQUESTED, SCAN_STARTED, SCAN_COMPLETED,
 271                 SCAN_ABORTED, SCHED_SCAN_STARTED, SCHED_SCAN_STOPPED,
 272                 SCHED_SCAN_RESULTS
 273         } scan_state;
 274
 275         struct nl_cb *nl_cb;
 276
 277         u8 auth_bssid[ETH_ALEN];
 278         u8 auth_attempt_bssid[ETH_ALEN];
 279         u8 bssid[ETH_ALEN];
 280         u8 prev_bssid[ETH_ALEN];
 281         int associated;
 282         u8 ssid[32];
 283         size_t ssid_len;
 284         enum nl80211_iftype nlmode;
 285         enum nl80211_iftype ap_scan_as_station;
 286         unsigned int assoc_freq;
 287
 288         int monitor_sock;
 289         int monitor_ifidx;
 290         int monitor_refcount;
 291
 292         unsigned int disabled_11b_rates:1;
 293         unsigned int pending_remain_on_chan:1;
 294         unsigned int in_interface_list:1;
 295         unsigned int device_ap_sme:1;
 296         unsigned int poll_command_supported:1;
 297         unsigned int data_tx_status:1;
 298         unsigned int scan_for_auth:1;
 299         unsigned int retry_auth:1;
 300         unsigned int use_monitor:1;
 301         unsigned int ignore_next_local_disconnect:1;
 302         unsigned int ignore_next_local_deauth:1;
 303         unsigned int allow_p2p_device:1;
 304         unsigned int hostapd:1;
 305         unsigned int start_mode_ap:1;
 306         unsigned int start_iface_up:1;
 307         unsigned int test_use_roc_tx:1;
 308         unsigned int ignore_deauth_event:1;
 309         unsigned int dfs_vendor_cmd_avail:1;
 310
 311         u64 remain_on_chan_cookie;
 312         u64 send_action_cookie;
 313
 314         unsigned int last_mgmt_freq;
 315
 316         struct wpa_driver_scan_filter *filter_ssids;
 317         size_t num_filter_ssids;
 318
 319         struct i802_bss *first_bss;
 320
 321         int eapol_tx_sock;
 322
 323         int eapol_sock; /* socket for EAPOL frames */
 324
 325         int default_if_indices[16];
 326         int *if_indices;
 327         int num_if_indices;
 328
 329         /* From failed authentication command */
 330         int auth_freq;
 331         u8 auth_bssid_[ETH_ALEN];
 332         u8 auth_ssid[32];
 333         size_t auth_ssid_len;
 334         int auth_alg;
 335         u8 *auth_ie;
 336         size_t auth_ie_len;
 337         u8 auth_wep_key[4][16];
 338         size_t auth_wep_key_len[4];
 339         int auth_wep_tx_keyidx;
 340         int auth_local_state_change;
 341         int auth_p2p;
 342 };
 343
 344
 345 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 346 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 347                                             void *timeout_ctx);
 348 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
 349                                        enum nl80211_iftype nlmode);
 350 static int
 351 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 352                                    const u8 *set_addr, int first);
 353 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 354                                    const u8 *addr, int cmd, u16 reason_code,
 355                                    int local_state_change);
 356 static void nl80211_remove_monitor_interface(
 357         struct wpa_driver_nl80211_data *drv);
 358 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 359                                   unsigned int freq, unsigned int wait,
 360                                   const u8 *buf, size_t buf_len, u64 *cookie,
 361                                   int no_cck, int no_ack, int offchanok);
 362 static int nl80211_register_frame(struct i802_bss *bss,
 363                                   struct nl_handle *hl_handle,
 364                                   u16 type, const u8 *match, size_t match_len);
 365 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 366                                                int report);
 367 #ifdef ANDROID
 368 static int android_pno_start(struct i802_bss *bss,
 369                              struct wpa_driver_scan_params *params);
 370 static int android_pno_stop(struct i802_bss *bss);
 371 extern int wpa_driver_nl80211_driver_cmd(void *priv, char *cmd, char *buf,
 372                                          size_t buf_len);
 373 #endif /* ANDROID */
 374 #ifdef ANDROID_P2P
 375 #ifdef ANDROID_P2P_STUB
 376 int wpa_driver_set_p2p_noa(void *priv, u8 count, int start, int duration) {
 377         return 0;
 378 }
 379 int wpa_driver_get_p2p_noa(void *priv, u8 *buf, size_t len) {
 380         return 0;
 381 }
 382 int wpa_driver_set_p2p_ps(void *priv, int legacy_ps, int opp_ps, int ctwindow) {
 383         return -1;
 384 }
 385 int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon,
 386                                  const struct wpabuf *proberesp,
 387                                  const struct wpabuf *assocresp) {
 388         return 0;
 389 }
 390 #else /* ANDROID_P2P_STUB */
 391 int wpa_driver_set_p2p_noa(void *priv, u8 count, int start, int duration);
 392 int wpa_driver_get_p2p_noa(void *priv, u8 *buf, size_t len);
 393 int wpa_driver_set_p2p_ps(void *priv, int legacy_ps, int opp_ps, int ctwindow);
 394 int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon,
 395                                  const struct wpabuf *proberesp,
 396                                  const struct wpabuf *assocresp);
 397 #endif /* ANDROID_P2P_STUB */
 398 #endif /* ANDROID_P2P */
 399
 400 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 401 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 402 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 403 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
 404                                         enum wpa_driver_if_type type,
 405                                         const char *ifname);
 406
 407 static int nl80211_set_channel(struct i802_bss *bss,
 408                                struct hostapd_freq_params *freq, int set_chan);
 409 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 410                                      int ifindex, int disabled);
 411
 412 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 413 static int wpa_driver_nl80211_authenticate_retry(
 414         struct wpa_driver_nl80211_data *drv);
 415
 416 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 417
 418
 419 static const char * nl80211_command_to_string(enum nl80211_commands cmd)
 420 {
 421 #define C2S(x) case x: return #x;
 422         switch (cmd) {
 423         C2S(NL80211_CMD_UNSPEC)
 424         C2S(NL80211_CMD_GET_WIPHY)
 425         C2S(NL80211_CMD_SET_WIPHY)
 426         C2S(NL80211_CMD_NEW_WIPHY)
 427         C2S(NL80211_CMD_DEL_WIPHY)
 428         C2S(NL80211_CMD_GET_INTERFACE)
 429         C2S(NL80211_CMD_SET_INTERFACE)
 430         C2S(NL80211_CMD_NEW_INTERFACE)
 431         C2S(NL80211_CMD_DEL_INTERFACE)
 432         C2S(NL80211_CMD_GET_KEY)
 433         C2S(NL80211_CMD_SET_KEY)
 434         C2S(NL80211_CMD_NEW_KEY)
 435         C2S(NL80211_CMD_DEL_KEY)
 436         C2S(NL80211_CMD_GET_BEACON)
 437         C2S(NL80211_CMD_SET_BEACON)
 438         C2S(NL80211_CMD_START_AP)
 439         C2S(NL80211_CMD_STOP_AP)
 440         C2S(NL80211_CMD_GET_STATION)
 441         C2S(NL80211_CMD_SET_STATION)
 442         C2S(NL80211_CMD_NEW_STATION)
 443         C2S(NL80211_CMD_DEL_STATION)
 444         C2S(NL80211_CMD_GET_MPATH)
 445         C2S(NL80211_CMD_SET_MPATH)
 446         C2S(NL80211_CMD_NEW_MPATH)
 447         C2S(NL80211_CMD_DEL_MPATH)
 448         C2S(NL80211_CMD_SET_BSS)
 449         C2S(NL80211_CMD_SET_REG)
 450         C2S(NL80211_CMD_REQ_SET_REG)
 451         C2S(NL80211_CMD_GET_MESH_CONFIG)
 452         C2S(NL80211_CMD_SET_MESH_CONFIG)
 453         C2S(NL80211_CMD_SET_MGMT_EXTRA_IE)
 454         C2S(NL80211_CMD_GET_REG)
 455         C2S(NL80211_CMD_GET_SCAN)
 456         C2S(NL80211_CMD_TRIGGER_SCAN)
 457         C2S(NL80211_CMD_NEW_SCAN_RESULTS)
 458         C2S(NL80211_CMD_SCAN_ABORTED)
 459         C2S(NL80211_CMD_REG_CHANGE)
 460         C2S(NL80211_CMD_AUTHENTICATE)
 461         C2S(NL80211_CMD_ASSOCIATE)
 462         C2S(NL80211_CMD_DEAUTHENTICATE)
 463         C2S(NL80211_CMD_DISASSOCIATE)
 464         C2S(NL80211_CMD_MICHAEL_MIC_FAILURE)
 465         C2S(NL80211_CMD_REG_BEACON_HINT)
 466         C2S(NL80211_CMD_JOIN_IBSS)
 467         C2S(NL80211_CMD_LEAVE_IBSS)
 468         C2S(NL80211_CMD_TESTMODE)
 469         C2S(NL80211_CMD_CONNECT)
 470         C2S(NL80211_CMD_ROAM)
 471         C2S(NL80211_CMD_DISCONNECT)
 472         C2S(NL80211_CMD_SET_WIPHY_NETNS)
 473         C2S(NL80211_CMD_GET_SURVEY)
 474         C2S(NL80211_CMD_NEW_SURVEY_RESULTS)
 475         C2S(NL80211_CMD_SET_PMKSA)
 476         C2S(NL80211_CMD_DEL_PMKSA)
 477         C2S(NL80211_CMD_FLUSH_PMKSA)
 478         C2S(NL80211_CMD_REMAIN_ON_CHANNEL)
 479         C2S(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL)
 480         C2S(NL80211_CMD_SET_TX_BITRATE_MASK)
 481         C2S(NL80211_CMD_REGISTER_FRAME)
 482         C2S(NL80211_CMD_FRAME)
 483         C2S(NL80211_CMD_FRAME_TX_STATUS)
 484         C2S(NL80211_CMD_SET_POWER_SAVE)
 485         C2S(NL80211_CMD_GET_POWER_SAVE)
 486         C2S(NL80211_CMD_SET_CQM)
 487         C2S(NL80211_CMD_NOTIFY_CQM)
 488         C2S(NL80211_CMD_SET_CHANNEL)
 489         C2S(NL80211_CMD_SET_WDS_PEER)
 490         C2S(NL80211_CMD_FRAME_WAIT_CANCEL)
 491         C2S(NL80211_CMD_JOIN_MESH)
 492         C2S(NL80211_CMD_LEAVE_MESH)
 493         C2S(NL80211_CMD_UNPROT_DEAUTHENTICATE)
 494         C2S(NL80211_CMD_UNPROT_DISASSOCIATE)
 495         C2S(NL80211_CMD_NEW_PEER_CANDIDATE)
 496         C2S(NL80211_CMD_GET_WOWLAN)
 497         C2S(NL80211_CMD_SET_WOWLAN)
 498         C2S(NL80211_CMD_START_SCHED_SCAN)
 499         C2S(NL80211_CMD_STOP_SCHED_SCAN)
 500         C2S(NL80211_CMD_SCHED_SCAN_RESULTS)
 501         C2S(NL80211_CMD_SCHED_SCAN_STOPPED)
 502         C2S(NL80211_CMD_SET_REKEY_OFFLOAD)
 503         C2S(NL80211_CMD_PMKSA_CANDIDATE)
 504         C2S(NL80211_CMD_TDLS_OPER)
 505         C2S(NL80211_CMD_TDLS_MGMT)
 506         C2S(NL80211_CMD_UNEXPECTED_FRAME)
 507         C2S(NL80211_CMD_PROBE_CLIENT)
 508         C2S(NL80211_CMD_REGISTER_BEACONS)
 509         C2S(NL80211_CMD_UNEXPECTED_4ADDR_FRAME)
 510         C2S(NL80211_CMD_SET_NOACK_MAP)
 511         C2S(NL80211_CMD_CH_SWITCH_NOTIFY)
 512         C2S(NL80211_CMD_START_P2P_DEVICE)
 513         C2S(NL80211_CMD_STOP_P2P_DEVICE)
 514         C2S(NL80211_CMD_CONN_FAILED)
 515         C2S(NL80211_CMD_SET_MCAST_RATE)
 516         C2S(NL80211_CMD_SET_MAC_ACL)
 517         C2S(NL80211_CMD_RADAR_DETECT)
 518         C2S(NL80211_CMD_GET_PROTOCOL_FEATURES)
 519         C2S(NL80211_CMD_UPDATE_FT_IES)
 520         C2S(NL80211_CMD_FT_EVENT)
 521         C2S(NL80211_CMD_CRIT_PROTOCOL_START)
 522         C2S(NL80211_CMD_CRIT_PROTOCOL_STOP)
 523         C2S(NL80211_CMD_GET_COALESCE)
 524         C2S(NL80211_CMD_SET_COALESCE)
 525         C2S(NL80211_CMD_CHANNEL_SWITCH)
 526         C2S(NL80211_CMD_VENDOR)
 527         C2S(NL80211_CMD_SET_QOS_MAP)
 528         default:
 529                 return "NL80211_CMD_UNKNOWN";
 530         }
 531 #undef C2S
 532 }
 533
 534
 535 /* Converts nl80211_chan_width to a common format */
 536 static enum chan_width convert2width(int width)
 537 {
 538         switch (width) {
 539         case NL80211_CHAN_WIDTH_20_NOHT:
 540                 return CHAN_WIDTH_20_NOHT;
 541         case NL80211_CHAN_WIDTH_20:
 542                 return CHAN_WIDTH_20;
 543         case NL80211_CHAN_WIDTH_40:
 544                 return CHAN_WIDTH_40;
 545         case NL80211_CHAN_WIDTH_80:
 546                 return CHAN_WIDTH_80;
 547         case NL80211_CHAN_WIDTH_80P80:
 548                 return CHAN_WIDTH_80P80;
 549         case NL80211_CHAN_WIDTH_160:
 550                 return CHAN_WIDTH_160;
 551         }
 552         return CHAN_WIDTH_UNKNOWN;
 553 }
 554
 555
 556 static int is_ap_interface(enum nl80211_iftype nlmode)
 557 {
 558         return nlmode == NL80211_IFTYPE_AP ||
 559                 nlmode == NL80211_IFTYPE_P2P_GO;
 560 }
 561
 562
 563 static int is_sta_interface(enum nl80211_iftype nlmode)
 564 {
 565         return nlmode == NL80211_IFTYPE_STATION ||
 566                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 567 }
 568
 569
 570 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 571 {
 572         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 573                 nlmode == NL80211_IFTYPE_P2P_GO;
 574 }
 575
 576
 577 static void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 578 {
 579         if (drv->associated)
 580                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 581         drv->associated = 0;
 582         os_memset(drv->bssid, 0, ETH_ALEN);
 583 }
 584
 585
 586 struct nl80211_bss_info_arg {
 587         struct wpa_driver_nl80211_data *drv;
 588         struct wpa_scan_results *res;
 589         unsigned int assoc_freq;
 590         unsigned int ibss_freq;
 591         u8 assoc_bssid[ETH_ALEN];
 592 };
 593
 594 static int bss_info_handler(struct nl_msg *msg, void *arg);
 595
 596
 597 /* nl80211 code */
 598 static int ack_handler(struct nl_msg *msg, void *arg)
 599 {
 600         int *err = arg;
 601         *err = 0;
 602         return NL_STOP;
 603 }
 604
 605 static int finish_handler(struct nl_msg *msg, void *arg)
 606 {
 607         int *ret = arg;
 608         *ret = 0;
 609         return NL_SKIP;
 610 }
 611
 612 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 613                          void *arg)
 614 {
 615         int *ret = arg;
 616         *ret = err->error;
 617         return NL_SKIP;
 618 }
 619
 620
 621 static int no_seq_check(struct nl_msg *msg, void *arg)
 622 {
 623         return NL_OK;
 624 }
 625
 626
 627 static int send_and_recv(struct nl80211_global *global,
 628                          struct nl_handle *nl_handle, struct nl_msg *msg,
 629                          int (*valid_handler)(struct nl_msg *, void *),
 630                          void *valid_data)
 631 {
 632         struct nl_cb *cb;
 633         int err = -ENOMEM;
 634
 635         cb = nl_cb_clone(global->nl_cb);
 636         if (!cb)
 637                 goto out;
 638
 639         err = nl_send_auto_complete(nl_handle, msg);
 640         if (err < 0)
 641                 goto out;
 642
 643         err = 1;
 644
 645         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 646         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 647         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 648
 649         if (valid_handler)
 650                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 651                           valid_handler, valid_data);
 652
 653         while (err > 0) {
 654                 int res = nl_recvmsgs(nl_handle, cb);
 655                 if (res) {
 656                         wpa_printf(MSG_INFO,
 657                                    "nl80211: %s->nl_recvmsgs failed: %d",
 658                                    __func__, res);
 659                 }
 660         }
 661  out:
 662         nl_cb_put(cb);
 663         nlmsg_free(msg);
 664         return err;
 665 }
 666
 667
 668 static int send_and_recv_msgs_global(struct nl80211_global *global,
 669                                      struct nl_msg *msg,
 670                                      int (*valid_handler)(struct nl_msg *, void *),
 671                                      void *valid_data)
 672 {
 673         return send_and_recv(global, global->nl, msg, valid_handler,
 674                              valid_data);
 675 }
 676
 677
 678 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 679                               struct nl_msg *msg,
 680                               int (*valid_handler)(struct nl_msg *, void *),
 681                               void *valid_data)
 682 {
 683         return send_and_recv(drv->global, drv->global->nl, msg,
 684                              valid_handler, valid_data);
 685 }
 686
 687
 688 struct family_data {
 689         const char *group;
 690         int id;
 691 };
 692
 693
 694 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 695 {
 696         if (bss->wdev_id_set)
 697                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 698         else
 699                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 700         return 0;
 701
 702 nla_put_failure:
 703         return -1;
 704 }
 705
 706
 707 static int family_handler(struct nl_msg *msg, void *arg)
 708 {
 709         struct family_data *res = arg;
 710         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 711         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 712         struct nlattr *mcgrp;
 713         int i;
 714
 715         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 716                   genlmsg_attrlen(gnlh, 0), NULL);
 717         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 718                 return NL_SKIP;
 719
 720         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 721                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 722                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 723                           nla_len(mcgrp), NULL);
 724                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 725                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 726                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 727                                res->group,
 728                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 729                         continue;
 730                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 731                 break;
 732         };
 733
 734         return NL_SKIP;
 735 }
 736
 737
 738 static int nl_get_multicast_id(struct nl80211_global *global,
 739                                const char *family, const char *group)
 740 {
 741         struct nl_msg *msg;
 742         int ret = -1;
 743         struct family_data res = { group, -ENOENT };
 744
 745         msg = nlmsg_alloc();
 746         if (!msg)
 747                 return -ENOMEM;
 748         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 749                     0, 0, CTRL_CMD_GETFAMILY, 0);
 750         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 751
 752         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 753         msg = NULL;
 754         if (ret == 0)
 755                 ret = res.id;
 756
 757 nla_put_failure:
 758         nlmsg_free(msg);
 759         return ret;
 760 }
 761
 762
 763 static void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 764                           struct nl_msg *msg, int flags, uint8_t cmd)
 765 {
 766         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 767                            0, flags, cmd, 0);
 768 }
 769
 770
 771 struct wiphy_idx_data {
 772         int wiphy_idx;
 773         enum nl80211_iftype nlmode;
 774         u8 *macaddr;
 775 };
 776
 777
 778 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 779 {
 780         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 781         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 782         struct wiphy_idx_data *info = arg;
 783
 784         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 785                   genlmsg_attrlen(gnlh, 0), NULL);
 786
 787         if (tb[NL80211_ATTR_WIPHY])
 788                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 789
 790         if (tb[NL80211_ATTR_IFTYPE])
 791                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 792
 793         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 794                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 795                           ETH_ALEN);
 796
 797         return NL_SKIP;
 798 }
 799
 800
 801 static int nl80211_get_wiphy_index(struct i802_bss *bss)
 802 {
 803         struct nl_msg *msg;
 804         struct wiphy_idx_data data = {
 805                 .wiphy_idx = -1,
 806                 .macaddr = NULL,
 807         };
 808
 809         msg = nlmsg_alloc();
 810         if (!msg)
 811                 return NL80211_IFTYPE_UNSPECIFIED;
 812
 813         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 814
 815         if (nl80211_set_iface_id(msg, bss) < 0)
 816                 goto nla_put_failure;
 817
 818         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 819                 return data.wiphy_idx;
 820         msg = NULL;
 821 nla_put_failure:
 822         nlmsg_free(msg);
 823         return -1;
 824 }
 825
 826
 827 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 828 {
 829         struct nl_msg *msg;
 830         struct wiphy_idx_data data = {
 831                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 832                 .macaddr = NULL,
 833         };
 834
 835         msg = nlmsg_alloc();
 836         if (!msg)
 837                 return -1;
 838
 839         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 840
 841         if (nl80211_set_iface_id(msg, bss) < 0)
 842                 goto nla_put_failure;
 843
 844         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 845                 return data.nlmode;
 846         msg = NULL;
 847 nla_put_failure:
 848         nlmsg_free(msg);
 849         return NL80211_IFTYPE_UNSPECIFIED;
 850 }
 851
 852
 853 static int nl80211_get_macaddr(struct i802_bss *bss)
 854 {
 855         struct nl_msg *msg;
 856         struct wiphy_idx_data data = {
 857                 .macaddr = bss->addr,
 858         };
 859
 860         msg = nlmsg_alloc();
 861         if (!msg)
 862                 return NL80211_IFTYPE_UNSPECIFIED;
 863
 864         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 865         if (nl80211_set_iface_id(msg, bss) < 0)
 866                 goto nla_put_failure;
 867
 868         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 869
 870 nla_put_failure:
 871         nlmsg_free(msg);
 872         return NL80211_IFTYPE_UNSPECIFIED;
 873 }
 874
 875
 876 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 877                                     struct nl80211_wiphy_data *w)
 878 {
 879         struct nl_msg *msg;
 880         int ret = -1;
 881
 882         msg = nlmsg_alloc();
 883         if (!msg)
 884                 return -1;
 885
 886         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
 887
 888         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
 889
 890         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 891         msg = NULL;
 892         if (ret) {
 893                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 894                            "failed: ret=%d (%s)",
 895                            ret, strerror(-ret));
 896                 goto nla_put_failure;
 897         }
 898         ret = 0;
 899 nla_put_failure:
 900         nlmsg_free(msg);
 901         return ret;
 902 }
 903
 904
 905 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 906 {
 907         struct nl80211_wiphy_data *w = eloop_ctx;
 908         int res;
 909
 910         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 911
 912         res = nl_recvmsgs(handle, w->nl_cb);
 913         if (res) {
 914                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 915                            __func__, res);
 916         }
 917 }
 918
 919
 920 static int process_beacon_event(struct nl_msg *msg, void *arg)
 921 {
 922         struct nl80211_wiphy_data *w = arg;
 923         struct wpa_driver_nl80211_data *drv;
 924         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 925         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 926         union wpa_event_data event;
 927
 928         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 929                   genlmsg_attrlen(gnlh, 0), NULL);
 930
 931         if (gnlh->cmd != NL80211_CMD_FRAME) {
 932                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 933                            gnlh->cmd);
 934                 return NL_SKIP;
 935         }
 936
 937         if (!tb[NL80211_ATTR_FRAME])
 938                 return NL_SKIP;
 939
 940         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 941                          wiphy_list) {
 942                 os_memset(&event, 0, sizeof(event));
 943                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 944                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 945                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 946         }
 947
 948         return NL_SKIP;
 949 }
 950
 951
 952 static struct nl80211_wiphy_data *
 953 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 954 {
 955         static DEFINE_DL_LIST(nl80211_wiphys);
 956         struct nl80211_wiphy_data *w;
 957         int wiphy_idx, found = 0;
 958         struct i802_bss *tmp_bss;
 959
 960         if (bss->wiphy_data != NULL)
 961                 return bss->wiphy_data;
 962
 963         wiphy_idx = nl80211_get_wiphy_index(bss);
 964
 965         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 966                 if (w->wiphy_idx == wiphy_idx)
 967                         goto add;
 968         }
 969
 970         /* alloc new one */
 971         w = os_zalloc(sizeof(*w));
 972         if (w == NULL)
 973                 return NULL;
 974         w->wiphy_idx = wiphy_idx;
 975         dl_list_init(&w->bsss);
 976         dl_list_init(&w->drvs);
 977
 978         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 979         if (!w->nl_cb) {
 980                 os_free(w);
 981                 return NULL;
 982         }
 983         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 984         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 985                   w);
 986
 987         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 988                                          "wiphy beacons");
 989         if (w->nl_beacons == NULL) {
 990                 os_free(w);
 991                 return NULL;
 992         }
 993
 994         if (nl80211_register_beacons(bss->drv, w)) {
 995                 nl_destroy_handles(&w->nl_beacons);
 996                 os_free(w);
 997                 return NULL;
 998         }
 999
1000         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
1001
1002         dl_list_add(&nl80211_wiphys, &w->list);
1003
1004 add:
1005         /* drv entry for this bss already there? */
1006         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
1007                 if (tmp_bss->drv == bss->drv) {
1008                         found = 1;
1009                         break;
1010                 }
1011         }
1012         /* if not add it */
1013         if (!found)
1014                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
1015
1016         dl_list_add(&w->bsss, &bss->wiphy_list);
1017         bss->wiphy_data = w;
1018         return w;
1019 }
1020
1021
1022 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
1023 {
1024         struct nl80211_wiphy_data *w = bss->wiphy_data;
1025         struct i802_bss *tmp_bss;
1026         int found = 0;
1027
1028         if (w == NULL)
1029                 return;
1030         bss->wiphy_data = NULL;
1031         dl_list_del(&bss->wiphy_list);
1032
1033         /* still any for this drv present? */
1034         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
1035                 if (tmp_bss->drv == bss->drv) {
1036                         found = 1;
1037                         break;
1038                 }
1039         }
1040         /* if not remove it */
1041         if (!found)
1042                 dl_list_del(&bss->drv->wiphy_list);
1043
1044         if (!dl_list_empty(&w->bsss))
1045                 return;
1046
1047         nl80211_destroy_eloop_handle(&w->nl_beacons);
1048
1049         nl_cb_put(w->nl_cb);
1050         dl_list_del(&w->list);
1051         os_free(w);
1052 }
1053
1054
1055 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
1056 {
1057         struct i802_bss *bss = priv;
1058         struct wpa_driver_nl80211_data *drv = bss->drv;
1059         if (!drv->associated)
1060                 return -1;
1061         os_memcpy(bssid, drv->bssid, ETH_ALEN);
1062         return 0;
1063 }
1064
1065
1066 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
1067 {
1068         struct i802_bss *bss = priv;
1069         struct wpa_driver_nl80211_data *drv = bss->drv;
1070         if (!drv->associated)
1071                 return -1;
1072         os_memcpy(ssid, drv->ssid, drv->ssid_len);
1073         return drv->ssid_len;
1074 }
1075
1076
1077 static void wpa_driver_nl80211_event_newlink(
1078         struct wpa_driver_nl80211_data *drv, char *ifname)
1079 {
1080         union wpa_event_data event;
1081
1082         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
1083                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
1084                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
1085                                    drv->first_bss->ifname);
1086                         return;
1087                 }
1088                 if (!drv->if_removed)
1089                         return;
1090                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
1091                            drv->first_bss->ifname);
1092                 drv->if_removed = 0;
1093         }
1094
1095         os_memset(&event, 0, sizeof(event));
1096         os_strlcpy(event.interface_status.ifname, ifname,
1097                    sizeof(event.interface_status.ifname));
1098         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
1099         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1100 }
1101
1102
1103 static void wpa_driver_nl80211_event_dellink(
1104         struct wpa_driver_nl80211_data *drv, char *ifname)
1105 {
1106         union wpa_event_data event;
1107
1108         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
1109                 if (drv->if_removed) {
1110                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
1111                                    ifname);
1112                         return;
1113                 }
1114                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
1115                            ifname);
1116                 drv->if_removed = 1;
1117         } else {
1118                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
1119                            ifname);
1120         }
1121
1122         os_memset(&event, 0, sizeof(event));
1123         os_strlcpy(event.interface_status.ifname, ifname,
1124                    sizeof(event.interface_status.ifname));
1125         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
1126         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1127 }
1128
1129
1130 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
1131                                          u8 *buf, size_t len)
1132 {
1133         int attrlen, rta_len;
1134         struct rtattr *attr;
1135
1136         attrlen = len;
1137         attr = (struct rtattr *) buf;
1138
1139         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1140         while (RTA_OK(attr, attrlen)) {
1141                 if (attr->rta_type == IFLA_IFNAME) {
1142                         if (os_strcmp(((char *) attr) + rta_len,
1143                                       drv->first_bss->ifname) == 0)
1144                                 return 1;
1145                         else
1146                                 break;
1147                 }
1148                 attr = RTA_NEXT(attr, attrlen);
1149         }
1150
1151         return 0;
1152 }
1153
1154
1155 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
1156                                           int ifindex, u8 *buf, size_t len)
1157 {
1158         if (drv->ifindex == ifindex)
1159                 return 1;
1160
1161         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
1162                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
1163                            "interface");
1164                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0);
1165                 return 1;
1166         }
1167
1168         return 0;
1169 }
1170
1171
1172 static struct wpa_driver_nl80211_data *
1173 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
1174 {
1175         struct wpa_driver_nl80211_data *drv;
1176         dl_list_for_each(drv, &global->interfaces,
1177                          struct wpa_driver_nl80211_data, list) {
1178                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
1179                     have_ifidx(drv, idx))
1180                         return drv;
1181         }
1182         return NULL;
1183 }
1184
1185
1186 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
1187                                                  struct ifinfomsg *ifi,
1188                                                  u8 *buf, size_t len)
1189 {
1190         struct nl80211_global *global = ctx;
1191         struct wpa_driver_nl80211_data *drv;
1192         int attrlen;
1193         struct rtattr *attr;
1194         u32 brid = 0;
1195         char namebuf[IFNAMSIZ];
1196         char ifname[IFNAMSIZ + 1];
1197         char extra[100], *pos, *end;
1198
1199         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1200         if (!drv) {
1201                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_NEWLINK event for foreign ifindex %d",
1202                            ifi->ifi_index);
1203                 return;
1204         }
1205
1206         extra[0] = '\0';
1207         pos = extra;
1208         end = pos + sizeof(extra);
1209         ifname[0] = '\0';
1210
1211         attrlen = len;
1212         attr = (struct rtattr *) buf;
1213         while (RTA_OK(attr, attrlen)) {
1214                 switch (attr->rta_type) {
1215                 case IFLA_IFNAME:
1216                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1217                                 break;
1218                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1219                         ifname[RTA_PAYLOAD(attr)] = '\0';
1220                         break;
1221                 case IFLA_MASTER:
1222                         brid = nla_get_u32((struct nlattr *) attr);
1223                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1224                         break;
1225                 case IFLA_WIRELESS:
1226                         pos += os_snprintf(pos, end - pos, " wext");
1227                         break;
1228                 case IFLA_OPERSTATE:
1229                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1230                                            nla_get_u32((struct nlattr *) attr));
1231                         break;
1232                 case IFLA_LINKMODE:
1233                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1234                                            nla_get_u32((struct nlattr *) attr));
1235                         break;
1236                 }
1237                 attr = RTA_NEXT(attr, attrlen);
1238         }
1239         extra[sizeof(extra) - 1] = '\0';
1240
1241         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_flags=0x%x (%s%s%s%s)",
1242                    ifi->ifi_index, ifname, extra, ifi->ifi_flags,
1243                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1244                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1245                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1246                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1247
1248         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
1249                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1250                     linux_iface_up(drv->global->ioctl_sock,
1251                                    drv->first_bss->ifname) > 0) {
1252                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
1253                                    "event since interface %s is up", namebuf);
1254                         return;
1255                 }
1256                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
1257                 if (drv->ignore_if_down_event) {
1258                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
1259                                    "event generated by mode change");
1260                         drv->ignore_if_down_event = 0;
1261                 } else {
1262                         drv->if_disabled = 1;
1263                         wpa_supplicant_event(drv->ctx,
1264                                              EVENT_INTERFACE_DISABLED, NULL);
1265
1266                         /*
1267                          * Try to get drv again, since it may be removed as
1268                          * part of the EVENT_INTERFACE_DISABLED handling for
1269                          * dynamic interfaces
1270                          */
1271                         drv = nl80211_find_drv(global, ifi->ifi_index,
1272                                                buf, len);
1273                         if (!drv)
1274                                 return;
1275                 }
1276         }
1277
1278         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
1279                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1280                     linux_iface_up(drv->global->ioctl_sock,
1281                                    drv->first_bss->ifname) == 0) {
1282                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1283                                    "event since interface %s is down",
1284                                    namebuf);
1285                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
1286                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1287                                    "event since interface %s does not exist",
1288                                    drv->first_bss->ifname);
1289                 } else if (drv->if_removed) {
1290                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1291                                    "event since interface %s is marked "
1292                                    "removed", drv->first_bss->ifname);
1293                 } else {
1294                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1295                         drv->if_disabled = 0;
1296                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1297                                              NULL);
1298                 }
1299         }
1300
1301         /*
1302          * Some drivers send the association event before the operup event--in
1303          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1304          * fails. This will hit us when wpa_supplicant does not need to do
1305          * IEEE 802.1X authentication
1306          */
1307         if (drv->operstate == 1 &&
1308             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1309             !(ifi->ifi_flags & IFF_RUNNING)) {
1310                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1311                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1312                                        -1, IF_OPER_UP);
1313         }
1314
1315         if (ifname[0])
1316                 wpa_driver_nl80211_event_newlink(drv, ifname);
1317
1318         if (ifi->ifi_family == AF_BRIDGE && brid) {
1319                 /* device has been added to bridge */
1320                 if_indextoname(brid, namebuf);
1321                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1322                            brid, namebuf);
1323                 add_ifidx(drv, brid);
1324         }
1325 }
1326
1327
1328 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1329                                                  struct ifinfomsg *ifi,
1330                                                  u8 *buf, size_t len)
1331 {
1332         struct nl80211_global *global = ctx;
1333         struct wpa_driver_nl80211_data *drv;
1334         int attrlen;
1335         struct rtattr *attr;
1336         u32 brid = 0;
1337         char ifname[IFNAMSIZ + 1];
1338
1339         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1340         if (!drv) {
1341                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_DELLINK event for foreign ifindex %d",
1342                            ifi->ifi_index);
1343                 return;
1344         }
1345
1346         ifname[0] = '\0';
1347
1348         attrlen = len;
1349         attr = (struct rtattr *) buf;
1350         while (RTA_OK(attr, attrlen)) {
1351                 switch (attr->rta_type) {
1352                 case IFLA_IFNAME:
1353                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1354                                 break;
1355                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1356                         ifname[RTA_PAYLOAD(attr)] = '\0';
1357                         break;
1358                 case IFLA_MASTER:
1359                         brid = nla_get_u32((struct nlattr *) attr);
1360                         break;
1361                 }
1362                 attr = RTA_NEXT(attr, attrlen);
1363         }
1364
1365         if (ifname[0])
1366                 wpa_driver_nl80211_event_dellink(drv, ifname);
1367
1368         if (ifi->ifi_family == AF_BRIDGE && brid) {
1369                 /* device has been removed from bridge */
1370                 char namebuf[IFNAMSIZ];
1371                 if_indextoname(brid, namebuf);
1372                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1373                            "%s", brid, namebuf);
1374                 del_ifidx(drv, brid);
1375         }
1376 }
1377
1378
1379 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
1380                             const u8 *frame, size_t len)
1381 {
1382         const struct ieee80211_mgmt *mgmt;
1383         union wpa_event_data event;
1384
1385         wpa_printf(MSG_DEBUG, "nl80211: Authenticate event");
1386         mgmt = (const struct ieee80211_mgmt *) frame;
1387         if (len < 24 + sizeof(mgmt->u.auth)) {
1388                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1389                            "frame");
1390                 return;
1391         }
1392
1393         os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
1394         os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
1395         os_memset(&event, 0, sizeof(event));
1396         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
1397         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1398         event.auth.auth_transaction =
1399                 le_to_host16(mgmt->u.auth.auth_transaction);
1400         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
1401         if (len > 24 + sizeof(mgmt->u.auth)) {
1402                 event.auth.ies = mgmt->u.auth.variable;
1403                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
1404         }
1405
1406         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
1407 }
1408
1409
1410 static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1411 {
1412         struct nl_msg *msg;
1413         int ret;
1414         struct nl80211_bss_info_arg arg;
1415
1416         os_memset(&arg, 0, sizeof(arg));
1417         msg = nlmsg_alloc();
1418         if (!msg)
1419                 goto nla_put_failure;
1420
1421         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1422         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1423
1424         arg.drv = drv;
1425         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1426         msg = NULL;
1427         if (ret == 0) {
1428                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1429                         arg.ibss_freq : arg.assoc_freq;
1430                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1431                            "associated BSS from scan results: %u MHz", freq);
1432                 if (freq)
1433                         drv->assoc_freq = freq;
1434                 return drv->assoc_freq;
1435         }
1436         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1437                    "(%s)", ret, strerror(-ret));
1438 nla_put_failure:
1439         nlmsg_free(msg);
1440         return drv->assoc_freq;
1441 }
1442
1443
1444 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
1445                             const u8 *frame, size_t len)
1446 {
1447         const struct ieee80211_mgmt *mgmt;
1448         union wpa_event_data event;
1449         u16 status;
1450
1451         wpa_printf(MSG_DEBUG, "nl80211: Associate event");
1452         mgmt = (const struct ieee80211_mgmt *) frame;
1453         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
1454                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1455                            "frame");
1456                 return;
1457         }
1458
1459         status = le_to_host16(mgmt->u.assoc_resp.status_code);
1460         if (status != WLAN_STATUS_SUCCESS) {
1461                 os_memset(&event, 0, sizeof(event));
1462                 event.assoc_reject.bssid = mgmt->bssid;
1463                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1464                         event.assoc_reject.resp_ies =
1465                                 (u8 *) mgmt->u.assoc_resp.variable;
1466                         event.assoc_reject.resp_ies_len =
1467                                 len - 24 - sizeof(mgmt->u.assoc_resp);
1468                 }
1469                 event.assoc_reject.status_code = status;
1470
1471                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1472                 return;
1473         }
1474
1475         drv->associated = 1;
1476         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
1477         os_memcpy(drv->prev_bssid, mgmt->sa, ETH_ALEN);
1478
1479         os_memset(&event, 0, sizeof(event));
1480         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1481                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
1482                 event.assoc_info.resp_ies_len =
1483                         len - 24 - sizeof(mgmt->u.assoc_resp);
1484         }
1485
1486         event.assoc_info.freq = drv->assoc_freq;
1487
1488         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1489 }
1490
1491
1492 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
1493                                enum nl80211_commands cmd, struct nlattr *status,
1494                                struct nlattr *addr, struct nlattr *req_ie,
1495                                struct nlattr *resp_ie)
1496 {
1497         union wpa_event_data event;
1498
1499         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1500                 /*
1501                  * Avoid reporting two association events that would confuse
1502                  * the core code.
1503                  */
1504                 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
1505                            "when using userspace SME", cmd);
1506                 return;
1507         }
1508
1509         if (cmd == NL80211_CMD_CONNECT)
1510                 wpa_printf(MSG_DEBUG, "nl80211: Connect event");
1511         else if (cmd == NL80211_CMD_ROAM)
1512                 wpa_printf(MSG_DEBUG, "nl80211: Roam event");
1513
1514         os_memset(&event, 0, sizeof(event));
1515         if (cmd == NL80211_CMD_CONNECT &&
1516             nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
1517                 if (addr)
1518                         event.assoc_reject.bssid = nla_data(addr);
1519                 if (resp_ie) {
1520                         event.assoc_reject.resp_ies = nla_data(resp_ie);
1521                         event.assoc_reject.resp_ies_len = nla_len(resp_ie);
1522                 }
1523                 event.assoc_reject.status_code = nla_get_u16(status);
1524                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1525                 return;
1526         }
1527
1528         drv->associated = 1;
1529         if (addr) {
1530                 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1531                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
1532         }
1533
1534         if (req_ie) {
1535                 event.assoc_info.req_ies = nla_data(req_ie);
1536                 event.assoc_info.req_ies_len = nla_len(req_ie);
1537         }
1538         if (resp_ie) {
1539                 event.assoc_info.resp_ies = nla_data(resp_ie);
1540                 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1541         }
1542
1543         event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1544
1545         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1546 }
1547
1548
1549 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1550                                   struct nlattr *reason, struct nlattr *addr,
1551                                   struct nlattr *by_ap)
1552 {
1553         union wpa_event_data data;
1554         unsigned int locally_generated = by_ap == NULL;
1555
1556         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1557                 /*
1558                  * Avoid reporting two disassociation events that could
1559                  * confuse the core code.
1560                  */
1561                 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1562                            "event when using userspace SME");
1563                 return;
1564         }
1565
1566         if (drv->ignore_next_local_disconnect) {
1567                 drv->ignore_next_local_disconnect = 0;
1568                 if (locally_generated) {
1569                         wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1570                                    "event triggered during reassociation");
1571                         return;
1572                 }
1573                 wpa_printf(MSG_WARNING, "nl80211: Was expecting local "
1574                            "disconnect but got another disconnect "
1575                            "event first");
1576         }
1577
1578         wpa_printf(MSG_DEBUG, "nl80211: Disconnect event");
1579         nl80211_mark_disconnected(drv);
1580         os_memset(&data, 0, sizeof(data));
1581         if (reason)
1582                 data.deauth_info.reason_code = nla_get_u16(reason);
1583         data.deauth_info.locally_generated = by_ap == NULL;
1584         wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1585 }
1586
1587
1588 static int calculate_chan_offset(int width, int freq, int cf1, int cf2)
1589 {
1590         int freq1 = 0;
1591
1592         switch (convert2width(width)) {
1593         case CHAN_WIDTH_20_NOHT:
1594         case CHAN_WIDTH_20:
1595                 return 0;
1596         case CHAN_WIDTH_40:
1597                 freq1 = cf1 - 10;
1598                 break;
1599         case CHAN_WIDTH_80:
1600                 freq1 = cf1 - 30;
1601                 break;
1602         case CHAN_WIDTH_160:
1603                 freq1 = cf1 - 70;
1604                 break;
1605         case CHAN_WIDTH_UNKNOWN:
1606         case CHAN_WIDTH_80P80:
1607                 /* FIXME: implement this */
1608                 return 0;
1609         }
1610
1611         return (abs(freq - freq1) / 20) % 2 == 0 ? 1 : -1;
1612 }
1613
1614
1615 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1616                                  struct nlattr *ifindex, struct nlattr *freq,
1617                                  struct nlattr *type, struct nlattr *bw,
1618                                  struct nlattr *cf1, struct nlattr *cf2)
1619 {
1620         struct i802_bss *bss;
1621         union wpa_event_data data;
1622         int ht_enabled = 1;
1623         int chan_offset = 0;
1624         int ifidx;
1625
1626         wpa_printf(MSG_DEBUG, "nl80211: Channel switch event");
1627
1628         if (!freq)
1629                 return;
1630
1631         ifidx = nla_get_u32(ifindex);
1632         for (bss = drv->first_bss; bss; bss = bss->next)
1633                 if (bss->ifindex == ifidx)
1634                         break;
1635
1636         if (bss == NULL) {
1637                 wpa_printf(MSG_WARNING, "nl80211: Unknown ifindex (%d) for channel switch, ignoring",
1638                            ifidx);
1639                 return;
1640         }
1641
1642         if (type) {
1643                 switch (nla_get_u32(type)) {
1644                 case NL80211_CHAN_NO_HT:
1645                         ht_enabled = 0;
1646                         break;
1647                 case NL80211_CHAN_HT20:
1648                         break;
1649                 case NL80211_CHAN_HT40PLUS:
1650                         chan_offset = 1;
1651                         break;
1652                 case NL80211_CHAN_HT40MINUS:
1653                         chan_offset = -1;
1654                         break;
1655                 }
1656         } else if (bw && cf1) {
1657                 /* This can happen for example with VHT80 ch switch */
1658                 chan_offset = calculate_chan_offset(nla_get_u32(bw),
1659                                                     nla_get_u32(freq),
1660                                                     nla_get_u32(cf1),
1661                                                     cf2 ? nla_get_u32(cf2) : 0);
1662         } else {
1663                 wpa_printf(MSG_WARNING, "nl80211: Unknown secondary channel information - following channel definition calculations may fail");
1664         }
1665
1666         os_memset(&data, 0, sizeof(data));
1667         data.ch_switch.freq = nla_get_u32(freq);
1668         data.ch_switch.ht_enabled = ht_enabled;
1669         data.ch_switch.ch_offset = chan_offset;
1670         if (bw)
1671                 data.ch_switch.ch_width = convert2width(nla_get_u32(bw));
1672         if (cf1)
1673                 data.ch_switch.cf1 = nla_get_u32(cf1);
1674         if (cf2)
1675                 data.ch_switch.cf2 = nla_get_u32(cf2);
1676
1677         bss->freq = data.ch_switch.freq;
1678
1679         wpa_supplicant_event(drv->ctx, EVENT_CH_SWITCH, &data);
1680 }
1681
1682
1683 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1684                                enum nl80211_commands cmd, struct nlattr *addr)
1685 {
1686         union wpa_event_data event;
1687         enum wpa_event_type ev;
1688
1689         if (nla_len(addr) != ETH_ALEN)
1690                 return;
1691
1692         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1693                    cmd, MAC2STR((u8 *) nla_data(addr)));
1694
1695         if (cmd == NL80211_CMD_AUTHENTICATE)
1696                 ev = EVENT_AUTH_TIMED_OUT;
1697         else if (cmd == NL80211_CMD_ASSOCIATE)
1698                 ev = EVENT_ASSOC_TIMED_OUT;
1699         else
1700                 return;
1701
1702         os_memset(&event, 0, sizeof(event));
1703         os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1704         wpa_supplicant_event(drv->ctx, ev, &event);
1705 }
1706
1707
1708 static void mlme_event_mgmt(struct i802_bss *bss,
1709                             struct nlattr *freq, struct nlattr *sig,
1710                             const u8 *frame, size_t len)
1711 {
1712         struct wpa_driver_nl80211_data *drv = bss->drv;
1713         const struct ieee80211_mgmt *mgmt;
1714         union wpa_event_data event;
1715         u16 fc, stype;
1716         int ssi_signal = 0;
1717         int rx_freq = 0;
1718
1719         wpa_printf(MSG_MSGDUMP, "nl80211: Frame event");
1720         mgmt = (const struct ieee80211_mgmt *) frame;
1721         if (len < 24) {
1722                 wpa_printf(MSG_DEBUG, "nl80211: Too short management frame");
1723                 return;
1724         }
1725
1726         fc = le_to_host16(mgmt->frame_control);
1727         stype = WLAN_FC_GET_STYPE(fc);
1728
1729         if (sig)
1730                 ssi_signal = (s32) nla_get_u32(sig);
1731
1732         os_memset(&event, 0, sizeof(event));
1733         if (freq) {
1734                 event.rx_mgmt.freq = nla_get_u32(freq);
1735                 rx_freq = drv->last_mgmt_freq = event.rx_mgmt.freq;
1736         }
1737         wpa_printf(MSG_DEBUG,
1738                    "nl80211: RX frame freq=%d ssi_signal=%d stype=%u len=%u",
1739                    rx_freq, ssi_signal, stype, (unsigned int) len);
1740         event.rx_mgmt.frame = frame;
1741         event.rx_mgmt.frame_len = len;
1742         event.rx_mgmt.ssi_signal = ssi_signal;
1743         event.rx_mgmt.drv_priv = bss;
1744         wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1745 }
1746
1747
1748 static void mlme_event_mgmt_tx_status(struct wpa_driver_nl80211_data *drv,
1749                                       struct nlattr *cookie, const u8 *frame,
1750                                       size_t len, struct nlattr *ack)
1751 {
1752         union wpa_event_data event;
1753         const struct ieee80211_hdr *hdr;
1754         u16 fc;
1755
1756         wpa_printf(MSG_DEBUG, "nl80211: Frame TX status event");
1757         if (!is_ap_interface(drv->nlmode)) {
1758                 u64 cookie_val;
1759
1760                 if (!cookie)
1761                         return;
1762
1763                 cookie_val = nla_get_u64(cookie);
1764                 wpa_printf(MSG_DEBUG, "nl80211: Action TX status:"
1765                            " cookie=0%llx%s (ack=%d)",
1766                            (long long unsigned int) cookie_val,
1767                            cookie_val == drv->send_action_cookie ?
1768                            " (match)" : " (unknown)", ack != NULL);
1769                 if (cookie_val != drv->send_action_cookie)
1770                         return;
1771         }
1772
1773         hdr = (const struct ieee80211_hdr *) frame;
1774         fc = le_to_host16(hdr->frame_control);
1775
1776         os_memset(&event, 0, sizeof(event));
1777         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1778         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1779         event.tx_status.dst = hdr->addr1;
1780         event.tx_status.data = frame;
1781         event.tx_status.data_len = len;
1782         event.tx_status.ack = ack != NULL;
1783         wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event);
1784 }
1785
1786
1787 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1788                                        enum wpa_event_type type,
1789                                        const u8 *frame, size_t len)
1790 {
1791         const struct ieee80211_mgmt *mgmt;
1792         union wpa_event_data event;
1793         const u8 *bssid = NULL;
1794         u16 reason_code = 0;
1795
1796         if (type == EVENT_DEAUTH)
1797                 wpa_printf(MSG_DEBUG, "nl80211: Deauthenticate event");
1798         else
1799                 wpa_printf(MSG_DEBUG, "nl80211: Disassociate event");
1800
1801         mgmt = (const struct ieee80211_mgmt *) frame;
1802         if (len >= 24) {
1803                 bssid = mgmt->bssid;
1804
1805                 if ((drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
1806                     !drv->associated &&
1807                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0 &&
1808                     os_memcmp(bssid, drv->auth_attempt_bssid, ETH_ALEN) != 0 &&
1809                     os_memcmp(bssid, drv->prev_bssid, ETH_ALEN) == 0) {
1810                         /*
1811                          * Avoid issues with some roaming cases where
1812                          * disconnection event for the old AP may show up after
1813                          * we have started connection with the new AP.
1814                          */
1815                         wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth/disassoc event from old AP " MACSTR " when already authenticating with " MACSTR,
1816                                    MAC2STR(bssid),
1817                                    MAC2STR(drv->auth_attempt_bssid));
1818                         return;
1819                 }
1820
1821                 if (drv->associated != 0 &&
1822                     os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
1823                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
1824                         /*
1825                          * We have presumably received this deauth as a
1826                          * response to a clear_state_mismatch() outgoing
1827                          * deauth.  Don't let it take us offline!
1828                          */
1829                         wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1830                                    "from Unknown BSSID " MACSTR " -- ignoring",
1831                                    MAC2STR(bssid));
1832                         return;
1833                 }
1834         }
1835
1836         nl80211_mark_disconnected(drv);
1837         os_memset(&event, 0, sizeof(event));
1838
1839         /* Note: Same offset for Reason Code in both frame subtypes */
1840         if (len >= 24 + sizeof(mgmt->u.deauth))
1841                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1842
1843         if (type == EVENT_DISASSOC) {
1844                 event.disassoc_info.locally_generated =
1845                         !os_memcmp(mgmt->sa, drv->first_bss->addr, ETH_ALEN);
1846                 event.disassoc_info.addr = bssid;
1847                 event.disassoc_info.reason_code = reason_code;
1848                 if (frame + len > mgmt->u.disassoc.variable) {
1849                         event.disassoc_info.ie = mgmt->u.disassoc.variable;
1850                         event.disassoc_info.ie_len = frame + len -
1851                                 mgmt->u.disassoc.variable;
1852                 }
1853         } else {
1854                 if (drv->ignore_deauth_event) {
1855                         wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event due to previous forced deauth-during-auth");
1856                         drv->ignore_deauth_event = 0;
1857                         return;
1858                 }
1859                 event.deauth_info.locally_generated =
1860                         !os_memcmp(mgmt->sa, drv->first_bss->addr, ETH_ALEN);
1861                 if (drv->ignore_next_local_deauth) {
1862                         drv->ignore_next_local_deauth = 0;
1863                         if (event.deauth_info.locally_generated) {
1864                                 wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event triggered due to own deauth request");
1865                                 return;
1866                         }
1867                         wpa_printf(MSG_WARNING, "nl80211: Was expecting local deauth but got another disconnect event first");
1868                 }
1869                 event.deauth_info.addr = bssid;
1870                 event.deauth_info.reason_code = reason_code;
1871                 if (frame + len > mgmt->u.deauth.variable) {
1872                         event.deauth_info.ie = mgmt->u.deauth.variable;
1873                         event.deauth_info.ie_len = frame + len -
1874                                 mgmt->u.deauth.variable;
1875                 }
1876         }
1877
1878         wpa_supplicant_event(drv->ctx, type, &event);
1879 }
1880
1881
1882 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1883                                          enum wpa_event_type type,
1884                                          const u8 *frame, size_t len)
1885 {
1886         const struct ieee80211_mgmt *mgmt;
1887         union wpa_event_data event;
1888         u16 reason_code = 0;
1889
1890         if (type == EVENT_UNPROT_DEAUTH)
1891                 wpa_printf(MSG_DEBUG, "nl80211: Unprot Deauthenticate event");
1892         else
1893                 wpa_printf(MSG_DEBUG, "nl80211: Unprot Disassociate event");
1894
1895         if (len < 24)
1896                 return;
1897
1898         mgmt = (const struct ieee80211_mgmt *) frame;
1899
1900         os_memset(&event, 0, sizeof(event));
1901         /* Note: Same offset for Reason Code in both frame subtypes */
1902         if (len >= 24 + sizeof(mgmt->u.deauth))
1903                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1904
1905         if (type == EVENT_UNPROT_DISASSOC) {
1906                 event.unprot_disassoc.sa = mgmt->sa;
1907                 event.unprot_disassoc.da = mgmt->da;
1908                 event.unprot_disassoc.reason_code = reason_code;
1909         } else {
1910                 event.unprot_deauth.sa = mgmt->sa;
1911                 event.unprot_deauth.da = mgmt->da;
1912                 event.unprot_deauth.reason_code = reason_code;
1913         }
1914
1915         wpa_supplicant_event(drv->ctx, type, &event);
1916 }
1917
1918
1919 static void mlme_event(struct i802_bss *bss,
1920                        enum nl80211_commands cmd, struct nlattr *frame,
1921                        struct nlattr *addr, struct nlattr *timed_out,
1922                        struct nlattr *freq, struct nlattr *ack,
1923                        struct nlattr *cookie, struct nlattr *sig)
1924 {
1925         struct wpa_driver_nl80211_data *drv = bss->drv;
1926         const u8 *data;
1927         size_t len;
1928
1929         if (timed_out && addr) {
1930                 mlme_timeout_event(drv, cmd, addr);
1931                 return;
1932         }
1933
1934         if (frame == NULL) {
1935                 wpa_printf(MSG_DEBUG,
1936                            "nl80211: MLME event %d (%s) without frame data",
1937                            cmd, nl80211_command_to_string(cmd));
1938                 return;
1939         }
1940
1941         data = nla_data(frame);
1942         len = nla_len(frame);
1943         if (len < 4 + 2 * ETH_ALEN) {
1944                 wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s("
1945                            MACSTR ") - too short",
1946                            cmd, nl80211_command_to_string(cmd), bss->ifname,
1947                            MAC2STR(bss->addr));
1948                 return;
1949         }
1950         wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s(" MACSTR
1951                    ") A1=" MACSTR " A2=" MACSTR, cmd,
1952                    nl80211_command_to_string(cmd), bss->ifname,
1953                    MAC2STR(bss->addr), MAC2STR(data + 4),
1954                    MAC2STR(data + 4 + ETH_ALEN));
1955         if (cmd != NL80211_CMD_FRAME_TX_STATUS && !(data[4] & 0x01) &&
1956             os_memcmp(bss->addr, data + 4, ETH_ALEN) != 0 &&
1957             os_memcmp(bss->addr, data + 4 + ETH_ALEN, ETH_ALEN) != 0) {
1958                 wpa_printf(MSG_MSGDUMP, "nl80211: %s: Ignore MLME frame event "
1959                            "for foreign address", bss->ifname);
1960                 return;
1961         }
1962         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1963                     nla_data(frame), nla_len(frame));
1964
1965         switch (cmd) {
1966         case NL80211_CMD_AUTHENTICATE:
1967                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1968                 break;
1969         case NL80211_CMD_ASSOCIATE:
1970                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
1971                 break;
1972         case NL80211_CMD_DEAUTHENTICATE:
1973                 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1974                                            nla_data(frame), nla_len(frame));
1975                 break;
1976         case NL80211_CMD_DISASSOCIATE:
1977                 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1978                                            nla_data(frame), nla_len(frame));
1979                 break;
1980         case NL80211_CMD_FRAME:
1981                 mlme_event_mgmt(bss, freq, sig, nla_data(frame),
1982                                 nla_len(frame));
1983                 break;
1984         case NL80211_CMD_FRAME_TX_STATUS:
1985                 mlme_event_mgmt_tx_status(drv, cookie, nla_data(frame),
1986                                           nla_len(frame), ack);
1987                 break;
1988         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1989                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1990                                              nla_data(frame), nla_len(frame));
1991                 break;
1992         case NL80211_CMD_UNPROT_DISASSOCIATE:
1993                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1994                                              nla_data(frame), nla_len(frame));
1995                 break;
1996         default:
1997                 break;
1998         }
1999 }
2000
2001
2002 static void mlme_event_michael_mic_failure(struct i802_bss *bss,
2003                                            struct nlattr *tb[])
2004 {
2005         union wpa_event_data data;
2006
2007         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
2008         os_memset(&data, 0, sizeof(data));
2009         if (tb[NL80211_ATTR_MAC]) {
2010                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
2011                             nla_data(tb[NL80211_ATTR_MAC]),
2012                             nla_len(tb[NL80211_ATTR_MAC]));
2013                 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
2014         }
2015         if (tb[NL80211_ATTR_KEY_SEQ]) {
2016                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
2017                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
2018                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
2019         }
2020         if (tb[NL80211_ATTR_KEY_TYPE]) {
2021                 enum nl80211_key_type key_type =
2022                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
2023                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
2024                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
2025                         data.michael_mic_failure.unicast = 1;
2026         } else
2027                 data.michael_mic_failure.unicast = 1;
2028
2029         if (tb[NL80211_ATTR_KEY_IDX]) {
2030                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
2031                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
2032         }
2033
2034         wpa_supplicant_event(bss->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
2035 }
2036
2037
2038 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
2039                                  struct nlattr *tb[])
2040 {
2041         unsigned int freq;
2042
2043         if (tb[NL80211_ATTR_MAC] == NULL) {
2044                 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
2045                            "event");
2046                 return;
2047         }
2048         os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2049
2050         drv->associated = 1;
2051         wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
2052                    MAC2STR(drv->bssid));
2053
2054         freq = nl80211_get_assoc_freq(drv);
2055         if (freq) {
2056                 wpa_printf(MSG_DEBUG, "nl80211: IBSS on frequency %u MHz",
2057                            freq);
2058                 drv->first_bss->freq = freq;
2059         }
2060
2061         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
2062 }
2063
2064
2065 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
2066                                          int cancel_event, struct nlattr *tb[])
2067 {
2068         unsigned int freq, chan_type, duration;
2069         union wpa_event_data data;
2070         u64 cookie;
2071
2072         if (tb[NL80211_ATTR_WIPHY_FREQ])
2073                 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2074         else
2075                 freq = 0;
2076
2077         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
2078                 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2079         else
2080                 chan_type = 0;
2081
2082         if (tb[NL80211_ATTR_DURATION])
2083                 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
2084         else
2085                 duration = 0;
2086
2087         if (tb[NL80211_ATTR_COOKIE])
2088                 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
2089         else
2090                 cookie = 0;
2091
2092         wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
2093                    "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
2094                    cancel_event, freq, chan_type, duration,
2095                    (long long unsigned int) cookie,
2096                    cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
2097
2098         if (cookie != drv->remain_on_chan_cookie)
2099                 return; /* not for us */
2100
2101         if (cancel_event)
2102                 drv->pending_remain_on_chan = 0;
2103
2104         os_memset(&data, 0, sizeof(data));
2105         data.remain_on_channel.freq = freq;
2106         data.remain_on_channel.duration = duration;
2107         wpa_supplicant_event(drv->ctx, cancel_event ?
2108                              EVENT_CANCEL_REMAIN_ON_CHANNEL :
2109                              EVENT_REMAIN_ON_CHANNEL, &data);
2110 }
2111
2112
2113 static void mlme_event_ft_event(struct wpa_driver_nl80211_data *drv,
2114                                 struct nlattr *tb[])
2115 {
2116         union wpa_event_data data;
2117
2118         os_memset(&data, 0, sizeof(data));
2119
2120         if (tb[NL80211_ATTR_IE]) {
2121                 data.ft_ies.ies = nla_data(tb[NL80211_ATTR_IE]);
2122                 data.ft_ies.ies_len = nla_len(tb[NL80211_ATTR_IE]);
2123         }
2124
2125         if (tb[NL80211_ATTR_IE_RIC]) {
2126                 data.ft_ies.ric_ies = nla_data(tb[NL80211_ATTR_IE_RIC]);
2127                 data.ft_ies.ric_ies_len = nla_len(tb[NL80211_ATTR_IE_RIC]);
2128         }
2129
2130         if (tb[NL80211_ATTR_MAC])
2131                 os_memcpy(data.ft_ies.target_ap,
2132                           nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2133
2134         wpa_printf(MSG_DEBUG, "nl80211: FT event target_ap " MACSTR,
2135                    MAC2STR(data.ft_ies.target_ap));
2136
2137         wpa_supplicant_event(drv->ctx, EVENT_FT_RESPONSE, &data);
2138 }
2139
2140
2141 static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
2142                             struct nlattr *tb[])
2143 {
2144         union wpa_event_data event;
2145         struct nlattr *nl;
2146         int rem;
2147         struct scan_info *info;
2148 #define MAX_REPORT_FREQS 50
2149         int freqs[MAX_REPORT_FREQS];
2150         int num_freqs = 0;
2151
2152         if (drv->scan_for_auth) {
2153                 drv->scan_for_auth = 0;
2154                 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
2155                            "cfg80211 BSS entry");
2156                 wpa_driver_nl80211_authenticate_retry(drv);
2157                 return;
2158         }
2159
2160         os_memset(&event, 0, sizeof(event));
2161         info = &event.scan_info;
2162         info->aborted = aborted;
2163
2164         if (tb[NL80211_ATTR_SCAN_SSIDS]) {
2165                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
2166                         struct wpa_driver_scan_ssid *s =
2167                                 &info->ssids[info->num_ssids];
2168                         s->ssid = nla_data(nl);
2169                         s->ssid_len = nla_len(nl);
2170                         wpa_printf(MSG_DEBUG, "nl80211: Scan probed for SSID '%s'",
2171                                    wpa_ssid_txt(s->ssid, s->ssid_len));
2172                         info->num_ssids++;
2173                         if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
2174                                 break;
2175                 }
2176         }
2177         if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
2178                 char msg[200], *pos, *end;
2179                 int res;
2180
2181                 pos = msg;
2182                 end = pos + sizeof(msg);
2183                 *pos = '\0';
2184
2185                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
2186                 {
2187                         freqs[num_freqs] = nla_get_u32(nl);
2188                         res = os_snprintf(pos, end - pos, " %d",
2189                                           freqs[num_freqs]);
2190                         if (res > 0 && end - pos > res)
2191                                 pos += res;
2192                         num_freqs++;
2193                         if (num_freqs == MAX_REPORT_FREQS - 1)
2194                                 break;
2195                 }
2196                 info->freqs = freqs;
2197                 info->num_freqs = num_freqs;
2198                 wpa_printf(MSG_DEBUG, "nl80211: Scan included frequencies:%s",
2199                            msg);
2200         }
2201         wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
2202 }
2203
2204
2205 static int get_link_signal(struct nl_msg *msg, void *arg)
2206 {
2207         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2208         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2209         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
2210         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
2211                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
2212                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
2213         };
2214         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
2215         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
2216                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
2217                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
2218                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
2219                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
2220         };
2221         struct wpa_signal_info *sig_change = arg;
2222
2223         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2224                   genlmsg_attrlen(gnlh, 0), NULL);
2225         if (!tb[NL80211_ATTR_STA_INFO] ||
2226             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
2227                              tb[NL80211_ATTR_STA_INFO], policy))
2228                 return NL_SKIP;
2229         if (!sinfo[NL80211_STA_INFO_SIGNAL])
2230                 return NL_SKIP;
2231
2232         sig_change->current_signal =
2233                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
2234
2235         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
2236                 sig_change->avg_signal =
2237                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
2238         else
2239                 sig_change->avg_signal = 0;
2240
2241         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
2242                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
2243                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
2244                                      rate_policy)) {
2245                         sig_change->current_txrate = 0;
2246                 } else {
2247                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
2248                                 sig_change->current_txrate =
2249                                         nla_get_u16(rinfo[
2250                                              NL80211_RATE_INFO_BITRATE]) * 100;
2251                         }
2252                 }
2253         }
2254
2255         return NL_SKIP;
2256 }
2257
2258
2259 static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
2260                                    struct wpa_signal_info *sig)
2261 {
2262         struct nl_msg *msg;
2263
2264         sig->current_signal = -9999;
2265         sig->current_txrate = 0;
2266
2267         msg = nlmsg_alloc();
2268         if (!msg)
2269                 return -ENOMEM;
2270
2271         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
2272
2273         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2274         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
2275
2276         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
2277  nla_put_failure:
2278         nlmsg_free(msg);
2279         return -ENOBUFS;
2280 }
2281
2282
2283 static int get_link_noise(struct nl_msg *msg, void *arg)
2284 {
2285         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2286         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2287         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
2288         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
2289                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
2290                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
2291         };
2292         struct wpa_signal_info *sig_change = arg;
2293
2294         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2295                   genlmsg_attrlen(gnlh, 0), NULL);
2296
2297         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
2298                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
2299                 return NL_SKIP;
2300         }
2301
2302         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
2303                              tb[NL80211_ATTR_SURVEY_INFO],
2304                              survey_policy)) {
2305                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
2306                            "attributes!");
2307                 return NL_SKIP;
2308         }
2309
2310         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
2311                 return NL_SKIP;
2312
2313         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
2314             sig_change->frequency)
2315                 return NL_SKIP;
2316
2317         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
2318                 return NL_SKIP;
2319
2320         sig_change->current_noise =
2321                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
2322
2323         return NL_SKIP;
2324 }
2325
2326
2327 static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
2328                                   struct wpa_signal_info *sig_change)
2329 {
2330         struct nl_msg *msg;
2331
2332         sig_change->current_noise = 9999;
2333         sig_change->frequency = drv->assoc_freq;
2334
2335         msg = nlmsg_alloc();
2336         if (!msg)
2337                 return -ENOMEM;
2338
2339         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
2340
2341         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2342
2343         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
2344  nla_put_failure:
2345         nlmsg_free(msg);
2346         return -ENOBUFS;
2347 }
2348
2349
2350 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
2351 {
2352         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2353         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2354         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
2355         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
2356                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
2357                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
2358         };
2359         struct wpa_scan_results *scan_results = arg;
2360         struct wpa_scan_res *scan_res;
2361         size_t i;
2362
2363         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2364                   genlmsg_attrlen(gnlh, 0), NULL);
2365
2366         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
2367                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
2368                 return NL_SKIP;
2369         }
2370
2371         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
2372                              tb[NL80211_ATTR_SURVEY_INFO],
2373                              survey_policy)) {
2374                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
2375                            "attributes");
2376                 return NL_SKIP;
2377         }
2378
2379         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
2380                 return NL_SKIP;
2381
2382         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
2383                 return NL_SKIP;
2384
2385         for (i = 0; i < scan_results->num; ++i) {
2386                 scan_res = scan_results->res[i];
2387                 if (!scan_res)
2388                         continue;
2389                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
2390                     scan_res->freq)
2391                         continue;
2392                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
2393                         continue;
2394                 scan_res->noise = (s8)
2395                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
2396                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
2397         }
2398
2399         return NL_SKIP;
2400 }
2401
2402
2403 static int nl80211_get_noise_for_scan_results(
2404         struct wpa_driver_nl80211_data *drv,
2405         struct wpa_scan_results *scan_res)
2406 {
2407         struct nl_msg *msg;
2408
2409         msg = nlmsg_alloc();
2410         if (!msg)
2411                 return -ENOMEM;
2412
2413         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
2414
2415         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2416
2417         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
2418                                   scan_res);
2419  nla_put_failure:
2420         nlmsg_free(msg);
2421         return -ENOBUFS;
2422 }
2423
2424
2425 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
2426                               struct nlattr *tb[])
2427 {
2428         static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
2429                 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
2430                 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
2431                 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
2432                 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
2433         };
2434         struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
2435         enum nl80211_cqm_rssi_threshold_event event;
2436         union wpa_event_data ed;
2437         struct wpa_signal_info sig;
2438         int res;
2439
2440         if (tb[NL80211_ATTR_CQM] == NULL ||
2441             nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
2442                              cqm_policy)) {
2443                 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
2444                 return;
2445         }
2446
2447         os_memset(&ed, 0, sizeof(ed));
2448
2449         if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
2450                 if (!tb[NL80211_ATTR_MAC])
2451                         return;
2452                 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
2453                           ETH_ALEN);
2454                 wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed);
2455                 return;
2456         }
2457
2458         if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
2459                 return;
2460         event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
2461
2462         if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
2463                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2464                            "event: RSSI high");
2465                 ed.signal_change.above_threshold = 1;
2466         } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
2467                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2468                            "event: RSSI low");
2469                 ed.signal_change.above_threshold = 0;
2470         } else
2471                 return;
2472
2473         res = nl80211_get_link_signal(drv, &sig);
2474         if (res == 0) {
2475                 ed.signal_change.current_signal = sig.current_signal;
2476                 ed.signal_change.current_txrate = sig.current_txrate;
2477                 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm  txrate: %d",
2478                            sig.current_signal, sig.current_txrate);
2479         }
2480
2481         res = nl80211_get_link_noise(drv, &sig);
2482         if (res == 0) {
2483                 ed.signal_change.current_noise = sig.current_noise;
2484                 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
2485                            sig.current_noise);
2486         }
2487
2488         wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
2489 }
2490
2491
2492 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
2493                                       struct nlattr **tb)
2494 {
2495         u8 *addr;
2496         union wpa_event_data data;
2497
2498         if (tb[NL80211_ATTR_MAC] == NULL)
2499                 return;
2500         addr = nla_data(tb[NL80211_ATTR_MAC]);
2501         wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr));
2502
2503         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2504                 u8 *ies = NULL;
2505                 size_t ies_len = 0;
2506                 if (tb[NL80211_ATTR_IE]) {
2507                         ies = nla_data(tb[NL80211_ATTR_IE]);
2508                         ies_len = nla_len(tb[NL80211_ATTR_IE]);
2509                 }
2510                 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len);
2511                 drv_event_assoc(drv->ctx, addr, ies, ies_len, 0);
2512                 return;
2513         }
2514
2515         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2516                 return;
2517
2518         os_memset(&data, 0, sizeof(data));
2519         os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN);
2520         wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data);
2521 }
2522
2523
2524 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
2525                                       struct nlattr **tb)
2526 {
2527         u8 *addr;
2528         union wpa_event_data data;
2529
2530         if (tb[NL80211_ATTR_MAC] == NULL)
2531                 return;
2532         addr = nla_data(tb[NL80211_ATTR_MAC]);
2533         wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
2534                    MAC2STR(addr));
2535
2536         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2537                 drv_event_disassoc(drv->ctx, addr);
2538                 return;
2539         }
2540
2541         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2542                 return;
2543
2544         os_memset(&data, 0, sizeof(data));
2545         os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
2546         wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data);
2547 }
2548
2549
2550 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
2551                                         struct nlattr **tb)
2552 {
2553         struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
2554         static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
2555                 [NL80211_REKEY_DATA_KEK] = {
2556                         .minlen = NL80211_KEK_LEN,
2557                         .maxlen = NL80211_KEK_LEN,
2558                 },
2559                 [NL80211_REKEY_DATA_KCK] = {
2560                         .minlen = NL80211_KCK_LEN,
2561                         .maxlen = NL80211_KCK_LEN,
2562                 },
2563                 [NL80211_REKEY_DATA_REPLAY_CTR] = {
2564                         .minlen = NL80211_REPLAY_CTR_LEN,
2565                         .maxlen = NL80211_REPLAY_CTR_LEN,
2566                 },
2567         };
2568         union wpa_event_data data;
2569
2570         if (!tb[NL80211_ATTR_MAC])
2571                 return;
2572         if (!tb[NL80211_ATTR_REKEY_DATA])
2573                 return;
2574         if (nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2575                              tb[NL80211_ATTR_REKEY_DATA], rekey_policy))
2576                 return;
2577         if (!rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2578                 return;
2579
2580         os_memset(&data, 0, sizeof(data));
2581         data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2582         wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2583                    MAC2STR(data.driver_gtk_rekey.bssid));
2584         data.driver_gtk_rekey.replay_ctr =
2585                 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2586         wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2587                     data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2588         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2589 }
2590
2591
2592 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2593                                           struct nlattr **tb)
2594 {
2595         struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2596         static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2597                 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2598                 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2599                         .minlen = ETH_ALEN,
2600                         .maxlen = ETH_ALEN,
2601                 },
2602                 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2603         };
2604         union wpa_event_data data;
2605
2606         wpa_printf(MSG_DEBUG, "nl80211: PMKSA candidate event");
2607
2608         if (!tb[NL80211_ATTR_PMKSA_CANDIDATE])
2609                 return;
2610         if (nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2611                              tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy))
2612                 return;
2613         if (!cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2614             !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2615                 return;
2616
2617         os_memset(&data, 0, sizeof(data));
2618         os_memcpy(data.pmkid_candidate.bssid,
2619                   nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2620         data.pmkid_candidate.index =
2621                 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2622         data.pmkid_candidate.preauth =
2623                 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2624         wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2625 }
2626
2627
2628 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2629                                        struct nlattr **tb)
2630 {
2631         union wpa_event_data data;
2632
2633         wpa_printf(MSG_DEBUG, "nl80211: Probe client event");
2634
2635         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_ACK])
2636                 return;
2637
2638         os_memset(&data, 0, sizeof(data));
2639         os_memcpy(data.client_poll.addr,
2640                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2641
2642         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2643 }
2644
2645
2646 static void nl80211_tdls_oper_event(struct wpa_driver_nl80211_data *drv,
2647                                     struct nlattr **tb)
2648 {
2649         union wpa_event_data data;
2650
2651         wpa_printf(MSG_DEBUG, "nl80211: TDLS operation event");
2652
2653         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_TDLS_OPERATION])
2654                 return;
2655
2656         os_memset(&data, 0, sizeof(data));
2657         os_memcpy(data.tdls.peer, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2658         switch (nla_get_u8(tb[NL80211_ATTR_TDLS_OPERATION])) {
2659         case NL80211_TDLS_SETUP:
2660                 wpa_printf(MSG_DEBUG, "nl80211: TDLS setup request for peer "
2661                            MACSTR, MAC2STR(data.tdls.peer));
2662                 data.tdls.oper = TDLS_REQUEST_SETUP;
2663                 break;
2664         case NL80211_TDLS_TEARDOWN:
2665                 wpa_printf(MSG_DEBUG, "nl80211: TDLS teardown request for peer "
2666                            MACSTR, MAC2STR(data.tdls.peer));
2667                 data.tdls.oper = TDLS_REQUEST_TEARDOWN;
2668                 break;
2669         default:
2670                 wpa_printf(MSG_DEBUG, "nl80211: Unsupported TDLS operatione "
2671                            "event");
2672                 return;
2673         }
2674         if (tb[NL80211_ATTR_REASON_CODE]) {
2675                 data.tdls.reason_code =
2676                         nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
2677         }
2678
2679         wpa_supplicant_event(drv->ctx, EVENT_TDLS, &data);
2680 }
2681
2682
2683 static void nl80211_stop_ap(struct wpa_driver_nl80211_data *drv,
2684                             struct nlattr **tb)
2685 {
2686         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_UNAVAILABLE, NULL);
2687 }
2688
2689
2690 static void nl80211_connect_failed_event(struct wpa_driver_nl80211_data *drv,
2691                                          struct nlattr **tb)
2692 {
2693         union wpa_event_data data;
2694         u32 reason;
2695
2696         wpa_printf(MSG_DEBUG, "nl80211: Connect failed event");
2697
2698         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_CONN_FAILED_REASON])
2699                 return;
2700
2701         os_memset(&data, 0, sizeof(data));
2702         os_memcpy(data.connect_failed_reason.addr,
2703                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2704
2705         reason = nla_get_u32(tb[NL80211_ATTR_CONN_FAILED_REASON]);
2706         switch (reason) {
2707         case NL80211_CONN_FAIL_MAX_CLIENTS:
2708                 wpa_printf(MSG_DEBUG, "nl80211: Max client reached");
2709                 data.connect_failed_reason.code = MAX_CLIENT_REACHED;
2710                 break;
2711         case NL80211_CONN_FAIL_BLOCKED_CLIENT:
2712                 wpa_printf(MSG_DEBUG, "nl80211: Blocked client " MACSTR
2713                            " tried to connect",
2714                            MAC2STR(data.connect_failed_reason.addr));
2715                 data.connect_failed_reason.code = BLOCKED_CLIENT;
2716                 break;
2717         default:
2718                 wpa_printf(MSG_DEBUG, "nl8021l: Unknown connect failed reason "
2719                            "%u", reason);
2720                 return;
2721         }
2722
2723         wpa_supplicant_event(drv->ctx, EVENT_CONNECT_FAILED_REASON, &data);
2724 }
2725
2726
2727 static void nl80211_radar_event(struct wpa_driver_nl80211_data *drv,
2728                                 struct nlattr **tb)
2729 {
2730         union wpa_event_data data;
2731         enum nl80211_radar_event event_type;
2732
2733         if (!tb[NL80211_ATTR_WIPHY_FREQ] || !tb[NL80211_ATTR_RADAR_EVENT])
2734                 return;
2735
2736         os_memset(&data, 0, sizeof(data));
2737         data.dfs_event.freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2738         event_type = nla_get_u32(tb[NL80211_ATTR_RADAR_EVENT]);
2739
2740         /* Check HT params */
2741         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2742                 data.dfs_event.ht_enabled = 1;
2743                 data.dfs_event.chan_offset = 0;
2744
2745                 switch (nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
2746                 case NL80211_CHAN_NO_HT:
2747                         data.dfs_event.ht_enabled = 0;
2748                         break;
2749                 case NL80211_CHAN_HT20:
2750                         break;
2751                 case NL80211_CHAN_HT40PLUS:
2752                         data.dfs_event.chan_offset = 1;
2753                         break;
2754                 case NL80211_CHAN_HT40MINUS:
2755                         data.dfs_event.chan_offset = -1;
2756                         break;
2757                 }
2758         }
2759
2760         /* Get VHT params */
2761         if (tb[NL80211_ATTR_CHANNEL_WIDTH])
2762                 data.dfs_event.chan_width =
2763                         convert2width(nla_get_u32(
2764                                               tb[NL80211_ATTR_CHANNEL_WIDTH]));
2765         if (tb[NL80211_ATTR_CENTER_FREQ1])
2766                 data.dfs_event.cf1 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
2767         if (tb[NL80211_ATTR_CENTER_FREQ2])
2768                 data.dfs_event.cf2 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
2769
2770         wpa_printf(MSG_DEBUG, "nl80211: DFS event on freq %d MHz, ht: %d, offset: %d, width: %d, cf1: %dMHz, cf2: %dMHz",
2771                    data.dfs_event.freq, data.dfs_event.ht_enabled,
2772                    data.dfs_event.chan_offset, data.dfs_event.chan_width,
2773                    data.dfs_event.cf1, data.dfs_event.cf2);
2774
2775         switch (event_type) {
2776         case NL80211_RADAR_DETECTED:
2777                 wpa_supplicant_event(drv->ctx, EVENT_DFS_RADAR_DETECTED, &data);
2778                 break;
2779         case NL80211_RADAR_CAC_FINISHED:
2780                 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_FINISHED, &data);
2781                 break;
2782         case NL80211_RADAR_CAC_ABORTED:
2783                 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_ABORTED, &data);
2784                 break;
2785         case NL80211_RADAR_NOP_FINISHED:
2786                 wpa_supplicant_event(drv->ctx, EVENT_DFS_NOP_FINISHED, &data);
2787                 break;
2788         default:
2789                 wpa_printf(MSG_DEBUG, "nl80211: Unknown radar event %d "
2790                            "received", event_type);
2791                 break;
2792         }
2793 }
2794
2795
2796 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2797                                    int wds)
2798 {
2799         struct wpa_driver_nl80211_data *drv = bss->drv;
2800         union wpa_event_data event;
2801
2802         if (!tb[NL80211_ATTR_MAC])
2803                 return;
2804
2805         os_memset(&event, 0, sizeof(event));
2806         event.rx_from_unknown.bssid = bss->addr;
2807         event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2808         event.rx_from_unknown.wds = wds;
2809
2810         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2811 }
2812
2813
2814 static void qca_nl80211_avoid_freq(struct wpa_driver_nl80211_data *drv,
2815                                    const u8 *data, size_t len)
2816 {
2817         u32 i, count;
2818         union wpa_event_data event;
2819         struct wpa_freq_range *range = NULL;
2820         const struct qca_avoid_freq_list *freq_range;
2821
2822         freq_range = (const struct qca_avoid_freq_list *) data;
2823         if (len < sizeof(freq_range->count))
2824                 return;
2825
2826         count = freq_range->count;
2827         if (len < sizeof(freq_range->count) +
2828             count * sizeof(struct qca_avoid_freq_range)) {
2829                 wpa_printf(MSG_DEBUG, "nl80211: Ignored too short avoid frequency list (len=%u)",
2830                            (unsigned int) len);
2831                 return;
2832         }
2833
2834         if (count > 0) {
2835                 range = os_calloc(count, sizeof(struct wpa_freq_range));
2836                 if (range == NULL)
2837                         return;
2838         }
2839
2840         os_memset(&event, 0, sizeof(event));
2841         for (i = 0; i < count; i++) {
2842                 unsigned int idx = event.freq_range.num;
2843                 range[idx].min = freq_range->range[i].start_freq;
2844                 range[idx].max = freq_range->range[i].end_freq;
2845                 wpa_printf(MSG_DEBUG, "nl80211: Avoid frequency range: %u-%u",
2846                            range[idx].min, range[idx].max);
2847                 if (range[idx].min > range[idx].max) {
2848                         wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid frequency range");
2849                         continue;
2850                 }
2851                 event.freq_range.num++;
2852         }
2853         event.freq_range.range = range;
2854
2855         wpa_supplicant_event(drv->ctx, EVENT_AVOID_FREQUENCIES, &event);
2856
2857         os_free(range);
2858 }
2859
2860
2861 static void nl80211_vendor_event_qca(struct wpa_driver_nl80211_data *drv,
2862                                      u32 subcmd, u8 *data, size_t len)
2863 {
2864         switch (subcmd) {
2865         case QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY:
2866                 qca_nl80211_avoid_freq(drv, data, len);
2867                 break;
2868         default:
2869                 wpa_printf(MSG_DEBUG,
2870                            "nl80211: Ignore unsupported QCA vendor event %u",
2871                            subcmd);
2872                 break;
2873         }
2874 }
2875
2876
2877 static void nl80211_vendor_event(struct wpa_driver_nl80211_data *drv,
2878                                  struct nlattr **tb)
2879 {
2880         u32 vendor_id, subcmd, wiphy = 0;
2881         int wiphy_idx;
2882         u8 *data = NULL;
2883         size_t len = 0;
2884
2885         if (!tb[NL80211_ATTR_VENDOR_ID] ||
2886             !tb[NL80211_ATTR_VENDOR_SUBCMD])
2887                 return;
2888
2889         vendor_id = nla_get_u32(tb[NL80211_ATTR_VENDOR_ID]);
2890         subcmd = nla_get_u32(tb[NL80211_ATTR_VENDOR_SUBCMD]);
2891
2892         if (tb[NL80211_ATTR_WIPHY])
2893                 wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2894
2895         wpa_printf(MSG_DEBUG, "nl80211: Vendor event: wiphy=%u vendor_id=0x%x subcmd=%u",
2896                    wiphy, vendor_id, subcmd);
2897
2898         if (tb[NL80211_ATTR_VENDOR_DATA]) {
2899                 data = nla_data(tb[NL80211_ATTR_VENDOR_DATA]);
2900                 len = nla_len(tb[NL80211_ATTR_VENDOR_DATA]);
2901                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Vendor data", data, len);
2902         }
2903
2904         wiphy_idx = nl80211_get_wiphy_index(drv->first_bss);
2905         if (wiphy_idx >= 0 && wiphy_idx != (int) wiphy) {
2906                 wpa_printf(MSG_DEBUG, "nl80211: Ignore vendor event for foreign wiphy %u (own: %d)",
2907                            wiphy, wiphy_idx);
2908                 return;
2909         }
2910
2911         switch (vendor_id) {
2912         case OUI_QCA:
2913                 nl80211_vendor_event_qca(drv, subcmd, data, len);
2914                 break;
2915         default:
2916                 wpa_printf(MSG_DEBUG, "nl80211: Ignore unsupported vendor event");
2917                 break;
2918         }
2919 }
2920
2921
2922 static void nl80211_reg_change_event(struct wpa_driver_nl80211_data *drv,
2923                                      struct nlattr *tb[])
2924 {
2925         union wpa_event_data data;
2926         enum nl80211_reg_initiator init;
2927
2928         wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
2929
2930         if (tb[NL80211_ATTR_REG_INITIATOR] == NULL)
2931                 return;
2932
2933         os_memset(&data, 0, sizeof(data));
2934         init = nla_get_u8(tb[NL80211_ATTR_REG_INITIATOR]);
2935         wpa_printf(MSG_DEBUG, " * initiator=%d", init);
2936         switch (init) {
2937         case NL80211_REGDOM_SET_BY_CORE:
2938                 data.channel_list_changed.initiator = REGDOM_SET_BY_CORE;
2939                 break;
2940         case NL80211_REGDOM_SET_BY_USER:
2941                 data.channel_list_changed.initiator = REGDOM_SET_BY_USER;
2942                 break;
2943         case NL80211_REGDOM_SET_BY_DRIVER:
2944                 data.channel_list_changed.initiator = REGDOM_SET_BY_DRIVER;
2945                 break;
2946         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
2947                 data.channel_list_changed.initiator = REGDOM_SET_BY_COUNTRY_IE;
2948                 break;
2949         }
2950
2951         if (tb[NL80211_ATTR_REG_TYPE]) {
2952                 enum nl80211_reg_type type;
2953                 type = nla_get_u8(tb[NL80211_ATTR_REG_TYPE]);
2954                 wpa_printf(MSG_DEBUG, " * type=%d", type);
2955                 switch (type) {
2956                 case NL80211_REGDOM_TYPE_COUNTRY:
2957                         data.channel_list_changed.type = REGDOM_TYPE_COUNTRY;
2958                         break;
2959                 case NL80211_REGDOM_TYPE_WORLD:
2960                         data.channel_list_changed.type = REGDOM_TYPE_WORLD;
2961                         break;
2962                 case NL80211_REGDOM_TYPE_CUSTOM_WORLD:
2963                         data.channel_list_changed.type =
2964                                 REGDOM_TYPE_CUSTOM_WORLD;
2965                         break;
2966                 case NL80211_REGDOM_TYPE_INTERSECTION:
2967                         data.channel_list_changed.type =
2968                                 REGDOM_TYPE_INTERSECTION;
2969                         break;
2970                 }
2971         }
2972
2973         if (tb[NL80211_ATTR_REG_ALPHA2]) {
2974                 os_strlcpy(data.channel_list_changed.alpha2,
2975                            nla_get_string(tb[NL80211_ATTR_REG_ALPHA2]),
2976                            sizeof(data.channel_list_changed.alpha2));
2977                 wpa_printf(MSG_DEBUG, " * alpha2=%s",
2978                            data.channel_list_changed.alpha2);
2979         }
2980
2981         wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, &data);
2982 }
2983
2984
2985 static void do_process_drv_event(struct i802_bss *bss, int cmd,
2986                                  struct nlattr **tb)
2987 {
2988         struct wpa_driver_nl80211_data *drv = bss->drv;
2989         union wpa_event_data data;
2990
2991         wpa_printf(MSG_DEBUG, "nl80211: Drv Event %d (%s) received for %s",
2992                    cmd, nl80211_command_to_string(cmd), bss->ifname);
2993
2994         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
2995             (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
2996              cmd == NL80211_CMD_SCAN_ABORTED)) {
2997                 wpa_driver_nl80211_set_mode(drv->first_bss,
2998                                             drv->ap_scan_as_station);
2999                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
3000         }
3001
3002         switch (cmd) {
3003         case NL80211_CMD_TRIGGER_SCAN:
3004                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan trigger");
3005                 drv->scan_state = SCAN_STARTED;
3006                 if (drv->scan_for_auth) {
3007                         /*
3008                          * Cannot indicate EVENT_SCAN_STARTED here since we skip
3009                          * EVENT_SCAN_RESULTS in scan_for_auth case and the
3010                          * upper layer implementation could get confused about
3011                          * scanning state.
3012                          */
3013                         wpa_printf(MSG_DEBUG, "nl80211: Do not indicate scan-start event due to internal scan_for_auth");
3014                         break;
3015                 }
3016                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_STARTED, NULL);
3017                 break;
3018         case NL80211_CMD_START_SCHED_SCAN:
3019                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan started");
3020                 drv->scan_state = SCHED_SCAN_STARTED;
3021                 break;
3022         case NL80211_CMD_SCHED_SCAN_STOPPED:
3023                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan stopped");
3024                 drv->scan_state = SCHED_SCAN_STOPPED;
3025                 wpa_supplicant_event(drv->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
3026                 break;
3027         case NL80211_CMD_NEW_SCAN_RESULTS:
3028                 wpa_dbg(drv->ctx, MSG_DEBUG,
3029                         "nl80211: New scan results available");
3030                 drv->scan_state = SCAN_COMPLETED;
3031                 drv->scan_complete_events = 1;
3032                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
3033                                      drv->ctx);
3034                 send_scan_event(drv, 0, tb);
3035                 break;
3036         case NL80211_CMD_SCHED_SCAN_RESULTS:
3037                 wpa_dbg(drv->ctx, MSG_DEBUG,
3038                         "nl80211: New sched scan results available");
3039                 drv->scan_state = SCHED_SCAN_RESULTS;
3040                 send_scan_event(drv, 0, tb);
3041                 break;
3042         case NL80211_CMD_SCAN_ABORTED:
3043                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan aborted");
3044                 drv->scan_state = SCAN_ABORTED;
3045                 /*
3046                  * Need to indicate that scan results are available in order
3047                  * not to make wpa_supplicant stop its scanning.
3048                  */
3049                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
3050                                      drv->ctx);
3051                 send_scan_event(drv, 1, tb);
3052                 break;
3053         case NL80211_CMD_AUTHENTICATE:
3054         case NL80211_CMD_ASSOCIATE:
3055         case NL80211_CMD_DEAUTHENTICATE:
3056         case NL80211_CMD_DISASSOCIATE:
3057         case NL80211_CMD_FRAME_TX_STATUS:
3058         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
3059         case NL80211_CMD_UNPROT_DISASSOCIATE:
3060                 mlme_event(bss, cmd, tb[NL80211_ATTR_FRAME],
3061                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
3062                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
3063                            tb[NL80211_ATTR_COOKIE],
3064                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
3065                 break;
3066         case NL80211_CMD_CONNECT:
3067         case NL80211_CMD_ROAM:
3068                 mlme_event_connect(drv, cmd,
3069                                    tb[NL80211_ATTR_STATUS_CODE],
3070                                    tb[NL80211_ATTR_MAC],
3071                                    tb[NL80211_ATTR_REQ_IE],
3072                                    tb[NL80211_ATTR_RESP_IE]);
3073                 break;
3074         case NL80211_CMD_CH_SWITCH_NOTIFY:
3075                 mlme_event_ch_switch(drv,
3076                                      tb[NL80211_ATTR_IFINDEX],
3077                                      tb[NL80211_ATTR_WIPHY_FREQ],
3078                                      tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3079                                      tb[NL80211_ATTR_CHANNEL_WIDTH],
3080                                      tb[NL80211_ATTR_CENTER_FREQ1],
3081                                      tb[NL80211_ATTR_CENTER_FREQ2]);
3082                 break;
3083         case NL80211_CMD_DISCONNECT:
3084                 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
3085                                       tb[NL80211_ATTR_MAC],
3086                                       tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
3087                 break;
3088         case NL80211_CMD_MICHAEL_MIC_FAILURE:
3089                 mlme_event_michael_mic_failure(bss, tb);
3090                 break;
3091         case NL80211_CMD_JOIN_IBSS:
3092                 mlme_event_join_ibss(drv, tb);
3093                 break;
3094         case NL80211_CMD_REMAIN_ON_CHANNEL:
3095                 mlme_event_remain_on_channel(drv, 0, tb);
3096                 break;
3097         case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
3098                 mlme_event_remain_on_channel(drv, 1, tb);
3099                 break;
3100         case NL80211_CMD_NOTIFY_CQM:
3101                 nl80211_cqm_event(drv, tb);
3102                 break;
3103         case NL80211_CMD_REG_CHANGE:
3104                 nl80211_reg_change_event(drv, tb);
3105                 break;
3106         case NL80211_CMD_REG_BEACON_HINT:
3107                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
3108                 os_memset(&data, 0, sizeof(data));
3109                 data.channel_list_changed.initiator = REGDOM_BEACON_HINT;
3110                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
3111                                      &data);
3112                 break;
3113         case NL80211_CMD_NEW_STATION:
3114                 nl80211_new_station_event(drv, tb);
3115                 break;
3116         case NL80211_CMD_DEL_STATION:
3117                 nl80211_del_station_event(drv, tb);
3118                 break;
3119         case NL80211_CMD_SET_REKEY_OFFLOAD:
3120                 nl80211_rekey_offload_event(drv, tb);
3121                 break;
3122         case NL80211_CMD_PMKSA_CANDIDATE:
3123                 nl80211_pmksa_candidate_event(drv, tb);
3124                 break;
3125         case NL80211_CMD_PROBE_CLIENT:
3126                 nl80211_client_probe_event(drv, tb);
3127                 break;
3128         case NL80211_CMD_TDLS_OPER:
3129                 nl80211_tdls_oper_event(drv, tb);
3130                 break;
3131         case NL80211_CMD_CONN_FAILED:
3132                 nl80211_connect_failed_event(drv, tb);
3133                 break;
3134         case NL80211_CMD_FT_EVENT:
3135                 mlme_event_ft_event(drv, tb);
3136                 break;
3137         case NL80211_CMD_RADAR_DETECT:
3138                 nl80211_radar_event(drv, tb);
3139                 break;
3140         case NL80211_CMD_STOP_AP:
3141                 nl80211_stop_ap(drv, tb);
3142                 break;
3143         case NL80211_CMD_VENDOR:
3144                 nl80211_vendor_event(drv, tb);
3145                 break;
3146         default:
3147                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Ignored unknown event "
3148                         "(cmd=%d)", cmd);
3149                 break;
3150         }
3151 }
3152
3153
3154 static int process_drv_event(struct nl_msg *msg, void *arg)
3155 {
3156         struct wpa_driver_nl80211_data *drv = arg;
3157         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3158         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3159         struct i802_bss *bss;
3160         int ifidx = -1;
3161
3162         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3163                   genlmsg_attrlen(gnlh, 0), NULL);
3164
3165         if (tb[NL80211_ATTR_IFINDEX]) {
3166                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3167
3168                 for (bss = drv->first_bss; bss; bss = bss->next)
3169                         if (ifidx == -1 || ifidx == bss->ifindex) {
3170                                 do_process_drv_event(bss, gnlh->cmd, tb);
3171                                 return NL_SKIP;
3172                         }
3173                 wpa_printf(MSG_DEBUG,
3174                            "nl80211: Ignored event (cmd=%d) for foreign interface (ifindex %d)",
3175                            gnlh->cmd, ifidx);
3176         } else if (tb[NL80211_ATTR_WDEV]) {
3177                 u64 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
3178                 wpa_printf(MSG_DEBUG, "nl80211: Process event on P2P device");
3179                 for (bss = drv->first_bss; bss; bss = bss->next) {
3180                         if (bss->wdev_id_set && wdev_id == bss->wdev_id) {
3181                                 do_process_drv_event(bss, gnlh->cmd, tb);
3182                                 return NL_SKIP;
3183                         }
3184                 }
3185                 wpa_printf(MSG_DEBUG,
3186                            "nl80211: Ignored event (cmd=%d) for foreign interface (wdev 0x%llx)",
3187                            gnlh->cmd, (long long unsigned int) wdev_id);
3188         }
3189
3190         return NL_SKIP;
3191 }
3192
3193
3194 static int process_global_event(struct nl_msg *msg, void *arg)
3195 {
3196         struct nl80211_global *global = arg;
3197         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3198         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3199         struct wpa_driver_nl80211_data *drv, *tmp;
3200         int ifidx = -1;
3201         struct i802_bss *bss;
3202         u64 wdev_id = 0;
3203         int wdev_id_set = 0;
3204
3205         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3206                   genlmsg_attrlen(gnlh, 0), NULL);
3207
3208         if (tb[NL80211_ATTR_IFINDEX])
3209                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3210         else if (tb[NL80211_ATTR_WDEV]) {
3211                 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
3212                 wdev_id_set = 1;
3213         }
3214
3215         dl_list_for_each_safe(drv, tmp, &global->interfaces,
3216                               struct wpa_driver_nl80211_data, list) {
3217                 for (bss = drv->first_bss; bss; bss = bss->next) {
3218                         if ((ifidx == -1 && !wdev_id_set) ||
3219                             ifidx == bss->ifindex ||
3220                             (wdev_id_set && bss->wdev_id_set &&
3221                              wdev_id == bss->wdev_id)) {
3222                                 do_process_drv_event(bss, gnlh->cmd, tb);
3223                                 return NL_SKIP;
3224                         }
3225                 }
3226         }
3227
3228         return NL_SKIP;
3229 }
3230
3231
3232 static int process_bss_event(struct nl_msg *msg, void *arg)
3233 {
3234         struct i802_bss *bss = arg;
3235         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3236         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3237
3238         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3239                   genlmsg_attrlen(gnlh, 0), NULL);
3240
3241         wpa_printf(MSG_DEBUG, "nl80211: BSS Event %d (%s) received for %s",
3242                    gnlh->cmd, nl80211_command_to_string(gnlh->cmd),
3243                    bss->ifname);
3244
3245         switch (gnlh->cmd) {
3246         case NL80211_CMD_FRAME:
3247         case NL80211_CMD_FRAME_TX_STATUS:
3248                 mlme_event(bss, gnlh->cmd, tb[NL80211_ATTR_FRAME],
3249                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
3250                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
3251                            tb[NL80211_ATTR_COOKIE],
3252                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
3253                 break;
3254         case NL80211_CMD_UNEXPECTED_FRAME:
3255                 nl80211_spurious_frame(bss, tb, 0);
3256                 break;
3257         case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
3258                 nl80211_spurious_frame(bss, tb, 1);
3259                 break;
3260         default:
3261                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
3262                            "(cmd=%d)", gnlh->cmd);
3263                 break;
3264         }
3265
3266         return NL_SKIP;
3267 }
3268
3269
3270 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
3271                                              void *handle)
3272 {
3273         struct nl_cb *cb = eloop_ctx;
3274         int res;
3275
3276         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
3277
3278         res = nl_recvmsgs(handle, cb);
3279         if (res) {
3280                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
3281                            __func__, res);
3282         }
3283 }
3284
3285
3286 /**
3287  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
3288  * @priv: driver_nl80211 private data
3289  * @alpha2_arg: country to which to switch to
3290  * Returns: 0 on success, -1 on failure
3291  *
3292  * This asks nl80211 to set the regulatory domain for given
3293  * country ISO / IEC alpha2.
3294  */
3295 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
3296 {
3297         struct i802_bss *bss = priv;
3298         struct wpa_driver_nl80211_data *drv = bss->drv;
3299         char alpha2[3];
3300         struct nl_msg *msg;
3301
3302         msg = nlmsg_alloc();
3303         if (!msg)
3304                 return -ENOMEM;
3305
3306         alpha2[0] = alpha2_arg[0];
3307         alpha2[1] = alpha2_arg[1];
3308         alpha2[2] = '\0';
3309
3310         nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
3311
3312         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
3313         if (send_and_recv_msgs(drv, msg, NULL, NULL))
3314                 return -EINVAL;
3315         return 0;
3316 nla_put_failure:
3317         nlmsg_free(msg);
3318         return -EINVAL;
3319 }
3320
3321
3322 static int nl80211_get_country(struct nl_msg *msg, void *arg)
3323 {
3324         char *alpha2 = arg;
3325         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
3326         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3327
3328         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3329                   genlmsg_attrlen(gnlh, 0), NULL);
3330         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
3331                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
3332                 return NL_SKIP;
3333         }
3334         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
3335         return NL_SKIP;
3336 }
3337
3338
3339 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
3340 {
3341         struct i802_bss *bss = priv;
3342         struct wpa_driver_nl80211_data *drv = bss->drv;
3343         struct nl_msg *msg;
3344         int ret;
3345
3346         msg = nlmsg_alloc();
3347         if (!msg)
3348                 return -ENOMEM;
3349
3350         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
3351         alpha2[0] = '\0';
3352         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
3353         if (!alpha2[0])
3354                 ret = -1;
3355
3356         return ret;
3357 }
3358
3359
3360 static int protocol_feature_handler(struct nl_msg *msg, void *arg)
3361 {
3362         u32 *feat = arg;
3363         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
3364         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3365
3366         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3367                   genlmsg_attrlen(gnlh, 0), NULL);
3368
3369         if (tb_msg[NL80211_ATTR_PROTOCOL_FEATURES])
3370                 *feat = nla_get_u32(tb_msg[NL80211_ATTR_PROTOCOL_FEATURES]);
3371
3372         return NL_SKIP;
3373 }
3374
3375
3376 static u32 get_nl80211_protocol_features(struct wpa_driver_nl80211_data *drv)
3377 {
3378         u32 feat = 0;
3379         struct nl_msg *msg;
3380
3381         msg = nlmsg_alloc();
3382         if (!msg)
3383                 goto nla_put_failure;
3384
3385         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_PROTOCOL_FEATURES);
3386         if (send_and_recv_msgs(drv, msg, protocol_feature_handler, &feat) == 0)
3387                 return feat;
3388
3389         msg = NULL;
3390 nla_put_failure:
3391         nlmsg_free(msg);
3392         return 0;
3393 }
3394
3395
3396 struct wiphy_info_data {
3397         struct wpa_driver_nl80211_data *drv;
3398         struct wpa_driver_capa *capa;
3399
3400         unsigned int num_multichan_concurrent;
3401
3402         unsigned int error:1;
3403         unsigned int device_ap_sme:1;
3404         unsigned int poll_command_supported:1;
3405         unsigned int data_tx_status:1;
3406         unsigned int monitor_supported:1;
3407         unsigned int auth_supported:1;
3408         unsigned int connect_supported:1;
3409         unsigned int p2p_go_supported:1;
3410         unsigned int p2p_client_supported:1;
3411         unsigned int p2p_concurrent:1;
3412         unsigned int channel_switch_supported:1;
3413         unsigned int set_qos_map_supported:1;
3414 };
3415
3416
3417 static unsigned int probe_resp_offload_support(int supp_protocols)
3418 {
3419         unsigned int prot = 0;
3420
3421         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS)
3422                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS;
3423         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2)
3424                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2;
3425         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P)
3426                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P;
3427         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U)
3428                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING;
3429
3430         return prot;
3431 }
3432
3433
3434 static void wiphy_info_supported_iftypes(struct wiphy_info_data *info,
3435                                          struct nlattr *tb)
3436 {
3437         struct nlattr *nl_mode;
3438         int i;
3439
3440         if (tb == NULL)
3441                 return;
3442
3443         nla_for_each_nested(nl_mode, tb, i) {
3444                 switch (nla_type(nl_mode)) {
3445                 case NL80211_IFTYPE_AP:
3446                         info->capa->flags |= WPA_DRIVER_FLAGS_AP;
3447                         break;
3448                 case NL80211_IFTYPE_ADHOC:
3449                         info->capa->flags |= WPA_DRIVER_FLAGS_IBSS;
3450                         break;
3451                 case NL80211_IFTYPE_P2P_DEVICE:
3452                         info->capa->flags |=
3453                                 WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE;
3454                         break;
3455                 case NL80211_IFTYPE_P2P_GO:
3456                         info->p2p_go_supported = 1;
3457                         break;
3458                 case NL80211_IFTYPE_P2P_CLIENT:
3459                         info->p2p_client_supported = 1;
3460                         break;
3461                 case NL80211_IFTYPE_MONITOR:
3462                         info->monitor_supported = 1;
3463                         break;
3464                 }
3465         }
3466 }
3467
3468
3469 static int wiphy_info_iface_comb_process(struct wiphy_info_data *info,
3470                                          struct nlattr *nl_combi)
3471 {
3472         struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
3473         struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
3474         struct nlattr *nl_limit, *nl_mode;
3475         int err, rem_limit, rem_mode;
3476         int combination_has_p2p = 0, combination_has_mgd = 0;
3477         static struct nla_policy
3478         iface_combination_policy[NUM_NL80211_IFACE_COMB] = {
3479                 [NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
3480                 [NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
3481                 [NL80211_IFACE_COMB_STA_AP_BI_MATCH] = { .type = NLA_FLAG },
3482                 [NL80211_IFACE_COMB_NUM_CHANNELS] = { .type = NLA_U32 },
3483                 [NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS] = { .type = NLA_U32 },
3484         },
3485         iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
3486                 [NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
3487                 [NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
3488         };
3489
3490         err = nla_parse_nested(tb_comb, MAX_NL80211_IFACE_COMB,
3491                                nl_combi, iface_combination_policy);
3492         if (err || !tb_comb[NL80211_IFACE_COMB_LIMITS] ||
3493             !tb_comb[NL80211_IFACE_COMB_MAXNUM] ||
3494             !tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS])
3495                 return 0; /* broken combination */
3496
3497         if (tb_comb[NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS])
3498                 info->capa->flags |= WPA_DRIVER_FLAGS_RADAR;
3499
3500         nla_for_each_nested(nl_limit, tb_comb[NL80211_IFACE_COMB_LIMITS],
3501                             rem_limit) {
3502                 err = nla_parse_nested(tb_limit, MAX_NL80211_IFACE_LIMIT,
3503                                        nl_limit, iface_limit_policy);
3504                 if (err || !tb_limit[NL80211_IFACE_LIMIT_TYPES])
3505                         return 0; /* broken combination */
3506
3507                 nla_for_each_nested(nl_mode,
3508                                     tb_limit[NL80211_IFACE_LIMIT_TYPES],
3509                                     rem_mode) {
3510                         int ift = nla_type(nl_mode);
3511                         if (ift == NL80211_IFTYPE_P2P_GO ||
3512                             ift == NL80211_IFTYPE_P2P_CLIENT)
3513                                 combination_has_p2p = 1;
3514                         if (ift == NL80211_IFTYPE_STATION)
3515                                 combination_has_mgd = 1;
3516                 }
3517                 if (combination_has_p2p && combination_has_mgd)
3518                         break;
3519         }
3520
3521         if (combination_has_p2p && combination_has_mgd) {
3522                 unsigned int num_channels =
3523                         nla_get_u32(tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS]);
3524
3525                 info->p2p_concurrent = 1;
3526                 if (info->num_multichan_concurrent < num_channels)
3527                         info->num_multichan_concurrent = num_channels;
3528         }
3529
3530         return 0;
3531 }
3532
3533
3534 static void wiphy_info_iface_comb(struct wiphy_info_data *info,
3535                                   struct nlattr *tb)
3536 {
3537         struct nlattr *nl_combi;
3538         int rem_combi;
3539
3540         if (tb == NULL)
3541                 return;
3542
3543         nla_for_each_nested(nl_combi, tb, rem_combi) {
3544                 if (wiphy_info_iface_comb_process(info, nl_combi) > 0)
3545                         break;
3546         }
3547 }
3548
3549
3550 static void wiphy_info_supp_cmds(struct wiphy_info_data *info,
3551                                  struct nlattr *tb)
3552 {
3553         struct nlattr *nl_cmd;
3554         int i;
3555
3556         if (tb == NULL)
3557                 return;
3558
3559         nla_for_each_nested(nl_cmd, tb, i) {
3560                 switch (nla_get_u32(nl_cmd)) {
3561                 case NL80211_CMD_AUTHENTICATE:
3562                         info->auth_supported = 1;
3563                         break;
3564                 case NL80211_CMD_CONNECT:
3565                         info->connect_supported = 1;
3566                         break;
3567                 case NL80211_CMD_START_SCHED_SCAN:
3568                         info->capa->sched_scan_supported = 1;
3569                         break;
3570                 case NL80211_CMD_PROBE_CLIENT:
3571                         info->poll_command_supported = 1;
3572                         break;
3573                 case NL80211_CMD_CHANNEL_SWITCH:
3574                         info->channel_switch_supported = 1;
3575                         break;
3576                 case NL80211_CMD_SET_QOS_MAP:
3577                         info->set_qos_map_supported = 1;
3578                         break;
3579                 }
3580         }
3581 }
3582
3583
3584 static void wiphy_info_cipher_suites(struct wiphy_info_data *info,
3585                                      struct nlattr *tb)
3586 {
3587         int i, num;
3588         u32 *ciphers;
3589
3590         if (tb == NULL)
3591                 return;
3592
3593         num = nla_len(tb) / sizeof(u32);
3594         ciphers = nla_data(tb);
3595         for (i = 0; i < num; i++) {
3596                 u32 c = ciphers[i];
3597
3598                 wpa_printf(MSG_DEBUG, "nl80211: Supported cipher %02x-%02x-%02x:%d",
3599                            c >> 24, (c >> 16) & 0xff,
3600                            (c >> 8) & 0xff, c & 0xff);
3601                 switch (c) {
3602                 case WLAN_CIPHER_SUITE_CCMP_256:
3603                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_CCMP_256;
3604                         break;
3605                 case WLAN_CIPHER_SUITE_GCMP_256:
3606                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_GCMP_256;
3607                         break;
3608                 case WLAN_CIPHER_SUITE_CCMP:
3609                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_CCMP;
3610                         break;
3611                 case WLAN_CIPHER_SUITE_GCMP:
3612                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_GCMP;
3613                         break;
3614                 case WLAN_CIPHER_SUITE_TKIP:
3615                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_TKIP;
3616                         break;
3617                 case WLAN_CIPHER_SUITE_WEP104:
3618                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_WEP104;
3619                         break;
3620                 case WLAN_CIPHER_SUITE_WEP40:
3621                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_WEP40;
3622                         break;
3623                 case WLAN_CIPHER_SUITE_AES_CMAC:
3624                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP;
3625                         break;
3626                 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3627                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_GMAC_128;
3628                         break;
3629                 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3630                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_GMAC_256;
3631                         break;
3632                 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
3633                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_CMAC_256;
3634                         break;
3635                 case WLAN_CIPHER_SUITE_NO_GROUP_ADDR:
3636                         info->capa->enc |= WPA_DRIVER_CAPA_ENC_GTK_NOT_USED;
3637                         break;
3638                 }
3639         }
3640 }
3641
3642
3643 static void wiphy_info_max_roc(struct wpa_driver_capa *capa,
3644                                struct nlattr *tb)
3645 {
3646         if (tb)
3647                 capa->max_remain_on_chan = nla_get_u32(tb);
3648 }
3649
3650
3651 static void wiphy_info_tdls(struct wpa_driver_capa *capa, struct nlattr *tdls,
3652                             struct nlattr *ext_setup)
3653 {
3654         if (tdls == NULL)
3655                 return;
3656
3657         wpa_printf(MSG_DEBUG, "nl80211: TDLS supported");
3658         capa->flags |= WPA_DRIVER_FLAGS_TDLS_SUPPORT;
3659
3660         if (ext_setup) {
3661                 wpa_printf(MSG_DEBUG, "nl80211: TDLS external setup");
3662                 capa->flags |= WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP;
3663         }
3664 }
3665
3666
3667 static void wiphy_info_feature_flags(struct wiphy_info_data *info,
3668                                      struct nlattr *tb)
3669 {
3670         u32 flags;
3671         struct wpa_driver_capa *capa = info->capa;
3672
3673         if (tb == NULL)
3674                 return;
3675
3676         flags = nla_get_u32(tb);
3677
3678         if (flags & NL80211_FEATURE_SK_TX_STATUS)
3679                 info->data_tx_status = 1;
3680
3681         if (flags & NL80211_FEATURE_INACTIVITY_TIMER)
3682                 capa->flags |= WPA_DRIVER_FLAGS_INACTIVITY_TIMER;
3683
3684         if (flags & NL80211_FEATURE_SAE)
3685                 capa->flags |= WPA_DRIVER_FLAGS_SAE;
3686
3687         if (flags & NL80211_FEATURE_NEED_OBSS_SCAN)
3688                 capa->flags |= WPA_DRIVER_FLAGS_OBSS_SCAN;
3689
3690         if (flags & NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)
3691                 capa->flags |= WPA_DRIVER_FLAGS_HT_2040_COEX;
3692 }
3693
3694
3695 static void wiphy_info_probe_resp_offload(struct wpa_driver_capa *capa,
3696                                           struct nlattr *tb)
3697 {
3698         u32 protocols;
3699
3700         if (tb == NULL)
3701                 return;
3702
3703         protocols = nla_get_u32(tb);
3704         wpa_printf(MSG_DEBUG, "nl80211: Supports Probe Response offload in AP "
3705                    "mode");
3706         capa->flags |= WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD;
3707         capa->probe_resp_offloads = probe_resp_offload_support(protocols);
3708 }
3709
3710
3711 static void wiphy_info_wowlan_triggers(struct wpa_driver_capa *capa,
3712                                        struct nlattr *tb)
3713 {
3714         struct nlattr *triggers[MAX_NL80211_WOWLAN_TRIG + 1];
3715
3716         if (tb == NULL)
3717                 return;
3718
3719         if (nla_parse_nested(triggers, MAX_NL80211_WOWLAN_TRIG,
3720                              tb, NULL))
3721                 return;
3722
3723         if (triggers[NL80211_WOWLAN_TRIG_ANY])
3724                 capa->wowlan_triggers.any = 1;
3725         if (triggers[NL80211_WOWLAN_TRIG_DISCONNECT])
3726                 capa->wowlan_triggers.disconnect = 1;
3727         if (triggers[NL80211_WOWLAN_TRIG_MAGIC_PKT])
3728                 capa->wowlan_triggers.magic_pkt = 1;
3729         if (triggers[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE])
3730                 capa->wowlan_triggers.gtk_rekey_failure = 1;
3731         if (triggers[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST])
3732                 capa->wowlan_triggers.eap_identity_req = 1;
3733         if (triggers[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE])
3734                 capa->wowlan_triggers.four_way_handshake = 1;
3735         if (triggers[NL80211_WOWLAN_TRIG_RFKILL_RELEASE])
3736                 capa->wowlan_triggers.rfkill_release = 1;
3737 }
3738
3739
3740 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
3741 {
3742         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3743         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3744         struct wiphy_info_data *info = arg;
3745         struct wpa_driver_capa *capa = info->capa;
3746         struct wpa_driver_nl80211_data *drv = info->drv;
3747
3748         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3749                   genlmsg_attrlen(gnlh, 0), NULL);
3750
3751         if (tb[NL80211_ATTR_WIPHY_NAME])
3752                 os_strlcpy(drv->phyname,
3753                            nla_get_string(tb[NL80211_ATTR_WIPHY_NAME]),
3754                            sizeof(drv->phyname));
3755         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
3756                 capa->max_scan_ssids =
3757                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
3758
3759         if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS])
3760                 capa->max_sched_scan_ssids =
3761                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS]);
3762
3763         if (tb[NL80211_ATTR_MAX_MATCH_SETS])
3764                 capa->max_match_sets =
3765                         nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
3766
3767         if (tb[NL80211_ATTR_MAC_ACL_MAX])
3768                 capa->max_acl_mac_addrs =
3769                         nla_get_u8(tb[NL80211_ATTR_MAC_ACL_MAX]);
3770
3771         wiphy_info_supported_iftypes(info, tb[NL80211_ATTR_SUPPORTED_IFTYPES]);
3772         wiphy_info_iface_comb(info, tb[NL80211_ATTR_INTERFACE_COMBINATIONS]);
3773         wiphy_info_supp_cmds(info, tb[NL80211_ATTR_SUPPORTED_COMMANDS]);
3774         wiphy_info_cipher_suites(info, tb[NL80211_ATTR_CIPHER_SUITES]);
3775
3776         if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) {
3777                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
3778                            "off-channel TX");
3779                 capa->flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
3780         }
3781
3782         if (tb[NL80211_ATTR_ROAM_SUPPORT]) {
3783                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based roaming");
3784                 capa->flags |= WPA_DRIVER_FLAGS_BSS_SELECTION;
3785         }
3786
3787         wiphy_info_max_roc(capa,
3788                            tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
3789
3790         if (tb[NL80211_ATTR_SUPPORT_AP_UAPSD])
3791                 capa->flags |= WPA_DRIVER_FLAGS_AP_UAPSD;
3792
3793         wiphy_info_tdls(capa, tb[NL80211_ATTR_TDLS_SUPPORT],
3794                         tb[NL80211_ATTR_TDLS_EXTERNAL_SETUP]);
3795
3796         if (tb[NL80211_ATTR_DEVICE_AP_SME])
3797                 info->device_ap_sme = 1;
3798
3799         wiphy_info_feature_flags(info, tb[NL80211_ATTR_FEATURE_FLAGS]);
3800         wiphy_info_probe_resp_offload(capa,
3801                                       tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]);
3802
3803         if (tb[NL80211_ATTR_EXT_CAPA] && tb[NL80211_ATTR_EXT_CAPA_MASK] &&
3804             drv->extended_capa == NULL) {
3805                 drv->extended_capa =
3806                         os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3807                 if (drv->extended_capa) {
3808                         os_memcpy(drv->extended_capa,
3809                                   nla_data(tb[NL80211_ATTR_EXT_CAPA]),
3810                                   nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3811                         drv->extended_capa_len =
3812                                 nla_len(tb[NL80211_ATTR_EXT_CAPA]);
3813                 }
3814                 drv->extended_capa_mask =
3815                         os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3816                 if (drv->extended_capa_mask) {
3817                         os_memcpy(drv->extended_capa_mask,
3818                                   nla_data(tb[NL80211_ATTR_EXT_CAPA]),
3819                                   nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3820                 } else {
3821                         os_free(drv->extended_capa);
3822                         drv->extended_capa = NULL;
3823                         drv->extended_capa_len = 0;
3824                 }
3825         }
3826
3827         if (tb[NL80211_ATTR_VENDOR_DATA]) {
3828                 struct nlattr *nl;
3829                 int rem;
3830
3831                 nla_for_each_nested(nl, tb[NL80211_ATTR_VENDOR_DATA], rem) {
3832                         struct nl80211_vendor_cmd_info *vinfo;
3833                         if (nla_len(nl) != sizeof(*vinfo)) {
3834                                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected vendor data info");
3835                                 continue;
3836                         }
3837                         vinfo = nla_data(nl);
3838                         if (vinfo->subcmd ==
3839                             QCA_NL80211_VENDOR_SUBCMD_DFS_CAPABILITY)
3840                                 drv->dfs_vendor_cmd_avail = 1;
3841
3842                         wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
3843                                    vinfo->vendor_id, vinfo->subcmd);
3844                 }
3845         }
3846
3847         if (tb[NL80211_ATTR_VENDOR_EVENTS]) {
3848                 struct nlattr *nl;
3849                 int rem;
3850
3851                 nla_for_each_nested(nl, tb[NL80211_ATTR_VENDOR_EVENTS], rem) {
3852                         struct nl80211_vendor_cmd_info *vinfo;
3853                         if (nla_len(nl) != sizeof(*vinfo)) {
3854                                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected vendor data info");
3855                                 continue;
3856                         }
3857                         vinfo = nla_data(nl);
3858                         wpa_printf(MSG_DEBUG, "nl80211: Supported vendor event: vendor_id=0x%x subcmd=%u",
3859                                    vinfo->vendor_id, vinfo->subcmd);
3860                 }
3861         }
3862
3863         wiphy_info_wowlan_triggers(capa,
3864                                    tb[NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED]);
3865
3866         if (tb[NL80211_ATTR_MAX_AP_ASSOC_STA])
3867                 capa->max_stations =
3868                         nla_get_u32(tb[NL80211_ATTR_MAX_AP_ASSOC_STA]);
3869
3870         return NL_SKIP;
3871 }
3872
3873
3874 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
3875                                        struct wiphy_info_data *info)
3876 {
3877         u32 feat;
3878         struct nl_msg *msg;
3879
3880         os_memset(info, 0, sizeof(*info));
3881         info->capa = &drv->capa;
3882         info->drv = drv;
3883
3884         msg = nlmsg_alloc();
3885         if (!msg)
3886                 return -1;
3887
3888         feat = get_nl80211_protocol_features(drv);
3889         if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
3890                 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
3891         else
3892                 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
3893
3894         NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
3895         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
3896                 goto nla_put_failure;
3897
3898         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info))
3899                 return -1;
3900
3901         if (info->auth_supported)
3902                 drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
3903         else if (!info->connect_supported) {
3904                 wpa_printf(MSG_INFO, "nl80211: Driver does not support "
3905                            "authentication/association or connect commands");
3906                 info->error = 1;
3907         }
3908
3909         if (info->p2p_go_supported && info->p2p_client_supported)
3910                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
3911         if (info->p2p_concurrent) {
3912                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
3913                            "interface (driver advertised support)");
3914                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
3915                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
3916         }
3917         if (info->num_multichan_concurrent > 1) {
3918                 wpa_printf(MSG_DEBUG, "nl80211: Enable multi-channel "
3919                            "concurrent (driver advertised support)");
3920                 drv->capa.num_multichan_concurrent =
3921                         info->num_multichan_concurrent;
3922         }
3923
3924         /* default to 5000 since early versions of mac80211 don't set it */
3925         if (!drv->capa.max_remain_on_chan)
3926                 drv->capa.max_remain_on_chan = 5000;
3927
3928         if (info->channel_switch_supported)
3929                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_CSA;
3930
3931         return 0;
3932 nla_put_failure:
3933         nlmsg_free(msg);
3934         return -1;
3935 }
3936
3937
3938 static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
3939 {
3940         struct wiphy_info_data info;
3941         if (wpa_driver_nl80211_get_info(drv, &info))
3942                 return -1;
3943
3944         if (info.error)
3945                 return -1;
3946
3947         drv->has_capability = 1;
3948         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3949                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3950                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
3951                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
3952         drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
3953                 WPA_DRIVER_AUTH_SHARED |
3954                 WPA_DRIVER_AUTH_LEAP;
3955
3956         drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES;
3957         drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
3958         drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3959
3960         /*
3961          * As all cfg80211 drivers must support cases where the AP interface is
3962          * removed without the knowledge of wpa_supplicant/hostapd, e.g., in
3963          * case that the user space daemon has crashed, they must be able to
3964          * cleanup all stations and key entries in the AP tear down flow. Thus,
3965          * this flag can/should always be set for cfg80211 drivers.
3966          */
3967         drv->capa.flags |= WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT;
3968
3969         if (!info.device_ap_sme) {
3970                 drv->capa.flags |= WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS;
3971
3972                 /*
3973                  * No AP SME is currently assumed to also indicate no AP MLME
3974                  * in the driver/firmware.
3975                  */
3976                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_MLME;
3977         }
3978
3979         drv->device_ap_sme = info.device_ap_sme;
3980         drv->poll_command_supported = info.poll_command_supported;
3981         drv->data_tx_status = info.data_tx_status;
3982         if (info.set_qos_map_supported)
3983                 drv->capa.flags |= WPA_DRIVER_FLAGS_QOS_MAPPING;
3984
3985         /*
3986          * If poll command and tx status are supported, mac80211 is new enough
3987          * to have everything we need to not need monitor interfaces.
3988          */
3989         drv->use_monitor = !info.poll_command_supported || !info.data_tx_status;
3990
3991         if (drv->device_ap_sme && drv->use_monitor) {
3992                 /*
3993                  * Non-mac80211 drivers may not support monitor interface.
3994                  * Make sure we do not get stuck with incorrect capability here
3995                  * by explicitly testing this.
3996                  */
3997                 if (!info.monitor_supported) {
3998                         wpa_printf(MSG_DEBUG, "nl80211: Disable use_monitor "
3999                                    "with device_ap_sme since no monitor mode "
4000                                    "support detected");
4001                         drv->use_monitor = 0;
4002                 }
4003         }
4004
4005         /*
4006          * If we aren't going to use monitor interfaces, but the
4007          * driver doesn't support data TX status, we won't get TX
4008          * status for EAPOL frames.
4009          */
4010         if (!drv->use_monitor && !info.data_tx_status)
4011                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
4012
4013         return 0;
4014 }
4015
4016
4017 #ifdef ANDROID
4018 static int android_genl_ctrl_resolve(struct nl_handle *handle,
4019                                      const char *name)
4020 {
4021         /*
4022          * Android ICS has very minimal genl_ctrl_resolve() implementation, so
4023          * need to work around that.
4024          */
4025         struct nl_cache *cache = NULL;
4026         struct genl_family *nl80211 = NULL;
4027         int id = -1;
4028
4029         if (genl_ctrl_alloc_cache(handle, &cache) < 0) {
4030                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
4031                            "netlink cache");
4032                 goto fail;
4033         }
4034
4035         nl80211 = genl_ctrl_search_by_name(cache, name);
4036         if (nl80211 == NULL)
4037                 goto fail;
4038
4039         id = genl_family_get_id(nl80211);
4040
4041 fail:
4042         if (nl80211)
4043                 genl_family_put(nl80211);
4044         if (cache)
4045                 nl_cache_free(cache);
4046
4047         return id;
4048 }
4049 #define genl_ctrl_resolve android_genl_ctrl_resolve
4050 #endif /* ANDROID */
4051
4052
4053 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
4054 {
4055         int ret;
4056
4057         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4058         if (global->nl_cb == NULL) {
4059                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
4060                            "callbacks");
4061                 return -1;
4062         }
4063
4064         global->nl = nl_create_handle(global->nl_cb, "nl");
4065         if (global->nl == NULL)
4066                 goto err;
4067
4068         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
4069         if (global->nl80211_id < 0) {
4070                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
4071                            "found");
4072                 goto err;
4073         }
4074
4075         global->nl_event = nl_create_handle(global->nl_cb, "event");
4076         if (global->nl_event == NULL)
4077                 goto err;
4078
4079         ret = nl_get_multicast_id(global, "nl80211", "scan");
4080         if (ret >= 0)
4081                 ret = nl_socket_add_membership(global->nl_event, ret);
4082         if (ret < 0) {
4083                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
4084                            "membership for scan events: %d (%s)",
4085                            ret, strerror(-ret));
4086                 goto err;
4087         }
4088
4089         ret = nl_get_multicast_id(global, "nl80211", "mlme");
4090         if (ret >= 0)
4091                 ret = nl_socket_add_membership(global->nl_event, ret);
4092         if (ret < 0) {
4093                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
4094                            "membership for mlme events: %d (%s)",
4095                            ret, strerror(-ret));
4096                 goto err;
4097         }
4098
4099         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
4100         if (ret >= 0)
4101                 ret = nl_socket_add_membership(global->nl_event, ret);
4102         if (ret < 0) {
4103                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4104                            "membership for regulatory events: %d (%s)",
4105                            ret, strerror(-ret));
4106                 /* Continue without regulatory events */
4107         }
4108
4109         ret = nl_get_multicast_id(global, "nl80211", "vendor");
4110         if (ret >= 0)
4111                 ret = nl_socket_add_membership(global->nl_event, ret);
4112         if (ret < 0) {
4113                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4114                            "membership for vendor events: %d (%s)",
4115                            ret, strerror(-ret));
4116                 /* Continue without vendor events */
4117         }
4118
4119         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
4120                   no_seq_check, NULL);
4121         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
4122                   process_global_event, global);
4123
4124         nl80211_register_eloop_read(&global->nl_event,
4125                                     wpa_driver_nl80211_event_receive,
4126                                     global->nl_cb);
4127
4128         return 0;
4129
4130 err:
4131         nl_destroy_handles(&global->nl_event);
4132         nl_destroy_handles(&global->nl);
4133         nl_cb_put(global->nl_cb);
4134         global->nl_cb = NULL;
4135         return -1;
4136 }
4137
4138
4139 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
4140 {
4141         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4142         if (!drv->nl_cb) {
4143                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
4144                 return -1;
4145         }
4146
4147         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
4148                   no_seq_check, NULL);
4149         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
4150                   process_drv_event, drv);
4151
4152         return 0;
4153 }
4154
4155
4156 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
4157 {
4158         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
4159         /*
4160          * This may be for any interface; use ifdown event to disable
4161          * interface.
4162          */
4163 }
4164
4165
4166 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
4167 {
4168         struct wpa_driver_nl80211_data *drv = ctx;
4169         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
4170         if (i802_set_iface_flags(drv->first_bss, 1)) {
4171                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
4172                            "after rfkill unblock");
4173                 return;
4174         }
4175         /* rtnetlink ifup handler will report interface as enabled */
4176 }
4177
4178
4179 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
4180                                                       void *eloop_ctx,
4181                                                       void *handle)
4182 {
4183         struct wpa_driver_nl80211_data *drv = eloop_ctx;
4184         u8 data[2048];
4185         struct msghdr msg;
4186         struct iovec entry;
4187         u8 control[512];
4188         struct cmsghdr *cmsg;
4189         int res, found_ee = 0, found_wifi = 0, acked = 0;
4190         union wpa_event_data event;
4191
4192         memset(&msg, 0, sizeof(msg));
4193         msg.msg_iov = &entry;
4194         msg.msg_iovlen = 1;
4195         entry.iov_base = data;
4196         entry.iov_len = sizeof(data);
4197         msg.msg_control = &control;
4198         msg.msg_controllen = sizeof(control);
4199
4200         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
4201         /* if error or not fitting 802.3 header, return */
4202         if (res < 14)
4203                 return;
4204
4205         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
4206         {
4207                 if (cmsg->cmsg_level == SOL_SOCKET &&
4208                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
4209                         int *ack;
4210
4211                         found_wifi = 1;
4212                         ack = (void *)CMSG_DATA(cmsg);
4213                         acked = *ack;
4214                 }
4215
4216                 if (cmsg->cmsg_level == SOL_PACKET &&
4217                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
4218                         struct sock_extended_err *err =
4219                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
4220
4221                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
4222                                 found_ee = 1;
4223                 }
4224         }
4225
4226         if (!found_ee || !found_wifi)
4227                 return;
4228
4229         memset(&event, 0, sizeof(event));
4230         event.eapol_tx_status.dst = data;
4231         event.eapol_tx_status.data = data + 14;
4232         event.eapol_tx_status.data_len = res - 14;
4233         event.eapol_tx_status.ack = acked;
4234         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
4235 }
4236
4237
4238 static int nl80211_init_bss(struct i802_bss *bss)
4239 {
4240         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4241         if (!bss->nl_cb)
4242                 return -1;
4243
4244         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
4245                   no_seq_check, NULL);
4246         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
4247                   process_bss_event, bss);
4248
4249         return 0;
4250 }
4251
4252
4253 static void nl80211_destroy_bss(struct i802_bss *bss)
4254 {
4255         nl_cb_put(bss->nl_cb);
4256         bss->nl_cb = NULL;
4257 }
4258
4259
4260 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
4261                                           void *global_priv, int hostapd,
4262                                           const u8 *set_addr)
4263 {
4264         struct wpa_driver_nl80211_data *drv;
4265         struct rfkill_config *rcfg;
4266         struct i802_bss *bss;
4267
4268         if (global_priv == NULL)
4269                 return NULL;
4270         drv = os_zalloc(sizeof(*drv));
4271         if (drv == NULL)
4272                 return NULL;
4273         drv->global = global_priv;
4274         drv->ctx = ctx;
4275         drv->hostapd = !!hostapd;
4276         drv->eapol_sock = -1;
4277         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
4278         drv->if_indices = drv->default_if_indices;
4279
4280         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
4281         if (!drv->first_bss) {
4282                 os_free(drv);
4283                 return NULL;
4284         }
4285         bss = drv->first_bss;
4286         bss->drv = drv;
4287         bss->ctx = ctx;
4288
4289         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
4290         drv->monitor_ifidx = -1;
4291         drv->monitor_sock = -1;
4292         drv->eapol_tx_sock = -1;
4293         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
4294
4295         if (wpa_driver_nl80211_init_nl(drv)) {
4296                 os_free(drv);
4297                 return NULL;
4298         }
4299
4300         if (nl80211_init_bss(bss))
4301                 goto failed;
4302
4303         rcfg = os_zalloc(sizeof(*rcfg));
4304         if (rcfg == NULL)
4305                 goto failed;
4306         rcfg->ctx = drv;
4307         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
4308         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
4309         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
4310         drv->rfkill = rfkill_init(rcfg);
4311         if (drv->rfkill == NULL) {
4312                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
4313                 os_free(rcfg);
4314         }
4315
4316         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
4317                 drv->start_iface_up = 1;
4318
4319         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1))
4320                 goto failed;
4321
4322         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
4323         if (drv->eapol_tx_sock < 0)
4324                 goto failed;
4325
4326         if (drv->data_tx_status) {
4327                 int enabled = 1;
4328
4329                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
4330                                &enabled, sizeof(enabled)) < 0) {
4331                         wpa_printf(MSG_DEBUG,
4332                                 "nl80211: wifi status sockopt failed\n");
4333                         drv->data_tx_status = 0;
4334                         if (!drv->use_monitor)
4335                                 drv->capa.flags &=
4336                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
4337                 } else {
4338                         eloop_register_read_sock(drv->eapol_tx_sock,
4339                                 wpa_driver_nl80211_handle_eapol_tx_status,
4340                                 drv, NULL);
4341                 }
4342         }
4343
4344         if (drv->global) {
4345                 dl_list_add(&drv->global->interfaces, &drv->list);
4346                 drv->in_interface_list = 1;
4347         }
4348
4349         return bss;
4350
4351 failed:
4352         wpa_driver_nl80211_deinit(bss);
4353         return NULL;
4354 }
4355
4356
4357 /**
4358  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
4359  * @ctx: context to be used when calling wpa_supplicant functions,
4360  * e.g., wpa_supplicant_event()
4361  * @ifname: interface name, e.g., wlan0
4362  * @global_priv: private driver global data from global_init()
4363  * Returns: Pointer to private data, %NULL on failure
4364  */
4365 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
4366                                       void *global_priv)
4367 {
4368         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL);
4369 }
4370
4371
4372 static int nl80211_register_frame(struct i802_bss *bss,
4373                                   struct nl_handle *nl_handle,
4374                                   u16 type, const u8 *match, size_t match_len)
4375 {
4376         struct wpa_driver_nl80211_data *drv = bss->drv;
4377         struct nl_msg *msg;
4378         int ret = -1;
4379         char buf[30];
4380
4381         msg = nlmsg_alloc();
4382         if (!msg)
4383                 return -1;
4384
4385         buf[0] = '\0';
4386         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
4387         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x nl_handle=%p match=%s",
4388                    type, nl_handle, buf);
4389
4390         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
4391
4392         if (nl80211_set_iface_id(msg, bss) < 0)
4393                 goto nla_put_failure;
4394
4395         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
4396         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
4397
4398         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
4399         msg = NULL;
4400         if (ret) {
4401                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
4402                            "failed (type=%u): ret=%d (%s)",
4403                            type, ret, strerror(-ret));
4404                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
4405                             match, match_len);
4406                 goto nla_put_failure;
4407         }
4408         ret = 0;
4409 nla_put_failure:
4410         nlmsg_free(msg);
4411         return ret;
4412 }
4413
4414
4415 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
4416 {
4417         struct wpa_driver_nl80211_data *drv = bss->drv;
4418
4419         if (bss->nl_mgmt) {
4420                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
4421                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
4422                 return -1;
4423         }
4424
4425         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
4426         if (bss->nl_mgmt == NULL)
4427                 return -1;
4428
4429         return 0;
4430 }
4431
4432
4433 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
4434 {
4435         nl80211_register_eloop_read(&bss->nl_mgmt,
4436                                     wpa_driver_nl80211_event_receive,
4437                                     bss->nl_cb);
4438 }
4439
4440
4441 static int nl80211_register_action_frame(struct i802_bss *bss,
4442                                          const u8 *match, size_t match_len)
4443 {
4444         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
4445         return nl80211_register_frame(bss, bss->nl_mgmt,
4446                                       type, match, match_len);
4447 }
4448
4449
4450 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
4451 {
4452         struct wpa_driver_nl80211_data *drv = bss->drv;
4453         int ret = 0;
4454
4455         if (nl80211_alloc_mgmt_handle(bss))
4456                 return -1;
4457         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
4458                    "handle %p", bss->nl_mgmt);
4459
4460         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
4461                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
4462
4463                 /* register for any AUTH message */
4464                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
4465         }
4466
4467 #ifdef CONFIG_INTERWORKING
4468         /* QoS Map Configure */
4469         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
4470                 ret = -1;
4471 #endif /* CONFIG_INTERWORKING */
4472 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
4473         /* GAS Initial Request */
4474         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
4475                 ret = -1;
4476         /* GAS Initial Response */
4477         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
4478                 ret = -1;
4479         /* GAS Comeback Request */
4480         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
4481                 ret = -1;
4482         /* GAS Comeback Response */
4483         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
4484                 ret = -1;
4485         /* Protected GAS Initial Request */
4486         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
4487                 ret = -1;
4488         /* Protected GAS Initial Response */
4489         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
4490                 ret = -1;
4491         /* Protected GAS Comeback Request */
4492         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
4493                 ret = -1;
4494         /* Protected GAS Comeback Response */
4495         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
4496                 ret = -1;
4497 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
4498 #ifdef CONFIG_P2P
4499         /* P2P Public Action */
4500         if (nl80211_register_action_frame(bss,
4501                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
4502                                           6) < 0)
4503                 ret = -1;
4504         /* P2P Action */
4505         if (nl80211_register_action_frame(bss,
4506                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
4507                                           5) < 0)
4508                 ret = -1;
4509 #endif /* CONFIG_P2P */
4510 #ifdef CONFIG_IEEE80211W
4511         /* SA Query Response */
4512         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
4513                 ret = -1;
4514 #endif /* CONFIG_IEEE80211W */
4515 #ifdef CONFIG_TDLS
4516         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
4517                 /* TDLS Discovery Response */
4518                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
4519                     0)
4520                         ret = -1;
4521         }
4522 #endif /* CONFIG_TDLS */
4523
4524         /* FT Action frames */
4525         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
4526                 ret = -1;
4527         else
4528                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
4529                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
4530
4531         /* WNM - BSS Transition Management Request */
4532         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
4533                 ret = -1;
4534         /* WNM-Sleep Mode Response */
4535         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
4536                 ret = -1;
4537
4538 #ifdef CONFIG_HS20
4539         /* WNM-Notification */
4540         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
4541                 return -1;
4542 #endif /* CONFIG_HS20 */
4543
4544         nl80211_mgmt_handle_register_eloop(bss);
4545
4546         return ret;
4547 }
4548
4549
4550 static int nl80211_register_spurious_class3(struct i802_bss *bss)
4551 {
4552         struct wpa_driver_nl80211_data *drv = bss->drv;
4553         struct nl_msg *msg;
4554         int ret = -1;
4555
4556         msg = nlmsg_alloc();
4557         if (!msg)
4558                 return -1;
4559
4560         nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
4561
4562         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
4563
4564         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
4565         msg = NULL;
4566         if (ret) {
4567                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
4568                            "failed: ret=%d (%s)",
4569                            ret, strerror(-ret));
4570                 goto nla_put_failure;
4571         }
4572         ret = 0;
4573 nla_put_failure:
4574         nlmsg_free(msg);
4575         return ret;
4576 }
4577
4578
4579 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
4580 {
4581         static const int stypes[] = {
4582                 WLAN_FC_STYPE_AUTH,
4583                 WLAN_FC_STYPE_ASSOC_REQ,
4584                 WLAN_FC_STYPE_REASSOC_REQ,
4585                 WLAN_FC_STYPE_DISASSOC,
4586                 WLAN_FC_STYPE_DEAUTH,
4587                 WLAN_FC_STYPE_ACTION,
4588                 WLAN_FC_STYPE_PROBE_REQ,
4589 /* Beacon doesn't work as mac80211 doesn't currently allow
4590  * it, but it wouldn't really be the right thing anyway as
4591  * it isn't per interface ... maybe just dump the scan
4592  * results periodically for OLBC?
4593  */
4594                 /* WLAN_FC_STYPE_BEACON, */
4595         };
4596         unsigned int i;
4597
4598         if (nl80211_alloc_mgmt_handle(bss))
4599                 return -1;
4600         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
4601                    "handle %p", bss->nl_mgmt);
4602
4603         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
4604                 if (nl80211_register_frame(bss, bss->nl_mgmt,
4605                                            (WLAN_FC_TYPE_MGMT << 2) |
4606                                            (stypes[i] << 4),
4607                                            NULL, 0) < 0) {
4608                         goto out_err;
4609                 }
4610         }
4611
4612         if (nl80211_register_spurious_class3(bss))
4613                 goto out_err;
4614
4615         if (nl80211_get_wiphy_data_ap(bss) == NULL)
4616                 goto out_err;
4617
4618         nl80211_mgmt_handle_register_eloop(bss);
4619         return 0;
4620
4621 out_err:
4622         nl_destroy_handles(&bss->nl_mgmt);
4623         return -1;
4624 }
4625
4626
4627 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
4628 {
4629         if (nl80211_alloc_mgmt_handle(bss))
4630                 return -1;
4631         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
4632                    "handle %p (device SME)", bss->nl_mgmt);
4633
4634         if (nl80211_register_frame(bss, bss->nl_mgmt,
4635                                    (WLAN_FC_TYPE_MGMT << 2) |
4636                                    (WLAN_FC_STYPE_ACTION << 4),
4637                                    NULL, 0) < 0)
4638                 goto out_err;
4639
4640         nl80211_mgmt_handle_register_eloop(bss);
4641         return 0;
4642
4643 out_err:
4644         nl_destroy_handles(&bss->nl_mgmt);
4645         return -1;
4646 }
4647
4648
4649 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
4650 {
4651         if (bss->nl_mgmt == NULL)
4652                 return;
4653         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
4654                    "(%s)", bss->nl_mgmt, reason);
4655         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
4656
4657         nl80211_put_wiphy_data_ap(bss);
4658 }
4659
4660
4661 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
4662 {
4663         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
4664 }
4665
4666
4667 static void nl80211_del_p2pdev(struct i802_bss *bss)
4668 {
4669         struct wpa_driver_nl80211_data *drv = bss->drv;
4670         struct nl_msg *msg;
4671         int ret;
4672
4673         msg = nlmsg_alloc();
4674         if (!msg)
4675                 return;
4676
4677         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
4678         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
4679
4680         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4681         msg = NULL;
4682
4683         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
4684                    bss->ifname, (long long unsigned int) bss->wdev_id,
4685                    strerror(-ret));
4686
4687 nla_put_failure:
4688         nlmsg_free(msg);
4689 }
4690
4691
4692 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
4693 {
4694         struct wpa_driver_nl80211_data *drv = bss->drv;
4695         struct nl_msg *msg;
4696         int ret = -1;
4697
4698         msg = nlmsg_alloc();
4699         if (!msg)
4700                 return -1;
4701
4702         if (start)
4703                 nl80211_cmd(drv, msg, 0, NL80211_CMD_START_P2P_DEVICE);
4704         else
4705                 nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_P2P_DEVICE);
4706
4707         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
4708
4709         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4710         msg = NULL;
4711
4712         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
4713                    start ? "Start" : "Stop",
4714                    bss->ifname, (long long unsigned int) bss->wdev_id,
4715                    strerror(-ret));
4716
4717 nla_put_failure:
4718         nlmsg_free(msg);
4719         return ret;
4720 }
4721
4722
4723 static int i802_set_iface_flags(struct i802_bss *bss, int up)
4724 {
4725         enum nl80211_iftype nlmode;
4726
4727         nlmode = nl80211_get_ifmode(bss);
4728         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
4729                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
4730                                              bss->ifname, up);
4731         }
4732
4733         /* P2P Device has start/stop which is equivalent */
4734         return nl80211_set_p2pdev(bss, up);
4735 }
4736
4737
4738 static int
4739 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
4740                                    const u8 *set_addr, int first)
4741 {
4742         struct i802_bss *bss = drv->first_bss;
4743         int send_rfkill_event = 0;
4744         enum nl80211_iftype nlmode;
4745
4746         drv->ifindex = if_nametoindex(bss->ifname);
4747         bss->ifindex = drv->ifindex;
4748         bss->wdev_id = drv->global->if_add_wdevid;
4749         bss->wdev_id_set = drv->global->if_add_wdevid_set;
4750
4751         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
4752         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
4753         drv->global->if_add_wdevid_set = 0;
4754
4755         if (wpa_driver_nl80211_capa(drv))
4756                 return -1;
4757
4758         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
4759                    bss->ifname, drv->phyname);
4760
4761         if (set_addr &&
4762             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
4763              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
4764                                 set_addr)))
4765                 return -1;
4766
4767         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
4768                 drv->start_mode_ap = 1;
4769
4770         if (drv->hostapd)
4771                 nlmode = NL80211_IFTYPE_AP;
4772         else if (bss->if_dynamic)
4773                 nlmode = nl80211_get_ifmode(bss);
4774         else
4775                 nlmode = NL80211_IFTYPE_STATION;
4776
4777         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
4778                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
4779                 return -1;
4780         }
4781
4782         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
4783                 nl80211_get_macaddr(bss);
4784
4785         if (!rfkill_is_blocked(drv->rfkill)) {
4786                 int ret = i802_set_iface_flags(bss, 1);
4787                 if (ret) {
4788                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
4789                                    "interface '%s' UP", bss->ifname);
4790                         return ret;
4791                 }
4792                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
4793                         return ret;
4794         } else {
4795                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
4796                            "interface '%s' due to rfkill", bss->ifname);
4797                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
4798                         return 0;
4799                 drv->if_disabled = 1;
4800                 send_rfkill_event = 1;
4801         }
4802
4803         if (!drv->hostapd)
4804                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
4805                                        1, IF_OPER_DORMANT);
4806
4807         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
4808                                bss->addr))
4809                 return -1;
4810
4811         if (send_rfkill_event) {
4812                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
4813                                        drv, drv->ctx);
4814         }
4815
4816         return 0;
4817 }
4818
4819
4820 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
4821 {
4822         struct nl_msg *msg;
4823
4824         msg = nlmsg_alloc();
4825         if (!msg)
4826                 return -ENOMEM;
4827
4828         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
4829                    drv->ifindex);
4830         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
4831         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4832
4833         return send_and_recv_msgs(drv, msg, NULL, NULL);
4834  nla_put_failure:
4835         nlmsg_free(msg);
4836         return -ENOBUFS;
4837 }
4838
4839
4840 /**
4841  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
4842  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
4843  *
4844  * Shut down driver interface and processing of driver events. Free
4845  * private data buffer if one was allocated in wpa_driver_nl80211_init().
4846  */
4847 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
4848 {
4849         struct wpa_driver_nl80211_data *drv = bss->drv;
4850
4851         bss->in_deinit = 1;
4852         if (drv->data_tx_status)
4853                 eloop_unregister_read_sock(drv->eapol_tx_sock);
4854         if (drv->eapol_tx_sock >= 0)
4855                 close(drv->eapol_tx_sock);
4856
4857         if (bss->nl_preq)
4858                 wpa_driver_nl80211_probe_req_report(bss, 0);
4859         if (bss->added_if_into_bridge) {
4860                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
4861                                     bss->ifname) < 0)
4862                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
4863                                    "interface %s from bridge %s: %s",
4864                                    bss->ifname, bss->brname, strerror(errno));
4865         }
4866         if (bss->added_bridge) {
4867                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
4868                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
4869                                    "bridge %s: %s",
4870                                    bss->brname, strerror(errno));
4871         }
4872
4873         nl80211_remove_monitor_interface(drv);
4874
4875         if (is_ap_interface(drv->nlmode))
4876                 wpa_driver_nl80211_del_beacon(drv);
4877
4878         if (drv->eapol_sock >= 0) {
4879                 eloop_unregister_read_sock(drv->eapol_sock);
4880                 close(drv->eapol_sock);
4881         }
4882
4883         if (drv->if_indices != drv->default_if_indices)
4884                 os_free(drv->if_indices);
4885
4886         if (drv->disabled_11b_rates)
4887                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
4888
4889         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
4890                                IF_OPER_UP);
4891         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
4892         rfkill_deinit(drv->rfkill);
4893
4894         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
4895
4896         if (!drv->start_iface_up)
4897                 (void) i802_set_iface_flags(bss, 0);
4898         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
4899                 if (!drv->hostapd || !drv->start_mode_ap)
4900                         wpa_driver_nl80211_set_mode(bss,
4901                                                     NL80211_IFTYPE_STATION);
4902                 nl80211_mgmt_unsubscribe(bss, "deinit");
4903         } else {
4904                 nl80211_mgmt_unsubscribe(bss, "deinit");
4905                 nl80211_del_p2pdev(bss);
4906         }
4907         nl_cb_put(drv->nl_cb);
4908
4909         nl80211_destroy_bss(drv->first_bss);
4910
4911         os_free(drv->filter_ssids);
4912
4913         os_free(drv->auth_ie);
4914
4915         if (drv->in_interface_list)
4916                 dl_list_del(&drv->list);
4917
4918         os_free(drv->extended_capa);
4919         os_free(drv->extended_capa_mask);
4920         os_free(drv->first_bss);
4921         os_free(drv);
4922 }
4923
4924
4925 /**
4926  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
4927  * @eloop_ctx: Driver private data
4928  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
4929  *
4930  * This function can be used as registered timeout when starting a scan to
4931  * generate a scan completed event if the driver does not report this.
4932  */
4933 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
4934 {
4935         struct wpa_driver_nl80211_data *drv = eloop_ctx;
4936         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
4937                 wpa_driver_nl80211_set_mode(drv->first_bss,
4938                                             drv->ap_scan_as_station);
4939                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
4940         }
4941         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
4942         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
4943 }
4944
4945
4946 static struct nl_msg *
4947 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
4948                     struct wpa_driver_scan_params *params, u64 *wdev_id)
4949 {
4950         struct nl_msg *msg;
4951         size_t i;
4952
4953         msg = nlmsg_alloc();
4954         if (!msg)
4955                 return NULL;
4956
4957         nl80211_cmd(drv, msg, 0, cmd);
4958
4959         if (!wdev_id)
4960                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4961         else
4962                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, *wdev_id);
4963
4964         if (params->num_ssids) {
4965                 struct nlattr *ssids;
4966
4967                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4968                 if (ssids == NULL)
4969                         goto fail;
4970                 for (i = 0; i < params->num_ssids; i++) {
4971                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
4972                                           params->ssids[i].ssid,
4973                                           params->ssids[i].ssid_len);
4974                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
4975                                     params->ssids[i].ssid) < 0)
4976                                 goto fail;
4977                 }
4978                 nla_nest_end(msg, ssids);
4979         }
4980
4981         if (params->extra_ies) {
4982                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
4983                             params->extra_ies, params->extra_ies_len);
4984                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
4985                             params->extra_ies) < 0)
4986                         goto fail;
4987         }
4988
4989         if (params->freqs) {
4990                 struct nlattr *freqs;
4991                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4992                 if (freqs == NULL)
4993                         goto fail;
4994                 for (i = 0; params->freqs[i]; i++) {
4995                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
4996                                    "MHz", params->freqs[i]);
4997                         if (nla_put_u32(msg, i + 1, params->freqs[i]) < 0)
4998                                 goto fail;
4999                 }
5000                 nla_nest_end(msg, freqs);
5001         }
5002
5003         os_free(drv->filter_ssids);
5004         drv->filter_ssids = params->filter_ssids;
5005         params->filter_ssids = NULL;
5006         drv->num_filter_ssids = params->num_filter_ssids;
5007
5008         if (params->only_new_results) {
5009                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
5010                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS,
5011                             NL80211_SCAN_FLAG_FLUSH);
5012         }
5013
5014         return msg;
5015
5016 fail:
5017 nla_put_failure:
5018         nlmsg_free(msg);
5019         return NULL;
5020 }
5021
5022
5023 /**
5024  * wpa_driver_nl80211_scan - Request the driver to initiate scan
5025  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
5026  * @params: Scan parameters
5027  * Returns: 0 on success, -1 on failure
5028  */
5029 static int wpa_driver_nl80211_scan(struct i802_bss *bss,
5030                                    struct wpa_driver_scan_params *params)
5031 {
5032         struct wpa_driver_nl80211_data *drv = bss->drv;
5033         int ret = -1, timeout;
5034         struct nl_msg *msg = NULL;
5035
5036         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
5037         drv->scan_for_auth = 0;
5038
5039         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params,
5040                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
5041         if (!msg)
5042                 return -1;
5043
5044         if (params->p2p_probe) {
5045                 struct nlattr *rates;
5046
5047                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
5048
5049                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
5050                 if (rates == NULL)
5051                         goto nla_put_failure;
5052
5053                 /*
5054                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
5055                  * by masking out everything else apart from the OFDM rates 6,
5056                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
5057                  * rates are left enabled.
5058                  */
5059                 NLA_PUT(msg, NL80211_BAND_2GHZ, 8,
5060                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
5061                 nla_nest_end(msg, rates);
5062
5063                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
5064         }
5065
5066         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5067         msg = NULL;
5068         if (ret) {
5069                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
5070                            "(%s)", ret, strerror(-ret));
5071                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
5072                         enum nl80211_iftype old_mode = drv->nlmode;
5073
5074                         /*
5075                          * mac80211 does not allow scan requests in AP mode, so
5076                          * try to do this in station mode.
5077                          */
5078                         if (wpa_driver_nl80211_set_mode(
5079                                     bss, NL80211_IFTYPE_STATION))
5080                                 goto nla_put_failure;
5081
5082                         if (wpa_driver_nl80211_scan(bss, params)) {
5083                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
5084                                 goto nla_put_failure;
5085                         }
5086
5087                         /* Restore AP mode when processing scan results */
5088                         drv->ap_scan_as_station = old_mode;
5089                         ret = 0;
5090                 } else
5091                         goto nla_put_failure;
5092         }
5093
5094         drv->scan_state = SCAN_REQUESTED;
5095         /* Not all drivers generate "scan completed" wireless event, so try to
5096          * read results after a timeout. */
5097         timeout = 10;
5098         if (drv->scan_complete_events) {
5099                 /*
5100                  * The driver seems to deliver events to notify when scan is
5101                  * complete, so use longer timeout to avoid race conditions
5102                  * with scanning and following association request.
5103                  */
5104                 timeout = 30;
5105         }
5106         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
5107                    "seconds", ret, timeout);
5108         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
5109         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
5110                                drv, drv->ctx);
5111
5112 nla_put_failure:
5113         nlmsg_free(msg);
5114         return ret;
5115 }
5116
5117
5118 /**
5119  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
5120  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
5121  * @params: Scan parameters
5122  * @interval: Interval between scan cycles in milliseconds
5123  * Returns: 0 on success, -1 on failure or if not supported
5124  */
5125 static int wpa_driver_nl80211_sched_scan(void *priv,
5126                                          struct wpa_driver_scan_params *params,
5127                                          u32 interval)
5128 {
5129         struct i802_bss *bss = priv;
5130         struct wpa_driver_nl80211_data *drv = bss->drv;
5131         int ret = -1;
5132         struct nl_msg *msg;
5133         size_t i;
5134
5135         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
5136
5137 #ifdef ANDROID
5138         if (!drv->capa.sched_scan_supported)
5139                 return android_pno_start(bss, params);
5140 #endif /* ANDROID */
5141
5142         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params,
5143                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
5144         if (!msg)
5145                 goto nla_put_failure;
5146
5147         NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
5148
5149         if ((drv->num_filter_ssids &&
5150             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
5151             params->filter_rssi) {
5152                 struct nlattr *match_sets;
5153                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
5154                 if (match_sets == NULL)
5155                         goto nla_put_failure;
5156
5157                 for (i = 0; i < drv->num_filter_ssids; i++) {
5158                         struct nlattr *match_set_ssid;
5159                         wpa_hexdump_ascii(MSG_MSGDUMP,
5160                                           "nl80211: Sched scan filter SSID",
5161                                           drv->filter_ssids[i].ssid,
5162                                           drv->filter_ssids[i].ssid_len);
5163
5164                         match_set_ssid = nla_nest_start(msg, i + 1);
5165                         if (match_set_ssid == NULL)
5166                                 goto nla_put_failure;
5167                         NLA_PUT(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
5168                                 drv->filter_ssids[i].ssid_len,
5169                                 drv->filter_ssids[i].ssid);
5170                         if (params->filter_rssi)
5171                                 NLA_PUT_U32(msg,
5172                                             NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
5173                                             params->filter_rssi);
5174
5175                         nla_nest_end(msg, match_set_ssid);
5176                 }
5177
5178                 /*
5179                  * Due to backward compatibility code, newer kernels treat this
5180                  * matchset (with only an RSSI filter) as the default for all
5181                  * other matchsets, unless it's the only one, in which case the
5182                  * matchset will actually allow all SSIDs above the RSSI.
5183                  */
5184                 if (params->filter_rssi) {
5185                         struct nlattr *match_set_rssi;
5186                         match_set_rssi = nla_nest_start(msg, 0);
5187                         if (match_set_rssi == NULL)
5188                                 goto nla_put_failure;
5189                         NLA_PUT_U32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
5190                                     params->filter_rssi);
5191                         wpa_printf(MSG_MSGDUMP,
5192                                    "nl80211: Sched scan RSSI filter %d dBm",
5193                                    params->filter_rssi);
5194                         nla_nest_end(msg, match_set_rssi);
5195                 }
5196
5197                 nla_nest_end(msg, match_sets);
5198         }
5199
5200         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5201
5202         /* TODO: if we get an error here, we should fall back to normal scan */
5203
5204         msg = NULL;
5205         if (ret) {
5206                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
5207                            "ret=%d (%s)", ret, strerror(-ret));
5208                 goto nla_put_failure;
5209         }
5210
5211         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
5212                    "scan interval %d msec", ret, interval);
5213
5214 nla_put_failure:
5215         nlmsg_free(msg);
5216         return ret;
5217 }
5218
5219
5220 /**
5221  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
5222  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
5223  * Returns: 0 on success, -1 on failure or if not supported
5224  */
5225 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
5226 {
5227         struct i802_bss *bss = priv;
5228         struct wpa_driver_nl80211_data *drv = bss->drv;
5229         int ret = 0;
5230         struct nl_msg *msg;
5231
5232 #ifdef ANDROID
5233         if (!drv->capa.sched_scan_supported)
5234                 return android_pno_stop(bss);
5235 #endif /* ANDROID */
5236
5237         msg = nlmsg_alloc();
5238         if (!msg)
5239                 return -1;
5240
5241         nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
5242
5243         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5244
5245         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5246         msg = NULL;
5247         if (ret) {
5248                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
5249                            "ret=%d (%s)", ret, strerror(-ret));
5250                 goto nla_put_failure;
5251         }
5252
5253         wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
5254
5255 nla_put_failure:
5256         nlmsg_free(msg);
5257         return ret;
5258 }
5259
5260
5261 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
5262 {
5263         const u8 *end, *pos;
5264
5265         if (ies == NULL)
5266                 return NULL;
5267
5268         pos = ies;
5269         end = ies + ies_len;
5270
5271         while (pos + 1 < end) {
5272                 if (pos + 2 + pos[1] > end)
5273                         break;
5274                 if (pos[0] == ie)
5275                         return pos;
5276                 pos += 2 + pos[1];
5277         }
5278
5279         return NULL;
5280 }
5281
5282
5283 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
5284                                  const u8 *ie, size_t ie_len)
5285 {
5286         const u8 *ssid;
5287         size_t i;
5288
5289         if (drv->filter_ssids == NULL)
5290                 return 0;
5291
5292         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
5293         if (ssid == NULL)
5294                 return 1;
5295
5296         for (i = 0; i < drv->num_filter_ssids; i++) {
5297                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
5298                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
5299                     0)
5300                         return 0;
5301         }
5302
5303         return 1;
5304 }
5305
5306
5307 static int bss_info_handler(struct nl_msg *msg, void *arg)
5308 {
5309         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5310         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5311         struct nlattr *bss[NL80211_BSS_MAX + 1];
5312         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
5313                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
5314                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
5315                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
5316                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
5317                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
5318                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
5319                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
5320                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
5321                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
5322                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
5323                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
5324         };
5325         struct nl80211_bss_info_arg *_arg = arg;
5326         struct wpa_scan_results *res = _arg->res;
5327         struct wpa_scan_res **tmp;
5328         struct wpa_scan_res *r;
5329         const u8 *ie, *beacon_ie;
5330         size_t ie_len, beacon_ie_len;
5331         u8 *pos;
5332         size_t i;
5333
5334         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5335                   genlmsg_attrlen(gnlh, 0), NULL);
5336         if (!tb[NL80211_ATTR_BSS])
5337                 return NL_SKIP;
5338         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
5339                              bss_policy))
5340                 return NL_SKIP;
5341         if (bss[NL80211_BSS_STATUS]) {
5342                 enum nl80211_bss_status status;
5343                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
5344                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
5345                     bss[NL80211_BSS_FREQUENCY]) {
5346                         _arg->assoc_freq =
5347                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
5348                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
5349                                    _arg->assoc_freq);
5350                 }
5351                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
5352                     bss[NL80211_BSS_FREQUENCY]) {
5353                         _arg->ibss_freq =
5354                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
5355                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
5356                                    _arg->ibss_freq);
5357                 }
5358                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
5359                     bss[NL80211_BSS_BSSID]) {
5360                         os_memcpy(_arg->assoc_bssid,
5361                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
5362                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
5363                                    MACSTR, MAC2STR(_arg->assoc_bssid));
5364                 }
5365         }
5366         if (!res)
5367                 return NL_SKIP;
5368         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
5369                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
5370                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
5371         } else {
5372                 ie = NULL;
5373                 ie_len = 0;
5374         }
5375         if (bss[NL80211_BSS_BEACON_IES]) {
5376                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
5377                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
5378         } else {
5379                 beacon_ie = NULL;
5380                 beacon_ie_len = 0;
5381         }
5382
5383         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
5384                                   ie ? ie_len : beacon_ie_len))
5385                 return NL_SKIP;
5386
5387         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
5388         if (r == NULL)
5389                 return NL_SKIP;
5390         if (bss[NL80211_BSS_BSSID])
5391                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
5392                           ETH_ALEN);
5393         if (bss[NL80211_BSS_FREQUENCY])
5394                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
5395         if (bss[NL80211_BSS_BEACON_INTERVAL])
5396                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
5397         if (bss[NL80211_BSS_CAPABILITY])
5398                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
5399         r->flags |= WPA_SCAN_NOISE_INVALID;
5400         if (bss[NL80211_BSS_SIGNAL_MBM]) {
5401                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
5402                 r->level /= 100; /* mBm to dBm */
5403                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
5404         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
5405                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
5406                 r->flags |= WPA_SCAN_QUAL_INVALID;
5407         } else
5408                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
5409         if (bss[NL80211_BSS_TSF])
5410                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
5411         if (bss[NL80211_BSS_SEEN_MS_AGO])
5412                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
5413         r->ie_len = ie_len;
5414         pos = (u8 *) (r + 1);
5415         if (ie) {
5416                 os_memcpy(pos, ie, ie_len);
5417                 pos += ie_len;
5418         }
5419         r->beacon_ie_len = beacon_ie_len;
5420         if (beacon_ie)
5421                 os_memcpy(pos, beacon_ie, beacon_ie_len);
5422
5423         if (bss[NL80211_BSS_STATUS]) {
5424                 enum nl80211_bss_status status;
5425                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
5426                 switch (status) {
5427                 case NL80211_BSS_STATUS_AUTHENTICATED:
5428                         r->flags |= WPA_SCAN_AUTHENTICATED;
5429                         break;
5430                 case NL80211_BSS_STATUS_ASSOCIATED:
5431                         r->flags |= WPA_SCAN_ASSOCIATED;
5432                         break;
5433                 default:
5434                         break;
5435                 }
5436         }
5437
5438         /*
5439          * cfg80211 maintains separate BSS table entries for APs if the same
5440          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
5441          * not use frequency as a separate key in the BSS table, so filter out
5442          * duplicated entries. Prefer associated BSS entry in such a case in
5443          * order to get the correct frequency into the BSS table. Similarly,
5444          * prefer newer entries over older.
5445          */
5446         for (i = 0; i < res->num; i++) {
5447                 const u8 *s1, *s2;
5448                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
5449                         continue;
5450
5451                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
5452                                     res->res[i]->ie_len, WLAN_EID_SSID);
5453                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
5454                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
5455                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
5456                         continue;
5457
5458                 /* Same BSSID,SSID was already included in scan results */
5459                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
5460                            "for " MACSTR, MAC2STR(r->bssid));
5461
5462                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
5463                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
5464                     r->age < res->res[i]->age) {
5465                         os_free(res->res[i]);
5466                         res->res[i] = r;
5467                 } else
5468                         os_free(r);
5469                 return NL_SKIP;
5470         }
5471
5472         tmp = os_realloc_array(res->res, res->num + 1,
5473                                sizeof(struct wpa_scan_res *));
5474         if (tmp == NULL) {
5475                 os_free(r);
5476                 return NL_SKIP;
5477         }
5478         tmp[res->num++] = r;
5479         res->res = tmp;
5480
5481         return NL_SKIP;
5482 }
5483
5484
5485 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
5486                                  const u8 *addr)
5487 {
5488         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
5489                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
5490                            "mismatch (" MACSTR ")", MAC2STR(addr));
5491                 wpa_driver_nl80211_mlme(drv, addr,
5492                                         NL80211_CMD_DEAUTHENTICATE,
5493                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
5494         }
5495 }
5496
5497
5498 static void wpa_driver_nl80211_check_bss_status(
5499         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
5500 {
5501         size_t i;
5502
5503         for (i = 0; i < res->num; i++) {
5504                 struct wpa_scan_res *r = res->res[i];
5505                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
5506                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
5507                                    "indicates BSS status with " MACSTR
5508                                    " as authenticated",
5509                                    MAC2STR(r->bssid));
5510                         if (is_sta_interface(drv->nlmode) &&
5511                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
5512                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
5513                             0) {
5514                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
5515                                            " in local state (auth=" MACSTR
5516                                            " assoc=" MACSTR ")",
5517                                            MAC2STR(drv->auth_bssid),
5518                                            MAC2STR(drv->bssid));
5519                                 clear_state_mismatch(drv, r->bssid);
5520                         }
5521                 }
5522
5523                 if (r->flags & WPA_SCAN_ASSOCIATED) {
5524                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
5525                                    "indicate BSS status with " MACSTR
5526                                    " as associated",
5527                                    MAC2STR(r->bssid));
5528                         if (is_sta_interface(drv->nlmode) &&
5529                             !drv->associated) {
5530                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
5531                                            "(not associated) does not match "
5532                                            "with BSS state");
5533                                 clear_state_mismatch(drv, r->bssid);
5534                         } else if (is_sta_interface(drv->nlmode) &&
5535                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
5536                                    0) {
5537                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
5538                                            "(associated with " MACSTR ") does "
5539                                            "not match with BSS state",
5540                                            MAC2STR(drv->bssid));
5541                                 clear_state_mismatch(drv, r->bssid);
5542                                 clear_state_mismatch(drv, drv->bssid);
5543                         }
5544                 }
5545         }
5546 }
5547
5548
5549 static struct wpa_scan_results *
5550 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
5551 {
5552         struct nl_msg *msg;
5553         struct wpa_scan_results *res;
5554         int ret;
5555         struct nl80211_bss_info_arg arg;
5556
5557         res = os_zalloc(sizeof(*res));
5558         if (res == NULL)
5559                 return NULL;
5560         msg = nlmsg_alloc();
5561         if (!msg)
5562                 goto nla_put_failure;
5563
5564         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
5565         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
5566                 goto nla_put_failure;
5567
5568         arg.drv = drv;
5569         arg.res = res;
5570         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
5571         msg = NULL;
5572         if (ret == 0) {
5573                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
5574                            "BSSes)", (unsigned long) res->num);
5575                 nl80211_get_noise_for_scan_results(drv, res);
5576                 return res;
5577         }
5578         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
5579                    "(%s)", ret, strerror(-ret));
5580 nla_put_failure:
5581         nlmsg_free(msg);
5582         wpa_scan_results_free(res);
5583         return NULL;
5584 }
5585
5586
5587 /**
5588  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
5589  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
5590  * Returns: Scan results on success, -1 on failure
5591  */
5592 static struct wpa_scan_results *
5593 wpa_driver_nl80211_get_scan_results(void *priv)
5594 {
5595         struct i802_bss *bss = priv;
5596         struct wpa_driver_nl80211_data *drv = bss->drv;
5597         struct wpa_scan_results *res;
5598
5599         res = nl80211_get_scan_results(drv);
5600         if (res)
5601                 wpa_driver_nl80211_check_bss_status(drv, res);
5602         return res;
5603 }
5604
5605
5606 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
5607 {
5608         struct wpa_scan_results *res;
5609         size_t i;
5610
5611         res = nl80211_get_scan_results(drv);
5612         if (res == NULL) {
5613                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
5614                 return;
5615         }
5616
5617         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
5618         for (i = 0; i < res->num; i++) {
5619                 struct wpa_scan_res *r = res->res[i];
5620                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
5621                            (int) i, (int) res->num, MAC2STR(r->bssid),
5622                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
5623                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
5624         }
5625
5626         wpa_scan_results_free(res);
5627 }
5628
5629
5630 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
5631 {
5632         switch (alg) {
5633         case WPA_ALG_WEP:
5634                 if (key_len == 5)
5635                         return WLAN_CIPHER_SUITE_WEP40;
5636                 return WLAN_CIPHER_SUITE_WEP104;
5637         case WPA_ALG_TKIP:
5638                 return WLAN_CIPHER_SUITE_TKIP;
5639         case WPA_ALG_CCMP:
5640                 return WLAN_CIPHER_SUITE_CCMP;
5641         case WPA_ALG_GCMP:
5642                 return WLAN_CIPHER_SUITE_GCMP;
5643         case WPA_ALG_CCMP_256:
5644                 return WLAN_CIPHER_SUITE_CCMP_256;
5645         case WPA_ALG_GCMP_256:
5646                 return WLAN_CIPHER_SUITE_GCMP_256;
5647         case WPA_ALG_IGTK:
5648                 return WLAN_CIPHER_SUITE_AES_CMAC;
5649         case WPA_ALG_BIP_GMAC_128:
5650                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
5651         case WPA_ALG_BIP_GMAC_256:
5652                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
5653         case WPA_ALG_BIP_CMAC_256:
5654                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
5655         case WPA_ALG_SMS4:
5656                 return WLAN_CIPHER_SUITE_SMS4;
5657         case WPA_ALG_KRK:
5658                 return WLAN_CIPHER_SUITE_KRK;
5659         case WPA_ALG_NONE:
5660         case WPA_ALG_PMK:
5661                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
5662                            alg);
5663                 return 0;
5664         }
5665
5666         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
5667                    alg);
5668         return 0;
5669 }
5670
5671
5672 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
5673 {
5674         switch (cipher) {
5675         case WPA_CIPHER_CCMP_256:
5676                 return WLAN_CIPHER_SUITE_CCMP_256;
5677         case WPA_CIPHER_GCMP_256:
5678                 return WLAN_CIPHER_SUITE_GCMP_256;
5679         case WPA_CIPHER_CCMP:
5680                 return WLAN_CIPHER_SUITE_CCMP;
5681         case WPA_CIPHER_GCMP:
5682                 return WLAN_CIPHER_SUITE_GCMP;
5683         case WPA_CIPHER_TKIP:
5684                 return WLAN_CIPHER_SUITE_TKIP;
5685         case WPA_CIPHER_WEP104:
5686                 return WLAN_CIPHER_SUITE_WEP104;
5687         case WPA_CIPHER_WEP40:
5688                 return WLAN_CIPHER_SUITE_WEP40;
5689         case WPA_CIPHER_GTK_NOT_USED:
5690                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
5691         }
5692
5693         return 0;
5694 }
5695
5696
5697 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
5698                                        int max_suites)
5699 {
5700         int num_suites = 0;
5701
5702         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
5703                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
5704         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
5705                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
5706         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
5707                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
5708         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
5709                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
5710         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
5711                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
5712         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
5713                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
5714         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
5715                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
5716
5717         return num_suites;
5718 }
5719
5720
5721 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
5722                                       enum wpa_alg alg, const u8 *addr,
5723                                       int key_idx, int set_tx,
5724                                       const u8 *seq, size_t seq_len,
5725                                       const u8 *key, size_t key_len)
5726 {
5727         struct wpa_driver_nl80211_data *drv = bss->drv;
5728         int ifindex;
5729         struct nl_msg *msg;
5730         int ret;
5731         int tdls = 0;
5732
5733         /* Ignore for P2P Device */
5734         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
5735                 return 0;
5736
5737         ifindex = if_nametoindex(ifname);
5738         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
5739                    "set_tx=%d seq_len=%lu key_len=%lu",
5740                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
5741                    (unsigned long) seq_len, (unsigned long) key_len);
5742 #ifdef CONFIG_TDLS
5743         if (key_idx == -1) {
5744                 key_idx = 0;
5745                 tdls = 1;
5746         }
5747 #endif /* CONFIG_TDLS */
5748
5749         msg = nlmsg_alloc();
5750         if (!msg)
5751                 return -ENOMEM;
5752
5753         if (alg == WPA_ALG_NONE) {
5754                 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
5755         } else {
5756                 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
5757                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
5758                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
5759                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5760                             wpa_alg_to_cipher_suite(alg, key_len));
5761         }
5762
5763         if (seq && seq_len) {
5764                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
5765                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
5766         }
5767
5768         if (addr && !is_broadcast_ether_addr(addr)) {
5769                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
5770                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5771
5772                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
5773                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
5774                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
5775                                     NL80211_KEYTYPE_GROUP);
5776                 }
5777         } else if (addr && is_broadcast_ether_addr(addr)) {
5778                 struct nlattr *types;
5779
5780                 wpa_printf(MSG_DEBUG, "   broadcast key");
5781
5782                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5783                 if (!types)
5784                         goto nla_put_failure;
5785                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
5786                 nla_nest_end(msg, types);
5787         }
5788         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
5789         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5790
5791         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5792         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
5793                 ret = 0;
5794         if (ret)
5795                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
5796                            ret, strerror(-ret));
5797
5798         /*
5799          * If we failed or don't need to set the default TX key (below),
5800          * we're done here.
5801          */
5802         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
5803                 return ret;
5804         if (is_ap_interface(drv->nlmode) && addr &&
5805             !is_broadcast_ether_addr(addr))
5806                 return ret;
5807
5808         msg = nlmsg_alloc();
5809         if (!msg)
5810                 return -ENOMEM;
5811
5812         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
5813         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
5814         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5815         if (alg == WPA_ALG_IGTK)
5816                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
5817         else
5818                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
5819         if (addr && is_broadcast_ether_addr(addr)) {
5820                 struct nlattr *types;
5821
5822                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5823                 if (!types)
5824                         goto nla_put_failure;
5825                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
5826                 nla_nest_end(msg, types);
5827         } else if (addr) {
5828                 struct nlattr *types;
5829
5830                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5831                 if (!types)
5832                         goto nla_put_failure;
5833                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST);
5834                 nla_nest_end(msg, types);
5835         }
5836
5837         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5838         if (ret == -ENOENT)
5839                 ret = 0;
5840         if (ret)
5841                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
5842                            "err=%d %s)", ret, strerror(-ret));
5843         return ret;
5844
5845 nla_put_failure:
5846         nlmsg_free(msg);
5847         return -ENOBUFS;
5848 }
5849
5850
5851 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
5852                       int key_idx, int defkey,
5853                       const u8 *seq, size_t seq_len,
5854                       const u8 *key, size_t key_len)
5855 {
5856         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
5857         if (!key_attr)
5858                 return -1;
5859
5860         if (defkey && alg == WPA_ALG_IGTK)
5861                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
5862         else if (defkey)
5863                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
5864
5865         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
5866
5867         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5868                     wpa_alg_to_cipher_suite(alg, key_len));
5869
5870         if (seq && seq_len)
5871                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
5872
5873         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
5874
5875         nla_nest_end(msg, key_attr);
5876
5877         return 0;
5878  nla_put_failure:
5879         return -1;
5880 }
5881
5882
5883 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
5884                                  struct nl_msg *msg)
5885 {
5886         int i, privacy = 0;
5887         struct nlattr *nl_keys, *nl_key;
5888
5889         for (i = 0; i < 4; i++) {
5890                 if (!params->wep_key[i])
5891                         continue;
5892                 privacy = 1;
5893                 break;
5894         }
5895         if (params->wps == WPS_MODE_PRIVACY)
5896                 privacy = 1;
5897         if (params->pairwise_suite &&
5898             params->pairwise_suite != WPA_CIPHER_NONE)
5899                 privacy = 1;
5900
5901         if (!privacy)
5902                 return 0;
5903
5904         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
5905
5906         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
5907         if (!nl_keys)
5908                 goto nla_put_failure;
5909
5910         for (i = 0; i < 4; i++) {
5911                 if (!params->wep_key[i])
5912                         continue;
5913
5914                 nl_key = nla_nest_start(msg, i);
5915                 if (!nl_key)
5916                         goto nla_put_failure;
5917
5918                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
5919                         params->wep_key[i]);
5920                 if (params->wep_key_len[i] == 5)
5921                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5922                                     WLAN_CIPHER_SUITE_WEP40);
5923                 else
5924                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5925                                     WLAN_CIPHER_SUITE_WEP104);
5926
5927                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
5928
5929                 if (i == params->wep_tx_keyidx)
5930                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
5931
5932                 nla_nest_end(msg, nl_key);
5933         }
5934         nla_nest_end(msg, nl_keys);
5935
5936         return 0;
5937
5938 nla_put_failure:
5939         return -ENOBUFS;
5940 }
5941
5942
5943 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
5944                                    const u8 *addr, int cmd, u16 reason_code,
5945                                    int local_state_change)
5946 {
5947         int ret = -1;
5948         struct nl_msg *msg;
5949
5950         msg = nlmsg_alloc();
5951         if (!msg)
5952                 return -1;
5953
5954         nl80211_cmd(drv, msg, 0, cmd);
5955
5956         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5957         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
5958         if (addr)
5959                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5960         if (local_state_change)
5961                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
5962
5963         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5964         msg = NULL;
5965         if (ret) {
5966                 wpa_dbg(drv->ctx, MSG_DEBUG,
5967                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
5968                         reason_code, ret, strerror(-ret));
5969                 goto nla_put_failure;
5970         }
5971         ret = 0;
5972
5973 nla_put_failure:
5974         nlmsg_free(msg);
5975         return ret;
5976 }
5977
5978
5979 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
5980                                          int reason_code)
5981 {
5982         int ret;
5983
5984         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
5985         nl80211_mark_disconnected(drv);
5986         /* Disconnect command doesn't need BSSID - it uses cached value */
5987         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
5988                                       reason_code, 0);
5989         /*
5990          * For locally generated disconnect, supplicant already generates a
5991          * DEAUTH event, so ignore the event from NL80211.
5992          */
5993         drv->ignore_next_local_disconnect = ret == 0;
5994
5995         return ret;
5996 }
5997
5998
5999 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
6000                                              const u8 *addr, int reason_code)
6001 {
6002         struct wpa_driver_nl80211_data *drv = bss->drv;
6003         int ret;
6004
6005         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
6006                 nl80211_mark_disconnected(drv);
6007                 return nl80211_leave_ibss(drv);
6008         }
6009         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
6010                 return wpa_driver_nl80211_disconnect(drv, reason_code);
6011         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
6012                    __func__, MAC2STR(addr), reason_code);
6013         nl80211_mark_disconnected(drv);
6014         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
6015                                       reason_code, 0);
6016         /*
6017          * For locally generated deauthenticate, supplicant already generates a
6018          * DEAUTH event, so ignore the event from NL80211.
6019          */
6020         drv->ignore_next_local_deauth = ret == 0;
6021         return ret;
6022 }
6023
6024
6025 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
6026                                      struct wpa_driver_auth_params *params)
6027 {
6028         int i;
6029
6030         drv->auth_freq = params->freq;
6031         drv->auth_alg = params->auth_alg;
6032         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
6033         drv->auth_local_state_change = params->local_state_change;
6034         drv->auth_p2p = params->p2p;
6035
6036         if (params->bssid)
6037                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
6038         else
6039                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
6040
6041         if (params->ssid) {
6042                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
6043                 drv->auth_ssid_len = params->ssid_len;
6044         } else
6045                 drv->auth_ssid_len = 0;
6046
6047
6048         os_free(drv->auth_ie);
6049         drv->auth_ie = NULL;
6050         drv->auth_ie_len = 0;
6051         if (params->ie) {
6052                 drv->auth_ie = os_malloc(params->ie_len);
6053                 if (drv->auth_ie) {
6054                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
6055                         drv->auth_ie_len = params->ie_len;
6056                 }
6057         }
6058
6059         for (i = 0; i < 4; i++) {
6060                 if (params->wep_key[i] && params->wep_key_len[i] &&
6061                     params->wep_key_len[i] <= 16) {
6062                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
6063                                   params->wep_key_len[i]);
6064                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
6065                 } else
6066                         drv->auth_wep_key_len[i] = 0;
6067         }
6068 }
6069
6070
6071 static int wpa_driver_nl80211_authenticate(
6072         struct i802_bss *bss, struct wpa_driver_auth_params *params)
6073 {
6074         struct wpa_driver_nl80211_data *drv = bss->drv;
6075         int ret = -1, i;
6076         struct nl_msg *msg;
6077         enum nl80211_auth_type type;
6078         enum nl80211_iftype nlmode;
6079         int count = 0;
6080         int is_retry;
6081
6082         is_retry = drv->retry_auth;
6083         drv->retry_auth = 0;
6084         drv->ignore_deauth_event = 0;
6085
6086         nl80211_mark_disconnected(drv);
6087         os_memset(drv->auth_bssid, 0, ETH_ALEN);
6088         if (params->bssid)
6089                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
6090         else
6091                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
6092         /* FIX: IBSS mode */
6093         nlmode = params->p2p ?
6094                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
6095         if (drv->nlmode != nlmode &&
6096             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
6097                 return -1;
6098
6099 retry:
6100         msg = nlmsg_alloc();
6101         if (!msg)
6102                 return -1;
6103
6104         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
6105                    drv->ifindex);
6106
6107         nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
6108
6109         for (i = 0; i < 4; i++) {
6110                 if (!params->wep_key[i])
6111                         continue;
6112                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
6113                                            NULL, i,
6114                                            i == params->wep_tx_keyidx, NULL, 0,
6115                                            params->wep_key[i],
6116                                            params->wep_key_len[i]);
6117                 if (params->wep_tx_keyidx != i)
6118                         continue;
6119                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
6120                                params->wep_key[i], params->wep_key_len[i])) {
6121                         nlmsg_free(msg);
6122                         return -1;
6123                 }
6124         }
6125
6126         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6127         if (params->bssid) {
6128                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
6129                            MAC2STR(params->bssid));
6130                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6131         }
6132         if (params->freq) {
6133                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6134                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6135         }
6136         if (params->ssid) {
6137                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6138                                   params->ssid, params->ssid_len);
6139                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6140                         params->ssid);
6141         }
6142         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
6143         if (params->ie)
6144                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
6145         if (params->sae_data) {
6146                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
6147                             params->sae_data_len);
6148                 NLA_PUT(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
6149                         params->sae_data);
6150         }
6151         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
6152                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
6153         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
6154                 type = NL80211_AUTHTYPE_SHARED_KEY;
6155         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
6156                 type = NL80211_AUTHTYPE_NETWORK_EAP;
6157         else if (params->auth_alg & WPA_AUTH_ALG_FT)
6158                 type = NL80211_AUTHTYPE_FT;
6159         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
6160                 type = NL80211_AUTHTYPE_SAE;
6161         else
6162                 goto nla_put_failure;
6163         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
6164         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
6165         if (params->local_state_change) {
6166                 wpa_printf(MSG_DEBUG, "  * Local state change only");
6167                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
6168         }
6169
6170         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6171         msg = NULL;
6172         if (ret) {
6173                 wpa_dbg(drv->ctx, MSG_DEBUG,
6174                         "nl80211: MLME command failed (auth): ret=%d (%s)",
6175                         ret, strerror(-ret));
6176                 count++;
6177                 if (ret == -EALREADY && count == 1 && params->bssid &&
6178                     !params->local_state_change) {
6179                         /*
6180                          * mac80211 does not currently accept new
6181                          * authentication if we are already authenticated. As a
6182                          * workaround, force deauthentication and try again.
6183                          */
6184                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
6185                                    "after forced deauthentication");
6186                         drv->ignore_deauth_event = 1;
6187                         wpa_driver_nl80211_deauthenticate(
6188                                 bss, params->bssid,
6189                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
6190                         nlmsg_free(msg);
6191                         goto retry;
6192                 }
6193
6194                 if (ret == -ENOENT && params->freq && !is_retry) {
6195                         /*
6196                          * cfg80211 has likely expired the BSS entry even
6197                          * though it was previously available in our internal
6198                          * BSS table. To recover quickly, start a single
6199                          * channel scan on the specified channel.
6200                          */
6201                         struct wpa_driver_scan_params scan;
6202                         int freqs[2];
6203
6204                         os_memset(&scan, 0, sizeof(scan));
6205                         scan.num_ssids = 1;
6206                         if (params->ssid) {
6207                                 scan.ssids[0].ssid = params->ssid;
6208                                 scan.ssids[0].ssid_len = params->ssid_len;
6209                         }
6210                         freqs[0] = params->freq;
6211                         freqs[1] = 0;
6212                         scan.freqs = freqs;
6213                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
6214                                    "channel scan to refresh cfg80211 BSS "
6215                                    "entry");
6216                         ret = wpa_driver_nl80211_scan(bss, &scan);
6217                         if (ret == 0) {
6218                                 nl80211_copy_auth_params(drv, params);
6219                                 drv->scan_for_auth = 1;
6220                         }
6221                 } else if (is_retry) {
6222                         /*
6223                          * Need to indicate this with an event since the return
6224                          * value from the retry is not delivered to core code.
6225                          */
6226                         union wpa_event_data event;
6227                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
6228                                    "failed");
6229                         os_memset(&event, 0, sizeof(event));
6230                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
6231                                   ETH_ALEN);
6232                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
6233                                              &event);
6234                 }
6235
6236                 goto nla_put_failure;
6237         }
6238         ret = 0;
6239         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
6240                    "successfully");
6241
6242 nla_put_failure:
6243         nlmsg_free(msg);
6244         return ret;
6245 }
6246
6247
6248 static int wpa_driver_nl80211_authenticate_retry(
6249         struct wpa_driver_nl80211_data *drv)
6250 {
6251         struct wpa_driver_auth_params params;
6252         struct i802_bss *bss = drv->first_bss;
6253         int i;
6254
6255         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
6256
6257         os_memset(&params, 0, sizeof(params));
6258         params.freq = drv->auth_freq;
6259         params.auth_alg = drv->auth_alg;
6260         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
6261         params.local_state_change = drv->auth_local_state_change;
6262         params.p2p = drv->auth_p2p;
6263
6264         if (!is_zero_ether_addr(drv->auth_bssid_))
6265                 params.bssid = drv->auth_bssid_;
6266
6267         if (drv->auth_ssid_len) {
6268                 params.ssid = drv->auth_ssid;
6269                 params.ssid_len = drv->auth_ssid_len;
6270         }
6271
6272         params.ie = drv->auth_ie;
6273         params.ie_len = drv->auth_ie_len;
6274
6275         for (i = 0; i < 4; i++) {
6276                 if (drv->auth_wep_key_len[i]) {
6277                         params.wep_key[i] = drv->auth_wep_key[i];
6278                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
6279                 }
6280         }
6281
6282         drv->retry_auth = 1;
6283         return wpa_driver_nl80211_authenticate(bss, &params);
6284 }
6285
6286
6287 struct phy_info_arg {
6288         u16 *num_modes;
6289         struct hostapd_hw_modes *modes;
6290         int last_mode, last_chan_idx;
6291 };
6292
6293 static void phy_info_ht_capa(struct hostapd_hw_modes *mode, struct nlattr *capa,
6294                              struct nlattr *ampdu_factor,
6295                              struct nlattr *ampdu_density,
6296                              struct nlattr *mcs_set)
6297 {
6298         if (capa)
6299                 mode->ht_capab = nla_get_u16(capa);
6300
6301         if (ampdu_factor)
6302                 mode->a_mpdu_params |= nla_get_u8(ampdu_factor) & 0x03;
6303
6304         if (ampdu_density)
6305                 mode->a_mpdu_params |= nla_get_u8(ampdu_density) << 2;
6306
6307         if (mcs_set && nla_len(mcs_set) >= 16) {
6308                 u8 *mcs;
6309                 mcs = nla_data(mcs_set);
6310                 os_memcpy(mode->mcs_set, mcs, 16);
6311         }
6312 }
6313
6314
6315 static void phy_info_vht_capa(struct hostapd_hw_modes *mode,
6316                               struct nlattr *capa,
6317                               struct nlattr *mcs_set)
6318 {
6319         if (capa)
6320                 mode->vht_capab = nla_get_u32(capa);
6321
6322         if (mcs_set && nla_len(mcs_set) >= 8) {
6323                 u8 *mcs;
6324                 mcs = nla_data(mcs_set);
6325                 os_memcpy(mode->vht_mcs_set, mcs, 8);
6326         }
6327 }
6328
6329
6330 static void phy_info_freq(struct hostapd_hw_modes *mode,
6331                           struct hostapd_channel_data *chan,
6332                           struct nlattr *tb_freq[])
6333 {
6334         u8 channel;
6335         chan->freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
6336         chan->flag = 0;
6337         chan->dfs_cac_ms = 0;
6338         if (ieee80211_freq_to_chan(chan->freq, &channel) != NUM_HOSTAPD_MODES)
6339                 chan->chan = channel;
6340
6341         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
6342                 chan->flag |= HOSTAPD_CHAN_DISABLED;
6343         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IR])
6344                 chan->flag |= HOSTAPD_CHAN_PASSIVE_SCAN | HOSTAPD_CHAN_NO_IBSS;
6345         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
6346                 chan->flag |= HOSTAPD_CHAN_RADAR;
6347
6348         if (tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]) {
6349                 enum nl80211_dfs_state state =
6350                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]);
6351
6352                 switch (state) {
6353                 case NL80211_DFS_USABLE:
6354                         chan->flag |= HOSTAPD_CHAN_DFS_USABLE;
6355                         break;
6356                 case NL80211_DFS_AVAILABLE:
6357                         chan->flag |= HOSTAPD_CHAN_DFS_AVAILABLE;
6358                         break;
6359                 case NL80211_DFS_UNAVAILABLE:
6360                         chan->flag |= HOSTAPD_CHAN_DFS_UNAVAILABLE;
6361                         break;
6362                 }
6363         }
6364
6365         if (tb_freq[NL80211_FREQUENCY_ATTR_DFS_CAC_TIME]) {
6366                 chan->dfs_cac_ms = nla_get_u32(
6367                         tb_freq[NL80211_FREQUENCY_ATTR_DFS_CAC_TIME]);
6368         }
6369 }
6370
6371
6372 static int phy_info_freqs(struct phy_info_arg *phy_info,
6373                           struct hostapd_hw_modes *mode, struct nlattr *tb)
6374 {
6375         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
6376                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
6377                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
6378                 [NL80211_FREQUENCY_ATTR_NO_IR] = { .type = NLA_FLAG },
6379                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
6380                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
6381                 [NL80211_FREQUENCY_ATTR_DFS_STATE] = { .type = NLA_U32 },
6382         };
6383         int new_channels = 0;
6384         struct hostapd_channel_data *channel;
6385         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
6386         struct nlattr *nl_freq;
6387         int rem_freq, idx;
6388
6389         if (tb == NULL)
6390                 return NL_OK;
6391
6392         nla_for_each_nested(nl_freq, tb, rem_freq) {
6393                 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
6394                           nla_data(nl_freq), nla_len(nl_freq), freq_policy);
6395                 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
6396                         continue;
6397                 new_channels++;
6398         }
6399
6400         channel = os_realloc_array(mode->channels,
6401                                    mode->num_channels + new_channels,
6402                                    sizeof(struct hostapd_channel_data));
6403         if (!channel)
6404                 return NL_SKIP;
6405
6406         mode->channels = channel;
6407         mode->num_channels += new_channels;
6408
6409         idx = phy_info->last_chan_idx;
6410
6411         nla_for_each_nested(nl_freq, tb, rem_freq) {
6412                 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
6413                           nla_data(nl_freq), nla_len(nl_freq), freq_policy);
6414                 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
6415                         continue;
6416                 phy_info_freq(mode, &mode->channels[idx], tb_freq);
6417                 idx++;
6418         }
6419         phy_info->last_chan_idx = idx;
6420
6421         return NL_OK;
6422 }
6423
6424
6425 static int phy_info_rates(struct hostapd_hw_modes *mode, struct nlattr *tb)
6426 {
6427         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
6428                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
6429                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] =
6430                 { .type = NLA_FLAG },
6431         };
6432         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
6433         struct nlattr *nl_rate;
6434         int rem_rate, idx;
6435
6436         if (tb == NULL)
6437                 return NL_OK;
6438
6439         nla_for_each_nested(nl_rate, tb, rem_rate) {
6440                 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
6441                           nla_data(nl_rate), nla_len(nl_rate),
6442                           rate_policy);
6443                 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
6444                         continue;
6445                 mode->num_rates++;
6446         }
6447
6448         mode->rates = os_calloc(mode->num_rates, sizeof(int));
6449         if (!mode->rates)
6450                 return NL_SKIP;
6451
6452         idx = 0;
6453
6454         nla_for_each_nested(nl_rate, tb, rem_rate) {
6455                 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
6456                           nla_data(nl_rate), nla_len(nl_rate),
6457                           rate_policy);
6458                 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
6459                         continue;
6460                 mode->rates[idx] = nla_get_u32(
6461                         tb_rate[NL80211_BITRATE_ATTR_RATE]);
6462                 idx++;
6463         }
6464
6465         return NL_OK;
6466 }
6467
6468
6469 static int phy_info_band(struct phy_info_arg *phy_info, struct nlattr *nl_band)
6470 {
6471         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
6472         struct hostapd_hw_modes *mode;
6473         int ret;
6474
6475         if (phy_info->last_mode != nl_band->nla_type) {
6476                 mode = os_realloc_array(phy_info->modes,
6477                                         *phy_info->num_modes + 1,
6478                                         sizeof(*mode));
6479                 if (!mode)
6480                         return NL_SKIP;
6481                 phy_info->modes = mode;
6482
6483                 mode = &phy_info->modes[*(phy_info->num_modes)];
6484                 os_memset(mode, 0, sizeof(*mode));
6485                 mode->mode = NUM_HOSTAPD_MODES;
6486                 mode->flags = HOSTAPD_MODE_FLAG_HT_INFO_KNOWN |
6487                         HOSTAPD_MODE_FLAG_VHT_INFO_KNOWN;
6488
6489                 /*
6490                  * Unsupported VHT MCS stream is defined as value 3, so the VHT
6491                  * MCS RX/TX map must be initialized with 0xffff to mark all 8
6492                  * possible streams as unsupported. This will be overridden if
6493                  * driver advertises VHT support.
6494                  */
6495                 mode->vht_mcs_set[0] = 0xff;
6496                 mode->vht_mcs_set[1] = 0xff;
6497                 mode->vht_mcs_set[4] = 0xff;
6498                 mode->vht_mcs_set[5] = 0xff;
6499
6500                 *(phy_info->num_modes) += 1;
6501                 phy_info->last_mode = nl_band->nla_type;
6502                 phy_info->last_chan_idx = 0;
6503         } else
6504                 mode = &phy_info->modes[*(phy_info->num_modes) - 1];
6505
6506         nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
6507                   nla_len(nl_band), NULL);
6508
6509         phy_info_ht_capa(mode, tb_band[NL80211_BAND_ATTR_HT_CAPA],
6510                          tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR],
6511                          tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY],
6512                          tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
6513         phy_info_vht_capa(mode, tb_band[NL80211_BAND_ATTR_VHT_CAPA],
6514                           tb_band[NL80211_BAND_ATTR_VHT_MCS_SET]);
6515         ret = phy_info_freqs(phy_info, mode, tb_band[NL80211_BAND_ATTR_FREQS]);
6516         if (ret != NL_OK)
6517                 return ret;
6518         ret = phy_info_rates(mode, tb_band[NL80211_BAND_ATTR_RATES]);
6519         if (ret != NL_OK)
6520                 return ret;
6521
6522         return NL_OK;
6523 }
6524
6525
6526 static int phy_info_handler(struct nl_msg *msg, void *arg)
6527 {
6528         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
6529         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6530         struct phy_info_arg *phy_info = arg;
6531         struct nlattr *nl_band;
6532         int rem_band;
6533
6534         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6535                   genlmsg_attrlen(gnlh, 0), NULL);
6536
6537         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
6538                 return NL_SKIP;
6539
6540         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band)
6541         {
6542                 int res = phy_info_band(phy_info, nl_band);
6543                 if (res != NL_OK)
6544                         return res;
6545         }
6546
6547         return NL_SKIP;
6548 }
6549
6550
6551 static struct hostapd_hw_modes *
6552 wpa_driver_nl80211_postprocess_modes(struct hostapd_hw_modes *modes,
6553                                      u16 *num_modes)
6554 {
6555         u16 m;
6556         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
6557         int i, mode11g_idx = -1;
6558
6559         /* heuristic to set up modes */
6560         for (m = 0; m < *num_modes; m++) {
6561                 if (!modes[m].num_channels)
6562                         continue;
6563                 if (modes[m].channels[0].freq < 4000) {
6564                         modes[m].mode = HOSTAPD_MODE_IEEE80211B;
6565                         for (i = 0; i < modes[m].num_rates; i++) {
6566                                 if (modes[m].rates[i] > 200) {
6567                                         modes[m].mode = HOSTAPD_MODE_IEEE80211G;
6568                                         break;
6569                                 }
6570                         }
6571                 } else if (modes[m].channels[0].freq > 50000)
6572                         modes[m].mode = HOSTAPD_MODE_IEEE80211AD;
6573                 else
6574                         modes[m].mode = HOSTAPD_MODE_IEEE80211A;
6575         }
6576
6577         /* If only 802.11g mode is included, use it to construct matching
6578          * 802.11b mode data. */
6579
6580         for (m = 0; m < *num_modes; m++) {
6581                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
6582                         return modes; /* 802.11b already included */
6583                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
6584                         mode11g_idx = m;
6585         }
6586
6587         if (mode11g_idx < 0)
6588                 return modes; /* 2.4 GHz band not supported at all */
6589
6590         nmodes = os_realloc_array(modes, *num_modes + 1, sizeof(*nmodes));
6591         if (nmodes == NULL)
6592                 return modes; /* Could not add 802.11b mode */
6593
6594         mode = &nmodes[*num_modes];
6595         os_memset(mode, 0, sizeof(*mode));
6596         (*num_modes)++;
6597         modes = nmodes;
6598
6599         mode->mode = HOSTAPD_MODE_IEEE80211B;
6600
6601         mode11g = &modes[mode11g_idx];
6602         mode->num_channels = mode11g->num_channels;
6603         mode->channels = os_malloc(mode11g->num_channels *
6604                                    sizeof(struct hostapd_channel_data));
6605         if (mode->channels == NULL) {
6606                 (*num_modes)--;
6607                 return modes; /* Could not add 802.11b mode */
6608         }
6609         os_memcpy(mode->channels, mode11g->channels,
6610                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
6611
6612         mode->num_rates = 0;
6613         mode->rates = os_malloc(4 * sizeof(int));
6614         if (mode->rates == NULL) {
6615                 os_free(mode->channels);
6616                 (*num_modes)--;
6617                 return modes; /* Could not add 802.11b mode */
6618         }
6619
6620         for (i = 0; i < mode11g->num_rates; i++) {
6621                 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
6622                     mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
6623                         continue;
6624                 mode->rates[mode->num_rates] = mode11g->rates[i];
6625                 mode->num_rates++;
6626                 if (mode->num_rates == 4)
6627                         break;
6628         }
6629
6630         if (mode->num_rates == 0) {
6631                 os_free(mode->channels);
6632                 os_free(mode->rates);
6633                 (*num_modes)--;
6634                 return modes; /* No 802.11b rates */
6635         }
6636
6637         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
6638                    "information");
6639
6640         return modes;
6641 }
6642
6643
6644 static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
6645                                   int end)
6646 {
6647         int c;
6648
6649         for (c = 0; c < mode->num_channels; c++) {
6650                 struct hostapd_channel_data *chan = &mode->channels[c];
6651                 if (chan->freq - 10 >= start && chan->freq + 10 <= end)
6652                         chan->flag |= HOSTAPD_CHAN_HT40;
6653         }
6654 }
6655
6656
6657 static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
6658                                       int end)
6659 {
6660         int c;
6661
6662         for (c = 0; c < mode->num_channels; c++) {
6663                 struct hostapd_channel_data *chan = &mode->channels[c];
6664                 if (!(chan->flag & HOSTAPD_CHAN_HT40))
6665                         continue;
6666                 if (chan->freq - 30 >= start && chan->freq - 10 <= end)
6667                         chan->flag |= HOSTAPD_CHAN_HT40MINUS;
6668                 if (chan->freq + 10 >= start && chan->freq + 30 <= end)
6669                         chan->flag |= HOSTAPD_CHAN_HT40PLUS;
6670         }
6671 }
6672
6673
6674 static void nl80211_reg_rule_max_eirp(u32 start, u32 end, u32 max_eirp,
6675                                       struct phy_info_arg *results)
6676 {
6677         u16 m;
6678
6679         for (m = 0; m < *results->num_modes; m++) {
6680                 int c;
6681                 struct hostapd_hw_modes *mode = &results->modes[m];
6682
6683                 for (c = 0; c < mode->num_channels; c++) {
6684                         struct hostapd_channel_data *chan = &mode->channels[c];
6685                         if ((u32) chan->freq - 10 >= start &&
6686                             (u32) chan->freq + 10 <= end)
6687                                 chan->max_tx_power = max_eirp;
6688                 }
6689         }
6690 }
6691
6692
6693 static void nl80211_reg_rule_ht40(u32 start, u32 end,
6694                                   struct phy_info_arg *results)
6695 {
6696         u16 m;
6697
6698         for (m = 0; m < *results->num_modes; m++) {
6699                 if (!(results->modes[m].ht_capab &
6700                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6701                         continue;
6702                 nl80211_set_ht40_mode(&results->modes[m], start, end);
6703         }
6704 }
6705
6706
6707 static void nl80211_reg_rule_sec(struct nlattr *tb[],
6708                                  struct phy_info_arg *results)
6709 {
6710         u32 start, end, max_bw;
6711         u16 m;
6712
6713         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6714             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6715             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
6716                 return;
6717
6718         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6719         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6720         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6721
6722         if (max_bw < 20)
6723                 return;
6724
6725         for (m = 0; m < *results->num_modes; m++) {
6726                 if (!(results->modes[m].ht_capab &
6727                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6728                         continue;
6729                 nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
6730         }
6731 }
6732
6733
6734 static void nl80211_set_vht_mode(struct hostapd_hw_modes *mode, int start,
6735                                  int end)
6736 {
6737         int c;
6738
6739         for (c = 0; c < mode->num_channels; c++) {
6740                 struct hostapd_channel_data *chan = &mode->channels[c];
6741                 if (chan->freq - 10 >= start && chan->freq + 70 <= end)
6742                         chan->flag |= HOSTAPD_CHAN_VHT_10_70;
6743
6744                 if (chan->freq - 30 >= start && chan->freq + 50 <= end)
6745                         chan->flag |= HOSTAPD_CHAN_VHT_30_50;
6746
6747                 if (chan->freq - 50 >= start && chan->freq + 30 <= end)
6748                         chan->flag |= HOSTAPD_CHAN_VHT_50_30;
6749
6750                 if (chan->freq - 70 >= start && chan->freq + 10 <= end)
6751                         chan->flag |= HOSTAPD_CHAN_VHT_70_10;
6752         }
6753 }
6754
6755
6756 static void nl80211_reg_rule_vht(struct nlattr *tb[],
6757                                  struct phy_info_arg *results)
6758 {
6759         u32 start, end, max_bw;
6760         u16 m;
6761
6762         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6763             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6764             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
6765                 return;
6766
6767         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6768         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6769         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6770
6771         if (max_bw < 80)
6772                 return;
6773
6774         for (m = 0; m < *results->num_modes; m++) {
6775                 if (!(results->modes[m].ht_capab &
6776                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6777                         continue;
6778                 /* TODO: use a real VHT support indication */
6779                 if (!results->modes[m].vht_capab)
6780                         continue;
6781
6782                 nl80211_set_vht_mode(&results->modes[m], start, end);
6783         }
6784 }
6785
6786
6787 static const char * dfs_domain_name(enum nl80211_dfs_regions region)
6788 {
6789         switch (region) {
6790         case NL80211_DFS_UNSET:
6791                 return "DFS-UNSET";
6792         case NL80211_DFS_FCC:
6793                 return "DFS-FCC";
6794         case NL80211_DFS_ETSI:
6795                 return "DFS-ETSI";
6796         case NL80211_DFS_JP:
6797                 return "DFS-JP";
6798         default:
6799                 return "DFS-invalid";
6800         }
6801 }
6802
6803
6804 static int nl80211_get_reg(struct nl_msg *msg, void *arg)
6805 {
6806         struct phy_info_arg *results = arg;
6807         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
6808         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6809         struct nlattr *nl_rule;
6810         struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
6811         int rem_rule;
6812         static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
6813                 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
6814                 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
6815                 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
6816                 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
6817                 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
6818                 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
6819         };
6820
6821         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6822                   genlmsg_attrlen(gnlh, 0), NULL);
6823         if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
6824             !tb_msg[NL80211_ATTR_REG_RULES]) {
6825                 wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
6826                            "available");
6827                 return NL_SKIP;
6828         }
6829
6830         if (tb_msg[NL80211_ATTR_DFS_REGION]) {
6831                 enum nl80211_dfs_regions dfs_domain;
6832                 dfs_domain = nla_get_u8(tb_msg[NL80211_ATTR_DFS_REGION]);
6833                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s (%s)",
6834                            (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]),
6835                            dfs_domain_name(dfs_domain));
6836         } else {
6837                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
6838                            (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
6839         }
6840
6841         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6842         {
6843                 u32 start, end, max_eirp = 0, max_bw = 0, flags = 0;
6844                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6845                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6846                 if (tb_rule[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6847                     tb_rule[NL80211_ATTR_FREQ_RANGE_END] == NULL)
6848                         continue;
6849                 start = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6850                 end = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6851                 if (tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6852                         max_eirp = nla_get_u32(tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP]) / 100;
6853                 if (tb_rule[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6854                         max_bw = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6855                 if (tb_rule[NL80211_ATTR_REG_RULE_FLAGS])
6856                         flags = nla_get_u32(tb_rule[NL80211_ATTR_REG_RULE_FLAGS]);
6857
6858                 wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz %u mBm%s%s%s%s%s%s%s%s",
6859                            start, end, max_bw, max_eirp,
6860                            flags & NL80211_RRF_NO_OFDM ? " (no OFDM)" : "",
6861                            flags & NL80211_RRF_NO_CCK ? " (no CCK)" : "",
6862                            flags & NL80211_RRF_NO_INDOOR ? " (no indoor)" : "",
6863                            flags & NL80211_RRF_NO_OUTDOOR ? " (no outdoor)" :
6864                            "",
6865                            flags & NL80211_RRF_DFS ? " (DFS)" : "",
6866                            flags & NL80211_RRF_PTP_ONLY ? " (PTP only)" : "",
6867                            flags & NL80211_RRF_PTMP_ONLY ? " (PTMP only)" : "",
6868                            flags & NL80211_RRF_NO_IR ? " (no IR)" : "");
6869                 if (max_bw >= 40)
6870                         nl80211_reg_rule_ht40(start, end, results);
6871                 if (tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6872                         nl80211_reg_rule_max_eirp(start, end, max_eirp,
6873                                                   results);
6874         }
6875
6876         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6877         {
6878                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6879                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6880                 nl80211_reg_rule_sec(tb_rule, results);
6881         }
6882
6883         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6884         {
6885                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6886                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6887                 nl80211_reg_rule_vht(tb_rule, results);
6888         }
6889
6890         return NL_SKIP;
6891 }
6892
6893
6894 static int nl80211_set_regulatory_flags(struct wpa_driver_nl80211_data *drv,
6895                                         struct phy_info_arg *results)
6896 {
6897         struct nl_msg *msg;
6898
6899         msg = nlmsg_alloc();
6900         if (!msg)
6901                 return -ENOMEM;
6902
6903         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
6904         return send_and_recv_msgs(drv, msg, nl80211_get_reg, results);
6905 }
6906
6907
6908 static struct hostapd_hw_modes *
6909 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
6910 {
6911         u32 feat;
6912         struct i802_bss *bss = priv;
6913         struct wpa_driver_nl80211_data *drv = bss->drv;
6914         struct nl_msg *msg;
6915         struct phy_info_arg result = {
6916                 .num_modes = num_modes,
6917                 .modes = NULL,
6918                 .last_mode = -1,
6919         };
6920
6921         *num_modes = 0;
6922         *flags = 0;
6923
6924         msg = nlmsg_alloc();
6925         if (!msg)
6926                 return NULL;
6927
6928         feat = get_nl80211_protocol_features(drv);
6929         if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
6930                 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
6931         else
6932                 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
6933
6934         NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
6935         if (nl80211_set_iface_id(msg, bss) < 0)
6936                 goto nla_put_failure;
6937
6938         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) {
6939                 nl80211_set_regulatory_flags(drv, &result);
6940                 return wpa_driver_nl80211_postprocess_modes(result.modes,
6941                                                             num_modes);
6942         }
6943         msg = NULL;
6944  nla_put_failure:
6945         nlmsg_free(msg);
6946         return NULL;
6947 }
6948
6949
6950 static int wpa_driver_nl80211_send_mntr(struct wpa_driver_nl80211_data *drv,
6951                                         const void *data, size_t len,
6952                                         int encrypt, int noack)
6953 {
6954         __u8 rtap_hdr[] = {
6955                 0x00, 0x00, /* radiotap version */
6956                 0x0e, 0x00, /* radiotap length */
6957                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
6958                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
6959                 0x00,       /* padding */
6960                 0x00, 0x00, /* RX and TX flags to indicate that */
6961                 0x00, 0x00, /* this is the injected frame directly */
6962         };
6963         struct iovec iov[2] = {
6964                 {
6965                         .iov_base = &rtap_hdr,
6966                         .iov_len = sizeof(rtap_hdr),
6967                 },
6968                 {
6969                         .iov_base = (void *) data,
6970                         .iov_len = len,
6971                 }
6972         };
6973         struct msghdr msg = {
6974                 .msg_name = NULL,
6975                 .msg_namelen = 0,
6976                 .msg_iov = iov,
6977                 .msg_iovlen = 2,
6978                 .msg_control = NULL,
6979                 .msg_controllen = 0,
6980                 .msg_flags = 0,
6981         };
6982         int res;
6983         u16 txflags = 0;
6984
6985         if (encrypt)
6986                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
6987
6988         if (drv->monitor_sock < 0) {
6989                 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
6990                            "for %s", __func__);
6991                 return -1;
6992         }
6993
6994         if (noack)
6995                 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
6996         WPA_PUT_LE16(&rtap_hdr[12], txflags);
6997
6998         res = sendmsg(drv->monitor_sock, &msg, 0);
6999         if (res < 0) {
7000                 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
7001                 return -1;
7002         }
7003         return 0;
7004 }
7005
7006
7007 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
7008                                          const void *data, size_t len,
7009                                          int encrypt, int noack,
7010                                          unsigned int freq, int no_cck,
7011                                          int offchanok, unsigned int wait_time)
7012 {
7013         struct wpa_driver_nl80211_data *drv = bss->drv;
7014         u64 cookie;
7015         int res;
7016
7017         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
7018                 freq = nl80211_get_assoc_freq(drv);
7019                 wpa_printf(MSG_DEBUG,
7020                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
7021                            freq);
7022         }
7023         if (freq == 0) {
7024                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
7025                            bss->freq);
7026                 freq = bss->freq;
7027         }
7028
7029         if (drv->use_monitor) {
7030                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_mntr",
7031                            freq, bss->freq);
7032                 return wpa_driver_nl80211_send_mntr(drv, data, len,
7033                                                     encrypt, noack);
7034         }
7035
7036         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
7037         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
7038                                      &cookie, no_cck, noack, offchanok);
7039         if (res == 0 && !noack) {
7040                 const struct ieee80211_mgmt *mgmt;
7041                 u16 fc;
7042
7043                 mgmt = (const struct ieee80211_mgmt *) data;
7044                 fc = le_to_host16(mgmt->frame_control);
7045                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
7046                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
7047                         wpa_printf(MSG_MSGDUMP,
7048                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
7049                                    (long long unsigned int)
7050                                    drv->send_action_cookie,
7051                                    (long long unsigned int) cookie);
7052                         drv->send_action_cookie = cookie;
7053                 }
7054         }
7055
7056         return res;
7057 }
7058
7059
7060 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
7061                                         size_t data_len, int noack,
7062                                         unsigned int freq, int no_cck,
7063                                         int offchanok,
7064                                         unsigned int wait_time)
7065 {
7066         struct wpa_driver_nl80211_data *drv = bss->drv;
7067         struct ieee80211_mgmt *mgmt;
7068         int encrypt = 1;
7069         u16 fc;
7070
7071         mgmt = (struct ieee80211_mgmt *) data;
7072         fc = le_to_host16(mgmt->frame_control);
7073         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x nlmode=%d",
7074                    noack, freq, no_cck, offchanok, wait_time, fc, drv->nlmode);
7075
7076         if ((is_sta_interface(drv->nlmode) ||
7077              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
7078             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
7079             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
7080                 /*
7081                  * The use of last_mgmt_freq is a bit of a hack,
7082                  * but it works due to the single-threaded nature
7083                  * of wpa_supplicant.
7084                  */
7085                 if (freq == 0) {
7086                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
7087                                    drv->last_mgmt_freq);
7088                         freq = drv->last_mgmt_freq;
7089                 }
7090                 return nl80211_send_frame_cmd(bss, freq, 0,
7091                                               data, data_len, NULL, 1, noack,
7092                                               1);
7093         }
7094
7095         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
7096                 if (freq == 0) {
7097                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
7098                                    bss->freq);
7099                         freq = bss->freq;
7100                 }
7101                 return nl80211_send_frame_cmd(bss, freq,
7102                                               (int) freq == bss->freq ? 0 :
7103                                               wait_time,
7104                                               data, data_len,
7105                                               &drv->send_action_cookie,
7106                                               no_cck, noack, offchanok);
7107         }
7108
7109         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
7110             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
7111                 /*
7112                  * Only one of the authentication frame types is encrypted.
7113                  * In order for static WEP encryption to work properly (i.e.,
7114                  * to not encrypt the frame), we need to tell mac80211 about
7115                  * the frames that must not be encrypted.
7116                  */
7117                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
7118                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
7119                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
7120                         encrypt = 0;
7121         }
7122
7123         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
7124         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
7125                                              noack, freq, no_cck, offchanok,
7126                                              wait_time);
7127 }
7128
7129
7130 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
7131                            int slot, int ht_opmode, int ap_isolate,
7132                            int *basic_rates)
7133 {
7134         struct wpa_driver_nl80211_data *drv = bss->drv;
7135         struct nl_msg *msg;
7136
7137         msg = nlmsg_alloc();
7138         if (!msg)
7139                 return -ENOMEM;
7140
7141         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
7142
7143         if (cts >= 0)
7144                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
7145         if (preamble >= 0)
7146                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
7147         if (slot >= 0)
7148                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
7149         if (ht_opmode >= 0)
7150                 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
7151         if (ap_isolate >= 0)
7152                 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
7153
7154         if (basic_rates) {
7155                 u8 rates[NL80211_MAX_SUPP_RATES];
7156                 u8 rates_len = 0;
7157                 int i;
7158
7159                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
7160                      i++)
7161                         rates[rates_len++] = basic_rates[i] / 5;
7162
7163                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
7164         }
7165
7166         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7167
7168         return send_and_recv_msgs(drv, msg, NULL, NULL);
7169  nla_put_failure:
7170         nlmsg_free(msg);
7171         return -ENOBUFS;
7172 }
7173
7174
7175 static int wpa_driver_nl80211_set_acl(void *priv,
7176                                       struct hostapd_acl_params *params)
7177 {
7178         struct i802_bss *bss = priv;
7179         struct wpa_driver_nl80211_data *drv = bss->drv;
7180         struct nl_msg *msg;
7181         struct nlattr *acl;
7182         unsigned int i;
7183         int ret = 0;
7184
7185         if (!(drv->capa.max_acl_mac_addrs))
7186                 return -ENOTSUP;
7187
7188         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
7189                 return -ENOTSUP;
7190
7191         msg = nlmsg_alloc();
7192         if (!msg)
7193                 return -ENOMEM;
7194
7195         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
7196                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
7197
7198         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_MAC_ACL);
7199
7200         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7201
7202         NLA_PUT_U32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
7203                     NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
7204                     NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED);
7205
7206         acl = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
7207         if (acl == NULL)
7208                 goto nla_put_failure;
7209
7210         for (i = 0; i < params->num_mac_acl; i++)
7211                 NLA_PUT(msg, i + 1, ETH_ALEN, params->mac_acl[i].addr);
7212
7213         nla_nest_end(msg, acl);
7214
7215         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7216         msg = NULL;
7217         if (ret) {
7218                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
7219                            ret, strerror(-ret));
7220         }
7221
7222 nla_put_failure:
7223         nlmsg_free(msg);
7224
7225         return ret;
7226 }
7227
7228
7229 static int wpa_driver_nl80211_set_ap(void *priv,
7230                                      struct wpa_driver_ap_params *params)
7231 {
7232         struct i802_bss *bss = priv;
7233         struct wpa_driver_nl80211_data *drv = bss->drv;
7234         struct nl_msg *msg;
7235         u8 cmd = NL80211_CMD_NEW_BEACON;
7236         int ret;
7237         int beacon_set;
7238         int ifindex = if_nametoindex(bss->ifname);
7239         int num_suites;
7240         u32 suites[10], suite;
7241         u32 ver;
7242
7243         beacon_set = bss->beacon_set;
7244
7245         msg = nlmsg_alloc();
7246         if (!msg)
7247                 return -ENOMEM;
7248
7249         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
7250                    beacon_set);
7251         if (beacon_set)
7252                 cmd = NL80211_CMD_SET_BEACON;
7253
7254         nl80211_cmd(drv, msg, 0, cmd);
7255         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
7256                     params->head, params->head_len);
7257         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
7258         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
7259                     params->tail, params->tail_len);
7260         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
7261         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", ifindex);
7262         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
7263         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
7264         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
7265         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
7266         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
7267         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
7268                           params->ssid, params->ssid_len);
7269         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
7270                 params->ssid);
7271         if (params->proberesp && params->proberesp_len) {
7272                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
7273                             params->proberesp, params->proberesp_len);
7274                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
7275                         params->proberesp);
7276         }
7277         switch (params->hide_ssid) {
7278         case NO_SSID_HIDING:
7279                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
7280                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
7281                             NL80211_HIDDEN_SSID_NOT_IN_USE);
7282                 break;
7283         case HIDDEN_SSID_ZERO_LEN:
7284                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
7285                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
7286                             NL80211_HIDDEN_SSID_ZERO_LEN);
7287                 break;
7288         case HIDDEN_SSID_ZERO_CONTENTS:
7289                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
7290                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
7291                             NL80211_HIDDEN_SSID_ZERO_CONTENTS);
7292                 break;
7293         }
7294         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
7295         if (params->privacy)
7296                 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
7297         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
7298         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
7299             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
7300                 /* Leave out the attribute */
7301         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
7302                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
7303                             NL80211_AUTHTYPE_SHARED_KEY);
7304         else
7305                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
7306                             NL80211_AUTHTYPE_OPEN_SYSTEM);
7307
7308         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
7309         ver = 0;
7310         if (params->wpa_version & WPA_PROTO_WPA)
7311                 ver |= NL80211_WPA_VERSION_1;
7312         if (params->wpa_version & WPA_PROTO_RSN)
7313                 ver |= NL80211_WPA_VERSION_2;
7314         if (ver)
7315                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
7316
7317         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
7318                    params->key_mgmt_suites);
7319         num_suites = 0;
7320         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
7321                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
7322         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
7323                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
7324         if (num_suites) {
7325                 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
7326                         num_suites * sizeof(u32), suites);
7327         }
7328
7329         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
7330             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
7331                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
7332
7333         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
7334                    params->pairwise_ciphers);
7335         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
7336                                                  suites, ARRAY_SIZE(suites));
7337         if (num_suites) {
7338                 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
7339                         num_suites * sizeof(u32), suites);
7340         }
7341
7342         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
7343                    params->group_cipher);
7344         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
7345         if (suite)
7346                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite);
7347
7348         if (params->beacon_ies) {
7349                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
7350                                 params->beacon_ies);
7351                 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
7352                         wpabuf_head(params->beacon_ies));
7353         }
7354         if (params->proberesp_ies) {
7355                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
7356                                 params->proberesp_ies);
7357                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
7358                         wpabuf_len(params->proberesp_ies),
7359                         wpabuf_head(params->proberesp_ies));
7360         }
7361         if (params->assocresp_ies) {
7362                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
7363                                 params->assocresp_ies);
7364                 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
7365                         wpabuf_len(params->assocresp_ies),
7366                         wpabuf_head(params->assocresp_ies));
7367         }
7368
7369         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
7370                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
7371                            params->ap_max_inactivity);
7372                 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
7373                             params->ap_max_inactivity);
7374         }
7375
7376         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7377         if (ret) {
7378                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
7379                            ret, strerror(-ret));
7380         } else {
7381                 bss->beacon_set = 1;
7382                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
7383                                 params->short_slot_time, params->ht_opmode,
7384                                 params->isolate, params->basic_rates);
7385                 if (beacon_set && params->freq &&
7386                     params->freq->bandwidth != bss->bandwidth) {
7387                         wpa_printf(MSG_DEBUG,
7388                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
7389                                    bss->ifname, bss->bandwidth,
7390                                    params->freq->bandwidth);
7391                         ret = nl80211_set_channel(bss, params->freq, 1);
7392                         if (ret) {
7393                                 wpa_printf(MSG_DEBUG,
7394                                            "nl80211: Frequency set failed: %d (%s)",
7395                                            ret, strerror(-ret));
7396                         } else {
7397                                 wpa_printf(MSG_DEBUG,
7398                                            "nl80211: Frequency set succeeded for ht2040 coex");
7399                                 bss->bandwidth = params->freq->bandwidth;
7400                         }
7401                 } else if (!beacon_set) {
7402                         /*
7403                          * cfg80211 updates the driver on frequence change in AP
7404                          * mode only at the point when beaconing is started, so
7405                          * set the initial value here.
7406                          */
7407                         bss->bandwidth = params->freq->bandwidth;
7408                 }
7409         }
7410         return ret;
7411  nla_put_failure:
7412         nlmsg_free(msg);
7413         return -ENOBUFS;
7414 }
7415
7416
7417 static int nl80211_put_freq_params(struct nl_msg *msg,
7418                                    struct hostapd_freq_params *freq)
7419 {
7420         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
7421         if (freq->vht_enabled) {
7422                 switch (freq->bandwidth) {
7423                 case 20:
7424                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7425                                     NL80211_CHAN_WIDTH_20);
7426                         break;
7427                 case 40:
7428                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7429                                     NL80211_CHAN_WIDTH_40);
7430                         break;
7431                 case 80:
7432                         if (freq->center_freq2)
7433                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7434                                             NL80211_CHAN_WIDTH_80P80);
7435                         else
7436                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7437                                             NL80211_CHAN_WIDTH_80);
7438                         break;
7439                 case 160:
7440                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
7441                                     NL80211_CHAN_WIDTH_160);
7442                         break;
7443                 default:
7444                         return -EINVAL;
7445                 }
7446                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
7447                 if (freq->center_freq2)
7448                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
7449                                     freq->center_freq2);
7450         } else if (freq->ht_enabled) {
7451                 switch (freq->sec_channel_offset) {
7452                 case -1:
7453                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
7454                                     NL80211_CHAN_HT40MINUS);
7455                         break;
7456                 case 1:
7457                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
7458                                     NL80211_CHAN_HT40PLUS);
7459                         break;
7460                 default:
7461                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
7462                                     NL80211_CHAN_HT20);
7463                         break;
7464                 }
7465         }
7466         return 0;
7467
7468 nla_put_failure:
7469         return -ENOBUFS;
7470 }
7471
7472
7473 static int nl80211_set_channel(struct i802_bss *bss,
7474                                struct hostapd_freq_params *freq, int set_chan)
7475 {
7476         struct wpa_driver_nl80211_data *drv = bss->drv;
7477         struct nl_msg *msg;
7478         int ret;
7479
7480         wpa_printf(MSG_DEBUG,
7481                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7482                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7483                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7484         msg = nlmsg_alloc();
7485         if (!msg)
7486                 return -1;
7487
7488         nl80211_cmd(drv, msg, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
7489                     NL80211_CMD_SET_WIPHY);
7490
7491         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7492         if (nl80211_put_freq_params(msg, freq) < 0)
7493                 goto nla_put_failure;
7494
7495         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7496         msg = NULL;
7497         if (ret == 0) {
7498                 bss->freq = freq->freq;
7499                 return 0;
7500         }
7501         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
7502                    "%d (%s)", freq->freq, ret, strerror(-ret));
7503 nla_put_failure:
7504         nlmsg_free(msg);
7505         return -1;
7506 }
7507
7508
7509 static u32 sta_flags_nl80211(int flags)
7510 {
7511         u32 f = 0;
7512
7513         if (flags & WPA_STA_AUTHORIZED)
7514                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
7515         if (flags & WPA_STA_WMM)
7516                 f |= BIT(NL80211_STA_FLAG_WME);
7517         if (flags & WPA_STA_SHORT_PREAMBLE)
7518                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
7519         if (flags & WPA_STA_MFP)
7520                 f |= BIT(NL80211_STA_FLAG_MFP);
7521         if (flags & WPA_STA_TDLS_PEER)
7522                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
7523
7524         return f;
7525 }
7526
7527
7528 static int wpa_driver_nl80211_sta_add(void *priv,
7529                                       struct hostapd_sta_add_params *params)
7530 {
7531         struct i802_bss *bss = priv;
7532         struct wpa_driver_nl80211_data *drv = bss->drv;
7533         struct nl_msg *msg;
7534         struct nl80211_sta_flag_update upd;
7535         int ret = -ENOBUFS;
7536
7537         if ((params->flags & WPA_STA_TDLS_PEER) &&
7538             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7539                 return -EOPNOTSUPP;
7540
7541         msg = nlmsg_alloc();
7542         if (!msg)
7543                 return -ENOMEM;
7544
7545         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
7546                    params->set ? "Set" : "Add", MAC2STR(params->addr));
7547         nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
7548                     NL80211_CMD_NEW_STATION);
7549
7550         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7551         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
7552         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
7553                 params->supp_rates);
7554         wpa_hexdump(MSG_DEBUG, "  * supported rates", params->supp_rates,
7555                     params->supp_rates_len);
7556         if (!params->set) {
7557                 if (params->aid) {
7558                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
7559                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
7560                 } else {
7561                         /*
7562                          * cfg80211 validates that AID is non-zero, so we have
7563                          * to make this a non-zero value for the TDLS case where
7564                          * a dummy STA entry is used for now.
7565                          */
7566                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
7567                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, 1);
7568                 }
7569                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
7570                            params->listen_interval);
7571                 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
7572                             params->listen_interval);
7573         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
7574                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
7575                 NLA_PUT_U16(msg, NL80211_ATTR_PEER_AID, params->aid);
7576         }
7577         if (params->ht_capabilities) {
7578                 wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
7579                             (u8 *) params->ht_capabilities,
7580                             sizeof(*params->ht_capabilities));
7581                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
7582                         sizeof(*params->ht_capabilities),
7583                         params->ht_capabilities);
7584         }
7585
7586         if (params->vht_capabilities) {
7587                 wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
7588                             (u8 *) params->vht_capabilities,
7589                             sizeof(*params->vht_capabilities));
7590                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY,
7591                         sizeof(*params->vht_capabilities),
7592                         params->vht_capabilities);
7593         }
7594
7595         if (params->vht_opmode_enabled) {
7596                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
7597                 NLA_PUT_U8(msg, NL80211_ATTR_OPMODE_NOTIF,
7598                            params->vht_opmode);
7599         }
7600
7601         wpa_printf(MSG_DEBUG, "  * capability=0x%x", params->capability);
7602         NLA_PUT_U16(msg, NL80211_ATTR_STA_CAPABILITY, params->capability);
7603
7604         if (params->ext_capab) {
7605                 wpa_hexdump(MSG_DEBUG, "  * ext_capab",
7606                             params->ext_capab, params->ext_capab_len);
7607                 NLA_PUT(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
7608                         params->ext_capab_len, params->ext_capab);
7609         }
7610
7611         if (params->supp_channels) {
7612                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
7613                             params->supp_channels, params->supp_channels_len);
7614                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
7615                         params->supp_channels_len, params->supp_channels);
7616         }
7617
7618         if (params->supp_oper_classes) {
7619                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
7620                             params->supp_oper_classes,
7621                             params->supp_oper_classes_len);
7622                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
7623                         params->supp_oper_classes_len,
7624                         params->supp_oper_classes);
7625         }
7626
7627         os_memset(&upd, 0, sizeof(upd));
7628         upd.mask = sta_flags_nl80211(params->flags);
7629         upd.set = upd.mask;
7630         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
7631                    upd.set, upd.mask);
7632         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
7633
7634         if (params->flags & WPA_STA_WMM) {
7635                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
7636
7637                 if (!wme)
7638                         goto nla_put_failure;
7639
7640                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
7641                 NLA_PUT_U8(msg, NL80211_STA_WME_UAPSD_QUEUES,
7642                                 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
7643                 NLA_PUT_U8(msg, NL80211_STA_WME_MAX_SP,
7644                                 (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
7645                                 WMM_QOSINFO_STA_SP_MASK);
7646                 nla_nest_end(msg, wme);
7647         }
7648
7649         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7650         msg = NULL;
7651         if (ret)
7652                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
7653                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
7654                            strerror(-ret));
7655         if (ret == -EEXIST)
7656                 ret = 0;
7657  nla_put_failure:
7658         nlmsg_free(msg);
7659         return ret;
7660 }
7661
7662
7663 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr)
7664 {
7665         struct wpa_driver_nl80211_data *drv = bss->drv;
7666         struct nl_msg *msg;
7667         int ret;
7668
7669         msg = nlmsg_alloc();
7670         if (!msg)
7671                 return -ENOMEM;
7672
7673         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
7674
7675         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7676                     if_nametoindex(bss->ifname));
7677         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7678
7679         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7680         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
7681                    " --> %d (%s)",
7682                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
7683         if (ret == -ENOENT)
7684                 return 0;
7685         return ret;
7686  nla_put_failure:
7687         nlmsg_free(msg);
7688         return -ENOBUFS;
7689 }
7690
7691
7692 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
7693                                  int ifidx)
7694 {
7695         struct nl_msg *msg;
7696
7697         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
7698
7699         /* stop listening for EAPOL on this interface */
7700         del_ifidx(drv, ifidx);
7701
7702         msg = nlmsg_alloc();
7703         if (!msg)
7704                 goto nla_put_failure;
7705
7706         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
7707         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
7708
7709         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
7710                 return;
7711         msg = NULL;
7712  nla_put_failure:
7713         nlmsg_free(msg);
7714         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
7715 }
7716
7717
7718 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
7719 {
7720         switch (mode) {
7721         case NL80211_IFTYPE_ADHOC:
7722                 return "ADHOC";
7723         case NL80211_IFTYPE_STATION:
7724                 return "STATION";
7725         case NL80211_IFTYPE_AP:
7726                 return "AP";
7727         case NL80211_IFTYPE_AP_VLAN:
7728                 return "AP_VLAN";
7729         case NL80211_IFTYPE_WDS:
7730                 return "WDS";
7731         case NL80211_IFTYPE_MONITOR:
7732                 return "MONITOR";
7733         case NL80211_IFTYPE_MESH_POINT:
7734                 return "MESH_POINT";
7735         case NL80211_IFTYPE_P2P_CLIENT:
7736                 return "P2P_CLIENT";
7737         case NL80211_IFTYPE_P2P_GO:
7738                 return "P2P_GO";
7739         case NL80211_IFTYPE_P2P_DEVICE:
7740                 return "P2P_DEVICE";
7741         default:
7742                 return "unknown";
7743         }
7744 }
7745
7746
7747 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
7748                                      const char *ifname,
7749                                      enum nl80211_iftype iftype,
7750                                      const u8 *addr, int wds,
7751                                      int (*handler)(struct nl_msg *, void *),
7752                                      void *arg)
7753 {
7754         struct nl_msg *msg;
7755         int ifidx;
7756         int ret = -ENOBUFS;
7757
7758         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
7759                    iftype, nl80211_iftype_str(iftype));
7760
7761         msg = nlmsg_alloc();
7762         if (!msg)
7763                 return -1;
7764
7765         nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
7766         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
7767                 goto nla_put_failure;
7768         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
7769         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
7770
7771         if (iftype == NL80211_IFTYPE_MONITOR) {
7772                 struct nlattr *flags;
7773
7774                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
7775                 if (!flags)
7776                         goto nla_put_failure;
7777
7778                 NLA_PUT_FLAG(msg, NL80211_MNTR_FLAG_COOK_FRAMES);
7779
7780                 nla_nest_end(msg, flags);
7781         } else if (wds) {
7782                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
7783         }
7784
7785         /*
7786          * Tell cfg80211 that the interface belongs to the socket that created
7787          * it, and the interface should be deleted when the socket is closed.
7788          */
7789         NLA_PUT_FLAG(msg, NL80211_ATTR_IFACE_SOCKET_OWNER);
7790
7791         ret = send_and_recv_msgs(drv, msg, handler, arg);
7792         msg = NULL;
7793         if (ret) {
7794  nla_put_failure:
7795                 nlmsg_free(msg);
7796                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
7797                            ifname, ret, strerror(-ret));
7798                 return ret;
7799         }
7800
7801         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
7802                 return 0;
7803
7804         ifidx = if_nametoindex(ifname);
7805         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
7806                    ifname, ifidx);
7807
7808         if (ifidx <= 0)
7809                 return -1;
7810
7811         /* start listening for EAPOL on this interface */
7812         add_ifidx(drv, ifidx);
7813
7814         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
7815             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
7816                 nl80211_remove_iface(drv, ifidx);
7817                 return -1;
7818         }
7819
7820         return ifidx;
7821 }
7822
7823
7824 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
7825                                 const char *ifname, enum nl80211_iftype iftype,
7826                                 const u8 *addr, int wds,
7827                                 int (*handler)(struct nl_msg *, void *),
7828                                 void *arg, int use_existing)
7829 {
7830         int ret;
7831
7832         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
7833                                         arg);
7834
7835         /* if error occurred and interface exists already */
7836         if (ret == -ENFILE && if_nametoindex(ifname)) {
7837                 if (use_existing) {
7838                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
7839                                    ifname);
7840                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
7841                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
7842                                                addr) < 0 &&
7843                             (linux_set_iface_flags(drv->global->ioctl_sock,
7844                                                    ifname, 0) < 0 ||
7845                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
7846                                                 addr) < 0 ||
7847                              linux_set_iface_flags(drv->global->ioctl_sock,
7848                                                    ifname, 1) < 0))
7849                                         return -1;
7850                         return -ENFILE;
7851                 }
7852                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
7853
7854                 /* Try to remove the interface that was already there. */
7855                 nl80211_remove_iface(drv, if_nametoindex(ifname));
7856
7857                 /* Try to create the interface again */
7858                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
7859                                                 wds, handler, arg);
7860         }
7861
7862         if (ret >= 0 && is_p2p_net_interface(iftype))
7863                 nl80211_disable_11b_rates(drv, ret, 1);
7864
7865         return ret;
7866 }
7867
7868
7869 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
7870 {
7871         struct ieee80211_hdr *hdr;
7872         u16 fc;
7873         union wpa_event_data event;
7874
7875         hdr = (struct ieee80211_hdr *) buf;
7876         fc = le_to_host16(hdr->frame_control);
7877
7878         os_memset(&event, 0, sizeof(event));
7879         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
7880         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
7881         event.tx_status.dst = hdr->addr1;
7882         event.tx_status.data = buf;
7883         event.tx_status.data_len = len;
7884         event.tx_status.ack = ok;
7885         wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
7886 }
7887
7888
7889 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
7890                              u8 *buf, size_t len)
7891 {
7892         struct ieee80211_hdr *hdr = (void *)buf;
7893         u16 fc;
7894         union wpa_event_data event;
7895
7896         if (len < sizeof(*hdr))
7897                 return;
7898
7899         fc = le_to_host16(hdr->frame_control);
7900
7901         os_memset(&event, 0, sizeof(event));
7902         event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
7903         event.rx_from_unknown.addr = hdr->addr2;
7904         event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
7905                 (WLAN_FC_FROMDS | WLAN_FC_TODS);
7906         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
7907 }
7908
7909
7910 static void handle_frame(struct wpa_driver_nl80211_data *drv,
7911                          u8 *buf, size_t len, int datarate, int ssi_signal)
7912 {
7913         struct ieee80211_hdr *hdr;
7914         u16 fc;
7915         union wpa_event_data event;
7916
7917         hdr = (struct ieee80211_hdr *) buf;
7918         fc = le_to_host16(hdr->frame_control);
7919
7920         switch (WLAN_FC_GET_TYPE(fc)) {
7921         case WLAN_FC_TYPE_MGMT:
7922                 os_memset(&event, 0, sizeof(event));
7923                 event.rx_mgmt.frame = buf;
7924                 event.rx_mgmt.frame_len = len;
7925                 event.rx_mgmt.datarate = datarate;
7926                 event.rx_mgmt.ssi_signal = ssi_signal;
7927                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
7928                 break;
7929         case WLAN_FC_TYPE_CTRL:
7930                 /* can only get here with PS-Poll frames */
7931                 wpa_printf(MSG_DEBUG, "CTRL");
7932                 from_unknown_sta(drv, buf, len);
7933                 break;
7934         case WLAN_FC_TYPE_DATA:
7935                 from_unknown_sta(drv, buf, len);
7936                 break;
7937         }
7938 }
7939
7940
7941 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
7942 {
7943         struct wpa_driver_nl80211_data *drv = eloop_ctx;
7944         int len;
7945         unsigned char buf[3000];
7946         struct ieee80211_radiotap_iterator iter;
7947         int ret;
7948         int datarate = 0, ssi_signal = 0;
7949         int injected = 0, failed = 0, rxflags = 0;
7950
7951         len = recv(sock, buf, sizeof(buf), 0);
7952         if (len < 0) {
7953                 wpa_printf(MSG_ERROR, "nl80211: Monitor socket recv failed: %s",
7954                            strerror(errno));
7955                 return;
7956         }
7957
7958         if (ieee80211_radiotap_iterator_init(&iter, (void *) buf, len, NULL)) {
7959                 wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame");
7960                 return;
7961         }
7962
7963         while (1) {
7964                 ret = ieee80211_radiotap_iterator_next(&iter);
7965                 if (ret == -ENOENT)
7966                         break;
7967                 if (ret) {
7968                         wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame (%d)",
7969                                    ret);
7970                         return;
7971                 }
7972                 switch (iter.this_arg_index) {
7973                 case IEEE80211_RADIOTAP_FLAGS:
7974                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
7975                                 len -= 4;
7976                         break;
7977                 case IEEE80211_RADIOTAP_RX_FLAGS:
7978                         rxflags = 1;
7979                         break;
7980                 case IEEE80211_RADIOTAP_TX_FLAGS:
7981                         injected = 1;
7982                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
7983                                         IEEE80211_RADIOTAP_F_TX_FAIL;
7984                         break;
7985                 case IEEE80211_RADIOTAP_DATA_RETRIES:
7986                         break;
7987                 case IEEE80211_RADIOTAP_CHANNEL:
7988                         /* TODO: convert from freq/flags to channel number */
7989                         break;
7990                 case IEEE80211_RADIOTAP_RATE:
7991                         datarate = *iter.this_arg * 5;
7992                         break;
7993                 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
7994                         ssi_signal = (s8) *iter.this_arg;
7995                         break;
7996                 }
7997         }
7998
7999         if (rxflags && injected)
8000                 return;
8001
8002         if (!injected)
8003                 handle_frame(drv, buf + iter._max_length,
8004                              len - iter._max_length, datarate, ssi_signal);
8005         else
8006                 handle_tx_callback(drv->ctx, buf + iter._max_length,
8007                                    len - iter._max_length, !failed);
8008 }
8009
8010
8011 /*
8012  * we post-process the filter code later and rewrite
8013  * this to the offset to the last instruction
8014  */
8015 #define PASS    0xFF
8016 #define FAIL    0xFE
8017
8018 static struct sock_filter msock_filter_insns[] = {
8019         /*
8020          * do a little-endian load of the radiotap length field
8021          */
8022         /* load lower byte into A */
8023         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
8024         /* put it into X (== index register) */
8025         BPF_STMT(BPF_MISC| BPF_TAX, 0),
8026         /* load upper byte into A */
8027         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
8028         /* left-shift it by 8 */
8029         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
8030         /* or with X */
8031         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
8032         /* put result into X */
8033         BPF_STMT(BPF_MISC| BPF_TAX, 0),
8034
8035         /*
8036          * Allow management frames through, this also gives us those
8037          * management frames that we sent ourselves with status
8038          */
8039         /* load the lower byte of the IEEE 802.11 frame control field */
8040         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
8041         /* mask off frame type and version */
8042         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
8043         /* accept frame if it's both 0, fall through otherwise */
8044         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
8045
8046         /*
8047          * TODO: add a bit to radiotap RX flags that indicates
8048          * that the sending station is not associated, then
8049          * add a filter here that filters on our DA and that flag
8050          * to allow us to deauth frames to that bad station.
8051          *
8052          * For now allow all To DS data frames through.
8053          */
8054         /* load the IEEE 802.11 frame control field */
8055         BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
8056         /* mask off frame type, version and DS status */
8057         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
8058         /* accept frame if version 0, type 2 and To DS, fall through otherwise
8059          */
8060         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
8061
8062 #if 0
8063         /*
8064          * drop non-data frames
8065          */
8066         /* load the lower byte of the frame control field */
8067         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
8068         /* mask off QoS bit */
8069         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
8070         /* drop non-data frames */
8071         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
8072 #endif
8073         /* load the upper byte of the frame control field */
8074         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
8075         /* mask off toDS/fromDS */
8076         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
8077         /* accept WDS frames */
8078         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
8079
8080         /*
8081          * add header length to index
8082          */
8083         /* load the lower byte of the frame control field */
8084         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
8085         /* mask off QoS bit */
8086         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
8087         /* right shift it by 6 to give 0 or 2 */
8088         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
8089         /* add data frame header length */
8090         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
8091         /* add index, was start of 802.11 header */
8092         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
8093         /* move to index, now start of LL header */
8094         BPF_STMT(BPF_MISC | BPF_TAX, 0),
8095
8096         /*
8097          * Accept empty data frames, we use those for
8098          * polling activity.
8099          */
8100         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
8101         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
8102
8103         /*
8104          * Accept EAPOL frames
8105          */
8106         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
8107         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
8108         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
8109         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
8110
8111         /* keep these last two statements or change the code below */
8112         /* return 0 == "DROP" */
8113         BPF_STMT(BPF_RET | BPF_K, 0),
8114         /* return ~0 == "keep all" */
8115         BPF_STMT(BPF_RET | BPF_K, ~0),
8116 };
8117
8118 static struct sock_fprog msock_filter = {
8119         .len = ARRAY_SIZE(msock_filter_insns),
8120         .filter = msock_filter_insns,
8121 };
8122
8123
8124 static int add_monitor_filter(int s)
8125 {
8126         int idx;
8127
8128         /* rewrite all PASS/FAIL jump offsets */
8129         for (idx = 0; idx < msock_filter.len; idx++) {
8130                 struct sock_filter *insn = &msock_filter_insns[idx];
8131
8132                 if (BPF_CLASS(insn->code) == BPF_JMP) {
8133                         if (insn->code == (BPF_JMP|BPF_JA)) {
8134                                 if (insn->k == PASS)
8135                                         insn->k = msock_filter.len - idx - 2;
8136                                 else if (insn->k == FAIL)
8137                                         insn->k = msock_filter.len - idx - 3;
8138                         }
8139
8140                         if (insn->jt == PASS)
8141                                 insn->jt = msock_filter.len - idx - 2;
8142                         else if (insn->jt == FAIL)
8143                                 insn->jt = msock_filter.len - idx - 3;
8144
8145                         if (insn->jf == PASS)
8146                                 insn->jf = msock_filter.len - idx - 2;
8147                         else if (insn->jf == FAIL)
8148                                 insn->jf = msock_filter.len - idx - 3;
8149                 }
8150         }
8151
8152         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
8153                        &msock_filter, sizeof(msock_filter))) {
8154                 wpa_printf(MSG_ERROR, "nl80211: setsockopt(SO_ATTACH_FILTER) failed: %s",
8155                            strerror(errno));
8156                 return -1;
8157         }
8158
8159         return 0;
8160 }
8161
8162
8163 static void nl80211_remove_monitor_interface(
8164         struct wpa_driver_nl80211_data *drv)
8165 {
8166         if (drv->monitor_refcount > 0)
8167                 drv->monitor_refcount--;
8168         wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface: refcount=%d",
8169                    drv->monitor_refcount);
8170         if (drv->monitor_refcount > 0)
8171                 return;
8172
8173         if (drv->monitor_ifidx >= 0) {
8174                 nl80211_remove_iface(drv, drv->monitor_ifidx);
8175                 drv->monitor_ifidx = -1;
8176         }
8177         if (drv->monitor_sock >= 0) {
8178                 eloop_unregister_read_sock(drv->monitor_sock);
8179                 close(drv->monitor_sock);
8180                 drv->monitor_sock = -1;
8181         }
8182 }
8183
8184
8185 static int
8186 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
8187 {
8188         char buf[IFNAMSIZ];
8189         struct sockaddr_ll ll;
8190         int optval;
8191         socklen_t optlen;
8192
8193         if (drv->monitor_ifidx >= 0) {
8194                 drv->monitor_refcount++;
8195                 wpa_printf(MSG_DEBUG, "nl80211: Re-use existing monitor interface: refcount=%d",
8196                            drv->monitor_refcount);
8197                 return 0;
8198         }
8199
8200         if (os_strncmp(drv->first_bss->ifname, "p2p-", 4) == 0) {
8201                 /*
8202                  * P2P interface name is of the format p2p-%s-%d. For monitor
8203                  * interface name corresponding to P2P GO, replace "p2p-" with
8204                  * "mon-" to retain the same interface name length and to
8205                  * indicate that it is a monitor interface.
8206                  */
8207                 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss->ifname + 4);
8208         } else {
8209                 /* Non-P2P interface with AP functionality. */
8210                 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss->ifname);
8211         }
8212
8213         buf[IFNAMSIZ - 1] = '\0';
8214
8215         drv->monitor_ifidx =
8216                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
8217                                      0, NULL, NULL, 0);
8218
8219         if (drv->monitor_ifidx == -EOPNOTSUPP) {
8220                 /*
8221                  * This is backward compatibility for a few versions of
8222                  * the kernel only that didn't advertise the right
8223                  * attributes for the only driver that then supported
8224                  * AP mode w/o monitor -- ath6kl.
8225                  */
8226                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
8227                            "monitor interface type - try to run without it");
8228                 drv->device_ap_sme = 1;
8229         }
8230
8231         if (drv->monitor_ifidx < 0)
8232                 return -1;
8233
8234         if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
8235                 goto error;
8236
8237         memset(&ll, 0, sizeof(ll));
8238         ll.sll_family = AF_PACKET;
8239         ll.sll_ifindex = drv->monitor_ifidx;
8240         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
8241         if (drv->monitor_sock < 0) {
8242                 wpa_printf(MSG_ERROR, "nl80211: socket[PF_PACKET,SOCK_RAW] failed: %s",
8243                            strerror(errno));
8244                 goto error;
8245         }
8246
8247         if (add_monitor_filter(drv->monitor_sock)) {
8248                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
8249                            "interface; do filtering in user space");
8250                 /* This works, but will cost in performance. */
8251         }
8252
8253         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
8254                 wpa_printf(MSG_ERROR, "nl80211: monitor socket bind failed: %s",
8255                            strerror(errno));
8256                 goto error;
8257         }
8258
8259         optlen = sizeof(optval);
8260         optval = 20;
8261         if (setsockopt
8262             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
8263                 wpa_printf(MSG_ERROR, "nl80211: Failed to set socket priority: %s",
8264                            strerror(errno));
8265                 goto error;
8266         }
8267
8268         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
8269                                      drv, NULL)) {
8270                 wpa_printf(MSG_INFO, "nl80211: Could not register monitor read socket");
8271                 goto error;
8272         }
8273
8274         drv->monitor_refcount++;
8275         return 0;
8276  error:
8277         nl80211_remove_monitor_interface(drv);
8278         return -1;
8279 }
8280
8281
8282 static int nl80211_setup_ap(struct i802_bss *bss)
8283 {
8284         struct wpa_driver_nl80211_data *drv = bss->drv;
8285
8286         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
8287                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
8288
8289         /*
8290          * Disable Probe Request reporting unless we need it in this way for
8291          * devices that include the AP SME, in the other case (unless using
8292          * monitor iface) we'll get it through the nl_mgmt socket instead.
8293          */
8294         if (!drv->device_ap_sme)
8295                 wpa_driver_nl80211_probe_req_report(bss, 0);
8296
8297         if (!drv->device_ap_sme && !drv->use_monitor)
8298                 if (nl80211_mgmt_subscribe_ap(bss))
8299                         return -1;
8300
8301         if (drv->device_ap_sme && !drv->use_monitor)
8302                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
8303                         return -1;
8304
8305         if (!drv->device_ap_sme && drv->use_monitor &&
8306             nl80211_create_monitor_interface(drv) &&
8307             !drv->device_ap_sme)
8308                 return -1;
8309
8310         if (drv->device_ap_sme &&
8311             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
8312                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
8313                            "Probe Request frame reporting in AP mode");
8314                 /* Try to survive without this */
8315         }
8316
8317         return 0;
8318 }
8319
8320
8321 static void nl80211_teardown_ap(struct i802_bss *bss)
8322 {
8323         struct wpa_driver_nl80211_data *drv = bss->drv;
8324
8325         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
8326                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
8327         if (drv->device_ap_sme) {
8328                 wpa_driver_nl80211_probe_req_report(bss, 0);
8329                 if (!drv->use_monitor)
8330                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
8331         } else if (drv->use_monitor)
8332                 nl80211_remove_monitor_interface(drv);
8333         else
8334                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
8335
8336         bss->beacon_set = 0;
8337 }
8338
8339
8340 static int nl80211_send_eapol_data(struct i802_bss *bss,
8341                                    const u8 *addr, const u8 *data,
8342                                    size_t data_len)
8343 {
8344         struct sockaddr_ll ll;
8345         int ret;
8346
8347         if (bss->drv->eapol_tx_sock < 0) {
8348                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
8349                 return -1;
8350         }
8351
8352         os_memset(&ll, 0, sizeof(ll));
8353         ll.sll_family = AF_PACKET;
8354         ll.sll_ifindex = bss->ifindex;
8355         ll.sll_protocol = htons(ETH_P_PAE);
8356         ll.sll_halen = ETH_ALEN;
8357         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
8358         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
8359                      (struct sockaddr *) &ll, sizeof(ll));
8360         if (ret < 0)
8361                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
8362                            strerror(errno));
8363
8364         return ret;
8365 }
8366
8367
8368 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
8369
8370 static int wpa_driver_nl80211_hapd_send_eapol(
8371         void *priv, const u8 *addr, const u8 *data,
8372         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
8373 {
8374         struct i802_bss *bss = priv;
8375         struct wpa_driver_nl80211_data *drv = bss->drv;
8376         struct ieee80211_hdr *hdr;
8377         size_t len;
8378         u8 *pos;
8379         int res;
8380         int qos = flags & WPA_STA_WMM;
8381
8382         if (drv->device_ap_sme || !drv->use_monitor)
8383                 return nl80211_send_eapol_data(bss, addr, data, data_len);
8384
8385         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
8386                 data_len;
8387         hdr = os_zalloc(len);
8388         if (hdr == NULL) {
8389                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
8390                            (unsigned long) len);
8391                 return -1;
8392         }
8393
8394         hdr->frame_control =
8395                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
8396         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
8397         if (encrypt)
8398                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
8399         if (qos) {
8400                 hdr->frame_control |=
8401                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
8402         }
8403
8404         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
8405         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
8406         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
8407         pos = (u8 *) (hdr + 1);
8408
8409         if (qos) {
8410                 /* Set highest priority in QoS header */
8411                 pos[0] = 7;
8412                 pos[1] = 0;
8413                 pos += 2;
8414         }
8415
8416         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
8417         pos += sizeof(rfc1042_header);
8418         WPA_PUT_BE16(pos, ETH_P_PAE);
8419         pos += 2;
8420         memcpy(pos, data, data_len);
8421
8422         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
8423                                             0, 0, 0, 0);
8424         if (res < 0) {
8425                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
8426                            "failed: %d (%s)",
8427                            (unsigned long) len, errno, strerror(errno));
8428         }
8429         os_free(hdr);
8430
8431         return res;
8432 }
8433
8434
8435 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
8436                                             int total_flags,
8437                                             int flags_or, int flags_and)
8438 {
8439         struct i802_bss *bss = priv;
8440         struct wpa_driver_nl80211_data *drv = bss->drv;
8441         struct nl_msg *msg;
8442         struct nlattr *flags;
8443         struct nl80211_sta_flag_update upd;
8444
8445         msg = nlmsg_alloc();
8446         if (!msg)
8447                 return -ENOMEM;
8448
8449         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
8450
8451         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
8452                     if_nametoindex(bss->ifname));
8453         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8454
8455         /*
8456          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
8457          * can be removed eventually.
8458          */
8459         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
8460         if (!flags)
8461                 goto nla_put_failure;
8462         if (total_flags & WPA_STA_AUTHORIZED)
8463                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_AUTHORIZED);
8464
8465         if (total_flags & WPA_STA_WMM)
8466                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_WME);
8467
8468         if (total_flags & WPA_STA_SHORT_PREAMBLE)
8469                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_SHORT_PREAMBLE);
8470
8471         if (total_flags & WPA_STA_MFP)
8472                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_MFP);
8473
8474         if (total_flags & WPA_STA_TDLS_PEER)
8475                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_TDLS_PEER);
8476
8477         nla_nest_end(msg, flags);
8478
8479         os_memset(&upd, 0, sizeof(upd));
8480         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
8481         upd.set = sta_flags_nl80211(flags_or);
8482         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
8483
8484         return send_and_recv_msgs(drv, msg, NULL, NULL);
8485  nla_put_failure:
8486         nlmsg_free(msg);
8487         return -ENOBUFS;
8488 }
8489
8490
8491 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
8492                                  struct wpa_driver_associate_params *params)
8493 {
8494         enum nl80211_iftype nlmode, old_mode;
8495         struct hostapd_freq_params freq = {
8496                 .freq = params->freq,
8497         };
8498
8499         if (params->p2p) {
8500                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
8501                            "group (GO)");
8502                 nlmode = NL80211_IFTYPE_P2P_GO;
8503         } else
8504                 nlmode = NL80211_IFTYPE_AP;
8505
8506         old_mode = drv->nlmode;
8507         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
8508                 nl80211_remove_monitor_interface(drv);
8509                 return -1;
8510         }
8511
8512         if (nl80211_set_channel(drv->first_bss, &freq, 0)) {
8513                 if (old_mode != nlmode)
8514                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
8515                 nl80211_remove_monitor_interface(drv);
8516                 return -1;
8517         }
8518
8519         return 0;
8520 }
8521
8522
8523 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
8524 {
8525         struct nl_msg *msg;
8526         int ret = -1;
8527
8528         msg = nlmsg_alloc();
8529         if (!msg)
8530                 return -1;
8531
8532         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
8533         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8534         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8535         msg = NULL;
8536         if (ret) {
8537                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
8538                            "(%s)", ret, strerror(-ret));
8539                 goto nla_put_failure;
8540         }
8541
8542         ret = 0;
8543         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
8544
8545 nla_put_failure:
8546         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8547                                         NL80211_IFTYPE_STATION)) {
8548                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
8549                            "station mode");
8550         }
8551
8552         nlmsg_free(msg);
8553         return ret;
8554 }
8555
8556
8557 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
8558                                    struct wpa_driver_associate_params *params)
8559 {
8560         struct nl_msg *msg;
8561         int ret = -1;
8562         int count = 0;
8563
8564         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
8565
8566         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8567                                         NL80211_IFTYPE_ADHOC)) {
8568                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
8569                            "IBSS mode");
8570                 return -1;
8571         }
8572
8573 retry:
8574         msg = nlmsg_alloc();
8575         if (!msg)
8576                 return -1;
8577
8578         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
8579         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8580
8581         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
8582                 goto nla_put_failure;
8583
8584         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8585                           params->ssid, params->ssid_len);
8586         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
8587                 params->ssid);
8588         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
8589         drv->ssid_len = params->ssid_len;
8590
8591         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8592         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
8593
8594         if (params->beacon_int > 0) {
8595                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", params->beacon_int);
8596                 NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL,
8597                             params->beacon_int);
8598         }
8599
8600         ret = nl80211_set_conn_keys(params, msg);
8601         if (ret)
8602                 goto nla_put_failure;
8603
8604         if (params->bssid && params->fixed_bssid) {
8605                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
8606                            MAC2STR(params->bssid));
8607                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
8608         }
8609
8610         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
8611             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
8612             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
8613             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
8614                 wpa_printf(MSG_DEBUG, "  * control port");
8615                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
8616         }
8617
8618         if (params->wpa_ie) {
8619                 wpa_hexdump(MSG_DEBUG,
8620                             "  * Extra IEs for Beacon/Probe Response frames",
8621                             params->wpa_ie, params->wpa_ie_len);
8622                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
8623                         params->wpa_ie);
8624         }
8625
8626         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8627         msg = NULL;
8628         if (ret) {
8629                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
8630                            ret, strerror(-ret));
8631                 count++;
8632                 if (ret == -EALREADY && count == 1) {
8633                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
8634                                    "forced leave");
8635                         nl80211_leave_ibss(drv);
8636                         nlmsg_free(msg);
8637                         goto retry;
8638                 }
8639
8640                 goto nla_put_failure;
8641         }
8642         ret = 0;
8643         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
8644
8645 nla_put_failure:
8646         nlmsg_free(msg);
8647         return ret;
8648 }
8649
8650
8651 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
8652                                   struct wpa_driver_associate_params *params,
8653                                   struct nl_msg *msg)
8654 {
8655         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8656
8657         if (params->bssid) {
8658                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
8659                            MAC2STR(params->bssid));
8660                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
8661         }
8662
8663         if (params->bssid_hint) {
8664                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
8665                            MAC2STR(params->bssid_hint));
8666                 NLA_PUT(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
8667                         params->bssid_hint);
8668         }
8669
8670         if (params->freq) {
8671                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8672                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
8673                 drv->assoc_freq = params->freq;
8674         } else
8675                 drv->assoc_freq = 0;
8676
8677         if (params->freq_hint) {
8678                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
8679                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
8680                             params->freq_hint);
8681         }
8682
8683         if (params->bg_scan_period >= 0) {
8684                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
8685                            params->bg_scan_period);
8686                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
8687                             params->bg_scan_period);
8688         }
8689
8690         if (params->ssid) {
8691                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8692                                   params->ssid, params->ssid_len);
8693                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
8694                         params->ssid);
8695                 if (params->ssid_len > sizeof(drv->ssid))
8696                         goto nla_put_failure;
8697                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
8698                 drv->ssid_len = params->ssid_len;
8699         }
8700
8701         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
8702         if (params->wpa_ie)
8703                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
8704                         params->wpa_ie);
8705
8706         if (params->wpa_proto) {
8707                 enum nl80211_wpa_versions ver = 0;
8708
8709                 if (params->wpa_proto & WPA_PROTO_WPA)
8710                         ver |= NL80211_WPA_VERSION_1;
8711                 if (params->wpa_proto & WPA_PROTO_RSN)
8712                         ver |= NL80211_WPA_VERSION_2;
8713
8714                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
8715                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
8716         }
8717
8718         if (params->pairwise_suite != WPA_CIPHER_NONE) {
8719                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
8720                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
8721                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
8722         }
8723
8724         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
8725             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
8726                 /*
8727                  * This is likely to work even though many drivers do not
8728                  * advertise support for operations without GTK.
8729                  */
8730                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
8731         } else if (params->group_suite != WPA_CIPHER_NONE) {
8732                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
8733                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
8734                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
8735         }
8736
8737         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
8738             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
8739             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
8740             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
8741             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
8742             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
8743             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
8744             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
8745                 int mgmt = WLAN_AKM_SUITE_PSK;
8746
8747                 switch (params->key_mgmt_suite) {
8748                 case WPA_KEY_MGMT_CCKM:
8749                         mgmt = WLAN_AKM_SUITE_CCKM;
8750                         break;
8751                 case WPA_KEY_MGMT_IEEE8021X:
8752                         mgmt = WLAN_AKM_SUITE_8021X;
8753                         break;
8754                 case WPA_KEY_MGMT_FT_IEEE8021X:
8755                         mgmt = WLAN_AKM_SUITE_FT_8021X;
8756                         break;
8757                 case WPA_KEY_MGMT_FT_PSK:
8758                         mgmt = WLAN_AKM_SUITE_FT_PSK;
8759                         break;
8760                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
8761                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
8762                         break;
8763                 case WPA_KEY_MGMT_PSK_SHA256:
8764                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
8765                         break;
8766                 case WPA_KEY_MGMT_OSEN:
8767                         mgmt = WLAN_AKM_SUITE_OSEN;
8768                         break;
8769                 case WPA_KEY_MGMT_PSK:
8770                 default:
8771                         mgmt = WLAN_AKM_SUITE_PSK;
8772                         break;
8773                 }
8774                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
8775                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
8776         }
8777
8778         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
8779
8780         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
8781                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
8782
8783         if (params->disable_ht)
8784                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
8785
8786         if (params->htcaps && params->htcaps_mask) {
8787                 int sz = sizeof(struct ieee80211_ht_capabilities);
8788                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
8789                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
8790                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
8791                             params->htcaps_mask, sz);
8792                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
8793                         params->htcaps_mask);
8794         }
8795
8796 #ifdef CONFIG_VHT_OVERRIDES
8797         if (params->disable_vht) {
8798                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
8799                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
8800         }
8801
8802         if (params->vhtcaps && params->vhtcaps_mask) {
8803                 int sz = sizeof(struct ieee80211_vht_capabilities);
8804                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
8805                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
8806                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
8807                             params->vhtcaps_mask, sz);
8808                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
8809                         params->vhtcaps_mask);
8810         }
8811 #endif /* CONFIG_VHT_OVERRIDES */
8812
8813         if (params->p2p)
8814                 wpa_printf(MSG_DEBUG, "  * P2P group");
8815
8816         return 0;
8817 nla_put_failure:
8818         return -1;
8819 }
8820
8821
8822 static int wpa_driver_nl80211_try_connect(
8823         struct wpa_driver_nl80211_data *drv,
8824         struct wpa_driver_associate_params *params)
8825 {
8826         struct nl_msg *msg;
8827         enum nl80211_auth_type type;
8828         int ret;
8829         int algs;
8830
8831         msg = nlmsg_alloc();
8832         if (!msg)
8833                 return -1;
8834
8835         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
8836         nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
8837
8838         ret = nl80211_connect_common(drv, params, msg);
8839         if (ret)
8840                 goto nla_put_failure;
8841
8842         algs = 0;
8843         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
8844                 algs++;
8845         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
8846                 algs++;
8847         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
8848                 algs++;
8849         if (algs > 1) {
8850                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
8851                            "selection");
8852                 goto skip_auth_type;
8853         }
8854
8855         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
8856                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
8857         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
8858                 type = NL80211_AUTHTYPE_SHARED_KEY;
8859         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
8860                 type = NL80211_AUTHTYPE_NETWORK_EAP;
8861         else if (params->auth_alg & WPA_AUTH_ALG_FT)
8862                 type = NL80211_AUTHTYPE_FT;
8863         else
8864                 goto nla_put_failure;
8865
8866         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
8867         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
8868
8869 skip_auth_type:
8870         ret = nl80211_set_conn_keys(params, msg);
8871         if (ret)
8872                 goto nla_put_failure;
8873
8874         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8875         msg = NULL;
8876         if (ret) {
8877                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
8878                            "(%s)", ret, strerror(-ret));
8879                 goto nla_put_failure;
8880         }
8881         ret = 0;
8882         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
8883
8884 nla_put_failure:
8885         nlmsg_free(msg);
8886         return ret;
8887
8888 }
8889
8890
8891 static int wpa_driver_nl80211_connect(
8892         struct wpa_driver_nl80211_data *drv,
8893         struct wpa_driver_associate_params *params)
8894 {
8895         int ret = wpa_driver_nl80211_try_connect(drv, params);
8896         if (ret == -EALREADY) {
8897                 /*
8898                  * cfg80211 does not currently accept new connections if
8899                  * we are already connected. As a workaround, force
8900                  * disconnection and try again.
8901                  */
8902                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
8903                            "disconnecting before reassociation "
8904                            "attempt");
8905                 if (wpa_driver_nl80211_disconnect(
8906                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
8907                         return -1;
8908                 ret = wpa_driver_nl80211_try_connect(drv, params);
8909         }
8910         return ret;
8911 }
8912
8913
8914 static int wpa_driver_nl80211_associate(
8915         void *priv, struct wpa_driver_associate_params *params)
8916 {
8917         struct i802_bss *bss = priv;
8918         struct wpa_driver_nl80211_data *drv = bss->drv;
8919         int ret;
8920         struct nl_msg *msg;
8921
8922         if (params->mode == IEEE80211_MODE_AP)
8923                 return wpa_driver_nl80211_ap(drv, params);
8924
8925         if (params->mode == IEEE80211_MODE_IBSS)
8926                 return wpa_driver_nl80211_ibss(drv, params);
8927
8928         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
8929                 enum nl80211_iftype nlmode = params->p2p ?
8930                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
8931
8932                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
8933                         return -1;
8934                 return wpa_driver_nl80211_connect(drv, params);
8935         }
8936
8937         nl80211_mark_disconnected(drv);
8938
8939         msg = nlmsg_alloc();
8940         if (!msg)
8941                 return -1;
8942
8943         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
8944                    drv->ifindex);
8945         nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
8946
8947         ret = nl80211_connect_common(drv, params, msg);
8948         if (ret)
8949                 goto nla_put_failure;
8950
8951         if (params->prev_bssid) {
8952                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
8953                            MAC2STR(params->prev_bssid));
8954                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
8955                         params->prev_bssid);
8956         }
8957
8958         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8959         msg = NULL;
8960         if (ret) {
8961                 wpa_dbg(drv->ctx, MSG_DEBUG,
8962                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
8963                         ret, strerror(-ret));
8964                 nl80211_dump_scan(drv);
8965                 goto nla_put_failure;
8966         }
8967         ret = 0;
8968         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
8969                    "successfully");
8970
8971 nla_put_failure:
8972         nlmsg_free(msg);
8973         return ret;
8974 }
8975
8976
8977 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
8978                             int ifindex, enum nl80211_iftype mode)
8979 {
8980         struct nl_msg *msg;
8981         int ret = -ENOBUFS;
8982
8983         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
8984                    ifindex, mode, nl80211_iftype_str(mode));
8985
8986         msg = nlmsg_alloc();
8987         if (!msg)
8988                 return -ENOMEM;
8989
8990         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
8991         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
8992                 goto nla_put_failure;
8993         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
8994
8995         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8996         msg = NULL;
8997         if (!ret)
8998                 return 0;
8999 nla_put_failure:
9000         nlmsg_free(msg);
9001         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
9002                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
9003         return ret;
9004 }
9005
9006
9007 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
9008                                        enum nl80211_iftype nlmode)
9009 {
9010         struct wpa_driver_nl80211_data *drv = bss->drv;
9011         int ret = -1;
9012         int i;
9013         int was_ap = is_ap_interface(drv->nlmode);
9014         int res;
9015
9016         res = nl80211_set_mode(drv, drv->ifindex, nlmode);
9017         if (res && nlmode == nl80211_get_ifmode(bss))
9018                 res = 0;
9019
9020         if (res == 0) {
9021                 drv->nlmode = nlmode;
9022                 ret = 0;
9023                 goto done;
9024         }
9025
9026         if (res == -ENODEV)
9027                 return -1;
9028
9029         if (nlmode == drv->nlmode) {
9030                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
9031                            "requested mode - ignore error");
9032                 ret = 0;
9033                 goto done; /* Already in the requested mode */
9034         }
9035
9036         /* mac80211 doesn't allow mode changes while the device is up, so
9037          * take the device down, try to set the mode again, and bring the
9038          * device back up.
9039          */
9040         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
9041                    "interface down");
9042         for (i = 0; i < 10; i++) {
9043                 res = i802_set_iface_flags(bss, 0);
9044                 if (res == -EACCES || res == -ENODEV)
9045                         break;
9046                 if (res == 0) {
9047                         /* Try to set the mode again while the interface is
9048                          * down */
9049                         ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
9050                         if (ret == -EACCES)
9051                                 break;
9052                         res = i802_set_iface_flags(bss, 1);
9053                         if (res && !ret)
9054                                 ret = -1;
9055                         else if (ret != -EBUSY)
9056                                 break;
9057                 } else
9058                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
9059                                    "interface down");
9060                 os_sleep(0, 100000);
9061         }
9062
9063         if (!ret) {
9064                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
9065                            "interface is down");
9066                 drv->nlmode = nlmode;
9067                 drv->ignore_if_down_event = 1;
9068         }
9069
9070 done:
9071         if (ret) {
9072                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
9073                            "from %d failed", nlmode, drv->nlmode);
9074                 return ret;
9075         }
9076
9077         if (is_p2p_net_interface(nlmode))
9078                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
9079         else if (drv->disabled_11b_rates)
9080                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
9081
9082         if (is_ap_interface(nlmode)) {
9083                 nl80211_mgmt_unsubscribe(bss, "start AP");
9084                 /* Setup additional AP mode functionality if needed */
9085                 if (nl80211_setup_ap(bss))
9086                         return -1;
9087         } else if (was_ap) {
9088                 /* Remove additional AP mode functionality */
9089                 nl80211_teardown_ap(bss);
9090         } else {
9091                 nl80211_mgmt_unsubscribe(bss, "mode change");
9092         }
9093
9094         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
9095             nl80211_mgmt_subscribe_non_ap(bss) < 0)
9096                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
9097                            "frame processing - ignore for now");
9098
9099         return 0;
9100 }
9101
9102
9103 static int dfs_info_handler(struct nl_msg *msg, void *arg)
9104 {
9105         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9106         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9107         int *dfs_capability_ptr = arg;
9108
9109         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9110                   genlmsg_attrlen(gnlh, 0), NULL);
9111
9112         if (tb[NL80211_ATTR_VENDOR_DATA]) {
9113                 struct nlattr *nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
9114                 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_MAX + 1];
9115
9116                 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_MAX,
9117                           nla_data(nl_vend), nla_len(nl_vend), NULL);
9118
9119                 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_DFS]) {
9120                         u32 val;
9121                         val = nla_get_u32(tb_vendor[QCA_WLAN_VENDOR_ATTR_DFS]);
9122                         wpa_printf(MSG_DEBUG, "nl80211: DFS offload capability: %u",
9123                                    val);
9124                         *dfs_capability_ptr = val;
9125                 }
9126         }
9127
9128         return NL_SKIP;
9129 }
9130
9131
9132 static int wpa_driver_nl80211_get_capa(void *priv,
9133                                        struct wpa_driver_capa *capa)
9134 {
9135         struct i802_bss *bss = priv;
9136         struct wpa_driver_nl80211_data *drv = bss->drv;
9137         struct nl_msg *msg;
9138         int dfs_capability = 0;
9139         int ret = 0;
9140
9141         if (!drv->has_capability)
9142                 return -1;
9143         os_memcpy(capa, &drv->capa, sizeof(*capa));
9144         if (drv->extended_capa && drv->extended_capa_mask) {
9145                 capa->extended_capa = drv->extended_capa;
9146                 capa->extended_capa_mask = drv->extended_capa_mask;
9147                 capa->extended_capa_len = drv->extended_capa_len;
9148         }
9149
9150         if ((capa->flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
9151             !drv->allow_p2p_device) {
9152                 wpa_printf(MSG_DEBUG, "nl80211: Do not indicate P2P_DEVICE support (p2p_device=1 driver param not specified)");
9153                 capa->flags &= ~WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE;
9154         }
9155
9156         if (drv->dfs_vendor_cmd_avail == 1) {
9157                 msg = nlmsg_alloc();
9158                 if (!msg)
9159                         return -ENOMEM;
9160
9161                 nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
9162
9163                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9164                 NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA);
9165                 NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9166                             QCA_NL80211_VENDOR_SUBCMD_DFS_CAPABILITY);
9167
9168                 ret = send_and_recv_msgs(drv, msg, dfs_info_handler,
9169                                          &dfs_capability);
9170                 if (!ret) {
9171                         if (dfs_capability)
9172                                 capa->flags |= WPA_DRIVER_FLAGS_DFS_OFFLOAD;
9173                 }
9174         }
9175
9176         return ret;
9177
9178  nla_put_failure:
9179         nlmsg_free(msg);
9180         return -ENOBUFS;
9181 }
9182
9183
9184 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
9185 {
9186         struct i802_bss *bss = priv;
9187         struct wpa_driver_nl80211_data *drv = bss->drv;
9188
9189         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
9190                    bss->ifname, drv->operstate, state,
9191                    state ? "UP" : "DORMANT");
9192         drv->operstate = state;
9193         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
9194                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
9195 }
9196
9197
9198 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
9199 {
9200         struct i802_bss *bss = priv;
9201         struct wpa_driver_nl80211_data *drv = bss->drv;
9202         struct nl_msg *msg;
9203         struct nl80211_sta_flag_update upd;
9204         int ret = -ENOBUFS;
9205
9206         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
9207                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
9208                 return 0;
9209         }
9210
9211         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
9212                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
9213
9214         msg = nlmsg_alloc();
9215         if (!msg)
9216                 return -ENOMEM;
9217
9218         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
9219
9220         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
9221                     if_nametoindex(bss->ifname));
9222         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
9223
9224         os_memset(&upd, 0, sizeof(upd));
9225         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
9226         if (authorized)
9227                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
9228         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
9229
9230         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9231         msg = NULL;
9232         if (!ret)
9233                 return 0;
9234  nla_put_failure:
9235         nlmsg_free(msg);
9236         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
9237                    ret, strerror(-ret));
9238         return ret;
9239 }
9240
9241
9242 /* Set kernel driver on given frequency (MHz) */
9243 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
9244 {
9245         struct i802_bss *bss = priv;
9246         return nl80211_set_channel(bss, freq, 0);
9247 }
9248
9249
9250 static inline int min_int(int a, int b)
9251 {
9252         if (a < b)
9253                 return a;
9254         return b;
9255 }
9256
9257
9258 static int get_key_handler(struct nl_msg *msg, void *arg)
9259 {
9260         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9261         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9262
9263         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9264                   genlmsg_attrlen(gnlh, 0), NULL);
9265
9266         /*
9267          * TODO: validate the key index and mac address!
9268          * Otherwise, there's a race condition as soon as
9269          * the kernel starts sending key notifications.
9270          */
9271
9272         if (tb[NL80211_ATTR_KEY_SEQ])
9273                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
9274                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
9275         return NL_SKIP;
9276 }
9277
9278
9279 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
9280                            int idx, u8 *seq)
9281 {
9282         struct i802_bss *bss = priv;
9283         struct wpa_driver_nl80211_data *drv = bss->drv;
9284         struct nl_msg *msg;
9285
9286         msg = nlmsg_alloc();
9287         if (!msg)
9288                 return -ENOMEM;
9289
9290         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
9291
9292         if (addr)
9293                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
9294         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
9295         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
9296
9297         memset(seq, 0, 6);
9298
9299         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
9300  nla_put_failure:
9301         nlmsg_free(msg);
9302         return -ENOBUFS;
9303 }
9304
9305
9306 static int i802_set_rts(void *priv, int rts)
9307 {
9308         struct i802_bss *bss = priv;
9309         struct wpa_driver_nl80211_data *drv = bss->drv;
9310         struct nl_msg *msg;
9311         int ret = -ENOBUFS;
9312         u32 val;
9313
9314         msg = nlmsg_alloc();
9315         if (!msg)
9316                 return -ENOMEM;
9317
9318         if (rts >= 2347)
9319                 val = (u32) -1;
9320         else
9321                 val = rts;
9322
9323         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
9324         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9325         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
9326
9327         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9328         msg = NULL;
9329         if (!ret)
9330                 return 0;
9331 nla_put_failure:
9332         nlmsg_free(msg);
9333         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
9334                    "%d (%s)", rts, ret, strerror(-ret));
9335         return ret;
9336 }
9337
9338
9339 static int i802_set_frag(void *priv, int frag)
9340 {
9341         struct i802_bss *bss = priv;
9342         struct wpa_driver_nl80211_data *drv = bss->drv;
9343         struct nl_msg *msg;
9344         int ret = -ENOBUFS;
9345         u32 val;
9346
9347         msg = nlmsg_alloc();
9348         if (!msg)
9349                 return -ENOMEM;
9350
9351         if (frag >= 2346)
9352                 val = (u32) -1;
9353         else
9354                 val = frag;
9355
9356         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
9357         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9358         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
9359
9360         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9361         msg = NULL;
9362         if (!ret)
9363                 return 0;
9364 nla_put_failure:
9365         nlmsg_free(msg);
9366         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
9367                    "%d: %d (%s)", frag, ret, strerror(-ret));
9368         return ret;
9369 }
9370
9371
9372 static int i802_flush(void *priv)
9373 {
9374         struct i802_bss *bss = priv;
9375         struct wpa_driver_nl80211_data *drv = bss->drv;
9376         struct nl_msg *msg;
9377         int res;
9378
9379         msg = nlmsg_alloc();
9380         if (!msg)
9381                 return -1;
9382
9383         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
9384                    bss->ifname);
9385         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
9386
9387         /*
9388          * XXX: FIX! this needs to flush all VLANs too
9389          */
9390         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
9391                     if_nametoindex(bss->ifname));
9392
9393         res = send_and_recv_msgs(drv, msg, NULL, NULL);
9394         if (res) {
9395                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
9396                            "(%s)", res, strerror(-res));
9397         }
9398         return res;
9399  nla_put_failure:
9400         nlmsg_free(msg);
9401         return -ENOBUFS;
9402 }
9403
9404
9405 static int get_sta_handler(struct nl_msg *msg, void *arg)
9406 {
9407         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9408         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9409         struct hostap_sta_driver_data *data = arg;
9410         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
9411         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
9412                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
9413                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
9414                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
9415                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
9416                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
9417                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
9418         };
9419
9420         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9421                   genlmsg_attrlen(gnlh, 0), NULL);
9422
9423         /*
9424          * TODO: validate the interface and mac address!
9425          * Otherwise, there's a race condition as soon as
9426          * the kernel starts sending station notifications.
9427          */
9428
9429         if (!tb[NL80211_ATTR_STA_INFO]) {
9430                 wpa_printf(MSG_DEBUG, "sta stats missing!");
9431                 return NL_SKIP;
9432         }
9433         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
9434                              tb[NL80211_ATTR_STA_INFO],
9435                              stats_policy)) {
9436                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
9437                 return NL_SKIP;
9438         }
9439
9440         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
9441                 data->inactive_msec =
9442                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
9443         if (stats[NL80211_STA_INFO_RX_BYTES])
9444                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
9445         if (stats[NL80211_STA_INFO_TX_BYTES])
9446                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
9447         if (stats[NL80211_STA_INFO_RX_PACKETS])
9448                 data->rx_packets =
9449                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
9450         if (stats[NL80211_STA_INFO_TX_PACKETS])
9451                 data->tx_packets =
9452                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
9453         if (stats[NL80211_STA_INFO_TX_FAILED])
9454                 data->tx_retry_failed =
9455                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
9456
9457         return NL_SKIP;
9458 }
9459
9460 static int i802_read_sta_data(struct i802_bss *bss,
9461                               struct hostap_sta_driver_data *data,
9462                               const u8 *addr)
9463 {
9464         struct wpa_driver_nl80211_data *drv = bss->drv;
9465         struct nl_msg *msg;
9466
9467         os_memset(data, 0, sizeof(*data));
9468         msg = nlmsg_alloc();
9469         if (!msg)
9470                 return -ENOMEM;
9471
9472         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
9473
9474         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
9475         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
9476
9477         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
9478  nla_put_failure:
9479         nlmsg_free(msg);
9480         return -ENOBUFS;
9481 }
9482
9483
9484 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
9485                                     int cw_min, int cw_max, int burst_time)
9486 {
9487         struct i802_bss *bss = priv;
9488         struct wpa_driver_nl80211_data *drv = bss->drv;
9489         struct nl_msg *msg;
9490         struct nlattr *txq, *params;
9491
9492         msg = nlmsg_alloc();
9493         if (!msg)
9494                 return -1;
9495
9496         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
9497
9498         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
9499
9500         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
9501         if (!txq)
9502                 goto nla_put_failure;
9503
9504         /* We are only sending parameters for a single TXQ at a time */
9505         params = nla_nest_start(msg, 1);
9506         if (!params)
9507                 goto nla_put_failure;
9508
9509         switch (queue) {
9510         case 0:
9511                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
9512                 break;
9513         case 1:
9514                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
9515                 break;
9516         case 2:
9517                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
9518                 break;
9519         case 3:
9520                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
9521                 break;
9522         }
9523         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
9524          * 32 usec, so need to convert the value here. */
9525         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
9526         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
9527         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
9528         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
9529
9530         nla_nest_end(msg, params);
9531
9532         nla_nest_end(msg, txq);
9533
9534         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
9535                 return 0;
9536         msg = NULL;
9537  nla_put_failure:
9538         nlmsg_free(msg);
9539         return -1;
9540 }
9541
9542
9543 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
9544                              const char *ifname, int vlan_id)
9545 {
9546         struct wpa_driver_nl80211_data *drv = bss->drv;
9547         struct nl_msg *msg;
9548         int ret = -ENOBUFS;
9549
9550         msg = nlmsg_alloc();
9551         if (!msg)
9552                 return -ENOMEM;
9553
9554         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
9555                    ", ifname=%s[%d], vlan_id=%d)",
9556                    bss->ifname, if_nametoindex(bss->ifname),
9557                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
9558         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
9559
9560         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
9561                     if_nametoindex(bss->ifname));
9562         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
9563         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
9564                     if_nametoindex(ifname));
9565
9566         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9567         msg = NULL;
9568         if (ret < 0) {
9569                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
9570                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
9571                            MAC2STR(addr), ifname, vlan_id, ret,
9572                            strerror(-ret));
9573         }
9574  nla_put_failure:
9575         nlmsg_free(msg);
9576         return ret;
9577 }
9578
9579
9580 static int i802_get_inact_sec(void *priv, const u8 *addr)
9581 {
9582         struct hostap_sta_driver_data data;
9583         int ret;
9584
9585         data.inactive_msec = (unsigned long) -1;
9586         ret = i802_read_sta_data(priv, &data, addr);
9587         if (ret || data.inactive_msec == (unsigned long) -1)
9588                 return -1;
9589         return data.inactive_msec / 1000;
9590 }
9591
9592
9593 static int i802_sta_clear_stats(void *priv, const u8 *addr)
9594 {
9595 #if 0
9596         /* TODO */
9597 #endif
9598         return 0;
9599 }
9600
9601
9602 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
9603                            int reason)
9604 {
9605         struct i802_bss *bss = priv;
9606         struct wpa_driver_nl80211_data *drv = bss->drv;
9607         struct ieee80211_mgmt mgmt;
9608
9609         if (drv->device_ap_sme)
9610                 return wpa_driver_nl80211_sta_remove(bss, addr);
9611
9612         memset(&mgmt, 0, sizeof(mgmt));
9613         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
9614                                           WLAN_FC_STYPE_DEAUTH);
9615         memcpy(mgmt.da, addr, ETH_ALEN);
9616         memcpy(mgmt.sa, own_addr, ETH_ALEN);
9617         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
9618         mgmt.u.deauth.reason_code = host_to_le16(reason);
9619         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
9620                                             IEEE80211_HDRLEN +
9621                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
9622                                             0);
9623 }
9624
9625
9626 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
9627                              int reason)
9628 {
9629         struct i802_bss *bss = priv;
9630         struct wpa_driver_nl80211_data *drv = bss->drv;
9631         struct ieee80211_mgmt mgmt;
9632
9633         if (drv->device_ap_sme)
9634                 return wpa_driver_nl80211_sta_remove(bss, addr);
9635
9636         memset(&mgmt, 0, sizeof(mgmt));
9637         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
9638                                           WLAN_FC_STYPE_DISASSOC);
9639         memcpy(mgmt.da, addr, ETH_ALEN);
9640         memcpy(mgmt.sa, own_addr, ETH_ALEN);
9641         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
9642         mgmt.u.disassoc.reason_code = host_to_le16(reason);
9643         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
9644                                             IEEE80211_HDRLEN +
9645                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
9646                                             0);
9647 }
9648
9649
9650 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
9651 {
9652         char buf[200], *pos, *end;
9653         int i, res;
9654
9655         pos = buf;
9656         end = pos + sizeof(buf);
9657
9658         for (i = 0; i < drv->num_if_indices; i++) {
9659                 if (!drv->if_indices[i])
9660                         continue;
9661                 res = os_snprintf(pos, end - pos, " %d", drv->if_indices[i]);
9662                 if (res < 0 || res >= end - pos)
9663                         break;
9664                 pos += res;
9665         }
9666         *pos = '\0';
9667
9668         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
9669                    drv->num_if_indices, buf);
9670 }
9671
9672
9673 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9674 {
9675         int i;
9676         int *old;
9677
9678         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
9679                    ifidx);
9680         if (have_ifidx(drv, ifidx)) {
9681                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
9682                            ifidx);
9683                 return;
9684         }
9685         for (i = 0; i < drv->num_if_indices; i++) {
9686                 if (drv->if_indices[i] == 0) {
9687                         drv->if_indices[i] = ifidx;
9688                         dump_ifidx(drv);
9689                         return;
9690                 }
9691         }
9692
9693         if (drv->if_indices != drv->default_if_indices)
9694                 old = drv->if_indices;
9695         else
9696                 old = NULL;
9697
9698         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
9699                                            sizeof(int));
9700         if (!drv->if_indices) {
9701                 if (!old)
9702                         drv->if_indices = drv->default_if_indices;
9703                 else
9704                         drv->if_indices = old;
9705                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
9706                            "interfaces");
9707                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
9708                 return;
9709         } else if (!old)
9710                 os_memcpy(drv->if_indices, drv->default_if_indices,
9711                           sizeof(drv->default_if_indices));
9712         drv->if_indices[drv->num_if_indices] = ifidx;
9713         drv->num_if_indices++;
9714         dump_ifidx(drv);
9715 }
9716
9717
9718 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9719 {
9720         int i;
9721
9722         for (i = 0; i < drv->num_if_indices; i++) {
9723                 if (drv->if_indices[i] == ifidx) {
9724                         drv->if_indices[i] = 0;
9725                         break;
9726                 }
9727         }
9728         dump_ifidx(drv);
9729 }
9730
9731
9732 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9733 {
9734         int i;
9735
9736         for (i = 0; i < drv->num_if_indices; i++)
9737                 if (drv->if_indices[i] == ifidx)
9738                         return 1;
9739
9740         return 0;
9741 }
9742
9743
9744 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
9745                             const char *bridge_ifname, char *ifname_wds)
9746 {
9747         struct i802_bss *bss = priv;
9748         struct wpa_driver_nl80211_data *drv = bss->drv;
9749         char name[IFNAMSIZ + 1];
9750
9751         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
9752         if (ifname_wds)
9753                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
9754
9755         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
9756                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
9757         if (val) {
9758                 if (!if_nametoindex(name)) {
9759                         if (nl80211_create_iface(drv, name,
9760                                                  NL80211_IFTYPE_AP_VLAN,
9761                                                  bss->addr, 1, NULL, NULL, 0) <
9762                             0)
9763                                 return -1;
9764                         if (bridge_ifname &&
9765                             linux_br_add_if(drv->global->ioctl_sock,
9766                                             bridge_ifname, name) < 0)
9767                                 return -1;
9768                 }
9769                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
9770                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
9771                                    "interface %s up", name);
9772                 }
9773                 return i802_set_sta_vlan(priv, addr, name, 0);
9774         } else {
9775                 if (bridge_ifname)
9776                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
9777                                         name);
9778
9779                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
9780                 nl80211_remove_iface(drv, if_nametoindex(name));
9781                 return 0;
9782         }
9783 }
9784
9785
9786 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
9787 {
9788         struct wpa_driver_nl80211_data *drv = eloop_ctx;
9789         struct sockaddr_ll lladdr;
9790         unsigned char buf[3000];
9791         int len;
9792         socklen_t fromlen = sizeof(lladdr);
9793
9794         len = recvfrom(sock, buf, sizeof(buf), 0,
9795                        (struct sockaddr *)&lladdr, &fromlen);
9796         if (len < 0) {
9797                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
9798                            strerror(errno));
9799                 return;
9800         }
9801
9802         if (have_ifidx(drv, lladdr.sll_ifindex))
9803                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
9804 }
9805
9806
9807 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
9808                              struct i802_bss *bss,
9809                              const char *brname, const char *ifname)
9810 {
9811         int ifindex;
9812         char in_br[IFNAMSIZ];
9813
9814         os_strlcpy(bss->brname, brname, IFNAMSIZ);
9815         ifindex = if_nametoindex(brname);
9816         if (ifindex == 0) {
9817                 /*
9818                  * Bridge was configured, but the bridge device does
9819                  * not exist. Try to add it now.
9820                  */
9821                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
9822                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
9823                                    "bridge interface %s: %s",
9824                                    brname, strerror(errno));
9825                         return -1;
9826                 }
9827                 bss->added_bridge = 1;
9828                 add_ifidx(drv, if_nametoindex(brname));
9829         }
9830
9831         if (linux_br_get(in_br, ifname) == 0) {
9832                 if (os_strcmp(in_br, brname) == 0)
9833                         return 0; /* already in the bridge */
9834
9835                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
9836                            "bridge %s", ifname, in_br);
9837                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
9838                     0) {
9839                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
9840                                    "remove interface %s from bridge "
9841                                    "%s: %s",
9842                                    ifname, brname, strerror(errno));
9843                         return -1;
9844                 }
9845         }
9846
9847         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
9848                    ifname, brname);
9849         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
9850                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
9851                            "into bridge %s: %s",
9852                            ifname, brname, strerror(errno));
9853                 return -1;
9854         }
9855         bss->added_if_into_bridge = 1;
9856
9857         return 0;
9858 }
9859
9860
9861 static void *i802_init(struct hostapd_data *hapd,
9862                        struct wpa_init_params *params)
9863 {
9864         struct wpa_driver_nl80211_data *drv;
9865         struct i802_bss *bss;
9866         size_t i;
9867         char brname[IFNAMSIZ];
9868         int ifindex, br_ifindex;
9869         int br_added = 0;
9870
9871         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
9872                                           params->global_priv, 1,
9873                                           params->bssid);
9874         if (bss == NULL)
9875                 return NULL;
9876
9877         drv = bss->drv;
9878
9879         if (linux_br_get(brname, params->ifname) == 0) {
9880                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
9881                            params->ifname, brname);
9882                 br_ifindex = if_nametoindex(brname);
9883         } else {
9884                 brname[0] = '\0';
9885                 br_ifindex = 0;
9886         }
9887
9888         for (i = 0; i < params->num_bridge; i++) {
9889                 if (params->bridge[i]) {
9890                         ifindex = if_nametoindex(params->bridge[i]);
9891                         if (ifindex)
9892                                 add_ifidx(drv, ifindex);
9893                         if (ifindex == br_ifindex)
9894                                 br_added = 1;
9895                 }
9896         }
9897         if (!br_added && br_ifindex &&
9898             (params->num_bridge == 0 || !params->bridge[0]))
9899                 add_ifidx(drv, br_ifindex);
9900
9901         /* start listening for EAPOL on the default AP interface */
9902         add_ifidx(drv, drv->ifindex);
9903
9904         if (params->num_bridge && params->bridge[0] &&
9905             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
9906                 goto failed;
9907
9908         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
9909         if (drv->eapol_sock < 0) {
9910                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
9911                            strerror(errno));
9912                 goto failed;
9913         }
9914
9915         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
9916         {
9917                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
9918                 goto failed;
9919         }
9920
9921         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
9922                                params->own_addr))
9923                 goto failed;
9924
9925         memcpy(bss->addr, params->own_addr, ETH_ALEN);
9926
9927         return bss;
9928
9929 failed:
9930         wpa_driver_nl80211_deinit(bss);
9931         return NULL;
9932 }
9933
9934
9935 static void i802_deinit(void *priv)
9936 {
9937         struct i802_bss *bss = priv;
9938         wpa_driver_nl80211_deinit(bss);
9939 }
9940
9941
9942 static enum nl80211_iftype wpa_driver_nl80211_if_type(
9943         enum wpa_driver_if_type type)
9944 {
9945         switch (type) {
9946         case WPA_IF_STATION:
9947                 return NL80211_IFTYPE_STATION;
9948         case WPA_IF_P2P_CLIENT:
9949         case WPA_IF_P2P_GROUP:
9950                 return NL80211_IFTYPE_P2P_CLIENT;
9951         case WPA_IF_AP_VLAN:
9952                 return NL80211_IFTYPE_AP_VLAN;
9953         case WPA_IF_AP_BSS:
9954                 return NL80211_IFTYPE_AP;
9955         case WPA_IF_P2P_GO:
9956                 return NL80211_IFTYPE_P2P_GO;
9957         case WPA_IF_P2P_DEVICE:
9958                 return NL80211_IFTYPE_P2P_DEVICE;
9959         }
9960         return -1;
9961 }
9962
9963
9964 #ifdef CONFIG_P2P
9965
9966 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
9967 {
9968         struct wpa_driver_nl80211_data *drv;
9969         dl_list_for_each(drv, &global->interfaces,
9970                          struct wpa_driver_nl80211_data, list) {
9971                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
9972                         return 1;
9973         }
9974         return 0;
9975 }
9976
9977
9978 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
9979                                       u8 *new_addr)
9980 {
9981         unsigned int idx;
9982
9983         if (!drv->global)
9984                 return -1;
9985
9986         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
9987         for (idx = 0; idx < 64; idx++) {
9988                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
9989                 new_addr[0] ^= idx << 2;
9990                 if (!nl80211_addr_in_use(drv->global, new_addr))
9991                         break;
9992         }
9993         if (idx == 64)
9994                 return -1;
9995
9996         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
9997                    MACSTR, MAC2STR(new_addr));
9998
9999         return 0;
10000 }
10001
10002 #endif /* CONFIG_P2P */
10003
10004
10005 struct wdev_info {
10006         u64 wdev_id;
10007         int wdev_id_set;
10008         u8 macaddr[ETH_ALEN];
10009 };
10010
10011 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
10012 {
10013         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10014         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10015         struct wdev_info *wi = arg;
10016
10017         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10018                   genlmsg_attrlen(gnlh, 0), NULL);
10019         if (tb[NL80211_ATTR_WDEV]) {
10020                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
10021                 wi->wdev_id_set = 1;
10022         }
10023
10024         if (tb[NL80211_ATTR_MAC])
10025                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
10026                           ETH_ALEN);
10027
10028         return NL_SKIP;
10029 }
10030
10031
10032 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
10033                                      const char *ifname, const u8 *addr,
10034                                      void *bss_ctx, void **drv_priv,
10035                                      char *force_ifname, u8 *if_addr,
10036                                      const char *bridge, int use_existing)
10037 {
10038         enum nl80211_iftype nlmode;
10039         struct i802_bss *bss = priv;
10040         struct wpa_driver_nl80211_data *drv = bss->drv;
10041         int ifidx;
10042         int added = 1;
10043
10044         if (addr)
10045                 os_memcpy(if_addr, addr, ETH_ALEN);
10046         nlmode = wpa_driver_nl80211_if_type(type);
10047         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
10048                 struct wdev_info p2pdev_info;
10049
10050                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
10051                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
10052                                              0, nl80211_wdev_handler,
10053                                              &p2pdev_info, use_existing);
10054                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
10055                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
10056                                    ifname);
10057                         return -1;
10058                 }
10059
10060                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
10061                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
10062                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
10063                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
10064                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
10065                            ifname,
10066                            (long long unsigned int) p2pdev_info.wdev_id);
10067         } else {
10068                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
10069                                              0, NULL, NULL, use_existing);
10070                 if (use_existing && ifidx == -ENFILE) {
10071                         added = 0;
10072                         ifidx = if_nametoindex(ifname);
10073                 } else if (ifidx < 0) {
10074                         return -1;
10075                 }
10076         }
10077
10078         if (!addr) {
10079                 if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
10080                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
10081                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
10082                                             bss->ifname, if_addr) < 0) {
10083                         if (added)
10084                                 nl80211_remove_iface(drv, ifidx);
10085                         return -1;
10086                 }
10087         }
10088
10089 #ifdef CONFIG_P2P
10090         if (!addr &&
10091             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
10092              type == WPA_IF_P2P_GO)) {
10093                 /* Enforce unique P2P Interface Address */
10094                 u8 new_addr[ETH_ALEN];
10095
10096                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
10097                                        new_addr) < 0) {
10098                         nl80211_remove_iface(drv, ifidx);
10099                         return -1;
10100                 }
10101                 if (nl80211_addr_in_use(drv->global, new_addr)) {
10102                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
10103                                    "for P2P group interface");
10104                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
10105                                 nl80211_remove_iface(drv, ifidx);
10106                                 return -1;
10107                         }
10108                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
10109                                                new_addr) < 0) {
10110                                 nl80211_remove_iface(drv, ifidx);
10111                                 return -1;
10112                         }
10113                 }
10114                 os_memcpy(if_addr, new_addr, ETH_ALEN);
10115         }
10116 #endif /* CONFIG_P2P */
10117
10118         if (type == WPA_IF_AP_BSS) {
10119                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
10120                 if (new_bss == NULL) {
10121                         if (added)
10122                                 nl80211_remove_iface(drv, ifidx);
10123                         return -1;
10124                 }
10125
10126                 if (bridge &&
10127                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
10128                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
10129                                    "interface %s to a bridge %s",
10130                                    ifname, bridge);
10131                         if (added)
10132                                 nl80211_remove_iface(drv, ifidx);
10133                         os_free(new_bss);
10134                         return -1;
10135                 }
10136
10137                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
10138                 {
10139                         nl80211_remove_iface(drv, ifidx);
10140                         os_free(new_bss);
10141                         return -1;
10142                 }
10143                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
10144                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
10145                 new_bss->ifindex = ifidx;
10146                 new_bss->drv = drv;
10147                 new_bss->next = drv->first_bss->next;
10148                 new_bss->freq = drv->first_bss->freq;
10149                 new_bss->ctx = bss_ctx;
10150                 new_bss->added_if = added;
10151                 drv->first_bss->next = new_bss;
10152                 if (drv_priv)
10153                         *drv_priv = new_bss;
10154                 nl80211_init_bss(new_bss);
10155
10156                 /* Subscribe management frames for this WPA_IF_AP_BSS */
10157                 if (nl80211_setup_ap(new_bss))
10158                         return -1;
10159         }
10160
10161         if (drv->global)
10162                 drv->global->if_add_ifindex = ifidx;
10163
10164         if (ifidx > 0)
10165                 add_ifidx(drv, ifidx);
10166
10167         return 0;
10168 }
10169
10170
10171 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
10172                                         enum wpa_driver_if_type type,
10173                                         const char *ifname)
10174 {
10175         struct wpa_driver_nl80211_data *drv = bss->drv;
10176         int ifindex = if_nametoindex(ifname);
10177
10178         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
10179                    __func__, type, ifname, ifindex, bss->added_if);
10180         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
10181                 nl80211_remove_iface(drv, ifindex);
10182         else if (ifindex > 0 && !bss->added_if)
10183                 del_ifidx(drv, ifindex);
10184
10185         if (type != WPA_IF_AP_BSS)
10186                 return 0;
10187
10188         if (bss->added_if_into_bridge) {
10189                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
10190                                     bss->ifname) < 0)
10191                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
10192                                    "interface %s from bridge %s: %s",
10193                                    bss->ifname, bss->brname, strerror(errno));
10194         }
10195         if (bss->added_bridge) {
10196                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
10197                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
10198                                    "bridge %s: %s",
10199                                    bss->brname, strerror(errno));
10200         }
10201
10202         if (bss != drv->first_bss) {
10203                 struct i802_bss *tbss;
10204
10205                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
10206                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
10207                         if (tbss->next == bss) {
10208                                 tbss->next = bss->next;
10209                                 /* Unsubscribe management frames */
10210                                 nl80211_teardown_ap(bss);
10211                                 nl80211_destroy_bss(bss);
10212                                 if (!bss->added_if)
10213                                         i802_set_iface_flags(bss, 0);
10214                                 os_free(bss);
10215                                 bss = NULL;
10216                                 break;
10217                         }
10218                 }
10219                 if (bss)
10220                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
10221                                    "BSS %p in the list", __func__, bss);
10222         } else {
10223                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
10224                 nl80211_teardown_ap(bss);
10225                 if (!bss->added_if && !drv->first_bss->next)
10226                         wpa_driver_nl80211_del_beacon(drv);
10227                 nl80211_destroy_bss(bss);
10228                 if (!bss->added_if)
10229                         i802_set_iface_flags(bss, 0);
10230                 if (drv->first_bss->next) {
10231                         drv->first_bss = drv->first_bss->next;
10232                         drv->ctx = drv->first_bss->ctx;
10233                         os_free(bss);
10234                 } else {
10235                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
10236                 }
10237         }
10238
10239         return 0;
10240 }
10241
10242
10243 static int cookie_handler(struct nl_msg *msg, void *arg)
10244 {
10245         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10246         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10247         u64 *cookie = arg;
10248         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10249                   genlmsg_attrlen(gnlh, 0), NULL);
10250         if (tb[NL80211_ATTR_COOKIE])
10251                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
10252         return NL_SKIP;
10253 }
10254
10255
10256 static int nl80211_send_frame_cmd(struct i802_bss *bss,
10257                                   unsigned int freq, unsigned int wait,
10258                                   const u8 *buf, size_t buf_len,
10259                                   u64 *cookie_out, int no_cck, int no_ack,
10260                                   int offchanok)
10261 {
10262         struct wpa_driver_nl80211_data *drv = bss->drv;
10263         struct nl_msg *msg;
10264         u64 cookie;
10265         int ret = -1;
10266
10267         msg = nlmsg_alloc();
10268         if (!msg)
10269                 return -1;
10270
10271         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
10272                    "no_ack=%d offchanok=%d",
10273                    freq, wait, no_cck, no_ack, offchanok);
10274         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
10275         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
10276
10277         if (nl80211_set_iface_id(msg, bss) < 0)
10278                 goto nla_put_failure;
10279         if (freq)
10280                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
10281         if (wait)
10282                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
10283         if (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
10284                           drv->test_use_roc_tx))
10285                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
10286         if (no_cck)
10287                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
10288         if (no_ack)
10289                 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
10290
10291         NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
10292
10293         cookie = 0;
10294         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
10295         msg = NULL;
10296         if (ret) {
10297                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
10298                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
10299                            freq, wait);
10300                 goto nla_put_failure;
10301         }
10302         wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
10303                    "cookie 0x%llx", no_ack ? " (no ACK)" : "",
10304                    (long long unsigned int) cookie);
10305
10306         if (cookie_out)
10307                 *cookie_out = no_ack ? (u64) -1 : cookie;
10308
10309 nla_put_failure:
10310         nlmsg_free(msg);
10311         return ret;
10312 }
10313
10314
10315 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
10316                                           unsigned int freq,
10317                                           unsigned int wait_time,
10318                                           const u8 *dst, const u8 *src,
10319                                           const u8 *bssid,
10320                                           const u8 *data, size_t data_len,
10321                                           int no_cck)
10322 {
10323         struct wpa_driver_nl80211_data *drv = bss->drv;
10324         int ret = -1;
10325         u8 *buf;
10326         struct ieee80211_hdr *hdr;
10327
10328         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
10329                    "freq=%u MHz wait=%d ms no_cck=%d)",
10330                    drv->ifindex, freq, wait_time, no_cck);
10331
10332         buf = os_zalloc(24 + data_len);
10333         if (buf == NULL)
10334                 return ret;
10335         os_memcpy(buf + 24, data, data_len);
10336         hdr = (struct ieee80211_hdr *) buf;
10337         hdr->frame_control =
10338                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
10339         os_memcpy(hdr->addr1, dst, ETH_ALEN);
10340         os_memcpy(hdr->addr2, src, ETH_ALEN);
10341         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
10342
10343         if (is_ap_interface(drv->nlmode) &&
10344             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
10345              (int) freq == bss->freq || drv->device_ap_sme ||
10346              !drv->use_monitor))
10347                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
10348                                                    0, freq, no_cck, 1,
10349                                                    wait_time);
10350         else
10351                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
10352                                              24 + data_len,
10353                                              &drv->send_action_cookie,
10354                                              no_cck, 0, 1);
10355
10356         os_free(buf);
10357         return ret;
10358 }
10359
10360
10361 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
10362 {
10363         struct i802_bss *bss = priv;
10364         struct wpa_driver_nl80211_data *drv = bss->drv;
10365         struct nl_msg *msg;
10366         int ret;
10367
10368         msg = nlmsg_alloc();
10369         if (!msg)
10370                 return;
10371
10372         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
10373                    (long long unsigned int) drv->send_action_cookie);
10374         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
10375
10376         if (nl80211_set_iface_id(msg, bss) < 0)
10377                 goto nla_put_failure;
10378         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
10379
10380         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10381         msg = NULL;
10382         if (ret)
10383                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
10384                            "(%s)", ret, strerror(-ret));
10385
10386  nla_put_failure:
10387         nlmsg_free(msg);
10388 }
10389
10390
10391 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
10392                                                 unsigned int duration)
10393 {
10394         struct i802_bss *bss = priv;
10395         struct wpa_driver_nl80211_data *drv = bss->drv;
10396         struct nl_msg *msg;
10397         int ret;
10398         u64 cookie;
10399
10400         msg = nlmsg_alloc();
10401         if (!msg)
10402                 return -1;
10403
10404         nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
10405
10406         if (nl80211_set_iface_id(msg, bss) < 0)
10407                 goto nla_put_failure;
10408
10409         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
10410         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
10411
10412         cookie = 0;
10413         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
10414         msg = NULL;
10415         if (ret == 0) {
10416                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
10417                            "0x%llx for freq=%u MHz duration=%u",
10418                            (long long unsigned int) cookie, freq, duration);
10419                 drv->remain_on_chan_cookie = cookie;
10420                 drv->pending_remain_on_chan = 1;
10421                 return 0;
10422         }
10423         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
10424                    "(freq=%d duration=%u): %d (%s)",
10425                    freq, duration, ret, strerror(-ret));
10426 nla_put_failure:
10427         nlmsg_free(msg);
10428         return -1;
10429 }
10430
10431
10432 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
10433 {
10434         struct i802_bss *bss = priv;
10435         struct wpa_driver_nl80211_data *drv = bss->drv;
10436         struct nl_msg *msg;
10437         int ret;
10438
10439         if (!drv->pending_remain_on_chan) {
10440                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
10441                            "to cancel");
10442                 return -1;
10443         }
10444
10445         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
10446                    "0x%llx",
10447                    (long long unsigned int) drv->remain_on_chan_cookie);
10448
10449         msg = nlmsg_alloc();
10450         if (!msg)
10451                 return -1;
10452
10453         nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
10454
10455         if (nl80211_set_iface_id(msg, bss) < 0)
10456                 goto nla_put_failure;
10457
10458         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
10459
10460         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10461         msg = NULL;
10462         if (ret == 0)
10463                 return 0;
10464         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
10465                    "%d (%s)", ret, strerror(-ret));
10466 nla_put_failure:
10467         nlmsg_free(msg);
10468         return -1;
10469 }
10470
10471
10472 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
10473 {
10474         struct wpa_driver_nl80211_data *drv = bss->drv;
10475
10476         if (!report) {
10477                 if (bss->nl_preq && drv->device_ap_sme &&
10478                     is_ap_interface(drv->nlmode)) {
10479                         /*
10480                          * Do not disable Probe Request reporting that was
10481                          * enabled in nl80211_setup_ap().
10482                          */
10483                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
10484                                    "Probe Request reporting nl_preq=%p while "
10485                                    "in AP mode", bss->nl_preq);
10486                 } else if (bss->nl_preq) {
10487                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
10488                                    "reporting nl_preq=%p", bss->nl_preq);
10489                         nl80211_destroy_eloop_handle(&bss->nl_preq);
10490                 }
10491                 return 0;
10492         }
10493
10494         if (bss->nl_preq) {
10495                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
10496                            "already on! nl_preq=%p", bss->nl_preq);
10497                 return 0;
10498         }
10499
10500         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
10501         if (bss->nl_preq == NULL)
10502                 return -1;
10503         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
10504                    "reporting nl_preq=%p", bss->nl_preq);
10505
10506         if (nl80211_register_frame(bss, bss->nl_preq,
10507                                    (WLAN_FC_TYPE_MGMT << 2) |
10508                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
10509                                    NULL, 0) < 0)
10510                 goto out_err;
10511
10512         nl80211_register_eloop_read(&bss->nl_preq,
10513                                     wpa_driver_nl80211_event_receive,
10514                                     bss->nl_cb);
10515
10516         return 0;
10517
10518  out_err:
10519         nl_destroy_handles(&bss->nl_preq);
10520         return -1;
10521 }
10522
10523
10524 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
10525                                      int ifindex, int disabled)
10526 {
10527         struct nl_msg *msg;
10528         struct nlattr *bands, *band;
10529         int ret;
10530
10531         msg = nlmsg_alloc();
10532         if (!msg)
10533                 return -1;
10534
10535         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
10536         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
10537
10538         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
10539         if (!bands)
10540                 goto nla_put_failure;
10541
10542         /*
10543          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
10544          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
10545          * rates. All 5 GHz rates are left enabled.
10546          */
10547         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
10548         if (!band)
10549                 goto nla_put_failure;
10550         if (disabled) {
10551                 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
10552                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
10553         }
10554         nla_nest_end(msg, band);
10555
10556         nla_nest_end(msg, bands);
10557
10558         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10559         msg = NULL;
10560         if (ret) {
10561                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
10562                            "(%s)", ret, strerror(-ret));
10563         } else
10564                 drv->disabled_11b_rates = disabled;
10565
10566         return ret;
10567
10568 nla_put_failure:
10569         nlmsg_free(msg);
10570         return -1;
10571 }
10572
10573
10574 static int wpa_driver_nl80211_deinit_ap(void *priv)
10575 {
10576         struct i802_bss *bss = priv;
10577         struct wpa_driver_nl80211_data *drv = bss->drv;
10578         if (!is_ap_interface(drv->nlmode))
10579                 return -1;
10580         wpa_driver_nl80211_del_beacon(drv);
10581
10582         /*
10583          * If the P2P GO interface was dynamically added, then it is
10584          * possible that the interface change to station is not possible.
10585          */
10586         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
10587                 return 0;
10588
10589         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
10590 }
10591
10592
10593 static int wpa_driver_nl80211_stop_ap(void *priv)
10594 {
10595         struct i802_bss *bss = priv;
10596         struct wpa_driver_nl80211_data *drv = bss->drv;
10597         if (!is_ap_interface(drv->nlmode))
10598                 return -1;
10599         wpa_driver_nl80211_del_beacon(drv);
10600         bss->beacon_set = 0;
10601         return 0;
10602 }
10603
10604
10605 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
10606 {
10607         struct i802_bss *bss = priv;
10608         struct wpa_driver_nl80211_data *drv = bss->drv;
10609         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
10610                 return -1;
10611
10612         /*
10613          * If the P2P Client interface was dynamically added, then it is
10614          * possible that the interface change to station is not possible.
10615          */
10616         if (bss->if_dynamic)
10617                 return 0;
10618
10619         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
10620 }
10621
10622
10623 static void wpa_driver_nl80211_resume(void *priv)
10624 {
10625         struct i802_bss *bss = priv;
10626
10627         if (i802_set_iface_flags(bss, 1))
10628                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
10629 }
10630
10631
10632 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
10633                                   const u8 *ies, size_t ies_len)
10634 {
10635         struct i802_bss *bss = priv;
10636         struct wpa_driver_nl80211_data *drv = bss->drv;
10637         int ret;
10638         u8 *data, *pos;
10639         size_t data_len;
10640         const u8 *own_addr = bss->addr;
10641
10642         if (action != 1) {
10643                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
10644                            "action %d", action);
10645                 return -1;
10646         }
10647
10648         /*
10649          * Action frame payload:
10650          * Category[1] = 6 (Fast BSS Transition)
10651          * Action[1] = 1 (Fast BSS Transition Request)
10652          * STA Address
10653          * Target AP Address
10654          * FT IEs
10655          */
10656
10657         data_len = 2 + 2 * ETH_ALEN + ies_len;
10658         data = os_malloc(data_len);
10659         if (data == NULL)
10660                 return -1;
10661         pos = data;
10662         *pos++ = 0x06; /* FT Action category */
10663         *pos++ = action;
10664         os_memcpy(pos, own_addr, ETH_ALEN);
10665         pos += ETH_ALEN;
10666         os_memcpy(pos, target_ap, ETH_ALEN);
10667         pos += ETH_ALEN;
10668         os_memcpy(pos, ies, ies_len);
10669
10670         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
10671                                              drv->bssid, own_addr, drv->bssid,
10672                                              data, data_len, 0);
10673         os_free(data);
10674
10675         return ret;
10676 }
10677
10678
10679 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
10680 {
10681         struct i802_bss *bss = priv;
10682         struct wpa_driver_nl80211_data *drv = bss->drv;
10683         struct nl_msg *msg;
10684         struct nlattr *cqm;
10685         int ret = -1;
10686
10687         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
10688                    "hysteresis=%d", threshold, hysteresis);
10689
10690         msg = nlmsg_alloc();
10691         if (!msg)
10692                 return -1;
10693
10694         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
10695
10696         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
10697
10698         cqm = nla_nest_start(msg, NL80211_ATTR_CQM);
10699         if (cqm == NULL)
10700                 goto nla_put_failure;
10701
10702         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
10703         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
10704         nla_nest_end(msg, cqm);
10705
10706         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10707         msg = NULL;
10708
10709 nla_put_failure:
10710         nlmsg_free(msg);
10711         return ret;
10712 }
10713
10714
10715 static int get_channel_width(struct nl_msg *msg, void *arg)
10716 {
10717         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10718         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10719         struct wpa_signal_info *sig_change = arg;
10720
10721         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10722                   genlmsg_attrlen(gnlh, 0), NULL);
10723
10724         sig_change->center_frq1 = -1;
10725         sig_change->center_frq2 = -1;
10726         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
10727
10728         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
10729                 sig_change->chanwidth = convert2width(
10730                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
10731                 if (tb[NL80211_ATTR_CENTER_FREQ1])
10732                         sig_change->center_frq1 =
10733                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
10734                 if (tb[NL80211_ATTR_CENTER_FREQ2])
10735                         sig_change->center_frq2 =
10736                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
10737         }
10738
10739         return NL_SKIP;
10740 }
10741
10742
10743 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
10744                                      struct wpa_signal_info *sig)
10745 {
10746         struct nl_msg *msg;
10747
10748         msg = nlmsg_alloc();
10749         if (!msg)
10750                 return -ENOMEM;
10751
10752         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_INTERFACE);
10753         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
10754
10755         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
10756
10757 nla_put_failure:
10758         nlmsg_free(msg);
10759         return -ENOBUFS;
10760 }
10761
10762
10763 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
10764 {
10765         struct i802_bss *bss = priv;
10766         struct wpa_driver_nl80211_data *drv = bss->drv;
10767         int res;
10768
10769         os_memset(si, 0, sizeof(*si));
10770         res = nl80211_get_link_signal(drv, si);
10771         if (res != 0)
10772                 return res;
10773
10774         res = nl80211_get_channel_width(drv, si);
10775         if (res != 0)
10776                 return res;
10777
10778         return nl80211_get_link_noise(drv, si);
10779 }
10780
10781
10782 static int wpa_driver_nl80211_shared_freq(void *priv)
10783 {
10784         struct i802_bss *bss = priv;
10785         struct wpa_driver_nl80211_data *drv = bss->drv;
10786         struct wpa_driver_nl80211_data *driver;
10787         int freq = 0;
10788
10789         /*
10790          * If the same PHY is in connected state with some other interface,
10791          * then retrieve the assoc freq.
10792          */
10793         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
10794                    drv->phyname);
10795
10796         dl_list_for_each(driver, &drv->global->interfaces,
10797                          struct wpa_driver_nl80211_data, list) {
10798                 if (drv == driver ||
10799                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
10800                     !driver->associated)
10801                         continue;
10802
10803                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
10804                            MACSTR,
10805                            driver->phyname, driver->first_bss->ifname,
10806                            MAC2STR(driver->first_bss->addr));
10807                 if (is_ap_interface(driver->nlmode))
10808                         freq = driver->first_bss->freq;
10809                 else
10810                         freq = nl80211_get_assoc_freq(driver);
10811                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
10812                            drv->phyname, freq);
10813         }
10814
10815         if (!freq)
10816                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
10817                            "PHY (%s) in associated state", drv->phyname);
10818
10819         return freq;
10820 }
10821
10822
10823 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
10824                               int encrypt)
10825 {
10826         struct i802_bss *bss = priv;
10827         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
10828                                              0, 0, 0, 0);
10829 }
10830
10831
10832 static int nl80211_set_param(void *priv, const char *param)
10833 {
10834         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
10835         if (param == NULL)
10836                 return 0;
10837
10838 #ifdef CONFIG_P2P
10839         if (os_strstr(param, "use_p2p_group_interface=1")) {
10840                 struct i802_bss *bss = priv;
10841                 struct wpa_driver_nl80211_data *drv = bss->drv;
10842
10843                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
10844                            "interface");
10845                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
10846                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
10847         }
10848
10849         if (os_strstr(param, "p2p_device=1")) {
10850                 struct i802_bss *bss = priv;
10851                 struct wpa_driver_nl80211_data *drv = bss->drv;
10852                 drv->allow_p2p_device = 1;
10853         }
10854 #endif /* CONFIG_P2P */
10855
10856         if (os_strstr(param, "use_monitor=1")) {
10857                 struct i802_bss *bss = priv;
10858                 struct wpa_driver_nl80211_data *drv = bss->drv;
10859                 drv->use_monitor = 1;
10860         }
10861
10862         if (os_strstr(param, "force_connect_cmd=1")) {
10863                 struct i802_bss *bss = priv;
10864                 struct wpa_driver_nl80211_data *drv = bss->drv;
10865                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
10866         }
10867
10868         if (os_strstr(param, "no_offchannel_tx=1")) {
10869                 struct i802_bss *bss = priv;
10870                 struct wpa_driver_nl80211_data *drv = bss->drv;
10871                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
10872                 drv->test_use_roc_tx = 1;
10873         }
10874
10875         return 0;
10876 }
10877
10878
10879 static void * nl80211_global_init(void)
10880 {
10881         struct nl80211_global *global;
10882         struct netlink_config *cfg;
10883
10884         global = os_zalloc(sizeof(*global));
10885         if (global == NULL)
10886                 return NULL;
10887         global->ioctl_sock = -1;
10888         dl_list_init(&global->interfaces);
10889         global->if_add_ifindex = -1;
10890
10891         cfg = os_zalloc(sizeof(*cfg));
10892         if (cfg == NULL)
10893                 goto err;
10894
10895         cfg->ctx = global;
10896         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
10897         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
10898         global->netlink = netlink_init(cfg);
10899         if (global->netlink == NULL) {
10900                 os_free(cfg);
10901                 goto err;
10902         }
10903
10904         if (wpa_driver_nl80211_init_nl_global(global) < 0)
10905                 goto err;
10906
10907         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
10908         if (global->ioctl_sock < 0) {
10909                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
10910                            strerror(errno));
10911                 goto err;
10912         }
10913
10914         return global;
10915
10916 err:
10917         nl80211_global_deinit(global);
10918         return NULL;
10919 }
10920
10921
10922 static void nl80211_global_deinit(void *priv)
10923 {
10924         struct nl80211_global *global = priv;
10925         if (global == NULL)
10926                 return;
10927         if (!dl_list_empty(&global->interfaces)) {
10928                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
10929                            "nl80211_global_deinit",
10930                            dl_list_len(&global->interfaces));
10931         }
10932
10933         if (global->netlink)
10934                 netlink_deinit(global->netlink);
10935
10936         nl_destroy_handles(&global->nl);
10937
10938         if (global->nl_event)
10939                 nl80211_destroy_eloop_handle(&global->nl_event);
10940
10941         nl_cb_put(global->nl_cb);
10942
10943         if (global->ioctl_sock >= 0)
10944                 close(global->ioctl_sock);
10945
10946         os_free(global);
10947 }
10948
10949
10950 static const char * nl80211_get_radio_name(void *priv)
10951 {
10952         struct i802_bss *bss = priv;
10953         struct wpa_driver_nl80211_data *drv = bss->drv;
10954         return drv->phyname;
10955 }
10956
10957
10958 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
10959                          const u8 *pmkid)
10960 {
10961         struct nl_msg *msg;
10962
10963         msg = nlmsg_alloc();
10964         if (!msg)
10965                 return -ENOMEM;
10966
10967         nl80211_cmd(bss->drv, msg, 0, cmd);
10968
10969         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
10970         if (pmkid)
10971                 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
10972         if (bssid)
10973                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
10974
10975         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
10976  nla_put_failure:
10977         nlmsg_free(msg);
10978         return -ENOBUFS;
10979 }
10980
10981
10982 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
10983 {
10984         struct i802_bss *bss = priv;
10985         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
10986         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
10987 }
10988
10989
10990 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
10991 {
10992         struct i802_bss *bss = priv;
10993         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
10994                    MAC2STR(bssid));
10995         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
10996 }
10997
10998
10999 static int nl80211_flush_pmkid(void *priv)
11000 {
11001         struct i802_bss *bss = priv;
11002         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
11003         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
11004 }
11005
11006
11007 static void clean_survey_results(struct survey_results *survey_results)
11008 {
11009         struct freq_survey *survey, *tmp;
11010
11011         if (dl_list_empty(&survey_results->survey_list))
11012                 return;
11013
11014         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
11015                               struct freq_survey, list) {
11016                 dl_list_del(&survey->list);
11017                 os_free(survey);
11018         }
11019 }
11020
11021
11022 static void add_survey(struct nlattr **sinfo, u32 ifidx,
11023                        struct dl_list *survey_list)
11024 {
11025         struct freq_survey *survey;
11026
11027         survey = os_zalloc(sizeof(struct freq_survey));
11028         if  (!survey)
11029                 return;
11030
11031         survey->ifidx = ifidx;
11032         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
11033         survey->filled = 0;
11034
11035         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
11036                 survey->nf = (int8_t)
11037                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
11038                 survey->filled |= SURVEY_HAS_NF;
11039         }
11040
11041         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
11042                 survey->channel_time =
11043                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
11044                 survey->filled |= SURVEY_HAS_CHAN_TIME;
11045         }
11046
11047         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
11048                 survey->channel_time_busy =
11049                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
11050                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
11051         }
11052
11053         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
11054                 survey->channel_time_rx =
11055                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
11056                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
11057         }
11058
11059         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
11060                 survey->channel_time_tx =
11061                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
11062                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
11063         }
11064
11065         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
11066                    survey->freq,
11067                    survey->nf,
11068                    (unsigned long int) survey->channel_time,
11069                    (unsigned long int) survey->channel_time_busy,
11070                    (unsigned long int) survey->channel_time_tx,
11071                    (unsigned long int) survey->channel_time_rx,
11072                    survey->filled);
11073
11074         dl_list_add_tail(survey_list, &survey->list);
11075 }
11076
11077
11078 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
11079                            unsigned int freq_filter)
11080 {
11081         if (!freq_filter)
11082                 return 1;
11083
11084         return freq_filter == surveyed_freq;
11085 }
11086
11087
11088 static int survey_handler(struct nl_msg *msg, void *arg)
11089 {
11090         struct nlattr *tb[NL80211_ATTR_MAX + 1];
11091         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
11092         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
11093         struct survey_results *survey_results;
11094         u32 surveyed_freq = 0;
11095         u32 ifidx;
11096
11097         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
11098                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
11099                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
11100         };
11101
11102         survey_results = (struct survey_results *) arg;
11103
11104         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
11105                   genlmsg_attrlen(gnlh, 0), NULL);
11106
11107         if (!tb[NL80211_ATTR_IFINDEX])
11108                 return NL_SKIP;
11109
11110         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
11111
11112         if (!tb[NL80211_ATTR_SURVEY_INFO])
11113                 return NL_SKIP;
11114
11115         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
11116                              tb[NL80211_ATTR_SURVEY_INFO],
11117                              survey_policy))
11118                 return NL_SKIP;
11119
11120         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
11121                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
11122                 return NL_SKIP;
11123         }
11124
11125         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
11126
11127         if (!check_survey_ok(sinfo, surveyed_freq,
11128                              survey_results->freq_filter))
11129                 return NL_SKIP;
11130
11131         if (survey_results->freq_filter &&
11132             survey_results->freq_filter != surveyed_freq) {
11133                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
11134                            surveyed_freq);
11135                 return NL_SKIP;
11136         }
11137
11138         add_survey(sinfo, ifidx, &survey_results->survey_list);
11139
11140         return NL_SKIP;
11141 }
11142
11143
11144 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
11145 {
11146         struct i802_bss *bss = priv;
11147         struct wpa_driver_nl80211_data *drv = bss->drv;
11148         struct nl_msg *msg;
11149         int err = -ENOBUFS;
11150         union wpa_event_data data;
11151         struct survey_results *survey_results;
11152
11153         os_memset(&data, 0, sizeof(data));
11154         survey_results = &data.survey_results;
11155
11156         dl_list_init(&survey_results->survey_list);
11157
11158         msg = nlmsg_alloc();
11159         if (!msg)
11160                 goto nla_put_failure;
11161
11162         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
11163
11164         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11165
11166         if (freq)
11167                 data.survey_results.freq_filter = freq;
11168
11169         do {
11170                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
11171                 err = send_and_recv_msgs(drv, msg, survey_handler,
11172                                          survey_results);
11173         } while (err > 0);
11174
11175         if (err) {
11176                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
11177                 goto out_clean;
11178         }
11179
11180         wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
11181
11182 out_clean:
11183         clean_survey_results(survey_results);
11184 nla_put_failure:
11185         return err;
11186 }
11187
11188
11189 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
11190                                    const u8 *replay_ctr)
11191 {
11192         struct i802_bss *bss = priv;
11193         struct wpa_driver_nl80211_data *drv = bss->drv;
11194         struct nlattr *replay_nested;
11195         struct nl_msg *msg;
11196
11197         msg = nlmsg_alloc();
11198         if (!msg)
11199                 return;
11200
11201         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11202
11203         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
11204
11205         replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11206         if (!replay_nested)
11207                 goto nla_put_failure;
11208
11209         NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
11210         NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
11211         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
11212                 replay_ctr);
11213
11214         nla_nest_end(msg, replay_nested);
11215
11216         send_and_recv_msgs(drv, msg, NULL, NULL);
11217         return;
11218  nla_put_failure:
11219         nlmsg_free(msg);
11220 }
11221
11222
11223 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
11224                                     const u8 *addr, int qos)
11225 {
11226         /* send data frame to poll STA and check whether
11227          * this frame is ACKed */
11228         struct {
11229                 struct ieee80211_hdr hdr;
11230                 u16 qos_ctl;
11231         } STRUCT_PACKED nulldata;
11232         size_t size;
11233
11234         /* Send data frame to poll STA and check whether this frame is ACKed */
11235
11236         os_memset(&nulldata, 0, sizeof(nulldata));
11237
11238         if (qos) {
11239                 nulldata.hdr.frame_control =
11240                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
11241                                      WLAN_FC_STYPE_QOS_NULL);
11242                 size = sizeof(nulldata);
11243         } else {
11244                 nulldata.hdr.frame_control =
11245                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
11246                                      WLAN_FC_STYPE_NULLFUNC);
11247                 size = sizeof(struct ieee80211_hdr);
11248         }
11249
11250         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
11251         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
11252         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
11253         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
11254
11255         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
11256                                          0, 0) < 0)
11257                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
11258                            "send poll frame");
11259 }
11260
11261 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
11262                                 int qos)
11263 {
11264         struct i802_bss *bss = priv;
11265         struct wpa_driver_nl80211_data *drv = bss->drv;
11266         struct nl_msg *msg;
11267
11268         if (!drv->poll_command_supported) {
11269                 nl80211_send_null_frame(bss, own_addr, addr, qos);
11270                 return;
11271         }
11272
11273         msg = nlmsg_alloc();
11274         if (!msg)
11275                 return;
11276
11277         nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
11278
11279         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
11280         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
11281
11282         send_and_recv_msgs(drv, msg, NULL, NULL);
11283         return;
11284  nla_put_failure:
11285         nlmsg_free(msg);
11286 }
11287
11288
11289 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
11290 {
11291         struct nl_msg *msg;
11292
11293         msg = nlmsg_alloc();
11294         if (!msg)
11295                 return -ENOMEM;
11296
11297         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
11298         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
11299         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
11300                     enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
11301         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
11302 nla_put_failure:
11303         nlmsg_free(msg);
11304         return -ENOBUFS;
11305 }
11306
11307
11308 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
11309                                      int ctwindow)
11310 {
11311         struct i802_bss *bss = priv;
11312
11313         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
11314                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
11315
11316         if (opp_ps != -1 || ctwindow != -1) {
11317 #ifdef ANDROID_P2P
11318                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
11319 #else /* ANDROID_P2P */
11320                 return -1; /* Not yet supported */
11321 #endif /* ANDROID_P2P */
11322         }
11323
11324         if (legacy_ps == -1)
11325                 return 0;
11326         if (legacy_ps != 0 && legacy_ps != 1)
11327                 return -1; /* Not yet supported */
11328
11329         return nl80211_set_power_save(bss, legacy_ps);
11330 }
11331
11332
11333 static int nl80211_start_radar_detection(void *priv,
11334                                          struct hostapd_freq_params *freq)
11335 {
11336         struct i802_bss *bss = priv;
11337         struct wpa_driver_nl80211_data *drv = bss->drv;
11338         struct nl_msg *msg;
11339         int ret;
11340
11341         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
11342                    freq->freq, freq->ht_enabled, freq->vht_enabled,
11343                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
11344
11345         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
11346                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
11347                            "detection");
11348                 return -1;
11349         }
11350
11351         msg = nlmsg_alloc();
11352         if (!msg)
11353                 return -1;
11354
11355         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_RADAR_DETECT);
11356         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11357         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
11358
11359         if (freq->vht_enabled) {
11360                 switch (freq->bandwidth) {
11361                 case 20:
11362                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11363                                     NL80211_CHAN_WIDTH_20);
11364                         break;
11365                 case 40:
11366                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11367                                     NL80211_CHAN_WIDTH_40);
11368                         break;
11369                 case 80:
11370                         if (freq->center_freq2)
11371                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11372                                             NL80211_CHAN_WIDTH_80P80);
11373                         else
11374                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11375                                             NL80211_CHAN_WIDTH_80);
11376                         break;
11377                 case 160:
11378                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
11379                                     NL80211_CHAN_WIDTH_160);
11380                         break;
11381                 default:
11382                         return -1;
11383                 }
11384                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
11385                 if (freq->center_freq2)
11386                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
11387                                     freq->center_freq2);
11388         } else if (freq->ht_enabled) {
11389                 switch (freq->sec_channel_offset) {
11390                 case -1:
11391                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11392                                     NL80211_CHAN_HT40MINUS);
11393                         break;
11394                 case 1:
11395                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11396                                     NL80211_CHAN_HT40PLUS);
11397                         break;
11398                 default:
11399                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11400                                     NL80211_CHAN_HT20);
11401                         break;
11402                 }
11403         }
11404
11405         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
11406         if (ret == 0)
11407                 return 0;
11408         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
11409                    "%d (%s)", ret, strerror(-ret));
11410 nla_put_failure:
11411         return -1;
11412 }
11413
11414 #ifdef CONFIG_TDLS
11415
11416 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
11417                                   u8 dialog_token, u16 status_code,
11418                                   u32 peer_capab, const u8 *buf, size_t len)
11419 {
11420         struct i802_bss *bss = priv;
11421         struct wpa_driver_nl80211_data *drv = bss->drv;
11422         struct nl_msg *msg;
11423
11424         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
11425                 return -EOPNOTSUPP;
11426
11427         if (!dst)
11428                 return -EINVAL;
11429
11430         msg = nlmsg_alloc();
11431         if (!msg)
11432                 return -ENOMEM;
11433
11434         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
11435         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11436         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
11437         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
11438         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
11439         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
11440         if (peer_capab) {
11441                 /*
11442                  * The internal enum tdls_peer_capability definition is
11443                  * currently identical with the nl80211 enum
11444                  * nl80211_tdls_peer_capability, so no conversion is needed
11445                  * here.
11446                  */
11447                 NLA_PUT_U32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY, peer_capab);
11448         }
11449         NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
11450
11451         return send_and_recv_msgs(drv, msg, NULL, NULL);
11452
11453 nla_put_failure:
11454         nlmsg_free(msg);
11455         return -ENOBUFS;
11456 }
11457
11458
11459 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
11460 {
11461         struct i802_bss *bss = priv;
11462         struct wpa_driver_nl80211_data *drv = bss->drv;
11463         struct nl_msg *msg;
11464         enum nl80211_tdls_operation nl80211_oper;
11465
11466         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
11467                 return -EOPNOTSUPP;
11468
11469         switch (oper) {
11470         case TDLS_DISCOVERY_REQ:
11471                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
11472                 break;
11473         case TDLS_SETUP:
11474                 nl80211_oper = NL80211_TDLS_SETUP;
11475                 break;
11476         case TDLS_TEARDOWN:
11477                 nl80211_oper = NL80211_TDLS_TEARDOWN;
11478                 break;
11479         case TDLS_ENABLE_LINK:
11480                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
11481                 break;
11482         case TDLS_DISABLE_LINK:
11483                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
11484                 break;
11485         case TDLS_ENABLE:
11486                 return 0;
11487         case TDLS_DISABLE:
11488                 return 0;
11489         default:
11490                 return -EINVAL;
11491         }
11492
11493         msg = nlmsg_alloc();
11494         if (!msg)
11495                 return -ENOMEM;
11496
11497         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
11498         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
11499         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11500         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
11501
11502         return send_and_recv_msgs(drv, msg, NULL, NULL);
11503
11504 nla_put_failure:
11505         nlmsg_free(msg);
11506         return -ENOBUFS;
11507 }
11508
11509 #endif /* CONFIG TDLS */
11510
11511
11512 #ifdef ANDROID
11513
11514 typedef struct android_wifi_priv_cmd {
11515         char *buf;
11516         int used_len;
11517         int total_len;
11518 } android_wifi_priv_cmd;
11519
11520 static int drv_errors = 0;
11521
11522 static void wpa_driver_send_hang_msg(struct wpa_driver_nl80211_data *drv)
11523 {
11524         drv_errors++;
11525         if (drv_errors > DRV_NUMBER_SEQUENTIAL_ERRORS) {
11526                 drv_errors = 0;
11527                 wpa_msg(drv->ctx, MSG_INFO, WPA_EVENT_DRIVER_STATE "HANGED");
11528         }
11529 }
11530
11531
11532 static int android_priv_cmd(struct i802_bss *bss, const char *cmd)
11533 {
11534         struct wpa_driver_nl80211_data *drv = bss->drv;
11535         struct ifreq ifr;
11536         android_wifi_priv_cmd priv_cmd;
11537         char buf[MAX_DRV_CMD_SIZE];
11538         int ret;
11539
11540         os_memset(&ifr, 0, sizeof(ifr));
11541         os_memset(&priv_cmd, 0, sizeof(priv_cmd));
11542         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
11543
11544         os_memset(buf, 0, sizeof(buf));
11545         os_strlcpy(buf, cmd, sizeof(buf));
11546
11547         priv_cmd.buf = buf;
11548         priv_cmd.used_len = sizeof(buf);
11549         priv_cmd.total_len = sizeof(buf);
11550         ifr.ifr_data = &priv_cmd;
11551
11552         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
11553         if (ret < 0) {
11554                 wpa_printf(MSG_ERROR, "%s: failed to issue private commands",
11555                            __func__);
11556                 wpa_driver_send_hang_msg(drv);
11557                 return ret;
11558         }
11559
11560         drv_errors = 0;
11561         return 0;
11562 }
11563
11564
11565 static int android_pno_start(struct i802_bss *bss,
11566                              struct wpa_driver_scan_params *params)
11567 {
11568         struct wpa_driver_nl80211_data *drv = bss->drv;
11569         struct ifreq ifr;
11570         android_wifi_priv_cmd priv_cmd;
11571         int ret = 0, i = 0, bp;
11572         char buf[WEXT_PNO_MAX_COMMAND_SIZE];
11573
11574         bp = WEXT_PNOSETUP_HEADER_SIZE;
11575         os_memcpy(buf, WEXT_PNOSETUP_HEADER, bp);
11576         buf[bp++] = WEXT_PNO_TLV_PREFIX;
11577         buf[bp++] = WEXT_PNO_TLV_VERSION;
11578         buf[bp++] = WEXT_PNO_TLV_SUBVERSION;
11579         buf[bp++] = WEXT_PNO_TLV_RESERVED;
11580
11581         while (i < WEXT_PNO_AMOUNT && (size_t) i < params->num_ssids) {
11582                 /* Check that there is enough space needed for 1 more SSID, the
11583                  * other sections and null termination */
11584                 if ((bp + WEXT_PNO_SSID_HEADER_SIZE + MAX_SSID_LEN +
11585                      WEXT_PNO_NONSSID_SECTIONS_SIZE + 1) >= (int) sizeof(buf))
11586                         break;
11587                 wpa_hexdump_ascii(MSG_DEBUG, "For PNO Scan",
11588                                   params->ssids[i].ssid,
11589                                   params->ssids[i].ssid_len);
11590                 buf[bp++] = WEXT_PNO_SSID_SECTION;
11591                 buf[bp++] = params->ssids[i].ssid_len;
11592                 os_memcpy(&buf[bp], params->ssids[i].ssid,
11593                           params->ssids[i].ssid_len);
11594                 bp += params->ssids[i].ssid_len;
11595                 i++;
11596         }
11597
11598         buf[bp++] = WEXT_PNO_SCAN_INTERVAL_SECTION;
11599         os_snprintf(&buf[bp], WEXT_PNO_SCAN_INTERVAL_LENGTH + 1, "%x",
11600                     WEXT_PNO_SCAN_INTERVAL);
11601         bp += WEXT_PNO_SCAN_INTERVAL_LENGTH;
11602
11603         buf[bp++] = WEXT_PNO_REPEAT_SECTION;
11604         os_snprintf(&buf[bp], WEXT_PNO_REPEAT_LENGTH + 1, "%x",
11605                     WEXT_PNO_REPEAT);
11606         bp += WEXT_PNO_REPEAT_LENGTH;
11607
11608         buf[bp++] = WEXT_PNO_MAX_REPEAT_SECTION;
11609         os_snprintf(&buf[bp], WEXT_PNO_MAX_REPEAT_LENGTH + 1, "%x",
11610                     WEXT_PNO_MAX_REPEAT);
11611         bp += WEXT_PNO_MAX_REPEAT_LENGTH + 1;
11612
11613         memset(&ifr, 0, sizeof(ifr));
11614         memset(&priv_cmd, 0, sizeof(priv_cmd));
11615         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
11616
11617         priv_cmd.buf = buf;
11618         priv_cmd.used_len = bp;
11619         priv_cmd.total_len = bp;
11620         ifr.ifr_data = &priv_cmd;
11621
11622         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
11623
11624         if (ret < 0) {
11625                 wpa_printf(MSG_ERROR, "ioctl[SIOCSIWPRIV] (pnosetup): %d",
11626                            ret);
11627                 wpa_driver_send_hang_msg(drv);
11628                 return ret;
11629         }
11630
11631         drv_errors = 0;
11632
11633         return android_priv_cmd(bss, "PNOFORCE 1");
11634 }
11635
11636
11637 static int android_pno_stop(struct i802_bss *bss)
11638 {
11639         return android_priv_cmd(bss, "PNOFORCE 0");
11640 }
11641
11642 #endif /* ANDROID */
11643
11644
11645 static int driver_nl80211_set_key(const char *ifname, void *priv,
11646                                   enum wpa_alg alg, const u8 *addr,
11647                                   int key_idx, int set_tx,
11648                                   const u8 *seq, size_t seq_len,
11649                                   const u8 *key, size_t key_len)
11650 {
11651         struct i802_bss *bss = priv;
11652         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
11653                                           set_tx, seq, seq_len, key, key_len);
11654 }
11655
11656
11657 static int driver_nl80211_scan2(void *priv,
11658                                 struct wpa_driver_scan_params *params)
11659 {
11660         struct i802_bss *bss = priv;
11661         return wpa_driver_nl80211_scan(bss, params);
11662 }
11663
11664
11665 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
11666                                          int reason_code)
11667 {
11668         struct i802_bss *bss = priv;
11669         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
11670 }
11671
11672
11673 static int driver_nl80211_authenticate(void *priv,
11674                                        struct wpa_driver_auth_params *params)
11675 {
11676         struct i802_bss *bss = priv;
11677         return wpa_driver_nl80211_authenticate(bss, params);
11678 }
11679
11680
11681 static void driver_nl80211_deinit(void *priv)
11682 {
11683         struct i802_bss *bss = priv;
11684         wpa_driver_nl80211_deinit(bss);
11685 }
11686
11687
11688 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
11689                                     const char *ifname)
11690 {
11691         struct i802_bss *bss = priv;
11692         return wpa_driver_nl80211_if_remove(bss, type, ifname);
11693 }
11694
11695
11696 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
11697                                     size_t data_len, int noack)
11698 {
11699         struct i802_bss *bss = priv;
11700         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
11701                                             0, 0, 0, 0);
11702 }
11703
11704
11705 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
11706 {
11707         struct i802_bss *bss = priv;
11708         return wpa_driver_nl80211_sta_remove(bss, addr);
11709 }
11710
11711
11712 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
11713                                        const char *ifname, int vlan_id)
11714 {
11715         struct i802_bss *bss = priv;
11716         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
11717 }
11718
11719
11720 static int driver_nl80211_read_sta_data(void *priv,
11721                                         struct hostap_sta_driver_data *data,
11722                                         const u8 *addr)
11723 {
11724         struct i802_bss *bss = priv;
11725         return i802_read_sta_data(bss, data, addr);
11726 }
11727
11728
11729 static int driver_nl80211_send_action(void *priv, unsigned int freq,
11730                                       unsigned int wait_time,
11731                                       const u8 *dst, const u8 *src,
11732                                       const u8 *bssid,
11733                                       const u8 *data, size_t data_len,
11734                                       int no_cck)
11735 {
11736         struct i802_bss *bss = priv;
11737         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
11738                                               bssid, data, data_len, no_cck);
11739 }
11740
11741
11742 static int driver_nl80211_probe_req_report(void *priv, int report)
11743 {
11744         struct i802_bss *bss = priv;
11745         return wpa_driver_nl80211_probe_req_report(bss, report);
11746 }
11747
11748
11749 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
11750                                             const u8 *ies, size_t ies_len)
11751 {
11752         int ret;
11753         struct nl_msg *msg;
11754         struct i802_bss *bss = priv;
11755         struct wpa_driver_nl80211_data *drv = bss->drv;
11756         u16 mdid = WPA_GET_LE16(md);
11757
11758         msg = nlmsg_alloc();
11759         if (!msg)
11760                 return -ENOMEM;
11761
11762         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
11763         nl80211_cmd(drv, msg, 0, NL80211_CMD_UPDATE_FT_IES);
11764         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11765         NLA_PUT(msg, NL80211_ATTR_IE, ies_len, ies);
11766         NLA_PUT_U16(msg, NL80211_ATTR_MDID, mdid);
11767
11768         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
11769         if (ret) {
11770                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
11771                            "err=%d (%s)", ret, strerror(-ret));
11772         }
11773
11774         return ret;
11775
11776 nla_put_failure:
11777         nlmsg_free(msg);
11778         return -ENOBUFS;
11779 }
11780
11781
11782 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
11783 {
11784         struct i802_bss *bss = priv;
11785         struct wpa_driver_nl80211_data *drv = bss->drv;
11786
11787         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
11788                 return NULL;
11789
11790         return bss->addr;
11791 }
11792
11793
11794 static const char * scan_state_str(enum scan_states scan_state)
11795 {
11796         switch (scan_state) {
11797         case NO_SCAN:
11798                 return "NO_SCAN";
11799         case SCAN_REQUESTED:
11800                 return "SCAN_REQUESTED";
11801         case SCAN_STARTED:
11802                 return "SCAN_STARTED";
11803         case SCAN_COMPLETED:
11804                 return "SCAN_COMPLETED";
11805         case SCAN_ABORTED:
11806                 return "SCAN_ABORTED";
11807         case SCHED_SCAN_STARTED:
11808                 return "SCHED_SCAN_STARTED";
11809         case SCHED_SCAN_STOPPED:
11810                 return "SCHED_SCAN_STOPPED";
11811         case SCHED_SCAN_RESULTS:
11812                 return "SCHED_SCAN_RESULTS";
11813         }
11814
11815         return "??";
11816 }
11817
11818
11819 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
11820 {
11821         struct i802_bss *bss = priv;
11822         struct wpa_driver_nl80211_data *drv = bss->drv;
11823         int res;
11824         char *pos, *end;
11825
11826         pos = buf;
11827         end = buf + buflen;
11828
11829         res = os_snprintf(pos, end - pos,
11830                           "ifindex=%d\n"
11831                           "ifname=%s\n"
11832                           "brname=%s\n"
11833                           "addr=" MACSTR "\n"
11834                           "freq=%d\n"
11835                           "%s%s%s%s%s",
11836                           bss->ifindex,
11837                           bss->ifname,
11838                           bss->brname,
11839                           MAC2STR(bss->addr),
11840                           bss->freq,
11841                           bss->beacon_set ? "beacon_set=1\n" : "",
11842                           bss->added_if_into_bridge ?
11843                           "added_if_into_bridge=1\n" : "",
11844                           bss->added_bridge ? "added_bridge=1\n" : "",
11845                           bss->in_deinit ? "in_deinit=1\n" : "",
11846                           bss->if_dynamic ? "if_dynamic=1\n" : "");
11847         if (res < 0 || res >= end - pos)
11848                 return pos - buf;
11849         pos += res;
11850
11851         if (bss->wdev_id_set) {
11852                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
11853                                   (unsigned long long) bss->wdev_id);
11854                 if (res < 0 || res >= end - pos)
11855                         return pos - buf;
11856                 pos += res;
11857         }
11858
11859         res = os_snprintf(pos, end - pos,
11860                           "phyname=%s\n"
11861                           "drv_ifindex=%d\n"
11862                           "operstate=%d\n"
11863                           "scan_state=%s\n"
11864                           "auth_bssid=" MACSTR "\n"
11865                           "auth_attempt_bssid=" MACSTR "\n"
11866                           "bssid=" MACSTR "\n"
11867                           "prev_bssid=" MACSTR "\n"
11868                           "associated=%d\n"
11869                           "assoc_freq=%u\n"
11870                           "monitor_sock=%d\n"
11871                           "monitor_ifidx=%d\n"
11872                           "monitor_refcount=%d\n"
11873                           "last_mgmt_freq=%u\n"
11874                           "eapol_tx_sock=%d\n"
11875                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
11876                           drv->phyname,
11877                           drv->ifindex,
11878                           drv->operstate,
11879                           scan_state_str(drv->scan_state),
11880                           MAC2STR(drv->auth_bssid),
11881                           MAC2STR(drv->auth_attempt_bssid),
11882                           MAC2STR(drv->bssid),
11883                           MAC2STR(drv->prev_bssid),
11884                           drv->associated,
11885                           drv->assoc_freq,
11886                           drv->monitor_sock,
11887                           drv->monitor_ifidx,
11888                           drv->monitor_refcount,
11889                           drv->last_mgmt_freq,
11890                           drv->eapol_tx_sock,
11891                           drv->ignore_if_down_event ?
11892                           "ignore_if_down_event=1\n" : "",
11893                           drv->scan_complete_events ?
11894                           "scan_complete_events=1\n" : "",
11895                           drv->disabled_11b_rates ?
11896                           "disabled_11b_rates=1\n" : "",
11897                           drv->pending_remain_on_chan ?
11898                           "pending_remain_on_chan=1\n" : "",
11899                           drv->in_interface_list ? "in_interface_list=1\n" : "",
11900                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
11901                           drv->poll_command_supported ?
11902                           "poll_command_supported=1\n" : "",
11903                           drv->data_tx_status ? "data_tx_status=1\n" : "",
11904                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
11905                           drv->retry_auth ? "retry_auth=1\n" : "",
11906                           drv->use_monitor ? "use_monitor=1\n" : "",
11907                           drv->ignore_next_local_disconnect ?
11908                           "ignore_next_local_disconnect=1\n" : "",
11909                           drv->ignore_next_local_deauth ?
11910                           "ignore_next_local_deauth=1\n" : "",
11911                           drv->allow_p2p_device ? "allow_p2p_device=1\n" : "");
11912         if (res < 0 || res >= end - pos)
11913                 return pos - buf;
11914         pos += res;
11915
11916         if (drv->has_capability) {
11917                 res = os_snprintf(pos, end - pos,
11918                                   "capa.key_mgmt=0x%x\n"
11919                                   "capa.enc=0x%x\n"
11920                                   "capa.auth=0x%x\n"
11921                                   "capa.flags=0x%x\n"
11922                                   "capa.max_scan_ssids=%d\n"
11923                                   "capa.max_sched_scan_ssids=%d\n"
11924                                   "capa.sched_scan_supported=%d\n"
11925                                   "capa.max_match_sets=%d\n"
11926                                   "capa.max_remain_on_chan=%u\n"
11927                                   "capa.max_stations=%u\n"
11928                                   "capa.probe_resp_offloads=0x%x\n"
11929                                   "capa.max_acl_mac_addrs=%u\n"
11930                                   "capa.num_multichan_concurrent=%u\n",
11931                                   drv->capa.key_mgmt,
11932                                   drv->capa.enc,
11933                                   drv->capa.auth,
11934                                   drv->capa.flags,
11935                                   drv->capa.max_scan_ssids,
11936                                   drv->capa.max_sched_scan_ssids,
11937                                   drv->capa.sched_scan_supported,
11938                                   drv->capa.max_match_sets,
11939                                   drv->capa.max_remain_on_chan,
11940                                   drv->capa.max_stations,
11941                                   drv->capa.probe_resp_offloads,
11942                                   drv->capa.max_acl_mac_addrs,
11943                                   drv->capa.num_multichan_concurrent);
11944                 if (res < 0 || res >= end - pos)
11945                         return pos - buf;
11946                 pos += res;
11947         }
11948
11949         return pos - buf;
11950 }
11951
11952
11953 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
11954 {
11955         if (settings->head)
11956                 NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD,
11957                         settings->head_len, settings->head);
11958
11959         if (settings->tail)
11960                 NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL,
11961                         settings->tail_len, settings->tail);
11962
11963         if (settings->beacon_ies)
11964                 NLA_PUT(msg, NL80211_ATTR_IE,
11965                         settings->beacon_ies_len, settings->beacon_ies);
11966
11967         if (settings->proberesp_ies)
11968                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
11969                         settings->proberesp_ies_len, settings->proberesp_ies);
11970
11971         if (settings->assocresp_ies)
11972                 NLA_PUT(msg,
11973                         NL80211_ATTR_IE_ASSOC_RESP,
11974                         settings->assocresp_ies_len, settings->assocresp_ies);
11975
11976         if (settings->probe_resp)
11977                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP,
11978                         settings->probe_resp_len, settings->probe_resp);
11979
11980         return 0;
11981
11982 nla_put_failure:
11983         return -ENOBUFS;
11984 }
11985
11986
11987 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
11988 {
11989         struct nl_msg *msg;
11990         struct i802_bss *bss = priv;
11991         struct wpa_driver_nl80211_data *drv = bss->drv;
11992         struct nlattr *beacon_csa;
11993         int ret = -ENOBUFS;
11994
11995         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
11996                    settings->cs_count, settings->block_tx,
11997                    settings->freq_params.freq, settings->freq_params.bandwidth,
11998                    settings->freq_params.center_freq1,
11999                    settings->freq_params.center_freq2);
12000
12001         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
12002                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
12003                 return -EOPNOTSUPP;
12004         }
12005
12006         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
12007             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
12008                 return -EOPNOTSUPP;
12009
12010         /* check settings validity */
12011         if (!settings->beacon_csa.tail ||
12012             ((settings->beacon_csa.tail_len <=
12013               settings->counter_offset_beacon) ||
12014              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
12015               settings->cs_count)))
12016                 return -EINVAL;
12017
12018         if (settings->beacon_csa.probe_resp &&
12019             ((settings->beacon_csa.probe_resp_len <=
12020               settings->counter_offset_presp) ||
12021              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
12022               settings->cs_count)))
12023                 return -EINVAL;
12024
12025         msg = nlmsg_alloc();
12026         if (!msg)
12027                 return -ENOMEM;
12028
12029         nl80211_cmd(drv, msg, 0, NL80211_CMD_CHANNEL_SWITCH);
12030         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
12031         NLA_PUT_U32(msg, NL80211_ATTR_CH_SWITCH_COUNT, settings->cs_count);
12032         ret = nl80211_put_freq_params(msg, &settings->freq_params);
12033         if (ret)
12034                 goto error;
12035
12036         if (settings->block_tx)
12037                 NLA_PUT_FLAG(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX);
12038
12039         /* beacon_after params */
12040         ret = set_beacon_data(msg, &settings->beacon_after);
12041         if (ret)
12042                 goto error;
12043
12044         /* beacon_csa params */
12045         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
12046         if (!beacon_csa)
12047                 goto nla_put_failure;
12048
12049         ret = set_beacon_data(msg, &settings->beacon_csa);
12050         if (ret)
12051                 goto error;
12052
12053         NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
12054                     settings->counter_offset_beacon);
12055
12056         if (settings->beacon_csa.probe_resp)
12057                 NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
12058                             settings->counter_offset_presp);
12059
12060         nla_nest_end(msg, beacon_csa);
12061         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
12062         if (ret) {
12063                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
12064                            ret, strerror(-ret));
12065         }
12066         return ret;
12067
12068 nla_put_failure:
12069         ret = -ENOBUFS;
12070 error:
12071         nlmsg_free(msg);
12072         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
12073         return ret;
12074 }
12075
12076
12077 #ifdef CONFIG_TESTING_OPTIONS
12078 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
12079 {
12080         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
12081         struct wpabuf *buf = arg;
12082
12083         if (!buf)
12084                 return NL_SKIP;
12085
12086         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
12087                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
12088                 return NL_SKIP;
12089         }
12090
12091         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
12092                         genlmsg_attrlen(gnlh, 0));
12093
12094         return NL_SKIP;
12095 }
12096 #endif /* CONFIG_TESTING_OPTIONS */
12097
12098
12099 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
12100 {
12101         struct nlattr *tb[NL80211_ATTR_MAX + 1];
12102         struct nlattr *nl_vendor_reply, *nl;
12103         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
12104         struct wpabuf *buf = arg;
12105         int rem;
12106
12107         if (!buf)
12108                 return NL_SKIP;
12109
12110         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
12111                   genlmsg_attrlen(gnlh, 0), NULL);
12112         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
12113
12114         if (!nl_vendor_reply)
12115                 return NL_SKIP;
12116
12117         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
12118                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
12119                 return NL_SKIP;
12120         }
12121
12122         nla_for_each_nested(nl, nl_vendor_reply, rem) {
12123                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
12124         }
12125
12126         return NL_SKIP;
12127 }
12128
12129
12130 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
12131                               unsigned int subcmd, const u8 *data,
12132                               size_t data_len, struct wpabuf *buf)
12133 {
12134         struct i802_bss *bss = priv;
12135         struct wpa_driver_nl80211_data *drv = bss->drv;
12136         struct nl_msg *msg;
12137         int ret;
12138
12139         msg = nlmsg_alloc();
12140         if (!msg)
12141                 return -ENOMEM;
12142
12143 #ifdef CONFIG_TESTING_OPTIONS
12144         if (vendor_id == 0xffffffff) {
12145                 nl80211_cmd(drv, msg, 0, subcmd);
12146                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
12147                     0)
12148                         goto nla_put_failure;
12149                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
12150                 if (ret)
12151                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
12152                                    ret);
12153                 return ret;
12154         }
12155 #endif /* CONFIG_TESTING_OPTIONS */
12156
12157         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
12158         if (nl80211_set_iface_id(msg, bss) < 0)
12159                 goto nla_put_failure;
12160         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, vendor_id);
12161         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd);
12162         if (data)
12163                 NLA_PUT(msg, NL80211_ATTR_VENDOR_DATA, data_len, data);
12164
12165         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
12166         if (ret)
12167                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
12168                            ret);
12169         return ret;
12170
12171 nla_put_failure:
12172         nlmsg_free(msg);
12173         return -ENOBUFS;
12174 }
12175
12176
12177 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
12178                                u8 qos_map_set_len)
12179 {
12180         struct i802_bss *bss = priv;
12181         struct wpa_driver_nl80211_data *drv = bss->drv;
12182         struct nl_msg *msg;
12183         int ret;
12184
12185         msg = nlmsg_alloc();
12186         if (!msg)
12187                 return -ENOMEM;
12188
12189         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
12190                     qos_map_set, qos_map_set_len);
12191
12192         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_QOS_MAP);
12193         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
12194         NLA_PUT(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set);
12195
12196         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
12197         if (ret)
12198                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
12199
12200         return ret;
12201
12202 nla_put_failure:
12203         nlmsg_free(msg);
12204         return -ENOBUFS;
12205 }
12206
12207
12208 static int nl80211_set_wowlan(void *priv,
12209                               const struct wowlan_triggers *triggers)
12210 {
12211         struct i802_bss *bss = priv;
12212         struct wpa_driver_nl80211_data *drv = bss->drv;
12213         struct nl_msg *msg;
12214         struct nlattr *wowlan_triggers;
12215         int ret;
12216
12217         msg = nlmsg_alloc();
12218         if (!msg)
12219                 return -ENOMEM;
12220
12221         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
12222
12223         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WOWLAN);
12224         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
12225
12226         wowlan_triggers = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12227         if (!wowlan_triggers)
12228                 goto nla_put_failure;
12229
12230         if (triggers->any)
12231                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
12232         if (triggers->disconnect)
12233                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
12234         if (triggers->magic_pkt)
12235                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
12236         if (triggers->gtk_rekey_failure)
12237                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
12238         if (triggers->eap_identity_req)
12239                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
12240         if (triggers->four_way_handshake)
12241                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
12242         if (triggers->rfkill_release)
12243                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
12244
12245         nla_nest_end(msg, wowlan_triggers);
12246
12247         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
12248         if (ret)
12249                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
12250
12251         return ret;
12252
12253 nla_put_failure:
12254         nlmsg_free(msg);
12255         return -ENOBUFS;
12256 }
12257
12258
12259 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
12260         .name = "nl80211",
12261         .desc = "Linux nl80211/cfg80211",
12262         .get_bssid = wpa_driver_nl80211_get_bssid,
12263         .get_ssid = wpa_driver_nl80211_get_ssid,
12264         .set_key = driver_nl80211_set_key,
12265         .scan2 = driver_nl80211_scan2,
12266         .sched_scan = wpa_driver_nl80211_sched_scan,
12267         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
12268         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
12269         .deauthenticate = driver_nl80211_deauthenticate,
12270         .authenticate = driver_nl80211_authenticate,
12271         .associate = wpa_driver_nl80211_associate,
12272         .global_init = nl80211_global_init,
12273         .global_deinit = nl80211_global_deinit,
12274         .init2 = wpa_driver_nl80211_init,
12275         .deinit = driver_nl80211_deinit,
12276         .get_capa = wpa_driver_nl80211_get_capa,
12277         .set_operstate = wpa_driver_nl80211_set_operstate,
12278         .set_supp_port = wpa_driver_nl80211_set_supp_port,
12279         .set_country = wpa_driver_nl80211_set_country,
12280         .get_country = wpa_driver_nl80211_get_country,
12281         .set_ap = wpa_driver_nl80211_set_ap,
12282         .set_acl = wpa_driver_nl80211_set_acl,
12283         .if_add = wpa_driver_nl80211_if_add,
12284         .if_remove = driver_nl80211_if_remove,
12285         .send_mlme = driver_nl80211_send_mlme,
12286         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
12287         .sta_add = wpa_driver_nl80211_sta_add,
12288         .sta_remove = driver_nl80211_sta_remove,
12289         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
12290         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
12291         .hapd_init = i802_init,
12292         .hapd_deinit = i802_deinit,
12293         .set_wds_sta = i802_set_wds_sta,
12294         .get_seqnum = i802_get_seqnum,
12295         .flush = i802_flush,
12296         .get_inact_sec = i802_get_inact_sec,
12297         .sta_clear_stats = i802_sta_clear_stats,
12298         .set_rts = i802_set_rts,
12299         .set_frag = i802_set_frag,
12300         .set_tx_queue_params = i802_set_tx_queue_params,
12301         .set_sta_vlan = driver_nl80211_set_sta_vlan,
12302         .sta_deauth = i802_sta_deauth,
12303         .sta_disassoc = i802_sta_disassoc,
12304         .read_sta_data = driver_nl80211_read_sta_data,
12305         .set_freq = i802_set_freq,
12306         .send_action = driver_nl80211_send_action,
12307         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
12308         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
12309         .cancel_remain_on_channel =
12310         wpa_driver_nl80211_cancel_remain_on_channel,
12311         .probe_req_report = driver_nl80211_probe_req_report,
12312         .deinit_ap = wpa_driver_nl80211_deinit_ap,
12313         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
12314         .resume = wpa_driver_nl80211_resume,
12315         .send_ft_action = nl80211_send_ft_action,
12316         .signal_monitor = nl80211_signal_monitor,
12317         .signal_poll = nl80211_signal_poll,
12318         .send_frame = nl80211_send_frame,
12319         .shared_freq = wpa_driver_nl80211_shared_freq,
12320         .set_param = nl80211_set_param,
12321         .get_radio_name = nl80211_get_radio_name,
12322         .add_pmkid = nl80211_add_pmkid,
12323         .remove_pmkid = nl80211_remove_pmkid,
12324         .flush_pmkid = nl80211_flush_pmkid,
12325         .set_rekey_info = nl80211_set_rekey_info,
12326         .poll_client = nl80211_poll_client,
12327         .set_p2p_powersave = nl80211_set_p2p_powersave,
12328         .start_dfs_cac = nl80211_start_radar_detection,
12329         .stop_ap = wpa_driver_nl80211_stop_ap,
12330 #ifdef CONFIG_TDLS
12331         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
12332         .tdls_oper = nl80211_tdls_oper,
12333 #endif /* CONFIG_TDLS */
12334         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
12335         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
12336         .get_survey = wpa_driver_nl80211_get_survey,
12337         .status = wpa_driver_nl80211_status,
12338         .switch_channel = nl80211_switch_channel,
12339 #ifdef ANDROID_P2P
12340         .set_noa = wpa_driver_set_p2p_noa,
12341         .get_noa = wpa_driver_get_p2p_noa,
12342         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
12343 #endif /* ANDROID_P2P */
12344 #ifdef ANDROID
12345         .driver_cmd = wpa_driver_nl80211_driver_cmd,
12346 #endif /* ANDROID */
12347         .vendor_cmd = nl80211_vendor_cmd,
12348         .set_qos_map = nl80211_set_qos_map,
12349         .set_wowlan = nl80211_set_wowlan,
12350 };