src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/ioctl.h>
  15 #include <sys/types.h>
  16 #include <sys/stat.h>
  17 #include <fcntl.h>
  18 #include <net/if.h>
  19 #include <netlink/genl/genl.h>
  20 #include <netlink/genl/family.h>
  21 #include <netlink/genl/ctrl.h>
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/filter.h>
  25 #include <linux/errqueue.h>
  26 #include "nl80211_copy.h"
  27
  28 #include "common.h"
  29 #include "eloop.h"
  30 #include "utils/list.h"
  31 #include "common/ieee802_11_defs.h"
  32 #include "common/ieee802_11_common.h"
  33 #include "l2_packet/l2_packet.h"
  34 #include "netlink.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver.h"
  40
  41 #ifndef SO_WIFI_STATUS
  42 # if defined(__sparc__)
  43 #  define SO_WIFI_STATUS        0x0025
  44 # elif defined(__parisc__)
  45 #  define SO_WIFI_STATUS        0x4022
  46 # else
  47 #  define SO_WIFI_STATUS        41
  48 # endif
  49
  50 # define SCM_WIFI_STATUS        SO_WIFI_STATUS
  51 #endif
  52
  53 #ifndef SO_EE_ORIGIN_TXSTATUS
  54 #define SO_EE_ORIGIN_TXSTATUS   4
  55 #endif
  56
  57 #ifndef PACKET_TX_TIMESTAMP
  58 #define PACKET_TX_TIMESTAMP     16
  59 #endif
  60
  61 #ifdef ANDROID
  62 #include "android_drv.h"
  63
  64 /* system/core/libnl_2 in AOSP does not include nla_put_u32() */
  65 int nla_put_u32(struct nl_msg *msg, int attrtype, uint32_t value)
  66 {
  67         return nla_put(msg, attrtype, sizeof(uint32_t), &value);
  68 }
  69 #endif /* ANDROID */
  70 #ifdef CONFIG_LIBNL20
  71 /* libnl 2.0 compatibility code */
  72 #define nl_handle nl_sock
  73 #define nl80211_handle_alloc nl_socket_alloc_cb
  74 #define nl80211_handle_destroy nl_socket_free
  75 #else
  76 /*
  77  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  78  * but when you free a socket again it will mess up its bitmap and
  79  * and use the wrong number the next time it needs a socket ID.
  80  * Therefore, we wrap the handle alloc/destroy and add our own pid
  81  * accounting.
  82  */
  83 static uint32_t port_bitmap[32] = { 0 };
  84
  85 static struct nl_handle *nl80211_handle_alloc(void *cb)
  86 {
  87         struct nl_handle *handle;
  88         uint32_t pid = getpid() & 0x3FFFFF;
  89         int i;
  90
  91         handle = nl_handle_alloc_cb(cb);
  92
  93         for (i = 0; i < 1024; i++) {
  94                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  95                         continue;
  96                 port_bitmap[i / 32] |= 1 << (i % 32);
  97                 pid += i << 22;
  98                 break;
  99         }
 100
 101         nl_socket_set_local_port(handle, pid);
 102
 103         return handle;
 104 }
 105
 106 static void nl80211_handle_destroy(struct nl_handle *handle)
 107 {
 108         uint32_t port = nl_socket_get_local_port(handle);
 109
 110         port >>= 22;
 111         port_bitmap[port / 32] &= ~(1 << (port % 32));
 112
 113         nl_handle_destroy(handle);
 114 }
 115 #endif /* CONFIG_LIBNL20 */
 116
 117
 118 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
 119 {
 120         struct nl_handle *handle;
 121
 122         handle = nl80211_handle_alloc(cb);
 123         if (handle == NULL) {
 124                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 125                            "callbacks (%s)", dbg);
 126                 return NULL;
 127         }
 128
 129         if (genl_connect(handle)) {
 130                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 131                            "netlink (%s)", dbg);
 132                 nl80211_handle_destroy(handle);
 133                 return NULL;
 134         }
 135
 136         return handle;
 137 }
 138
 139
 140 static void nl_destroy_handles(struct nl_handle **handle)
 141 {
 142         if (*handle == NULL)
 143                 return;
 144         nl80211_handle_destroy(*handle);
 145         *handle = NULL;
 146 }
 147
 148
 149 #ifndef IFF_LOWER_UP
 150 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
 151 #endif
 152 #ifndef IFF_DORMANT
 153 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
 154 #endif
 155
 156 #ifndef IF_OPER_DORMANT
 157 #define IF_OPER_DORMANT 5
 158 #endif
 159 #ifndef IF_OPER_UP
 160 #define IF_OPER_UP 6
 161 #endif
 162
 163 struct nl80211_global {
 164         struct dl_list interfaces;
 165         int if_add_ifindex;
 166         struct netlink_data *netlink;
 167         struct nl_cb *nl_cb;
 168         struct nl_handle *nl;
 169         int nl80211_id;
 170         int ioctl_sock; /* socket for ioctl() use */
 171
 172         struct nl_handle *nl_event;
 173 };
 174
 175 struct nl80211_wiphy_data {
 176         struct dl_list list;
 177         struct dl_list bsss;
 178         struct dl_list drvs;
 179
 180         struct nl_handle *nl_beacons;
 181         struct nl_cb *nl_cb;
 182
 183         int wiphy_idx;
 184 };
 185
 186 static void nl80211_global_deinit(void *priv);
 187 static void wpa_driver_nl80211_deinit(void *priv);
 188
 189 struct i802_bss {
 190         struct wpa_driver_nl80211_data *drv;
 191         struct i802_bss *next;
 192         int ifindex;
 193         char ifname[IFNAMSIZ + 1];
 194         char brname[IFNAMSIZ];
 195         unsigned int beacon_set:1;
 196         unsigned int added_if_into_bridge:1;
 197         unsigned int added_bridge:1;
 198         unsigned int in_deinit:1;
 199
 200         u8 addr[ETH_ALEN];
 201
 202         int freq;
 203
 204         struct nl_handle *nl_preq, *nl_mgmt;
 205         struct nl_cb *nl_cb;
 206
 207         struct nl80211_wiphy_data *wiphy_data;
 208         struct dl_list wiphy_list;
 209 };
 210
 211 struct wpa_driver_nl80211_data {
 212         struct nl80211_global *global;
 213         struct dl_list list;
 214         struct dl_list wiphy_list;
 215         char phyname[32];
 216         void *ctx;
 217         int ifindex;
 218         int if_removed;
 219         int if_disabled;
 220         int ignore_if_down_event;
 221         struct rfkill_data *rfkill;
 222         struct wpa_driver_capa capa;
 223         int has_capability;
 224
 225         int operstate;
 226
 227         int scan_complete_events;
 228
 229         struct nl_cb *nl_cb;
 230
 231         u8 auth_bssid[ETH_ALEN];
 232         u8 bssid[ETH_ALEN];
 233         int associated;
 234         u8 ssid[32];
 235         size_t ssid_len;
 236         enum nl80211_iftype nlmode;
 237         enum nl80211_iftype ap_scan_as_station;
 238         unsigned int assoc_freq;
 239
 240         int monitor_sock;
 241         int monitor_ifidx;
 242         int monitor_refcount;
 243
 244         unsigned int disabled_11b_rates:1;
 245         unsigned int pending_remain_on_chan:1;
 246         unsigned int in_interface_list:1;
 247         unsigned int device_ap_sme:1;
 248         unsigned int poll_command_supported:1;
 249         unsigned int data_tx_status:1;
 250         unsigned int scan_for_auth:1;
 251         unsigned int retry_auth:1;
 252         unsigned int use_monitor:1;
 253
 254         u64 remain_on_chan_cookie;
 255         u64 send_action_cookie;
 256
 257         unsigned int last_mgmt_freq;
 258
 259         struct wpa_driver_scan_filter *filter_ssids;
 260         size_t num_filter_ssids;
 261
 262         struct i802_bss first_bss;
 263
 264         int eapol_tx_sock;
 265
 266 #ifdef HOSTAPD
 267         int eapol_sock; /* socket for EAPOL frames */
 268
 269         int default_if_indices[16];
 270         int *if_indices;
 271         int num_if_indices;
 272
 273         int last_freq;
 274         int last_freq_ht;
 275 #endif /* HOSTAPD */
 276
 277         /* From failed authentication command */
 278         int auth_freq;
 279         u8 auth_bssid_[ETH_ALEN];
 280         u8 auth_ssid[32];
 281         size_t auth_ssid_len;
 282         int auth_alg;
 283         u8 *auth_ie;
 284         size_t auth_ie_len;
 285         u8 auth_wep_key[4][16];
 286         size_t auth_wep_key_len[4];
 287         int auth_wep_tx_keyidx;
 288         int auth_local_state_change;
 289         int auth_p2p;
 290 };
 291
 292
 293 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 294                                             void *timeout_ctx);
 295 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
 296                                        enum nl80211_iftype nlmode);
 297 static int
 298 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
 299 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 300                                    const u8 *addr, int cmd, u16 reason_code,
 301                                    int local_state_change);
 302 static void nl80211_remove_monitor_interface(
 303         struct wpa_driver_nl80211_data *drv);
 304 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 305                                   unsigned int freq, unsigned int wait,
 306                                   const u8 *buf, size_t buf_len, u64 *cookie,
 307                                   int no_cck, int no_ack, int offchanok);
 308 static int wpa_driver_nl80211_probe_req_report(void *priv, int report);
 309 #ifdef ANDROID
 310 static int android_pno_start(struct i802_bss *bss,
 311                              struct wpa_driver_scan_params *params);
 312 static int android_pno_stop(struct i802_bss *bss);
 313 #endif /* ANDROID */
 314
 315 #ifdef HOSTAPD
 316 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 317 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 318 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 319 static int wpa_driver_nl80211_if_remove(void *priv,
 320                                         enum wpa_driver_if_type type,
 321                                         const char *ifname);
 322 #else /* HOSTAPD */
 323 static inline void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 324 {
 325 }
 326
 327 static inline void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 328 {
 329 }
 330
 331 static inline int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 332 {
 333         return 0;
 334 }
 335 #endif /* HOSTAPD */
 336
 337 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
 338 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 339                                      int ifindex, int disabled);
 340
 341 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 342 static int wpa_driver_nl80211_authenticate_retry(
 343         struct wpa_driver_nl80211_data *drv);
 344
 345
 346 static int is_ap_interface(enum nl80211_iftype nlmode)
 347 {
 348         return (nlmode == NL80211_IFTYPE_AP ||
 349                 nlmode == NL80211_IFTYPE_P2P_GO);
 350 }
 351
 352
 353 static int is_sta_interface(enum nl80211_iftype nlmode)
 354 {
 355         return (nlmode == NL80211_IFTYPE_STATION ||
 356                 nlmode == NL80211_IFTYPE_P2P_CLIENT);
 357 }
 358
 359
 360 static int is_p2p_interface(enum nl80211_iftype nlmode)
 361 {
 362         return (nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 363                 nlmode == NL80211_IFTYPE_P2P_GO);
 364 }
 365
 366
 367 struct nl80211_bss_info_arg {
 368         struct wpa_driver_nl80211_data *drv;
 369         struct wpa_scan_results *res;
 370         unsigned int assoc_freq;
 371         u8 assoc_bssid[ETH_ALEN];
 372 };
 373
 374 static int bss_info_handler(struct nl_msg *msg, void *arg);
 375
 376
 377 /* nl80211 code */
 378 static int ack_handler(struct nl_msg *msg, void *arg)
 379 {
 380         int *err = arg;
 381         *err = 0;
 382         return NL_STOP;
 383 }
 384
 385 static int finish_handler(struct nl_msg *msg, void *arg)
 386 {
 387         int *ret = arg;
 388         *ret = 0;
 389         return NL_SKIP;
 390 }
 391
 392 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 393                          void *arg)
 394 {
 395         int *ret = arg;
 396         *ret = err->error;
 397         return NL_SKIP;
 398 }
 399
 400
 401 static int no_seq_check(struct nl_msg *msg, void *arg)
 402 {
 403         return NL_OK;
 404 }
 405
 406
 407 static int send_and_recv(struct nl80211_global *global,
 408                          struct nl_handle *nl_handle, struct nl_msg *msg,
 409                          int (*valid_handler)(struct nl_msg *, void *),
 410                          void *valid_data)
 411 {
 412         struct nl_cb *cb;
 413         int err = -ENOMEM;
 414
 415         cb = nl_cb_clone(global->nl_cb);
 416         if (!cb)
 417                 goto out;
 418
 419         err = nl_send_auto_complete(nl_handle, msg);
 420         if (err < 0)
 421                 goto out;
 422
 423         err = 1;
 424
 425         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 426         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 427         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 428
 429         if (valid_handler)
 430                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 431                           valid_handler, valid_data);
 432
 433         while (err > 0)
 434                 nl_recvmsgs(nl_handle, cb);
 435  out:
 436         nl_cb_put(cb);
 437         nlmsg_free(msg);
 438         return err;
 439 }
 440
 441
 442 static int send_and_recv_msgs_global(struct nl80211_global *global,
 443                                      struct nl_msg *msg,
 444                                      int (*valid_handler)(struct nl_msg *, void *),
 445                                      void *valid_data)
 446 {
 447         return send_and_recv(global, global->nl, msg, valid_handler,
 448                              valid_data);
 449 }
 450
 451
 452 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 453                               struct nl_msg *msg,
 454                               int (*valid_handler)(struct nl_msg *, void *),
 455                               void *valid_data)
 456 {
 457         return send_and_recv(drv->global, drv->global->nl, msg,
 458                              valid_handler, valid_data);
 459 }
 460
 461
 462 struct family_data {
 463         const char *group;
 464         int id;
 465 };
 466
 467
 468 static int family_handler(struct nl_msg *msg, void *arg)
 469 {
 470         struct family_data *res = arg;
 471         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 472         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 473         struct nlattr *mcgrp;
 474         int i;
 475
 476         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 477                   genlmsg_attrlen(gnlh, 0), NULL);
 478         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 479                 return NL_SKIP;
 480
 481         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 482                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 483                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 484                           nla_len(mcgrp), NULL);
 485                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 486                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 487                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 488                                res->group,
 489                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 490                         continue;
 491                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 492                 break;
 493         };
 494
 495         return NL_SKIP;
 496 }
 497
 498
 499 static int nl_get_multicast_id(struct nl80211_global *global,
 500                                const char *family, const char *group)
 501 {
 502         struct nl_msg *msg;
 503         int ret = -1;
 504         struct family_data res = { group, -ENOENT };
 505
 506         msg = nlmsg_alloc();
 507         if (!msg)
 508                 return -ENOMEM;
 509         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 510                     0, 0, CTRL_CMD_GETFAMILY, 0);
 511         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 512
 513         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 514         msg = NULL;
 515         if (ret == 0)
 516                 ret = res.id;
 517
 518 nla_put_failure:
 519         nlmsg_free(msg);
 520         return ret;
 521 }
 522
 523
 524 static void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 525                           struct nl_msg *msg, int flags, uint8_t cmd)
 526 {
 527         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 528                            0, flags, cmd, 0);
 529 }
 530
 531
 532 struct wiphy_idx_data {
 533         int wiphy_idx;
 534 };
 535
 536
 537 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 538 {
 539         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 540         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 541         struct wiphy_idx_data *info = arg;
 542
 543         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 544                   genlmsg_attrlen(gnlh, 0), NULL);
 545
 546         if (tb[NL80211_ATTR_WIPHY])
 547                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 548
 549         return NL_SKIP;
 550 }
 551
 552
 553 static int nl80211_get_wiphy_index(struct i802_bss *bss)
 554 {
 555         struct nl_msg *msg;
 556         struct wiphy_idx_data data = {
 557                 .wiphy_idx = -1,
 558         };
 559
 560         msg = nlmsg_alloc();
 561         if (!msg)
 562                 return -1;
 563
 564         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 565
 566         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 567
 568         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 569                 return data.wiphy_idx;
 570         msg = NULL;
 571 nla_put_failure:
 572         nlmsg_free(msg);
 573         return -1;
 574 }
 575
 576
 577 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 578                                     struct nl80211_wiphy_data *w)
 579 {
 580         struct nl_msg *msg;
 581         int ret = -1;
 582
 583         msg = nlmsg_alloc();
 584         if (!msg)
 585                 return -1;
 586
 587         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
 588
 589         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
 590
 591         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 592         msg = NULL;
 593         if (ret) {
 594                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 595                            "failed: ret=%d (%s)",
 596                            ret, strerror(-ret));
 597                 goto nla_put_failure;
 598         }
 599         ret = 0;
 600 nla_put_failure:
 601         nlmsg_free(msg);
 602         return ret;
 603 }
 604
 605
 606 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 607 {
 608         struct nl80211_wiphy_data *w = eloop_ctx;
 609
 610         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 611
 612         nl_recvmsgs(handle, w->nl_cb);
 613 }
 614
 615
 616 static int process_beacon_event(struct nl_msg *msg, void *arg)
 617 {
 618         struct nl80211_wiphy_data *w = arg;
 619         struct wpa_driver_nl80211_data *drv;
 620         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 621         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 622         union wpa_event_data event;
 623
 624         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 625                   genlmsg_attrlen(gnlh, 0), NULL);
 626
 627         if (gnlh->cmd != NL80211_CMD_FRAME) {
 628                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 629                            gnlh->cmd);
 630                 return NL_SKIP;
 631         }
 632
 633         if (!tb[NL80211_ATTR_FRAME])
 634                 return NL_SKIP;
 635
 636         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 637                          wiphy_list) {
 638                 os_memset(&event, 0, sizeof(event));
 639                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 640                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 641                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 642         }
 643
 644         return NL_SKIP;
 645 }
 646
 647
 648 static struct nl80211_wiphy_data *
 649 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 650 {
 651         static DEFINE_DL_LIST(nl80211_wiphys);
 652         struct nl80211_wiphy_data *w;
 653         int wiphy_idx, found = 0;
 654         struct i802_bss *tmp_bss;
 655
 656         if (bss->wiphy_data != NULL)
 657                 return bss->wiphy_data;
 658
 659         wiphy_idx = nl80211_get_wiphy_index(bss);
 660
 661         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 662                 if (w->wiphy_idx == wiphy_idx)
 663                         goto add;
 664         }
 665
 666         /* alloc new one */
 667         w = os_zalloc(sizeof(*w));
 668         if (w == NULL)
 669                 return NULL;
 670         w->wiphy_idx = wiphy_idx;
 671         dl_list_init(&w->bsss);
 672         dl_list_init(&w->drvs);
 673
 674         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 675         if (!w->nl_cb) {
 676                 os_free(w);
 677                 return NULL;
 678         }
 679         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 680         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 681                   w);
 682
 683         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 684                                          "wiphy beacons");
 685         if (w->nl_beacons == NULL) {
 686                 os_free(w);
 687                 return NULL;
 688         }
 689
 690         if (nl80211_register_beacons(bss->drv, w)) {
 691                 nl_destroy_handles(&w->nl_beacons);
 692                 os_free(w);
 693                 return NULL;
 694         }
 695
 696         eloop_register_read_sock(nl_socket_get_fd(w->nl_beacons),
 697                                  nl80211_recv_beacons, w, w->nl_beacons);
 698
 699         dl_list_add(&nl80211_wiphys, &w->list);
 700
 701 add:
 702         /* drv entry for this bss already there? */
 703         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 704                 if (tmp_bss->drv == bss->drv) {
 705                         found = 1;
 706                         break;
 707                 }
 708         }
 709         /* if not add it */
 710         if (!found)
 711                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 712
 713         dl_list_add(&w->bsss, &bss->wiphy_list);
 714         bss->wiphy_data = w;
 715         return w;
 716 }
 717
 718
 719 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 720 {
 721         struct nl80211_wiphy_data *w = bss->wiphy_data;
 722         struct i802_bss *tmp_bss;
 723         int found = 0;
 724
 725         if (w == NULL)
 726                 return;
 727         bss->wiphy_data = NULL;
 728         dl_list_del(&bss->wiphy_list);
 729
 730         /* still any for this drv present? */
 731         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 732                 if (tmp_bss->drv == bss->drv) {
 733                         found = 1;
 734                         break;
 735                 }
 736         }
 737         /* if not remove it */
 738         if (!found)
 739                 dl_list_del(&bss->drv->wiphy_list);
 740
 741         if (!dl_list_empty(&w->bsss))
 742                 return;
 743
 744         eloop_unregister_read_sock(nl_socket_get_fd(w->nl_beacons));
 745
 746         nl_cb_put(w->nl_cb);
 747         nl_destroy_handles(&w->nl_beacons);
 748         dl_list_del(&w->list);
 749         os_free(w);
 750 }
 751
 752
 753 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 754 {
 755         struct i802_bss *bss = priv;
 756         struct wpa_driver_nl80211_data *drv = bss->drv;
 757         if (!drv->associated)
 758                 return -1;
 759         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 760         return 0;
 761 }
 762
 763
 764 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 765 {
 766         struct i802_bss *bss = priv;
 767         struct wpa_driver_nl80211_data *drv = bss->drv;
 768         if (!drv->associated)
 769                 return -1;
 770         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 771         return drv->ssid_len;
 772 }
 773
 774
 775 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
 776                                           char *buf, size_t len, int del)
 777 {
 778         union wpa_event_data event;
 779
 780         os_memset(&event, 0, sizeof(event));
 781         if (len > sizeof(event.interface_status.ifname))
 782                 len = sizeof(event.interface_status.ifname) - 1;
 783         os_memcpy(event.interface_status.ifname, buf, len);
 784         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
 785                 EVENT_INTERFACE_ADDED;
 786
 787         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
 788                    del ? "DEL" : "NEW",
 789                    event.interface_status.ifname,
 790                    del ? "removed" : "added");
 791
 792         if (os_strcmp(drv->first_bss.ifname, event.interface_status.ifname) == 0) {
 793                 if (del) {
 794                         if (drv->if_removed) {
 795                                 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
 796                                            "already set - ignore event");
 797                                 return;
 798                         }
 799                         drv->if_removed = 1;
 800                 } else {
 801                         if (if_nametoindex(drv->first_bss.ifname) == 0) {
 802                                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s "
 803                                            "does not exist - ignore "
 804                                            "RTM_NEWLINK",
 805                                            drv->first_bss.ifname);
 806                                 return;
 807                         }
 808                         if (!drv->if_removed) {
 809                                 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
 810                                            "already cleared - ignore event");
 811                                 return;
 812                         }
 813                         drv->if_removed = 0;
 814                 }
 815         }
 816
 817         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 818 }
 819
 820
 821 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 822                                          u8 *buf, size_t len)
 823 {
 824         int attrlen, rta_len;
 825         struct rtattr *attr;
 826
 827         attrlen = len;
 828         attr = (struct rtattr *) buf;
 829
 830         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 831         while (RTA_OK(attr, attrlen)) {
 832                 if (attr->rta_type == IFLA_IFNAME) {
 833                         if (os_strcmp(((char *) attr) + rta_len, drv->first_bss.ifname)
 834                             == 0)
 835                                 return 1;
 836                         else
 837                                 break;
 838                 }
 839                 attr = RTA_NEXT(attr, attrlen);
 840         }
 841
 842         return 0;
 843 }
 844
 845
 846 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 847                                           int ifindex, u8 *buf, size_t len)
 848 {
 849         if (drv->ifindex == ifindex)
 850                 return 1;
 851
 852         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 853                 drv->first_bss.ifindex = if_nametoindex(drv->first_bss.ifname);
 854                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 855                            "interface");
 856                 wpa_driver_nl80211_finish_drv_init(drv);
 857                 return 1;
 858         }
 859
 860         return 0;
 861 }
 862
 863
 864 static struct wpa_driver_nl80211_data *
 865 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 866 {
 867         struct wpa_driver_nl80211_data *drv;
 868         dl_list_for_each(drv, &global->interfaces,
 869                          struct wpa_driver_nl80211_data, list) {
 870                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 871                     have_ifidx(drv, idx))
 872                         return drv;
 873         }
 874         return NULL;
 875 }
 876
 877
 878 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 879                                                  struct ifinfomsg *ifi,
 880                                                  u8 *buf, size_t len)
 881 {
 882         struct nl80211_global *global = ctx;
 883         struct wpa_driver_nl80211_data *drv;
 884         int attrlen, rta_len;
 885         struct rtattr *attr;
 886         u32 brid = 0;
 887         char namebuf[IFNAMSIZ];
 888
 889         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 890         if (!drv) {
 891                 wpa_printf(MSG_DEBUG, "nl80211: Ignore event for foreign "
 892                            "ifindex %d", ifi->ifi_index);
 893                 return;
 894         }
 895
 896         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
 897                    "(%s%s%s%s)",
 898                    drv->operstate, ifi->ifi_flags,
 899                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 900                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 901                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 902                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 903
 904         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 905                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 906                     linux_iface_up(drv->global->ioctl_sock,
 907                                    drv->first_bss.ifname) > 0) {
 908                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 909                                    "event since interface %s is up", namebuf);
 910                         return;
 911                 }
 912                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
 913                 if (drv->ignore_if_down_event) {
 914                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 915                                    "event generated by mode change");
 916                         drv->ignore_if_down_event = 0;
 917                 } else {
 918                         drv->if_disabled = 1;
 919                         wpa_supplicant_event(drv->ctx,
 920                                              EVENT_INTERFACE_DISABLED, NULL);
 921                 }
 922         }
 923
 924         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 925                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 926                     linux_iface_up(drv->global->ioctl_sock,
 927                                    drv->first_bss.ifname) == 0) {
 928                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 929                                    "event since interface %s is down",
 930                                    namebuf);
 931                 } else if (if_nametoindex(drv->first_bss.ifname) == 0) {
 932                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 933                                    "event since interface %s does not exist",
 934                                    drv->first_bss.ifname);
 935                 } else if (drv->if_removed) {
 936                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 937                                    "event since interface %s is marked "
 938                                    "removed", drv->first_bss.ifname);
 939                 } else {
 940                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
 941                         drv->if_disabled = 0;
 942                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
 943                                              NULL);
 944                 }
 945         }
 946
 947         /*
 948          * Some drivers send the association event before the operup event--in
 949          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
 950          * fails. This will hit us when wpa_supplicant does not need to do
 951          * IEEE 802.1X authentication
 952          */
 953         if (drv->operstate == 1 &&
 954             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
 955             !(ifi->ifi_flags & IFF_RUNNING))
 956                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
 957                                        -1, IF_OPER_UP);
 958
 959         attrlen = len;
 960         attr = (struct rtattr *) buf;
 961         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 962         while (RTA_OK(attr, attrlen)) {
 963                 if (attr->rta_type == IFLA_IFNAME) {
 964                         wpa_driver_nl80211_event_link(
 965                                 drv,
 966                                 ((char *) attr) + rta_len,
 967                                 attr->rta_len - rta_len, 0);
 968                 } else if (attr->rta_type == IFLA_MASTER)
 969                         brid = nla_get_u32((struct nlattr *) attr);
 970                 attr = RTA_NEXT(attr, attrlen);
 971         }
 972
 973         if (ifi->ifi_family == AF_BRIDGE && brid) {
 974                 /* device has been added to bridge */
 975                 if_indextoname(brid, namebuf);
 976                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
 977                            brid, namebuf);
 978                 add_ifidx(drv, brid);
 979         }
 980 }
 981
 982
 983 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
 984                                                  struct ifinfomsg *ifi,
 985                                                  u8 *buf, size_t len)
 986 {
 987         struct nl80211_global *global = ctx;
 988         struct wpa_driver_nl80211_data *drv;
 989         int attrlen, rta_len;
 990         struct rtattr *attr;
 991         u32 brid = 0;
 992
 993         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 994         if (!drv) {
 995                 wpa_printf(MSG_DEBUG, "nl80211: Ignore dellink event for "
 996                            "foreign ifindex %d", ifi->ifi_index);
 997                 return;
 998         }
 999
1000         attrlen = len;
1001         attr = (struct rtattr *) buf;
1002
1003         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1004         while (RTA_OK(attr, attrlen)) {
1005                 if (attr->rta_type == IFLA_IFNAME) {
1006                         wpa_driver_nl80211_event_link(
1007                                 drv,
1008                                 ((char *) attr) + rta_len,
1009                                 attr->rta_len - rta_len, 1);
1010                 } else if (attr->rta_type == IFLA_MASTER)
1011                         brid = nla_get_u32((struct nlattr *) attr);
1012                 attr = RTA_NEXT(attr, attrlen);
1013         }
1014
1015         if (ifi->ifi_family == AF_BRIDGE && brid) {
1016                 /* device has been removed from bridge */
1017                 char namebuf[IFNAMSIZ];
1018                 if_indextoname(brid, namebuf);
1019                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1020                            "%s", brid, namebuf);
1021                 del_ifidx(drv, brid);
1022         }
1023 }
1024
1025
1026 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
1027                             const u8 *frame, size_t len)
1028 {
1029         const struct ieee80211_mgmt *mgmt;
1030         union wpa_event_data event;
1031
1032         mgmt = (const struct ieee80211_mgmt *) frame;
1033         if (len < 24 + sizeof(mgmt->u.auth)) {
1034                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1035                            "frame");
1036                 return;
1037         }
1038
1039         os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
1040         os_memset(&event, 0, sizeof(event));
1041         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
1042         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1043         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
1044         if (len > 24 + sizeof(mgmt->u.auth)) {
1045                 event.auth.ies = mgmt->u.auth.variable;
1046                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
1047         }
1048
1049         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
1050 }
1051
1052
1053 static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1054 {
1055         struct nl_msg *msg;
1056         int ret;
1057         struct nl80211_bss_info_arg arg;
1058
1059         os_memset(&arg, 0, sizeof(arg));
1060         msg = nlmsg_alloc();
1061         if (!msg)
1062                 goto nla_put_failure;
1063
1064         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1065         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1066
1067         arg.drv = drv;
1068         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1069         msg = NULL;
1070         if (ret == 0) {
1071                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1072                            "associated BSS from scan results: %u MHz",
1073                            arg.assoc_freq);
1074                 return arg.assoc_freq ? arg.assoc_freq : drv->assoc_freq;
1075         }
1076         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1077                    "(%s)", ret, strerror(-ret));
1078 nla_put_failure:
1079         nlmsg_free(msg);
1080         return drv->assoc_freq;
1081 }
1082
1083
1084 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
1085                             const u8 *frame, size_t len)
1086 {
1087         const struct ieee80211_mgmt *mgmt;
1088         union wpa_event_data event;
1089         u16 status;
1090
1091         mgmt = (const struct ieee80211_mgmt *) frame;
1092         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
1093                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1094                            "frame");
1095                 return;
1096         }
1097
1098         status = le_to_host16(mgmt->u.assoc_resp.status_code);
1099         if (status != WLAN_STATUS_SUCCESS) {
1100                 os_memset(&event, 0, sizeof(event));
1101                 event.assoc_reject.bssid = mgmt->bssid;
1102                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1103                         event.assoc_reject.resp_ies =
1104                                 (u8 *) mgmt->u.assoc_resp.variable;
1105                         event.assoc_reject.resp_ies_len =
1106                                 len - 24 - sizeof(mgmt->u.assoc_resp);
1107                 }
1108                 event.assoc_reject.status_code = status;
1109
1110                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1111                 return;
1112         }
1113
1114         drv->associated = 1;
1115         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
1116
1117         os_memset(&event, 0, sizeof(event));
1118         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1119                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
1120                 event.assoc_info.resp_ies_len =
1121                         len - 24 - sizeof(mgmt->u.assoc_resp);
1122         }
1123
1124         event.assoc_info.freq = drv->assoc_freq;
1125
1126         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1127 }
1128
1129
1130 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
1131                                enum nl80211_commands cmd, struct nlattr *status,
1132                                struct nlattr *addr, struct nlattr *req_ie,
1133                                struct nlattr *resp_ie)
1134 {
1135         union wpa_event_data event;
1136
1137         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1138                 /*
1139                  * Avoid reporting two association events that would confuse
1140                  * the core code.
1141                  */
1142                 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
1143                            "when using userspace SME", cmd);
1144                 return;
1145         }
1146
1147         os_memset(&event, 0, sizeof(event));
1148         if (cmd == NL80211_CMD_CONNECT &&
1149             nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
1150                 if (addr)
1151                         event.assoc_reject.bssid = nla_data(addr);
1152                 if (resp_ie) {
1153                         event.assoc_reject.resp_ies = nla_data(resp_ie);
1154                         event.assoc_reject.resp_ies_len = nla_len(resp_ie);
1155                 }
1156                 event.assoc_reject.status_code = nla_get_u16(status);
1157                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1158                 return;
1159         }
1160
1161         drv->associated = 1;
1162         if (addr)
1163                 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1164
1165         if (req_ie) {
1166                 event.assoc_info.req_ies = nla_data(req_ie);
1167                 event.assoc_info.req_ies_len = nla_len(req_ie);
1168         }
1169         if (resp_ie) {
1170                 event.assoc_info.resp_ies = nla_data(resp_ie);
1171                 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1172         }
1173
1174         event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1175
1176         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1177 }
1178
1179
1180 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1181                                   struct nlattr *reason, struct nlattr *addr,
1182                                   struct nlattr *by_ap)
1183 {
1184         union wpa_event_data data;
1185
1186         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1187                 /*
1188                  * Avoid reporting two disassociation events that could
1189                  * confuse the core code.
1190                  */
1191                 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1192                            "event when using userspace SME");
1193                 return;
1194         }
1195
1196         drv->associated = 0;
1197         os_memset(&data, 0, sizeof(data));
1198         if (reason)
1199                 data.deauth_info.reason_code = nla_get_u16(reason);
1200         data.deauth_info.locally_generated = by_ap == NULL;
1201         wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1202 }
1203
1204
1205 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1206                                  struct nlattr *freq, struct nlattr *type)
1207 {
1208         union wpa_event_data data;
1209         int ht_enabled = 1;
1210         int chan_offset = 0;
1211
1212         wpa_printf(MSG_DEBUG, "nl80211: Channel switch event");
1213
1214         if (!freq || !type)
1215                 return;
1216
1217         switch (nla_get_u32(type)) {
1218         case NL80211_CHAN_NO_HT:
1219                 ht_enabled = 0;
1220                 break;
1221         case NL80211_CHAN_HT20:
1222                 break;
1223         case NL80211_CHAN_HT40PLUS:
1224                 chan_offset = 1;
1225                 break;
1226         case NL80211_CHAN_HT40MINUS:
1227                 chan_offset = -1;
1228                 break;
1229         }
1230
1231         data.ch_switch.freq = nla_get_u32(freq);
1232         data.ch_switch.ht_enabled = ht_enabled;
1233         data.ch_switch.ch_offset = chan_offset;
1234
1235         wpa_supplicant_event(drv->ctx, EVENT_CH_SWITCH, &data);
1236 }
1237
1238
1239 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1240                                enum nl80211_commands cmd, struct nlattr *addr)
1241 {
1242         union wpa_event_data event;
1243         enum wpa_event_type ev;
1244
1245         if (nla_len(addr) != ETH_ALEN)
1246                 return;
1247
1248         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1249                    cmd, MAC2STR((u8 *) nla_data(addr)));
1250
1251         if (cmd == NL80211_CMD_AUTHENTICATE)
1252                 ev = EVENT_AUTH_TIMED_OUT;
1253         else if (cmd == NL80211_CMD_ASSOCIATE)
1254                 ev = EVENT_ASSOC_TIMED_OUT;
1255         else
1256                 return;
1257
1258         os_memset(&event, 0, sizeof(event));
1259         os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1260         wpa_supplicant_event(drv->ctx, ev, &event);
1261 }
1262
1263
1264 static void mlme_event_mgmt(struct wpa_driver_nl80211_data *drv,
1265                             struct nlattr *freq, struct nlattr *sig,
1266                             const u8 *frame, size_t len)
1267 {
1268         const struct ieee80211_mgmt *mgmt;
1269         union wpa_event_data event;
1270         u16 fc, stype;
1271         int ssi_signal = 0;
1272
1273         mgmt = (const struct ieee80211_mgmt *) frame;
1274         if (len < 24) {
1275                 wpa_printf(MSG_DEBUG, "nl80211: Too short action frame");
1276                 return;
1277         }
1278
1279         fc = le_to_host16(mgmt->frame_control);
1280         stype = WLAN_FC_GET_STYPE(fc);
1281
1282         if (sig)
1283                 ssi_signal = (s32) nla_get_u32(sig);
1284
1285         os_memset(&event, 0, sizeof(event));
1286         if (freq) {
1287                 event.rx_action.freq = nla_get_u32(freq);
1288                 drv->last_mgmt_freq = event.rx_action.freq;
1289         }
1290         if (stype == WLAN_FC_STYPE_ACTION) {
1291                 event.rx_action.da = mgmt->da;
1292                 event.rx_action.sa = mgmt->sa;
1293                 event.rx_action.bssid = mgmt->bssid;
1294                 event.rx_action.category = mgmt->u.action.category;
1295                 event.rx_action.data = &mgmt->u.action.category + 1;
1296                 event.rx_action.len = frame + len - event.rx_action.data;
1297                 wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event);
1298         } else {
1299                 event.rx_mgmt.frame = frame;
1300                 event.rx_mgmt.frame_len = len;
1301                 event.rx_mgmt.ssi_signal = ssi_signal;
1302                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1303         }
1304 }
1305
1306
1307 static void mlme_event_mgmt_tx_status(struct wpa_driver_nl80211_data *drv,
1308                                       struct nlattr *cookie, const u8 *frame,
1309                                       size_t len, struct nlattr *ack)
1310 {
1311         union wpa_event_data event;
1312         const struct ieee80211_hdr *hdr;
1313         u16 fc;
1314
1315         if (!is_ap_interface(drv->nlmode)) {
1316                 u64 cookie_val;
1317
1318                 if (!cookie)
1319                         return;
1320
1321                 cookie_val = nla_get_u64(cookie);
1322                 wpa_printf(MSG_DEBUG, "nl80211: Action TX status:"
1323                            " cookie=0%llx%s (ack=%d)",
1324                            (long long unsigned int) cookie_val,
1325                            cookie_val == drv->send_action_cookie ?
1326                            " (match)" : " (unknown)", ack != NULL);
1327                 if (cookie_val != drv->send_action_cookie)
1328                         return;
1329         }
1330
1331         hdr = (const struct ieee80211_hdr *) frame;
1332         fc = le_to_host16(hdr->frame_control);
1333
1334         os_memset(&event, 0, sizeof(event));
1335         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1336         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1337         event.tx_status.dst = hdr->addr1;
1338         event.tx_status.data = frame;
1339         event.tx_status.data_len = len;
1340         event.tx_status.ack = ack != NULL;
1341         wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event);
1342 }
1343
1344
1345 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1346                                        enum wpa_event_type type,
1347                                        const u8 *frame, size_t len)
1348 {
1349         const struct ieee80211_mgmt *mgmt;
1350         union wpa_event_data event;
1351         const u8 *bssid = NULL;
1352         u16 reason_code = 0;
1353
1354         mgmt = (const struct ieee80211_mgmt *) frame;
1355         if (len >= 24) {
1356                 bssid = mgmt->bssid;
1357
1358                 if (drv->associated != 0 &&
1359                     os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
1360                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
1361                         /*
1362                          * We have presumably received this deauth as a
1363                          * response to a clear_state_mismatch() outgoing
1364                          * deauth.  Don't let it take us offline!
1365                          */
1366                         wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1367                                    "from Unknown BSSID " MACSTR " -- ignoring",
1368                                    MAC2STR(bssid));
1369                         return;
1370                 }
1371         }
1372
1373         drv->associated = 0;
1374         os_memset(&event, 0, sizeof(event));
1375
1376         /* Note: Same offset for Reason Code in both frame subtypes */
1377         if (len >= 24 + sizeof(mgmt->u.deauth))
1378                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1379
1380         if (type == EVENT_DISASSOC) {
1381                 event.disassoc_info.locally_generated =
1382                         !os_memcmp(mgmt->sa, drv->first_bss.addr, ETH_ALEN);
1383                 event.disassoc_info.addr = bssid;
1384                 event.disassoc_info.reason_code = reason_code;
1385                 if (frame + len > mgmt->u.disassoc.variable) {
1386                         event.disassoc_info.ie = mgmt->u.disassoc.variable;
1387                         event.disassoc_info.ie_len = frame + len -
1388                                 mgmt->u.disassoc.variable;
1389                 }
1390         } else {
1391                 event.deauth_info.locally_generated =
1392                         !os_memcmp(mgmt->sa, drv->first_bss.addr, ETH_ALEN);
1393                 event.deauth_info.addr = bssid;
1394                 event.deauth_info.reason_code = reason_code;
1395                 if (frame + len > mgmt->u.deauth.variable) {
1396                         event.deauth_info.ie = mgmt->u.deauth.variable;
1397                         event.deauth_info.ie_len = frame + len -
1398                                 mgmt->u.deauth.variable;
1399                 }
1400         }
1401
1402         wpa_supplicant_event(drv->ctx, type, &event);
1403 }
1404
1405
1406 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1407                                          enum wpa_event_type type,
1408                                          const u8 *frame, size_t len)
1409 {
1410         const struct ieee80211_mgmt *mgmt;
1411         union wpa_event_data event;
1412         u16 reason_code = 0;
1413
1414         if (len < 24)
1415                 return;
1416
1417         mgmt = (const struct ieee80211_mgmt *) frame;
1418
1419         os_memset(&event, 0, sizeof(event));
1420         /* Note: Same offset for Reason Code in both frame subtypes */
1421         if (len >= 24 + sizeof(mgmt->u.deauth))
1422                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1423
1424         if (type == EVENT_UNPROT_DISASSOC) {
1425                 event.unprot_disassoc.sa = mgmt->sa;
1426                 event.unprot_disassoc.da = mgmt->da;
1427                 event.unprot_disassoc.reason_code = reason_code;
1428         } else {
1429                 event.unprot_deauth.sa = mgmt->sa;
1430                 event.unprot_deauth.da = mgmt->da;
1431                 event.unprot_deauth.reason_code = reason_code;
1432         }
1433
1434         wpa_supplicant_event(drv->ctx, type, &event);
1435 }
1436
1437
1438 static void mlme_event(struct wpa_driver_nl80211_data *drv,
1439                        enum nl80211_commands cmd, struct nlattr *frame,
1440                        struct nlattr *addr, struct nlattr *timed_out,
1441                        struct nlattr *freq, struct nlattr *ack,
1442                        struct nlattr *cookie, struct nlattr *sig)
1443 {
1444         if (timed_out && addr) {
1445                 mlme_timeout_event(drv, cmd, addr);
1446                 return;
1447         }
1448
1449         if (frame == NULL) {
1450                 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
1451                            "data", cmd);
1452                 return;
1453         }
1454
1455         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
1456         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1457                     nla_data(frame), nla_len(frame));
1458
1459         switch (cmd) {
1460         case NL80211_CMD_AUTHENTICATE:
1461                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1462                 break;
1463         case NL80211_CMD_ASSOCIATE:
1464                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
1465                 break;
1466         case NL80211_CMD_DEAUTHENTICATE:
1467                 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1468                                            nla_data(frame), nla_len(frame));
1469                 break;
1470         case NL80211_CMD_DISASSOCIATE:
1471                 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1472                                            nla_data(frame), nla_len(frame));
1473                 break;
1474         case NL80211_CMD_FRAME:
1475                 mlme_event_mgmt(drv, freq, sig, nla_data(frame),
1476                                 nla_len(frame));
1477                 break;
1478         case NL80211_CMD_FRAME_TX_STATUS:
1479                 mlme_event_mgmt_tx_status(drv, cookie, nla_data(frame),
1480                                           nla_len(frame), ack);
1481                 break;
1482         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1483                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1484                                              nla_data(frame), nla_len(frame));
1485                 break;
1486         case NL80211_CMD_UNPROT_DISASSOCIATE:
1487                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1488                                              nla_data(frame), nla_len(frame));
1489                 break;
1490         default:
1491                 break;
1492         }
1493 }
1494
1495
1496 static void mlme_event_michael_mic_failure(struct wpa_driver_nl80211_data *drv,
1497                                            struct nlattr *tb[])
1498 {
1499         union wpa_event_data data;
1500
1501         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
1502         os_memset(&data, 0, sizeof(data));
1503         if (tb[NL80211_ATTR_MAC]) {
1504                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
1505                             nla_data(tb[NL80211_ATTR_MAC]),
1506                             nla_len(tb[NL80211_ATTR_MAC]));
1507                 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
1508         }
1509         if (tb[NL80211_ATTR_KEY_SEQ]) {
1510                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
1511                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
1512                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
1513         }
1514         if (tb[NL80211_ATTR_KEY_TYPE]) {
1515                 enum nl80211_key_type key_type =
1516                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
1517                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
1518                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
1519                         data.michael_mic_failure.unicast = 1;
1520         } else
1521                 data.michael_mic_failure.unicast = 1;
1522
1523         if (tb[NL80211_ATTR_KEY_IDX]) {
1524                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
1525                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
1526         }
1527
1528         wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
1529 }
1530
1531
1532 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
1533                                  struct nlattr *tb[])
1534 {
1535         if (tb[NL80211_ATTR_MAC] == NULL) {
1536                 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
1537                            "event");
1538                 return;
1539         }
1540         os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1541         drv->associated = 1;
1542         wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
1543                    MAC2STR(drv->bssid));
1544
1545         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1546 }
1547
1548
1549 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
1550                                          int cancel_event, struct nlattr *tb[])
1551 {
1552         unsigned int freq, chan_type, duration;
1553         union wpa_event_data data;
1554         u64 cookie;
1555
1556         if (tb[NL80211_ATTR_WIPHY_FREQ])
1557                 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
1558         else
1559                 freq = 0;
1560
1561         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1562                 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1563         else
1564                 chan_type = 0;
1565
1566         if (tb[NL80211_ATTR_DURATION])
1567                 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
1568         else
1569                 duration = 0;
1570
1571         if (tb[NL80211_ATTR_COOKIE])
1572                 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
1573         else
1574                 cookie = 0;
1575
1576         wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
1577                    "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
1578                    cancel_event, freq, chan_type, duration,
1579                    (long long unsigned int) cookie,
1580                    cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
1581
1582         if (cookie != drv->remain_on_chan_cookie)
1583                 return; /* not for us */
1584
1585         if (cancel_event)
1586                 drv->pending_remain_on_chan = 0;
1587
1588         os_memset(&data, 0, sizeof(data));
1589         data.remain_on_channel.freq = freq;
1590         data.remain_on_channel.duration = duration;
1591         wpa_supplicant_event(drv->ctx, cancel_event ?
1592                              EVENT_CANCEL_REMAIN_ON_CHANNEL :
1593                              EVENT_REMAIN_ON_CHANNEL, &data);
1594 }
1595
1596
1597 static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
1598                             struct nlattr *tb[])
1599 {
1600         union wpa_event_data event;
1601         struct nlattr *nl;
1602         int rem;
1603         struct scan_info *info;
1604 #define MAX_REPORT_FREQS 50
1605         int freqs[MAX_REPORT_FREQS];
1606         int num_freqs = 0;
1607
1608         if (drv->scan_for_auth) {
1609                 drv->scan_for_auth = 0;
1610                 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
1611                            "cfg80211 BSS entry");
1612                 wpa_driver_nl80211_authenticate_retry(drv);
1613                 return;
1614         }
1615
1616         os_memset(&event, 0, sizeof(event));
1617         info = &event.scan_info;
1618         info->aborted = aborted;
1619
1620         if (tb[NL80211_ATTR_SCAN_SSIDS]) {
1621                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
1622                         struct wpa_driver_scan_ssid *s =
1623                                 &info->ssids[info->num_ssids];
1624                         s->ssid = nla_data(nl);
1625                         s->ssid_len = nla_len(nl);
1626                         info->num_ssids++;
1627                         if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
1628                                 break;
1629                 }
1630         }
1631         if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
1632                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
1633                 {
1634                         freqs[num_freqs] = nla_get_u32(nl);
1635                         num_freqs++;
1636                         if (num_freqs == MAX_REPORT_FREQS - 1)
1637                                 break;
1638                 }
1639                 info->freqs = freqs;
1640                 info->num_freqs = num_freqs;
1641         }
1642         wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
1643 }
1644
1645
1646 static int get_link_signal(struct nl_msg *msg, void *arg)
1647 {
1648         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1649         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1650         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1651         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1652                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1653         };
1654         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1655         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1656                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1657                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1658                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1659                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1660         };
1661         struct wpa_signal_info *sig_change = arg;
1662
1663         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1664                   genlmsg_attrlen(gnlh, 0), NULL);
1665         if (!tb[NL80211_ATTR_STA_INFO] ||
1666             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1667                              tb[NL80211_ATTR_STA_INFO], policy))
1668                 return NL_SKIP;
1669         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1670                 return NL_SKIP;
1671
1672         sig_change->current_signal =
1673                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1674
1675         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1676                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1677                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1678                                      rate_policy)) {
1679                         sig_change->current_txrate = 0;
1680                 } else {
1681                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1682                                 sig_change->current_txrate =
1683                                         nla_get_u16(rinfo[
1684                                              NL80211_RATE_INFO_BITRATE]) * 100;
1685                         }
1686                 }
1687         }
1688
1689         return NL_SKIP;
1690 }
1691
1692
1693 static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1694                                    struct wpa_signal_info *sig)
1695 {
1696         struct nl_msg *msg;
1697
1698         sig->current_signal = -9999;
1699         sig->current_txrate = 0;
1700
1701         msg = nlmsg_alloc();
1702         if (!msg)
1703                 return -ENOMEM;
1704
1705         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
1706
1707         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1708         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
1709
1710         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1711  nla_put_failure:
1712         nlmsg_free(msg);
1713         return -ENOBUFS;
1714 }
1715
1716
1717 static int get_link_noise(struct nl_msg *msg, void *arg)
1718 {
1719         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1720         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1721         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1722         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1723                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1724                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1725         };
1726         struct wpa_signal_info *sig_change = arg;
1727
1728         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1729                   genlmsg_attrlen(gnlh, 0), NULL);
1730
1731         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1732                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1733                 return NL_SKIP;
1734         }
1735
1736         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1737                              tb[NL80211_ATTR_SURVEY_INFO],
1738                              survey_policy)) {
1739                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1740                            "attributes!");
1741                 return NL_SKIP;
1742         }
1743
1744         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1745                 return NL_SKIP;
1746
1747         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1748             sig_change->frequency)
1749                 return NL_SKIP;
1750
1751         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1752                 return NL_SKIP;
1753
1754         sig_change->current_noise =
1755                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1756
1757         return NL_SKIP;
1758 }
1759
1760
1761 static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1762                                   struct wpa_signal_info *sig_change)
1763 {
1764         struct nl_msg *msg;
1765
1766         sig_change->current_noise = 9999;
1767         sig_change->frequency = drv->assoc_freq;
1768
1769         msg = nlmsg_alloc();
1770         if (!msg)
1771                 return -ENOMEM;
1772
1773         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1774
1775         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1776
1777         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1778  nla_put_failure:
1779         nlmsg_free(msg);
1780         return -ENOBUFS;
1781 }
1782
1783
1784 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
1785 {
1786         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1787         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1788         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1789         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1790                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1791                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1792         };
1793         struct wpa_scan_results *scan_results = arg;
1794         struct wpa_scan_res *scan_res;
1795         size_t i;
1796
1797         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1798                   genlmsg_attrlen(gnlh, 0), NULL);
1799
1800         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1801                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
1802                 return NL_SKIP;
1803         }
1804
1805         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1806                              tb[NL80211_ATTR_SURVEY_INFO],
1807                              survey_policy)) {
1808                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
1809                            "attributes");
1810                 return NL_SKIP;
1811         }
1812
1813         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1814                 return NL_SKIP;
1815
1816         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1817                 return NL_SKIP;
1818
1819         for (i = 0; i < scan_results->num; ++i) {
1820                 scan_res = scan_results->res[i];
1821                 if (!scan_res)
1822                         continue;
1823                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1824                     scan_res->freq)
1825                         continue;
1826                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
1827                         continue;
1828                 scan_res->noise = (s8)
1829                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1830                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
1831         }
1832
1833         return NL_SKIP;
1834 }
1835
1836
1837 static int nl80211_get_noise_for_scan_results(
1838         struct wpa_driver_nl80211_data *drv,
1839         struct wpa_scan_results *scan_res)
1840 {
1841         struct nl_msg *msg;
1842
1843         msg = nlmsg_alloc();
1844         if (!msg)
1845                 return -ENOMEM;
1846
1847         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1848
1849         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1850
1851         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
1852                                   scan_res);
1853  nla_put_failure:
1854         nlmsg_free(msg);
1855         return -ENOBUFS;
1856 }
1857
1858
1859 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
1860                               struct nlattr *tb[])
1861 {
1862         static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
1863                 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
1864                 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
1865                 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
1866                 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
1867         };
1868         struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
1869         enum nl80211_cqm_rssi_threshold_event event;
1870         union wpa_event_data ed;
1871         struct wpa_signal_info sig;
1872         int res;
1873
1874         if (tb[NL80211_ATTR_CQM] == NULL ||
1875             nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
1876                              cqm_policy)) {
1877                 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
1878                 return;
1879         }
1880
1881         os_memset(&ed, 0, sizeof(ed));
1882
1883         if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
1884                 if (!tb[NL80211_ATTR_MAC])
1885                         return;
1886                 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
1887                           ETH_ALEN);
1888                 wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed);
1889                 return;
1890         }
1891
1892         if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
1893                 return;
1894         event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
1895
1896         if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
1897                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1898                            "event: RSSI high");
1899                 ed.signal_change.above_threshold = 1;
1900         } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
1901                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1902                            "event: RSSI low");
1903                 ed.signal_change.above_threshold = 0;
1904         } else
1905                 return;
1906
1907         res = nl80211_get_link_signal(drv, &sig);
1908         if (res == 0) {
1909                 ed.signal_change.current_signal = sig.current_signal;
1910                 ed.signal_change.current_txrate = sig.current_txrate;
1911                 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm  txrate: %d",
1912                            sig.current_signal, sig.current_txrate);
1913         }
1914
1915         res = nl80211_get_link_noise(drv, &sig);
1916         if (res == 0) {
1917                 ed.signal_change.current_noise = sig.current_noise;
1918                 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
1919                            sig.current_noise);
1920         }
1921
1922         wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
1923 }
1924
1925
1926 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
1927                                       struct nlattr **tb)
1928 {
1929         u8 *addr;
1930         union wpa_event_data data;
1931
1932         if (tb[NL80211_ATTR_MAC] == NULL)
1933                 return;
1934         addr = nla_data(tb[NL80211_ATTR_MAC]);
1935         wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr));
1936
1937         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
1938                 u8 *ies = NULL;
1939                 size_t ies_len = 0;
1940                 if (tb[NL80211_ATTR_IE]) {
1941                         ies = nla_data(tb[NL80211_ATTR_IE]);
1942                         ies_len = nla_len(tb[NL80211_ATTR_IE]);
1943                 }
1944                 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len);
1945                 drv_event_assoc(drv->ctx, addr, ies, ies_len, 0);
1946                 return;
1947         }
1948
1949         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
1950                 return;
1951
1952         os_memset(&data, 0, sizeof(data));
1953         os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN);
1954         wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data);
1955 }
1956
1957
1958 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
1959                                       struct nlattr **tb)
1960 {
1961         u8 *addr;
1962         union wpa_event_data data;
1963
1964         if (tb[NL80211_ATTR_MAC] == NULL)
1965                 return;
1966         addr = nla_data(tb[NL80211_ATTR_MAC]);
1967         wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
1968                    MAC2STR(addr));
1969
1970         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
1971                 drv_event_disassoc(drv->ctx, addr);
1972                 return;
1973         }
1974
1975         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
1976                 return;
1977
1978         os_memset(&data, 0, sizeof(data));
1979         os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
1980         wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data);
1981 }
1982
1983
1984 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
1985                                         struct nlattr **tb)
1986 {
1987         struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
1988         static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
1989                 [NL80211_REKEY_DATA_KEK] = {
1990                         .minlen = NL80211_KEK_LEN,
1991                         .maxlen = NL80211_KEK_LEN,
1992                 },
1993                 [NL80211_REKEY_DATA_KCK] = {
1994                         .minlen = NL80211_KCK_LEN,
1995                         .maxlen = NL80211_KCK_LEN,
1996                 },
1997                 [NL80211_REKEY_DATA_REPLAY_CTR] = {
1998                         .minlen = NL80211_REPLAY_CTR_LEN,
1999                         .maxlen = NL80211_REPLAY_CTR_LEN,
2000                 },
2001         };
2002         union wpa_event_data data;
2003
2004         if (!tb[NL80211_ATTR_MAC])
2005                 return;
2006         if (!tb[NL80211_ATTR_REKEY_DATA])
2007                 return;
2008         if (nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2009                              tb[NL80211_ATTR_REKEY_DATA], rekey_policy))
2010                 return;
2011         if (!rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2012                 return;
2013
2014         os_memset(&data, 0, sizeof(data));
2015         data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2016         wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2017                    MAC2STR(data.driver_gtk_rekey.bssid));
2018         data.driver_gtk_rekey.replay_ctr =
2019                 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2020         wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2021                     data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2022         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2023 }
2024
2025
2026 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2027                                           struct nlattr **tb)
2028 {
2029         struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2030         static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2031                 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2032                 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2033                         .minlen = ETH_ALEN,
2034                         .maxlen = ETH_ALEN,
2035                 },
2036                 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2037         };
2038         union wpa_event_data data;
2039
2040         if (!tb[NL80211_ATTR_PMKSA_CANDIDATE])
2041                 return;
2042         if (nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2043                              tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy))
2044                 return;
2045         if (!cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2046             !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2047                 return;
2048
2049         os_memset(&data, 0, sizeof(data));
2050         os_memcpy(data.pmkid_candidate.bssid,
2051                   nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2052         data.pmkid_candidate.index =
2053                 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2054         data.pmkid_candidate.preauth =
2055                 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2056         wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2057 }
2058
2059
2060 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2061                                        struct nlattr **tb)
2062 {
2063         union wpa_event_data data;
2064
2065         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_ACK])
2066                 return;
2067
2068         os_memset(&data, 0, sizeof(data));
2069         os_memcpy(data.client_poll.addr,
2070                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2071
2072         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2073 }
2074
2075
2076 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2077                                    int wds)
2078 {
2079         struct wpa_driver_nl80211_data *drv = bss->drv;
2080         union wpa_event_data event;
2081
2082         if (!tb[NL80211_ATTR_MAC])
2083                 return;
2084
2085         os_memset(&event, 0, sizeof(event));
2086         event.rx_from_unknown.bssid = bss->addr;
2087         event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2088         event.rx_from_unknown.wds = wds;
2089
2090         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2091 }
2092
2093
2094 static void do_process_drv_event(struct wpa_driver_nl80211_data *drv,
2095                                  int cmd, struct nlattr **tb)
2096 {
2097         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
2098             (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
2099              cmd == NL80211_CMD_SCAN_ABORTED)) {
2100                 wpa_driver_nl80211_set_mode(&drv->first_bss,
2101                                             drv->ap_scan_as_station);
2102                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2103         }
2104
2105         switch (cmd) {
2106         case NL80211_CMD_TRIGGER_SCAN:
2107                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger");
2108                 break;
2109         case NL80211_CMD_START_SCHED_SCAN:
2110                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan started");
2111                 break;
2112         case NL80211_CMD_SCHED_SCAN_STOPPED:
2113                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stopped");
2114                 wpa_supplicant_event(drv->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
2115                 break;
2116         case NL80211_CMD_NEW_SCAN_RESULTS:
2117                 wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
2118                 drv->scan_complete_events = 1;
2119                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2120                                      drv->ctx);
2121                 send_scan_event(drv, 0, tb);
2122                 break;
2123         case NL80211_CMD_SCHED_SCAN_RESULTS:
2124                 wpa_printf(MSG_DEBUG,
2125                            "nl80211: New sched scan results available");
2126                 send_scan_event(drv, 0, tb);
2127                 break;
2128         case NL80211_CMD_SCAN_ABORTED:
2129                 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
2130                 /*
2131                  * Need to indicate that scan results are available in order
2132                  * not to make wpa_supplicant stop its scanning.
2133                  */
2134                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2135                                      drv->ctx);
2136                 send_scan_event(drv, 1, tb);
2137                 break;
2138         case NL80211_CMD_AUTHENTICATE:
2139         case NL80211_CMD_ASSOCIATE:
2140         case NL80211_CMD_DEAUTHENTICATE:
2141         case NL80211_CMD_DISASSOCIATE:
2142         case NL80211_CMD_FRAME_TX_STATUS:
2143         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
2144         case NL80211_CMD_UNPROT_DISASSOCIATE:
2145                 mlme_event(drv, cmd, tb[NL80211_ATTR_FRAME],
2146                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2147                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2148                            tb[NL80211_ATTR_COOKIE],
2149                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2150                 break;
2151         case NL80211_CMD_CONNECT:
2152         case NL80211_CMD_ROAM:
2153                 mlme_event_connect(drv, cmd,
2154                                    tb[NL80211_ATTR_STATUS_CODE],
2155                                    tb[NL80211_ATTR_MAC],
2156                                    tb[NL80211_ATTR_REQ_IE],
2157                                    tb[NL80211_ATTR_RESP_IE]);
2158                 break;
2159         case NL80211_CMD_CH_SWITCH_NOTIFY:
2160                 mlme_event_ch_switch(drv, tb[NL80211_ATTR_WIPHY_FREQ],
2161                                      tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2162                 break;
2163         case NL80211_CMD_DISCONNECT:
2164                 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
2165                                       tb[NL80211_ATTR_MAC],
2166                                       tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
2167                 break;
2168         case NL80211_CMD_MICHAEL_MIC_FAILURE:
2169                 mlme_event_michael_mic_failure(drv, tb);
2170                 break;
2171         case NL80211_CMD_JOIN_IBSS:
2172                 mlme_event_join_ibss(drv, tb);
2173                 break;
2174         case NL80211_CMD_REMAIN_ON_CHANNEL:
2175                 mlme_event_remain_on_channel(drv, 0, tb);
2176                 break;
2177         case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
2178                 mlme_event_remain_on_channel(drv, 1, tb);
2179                 break;
2180         case NL80211_CMD_NOTIFY_CQM:
2181                 nl80211_cqm_event(drv, tb);
2182                 break;
2183         case NL80211_CMD_REG_CHANGE:
2184                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
2185                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2186                                      NULL);
2187                 break;
2188         case NL80211_CMD_REG_BEACON_HINT:
2189                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
2190                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2191                                      NULL);
2192                 break;
2193         case NL80211_CMD_NEW_STATION:
2194                 nl80211_new_station_event(drv, tb);
2195                 break;
2196         case NL80211_CMD_DEL_STATION:
2197                 nl80211_del_station_event(drv, tb);
2198                 break;
2199         case NL80211_CMD_SET_REKEY_OFFLOAD:
2200                 nl80211_rekey_offload_event(drv, tb);
2201                 break;
2202         case NL80211_CMD_PMKSA_CANDIDATE:
2203                 nl80211_pmksa_candidate_event(drv, tb);
2204                 break;
2205         case NL80211_CMD_PROBE_CLIENT:
2206                 nl80211_client_probe_event(drv, tb);
2207                 break;
2208         default:
2209                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
2210                            "(cmd=%d)", cmd);
2211                 break;
2212         }
2213 }
2214
2215
2216 static int process_drv_event(struct nl_msg *msg, void *arg)
2217 {
2218         struct wpa_driver_nl80211_data *drv = arg;
2219         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2220         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2221
2222         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2223                   genlmsg_attrlen(gnlh, 0), NULL);
2224
2225         if (tb[NL80211_ATTR_IFINDEX]) {
2226                 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2227                 if (ifindex != drv->ifindex && !have_ifidx(drv, ifindex)) {
2228                         wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
2229                                    " for foreign interface (ifindex %d)",
2230                                    gnlh->cmd, ifindex);
2231                         return NL_SKIP;
2232                 }
2233         }
2234
2235         do_process_drv_event(drv, gnlh->cmd, tb);
2236         return NL_SKIP;
2237 }
2238
2239
2240 static int process_global_event(struct nl_msg *msg, void *arg)
2241 {
2242         struct nl80211_global *global = arg;
2243         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2244         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2245         struct wpa_driver_nl80211_data *drv, *tmp;
2246         int ifidx = -1;
2247
2248         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2249                   genlmsg_attrlen(gnlh, 0), NULL);
2250
2251         if (tb[NL80211_ATTR_IFINDEX])
2252                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2253
2254         dl_list_for_each_safe(drv, tmp, &global->interfaces,
2255                               struct wpa_driver_nl80211_data, list) {
2256                 if (ifidx == -1 || ifidx == drv->ifindex ||
2257                     have_ifidx(drv, ifidx))
2258                         do_process_drv_event(drv, gnlh->cmd, tb);
2259         }
2260
2261         return NL_SKIP;
2262 }
2263
2264
2265 static int process_bss_event(struct nl_msg *msg, void *arg)
2266 {
2267         struct i802_bss *bss = arg;
2268         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2269         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2270
2271         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2272                   genlmsg_attrlen(gnlh, 0), NULL);
2273
2274         switch (gnlh->cmd) {
2275         case NL80211_CMD_FRAME:
2276         case NL80211_CMD_FRAME_TX_STATUS:
2277                 mlme_event(bss->drv, gnlh->cmd, tb[NL80211_ATTR_FRAME],
2278                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2279                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2280                            tb[NL80211_ATTR_COOKIE],
2281                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2282                 break;
2283         case NL80211_CMD_UNEXPECTED_FRAME:
2284                 nl80211_spurious_frame(bss, tb, 0);
2285                 break;
2286         case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
2287                 nl80211_spurious_frame(bss, tb, 1);
2288                 break;
2289         default:
2290                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
2291                            "(cmd=%d)", gnlh->cmd);
2292                 break;
2293         }
2294
2295         return NL_SKIP;
2296 }
2297
2298
2299 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
2300                                              void *handle)
2301 {
2302         struct nl_cb *cb = eloop_ctx;
2303
2304         wpa_printf(MSG_DEBUG, "nl80211: Event message available");
2305
2306         nl_recvmsgs(handle, cb);
2307 }
2308
2309
2310 /**
2311  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
2312  * @priv: driver_nl80211 private data
2313  * @alpha2_arg: country to which to switch to
2314  * Returns: 0 on success, -1 on failure
2315  *
2316  * This asks nl80211 to set the regulatory domain for given
2317  * country ISO / IEC alpha2.
2318  */
2319 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
2320 {
2321         struct i802_bss *bss = priv;
2322         struct wpa_driver_nl80211_data *drv = bss->drv;
2323         char alpha2[3];
2324         struct nl_msg *msg;
2325
2326         msg = nlmsg_alloc();
2327         if (!msg)
2328                 return -ENOMEM;
2329
2330         alpha2[0] = alpha2_arg[0];
2331         alpha2[1] = alpha2_arg[1];
2332         alpha2[2] = '\0';
2333
2334         nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
2335
2336         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
2337         if (send_and_recv_msgs(drv, msg, NULL, NULL))
2338                 return -EINVAL;
2339         return 0;
2340 nla_put_failure:
2341         nlmsg_free(msg);
2342         return -EINVAL;
2343 }
2344
2345
2346 struct wiphy_info_data {
2347         struct wpa_driver_capa *capa;
2348
2349         unsigned int error:1;
2350         unsigned int device_ap_sme:1;
2351         unsigned int poll_command_supported:1;
2352         unsigned int data_tx_status:1;
2353         unsigned int monitor_supported:1;
2354 };
2355
2356
2357 static unsigned int probe_resp_offload_support(int supp_protocols)
2358 {
2359         unsigned int prot = 0;
2360
2361         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS)
2362                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS;
2363         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2)
2364                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2;
2365         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P)
2366                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P;
2367         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U)
2368                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING;
2369
2370         return prot;
2371 }
2372
2373
2374 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
2375 {
2376         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2377         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2378         struct wiphy_info_data *info = arg;
2379         int p2p_go_supported = 0, p2p_client_supported = 0;
2380         int p2p_concurrent = 0;
2381         int auth_supported = 0, connect_supported = 0;
2382         struct wpa_driver_capa *capa = info->capa;
2383         static struct nla_policy
2384         iface_combination_policy[NUM_NL80211_IFACE_COMB] = {
2385                 [NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
2386                 [NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
2387                 [NL80211_IFACE_COMB_STA_AP_BI_MATCH] = { .type = NLA_FLAG },
2388                 [NL80211_IFACE_COMB_NUM_CHANNELS] = { .type = NLA_U32 },
2389         },
2390         iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
2391                 [NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
2392                 [NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
2393         };
2394
2395         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2396                   genlmsg_attrlen(gnlh, 0), NULL);
2397
2398         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
2399                 capa->max_scan_ssids =
2400                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
2401
2402         if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS])
2403                 capa->max_sched_scan_ssids =
2404                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS]);
2405
2406         if (tb[NL80211_ATTR_MAX_MATCH_SETS])
2407                 capa->max_match_sets =
2408                         nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
2409
2410         if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) {
2411                 struct nlattr *nl_mode;
2412                 int i;
2413                 nla_for_each_nested(nl_mode,
2414                                     tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
2415                         switch (nla_type(nl_mode)) {
2416                         case NL80211_IFTYPE_AP:
2417                                 capa->flags |= WPA_DRIVER_FLAGS_AP;
2418                                 break;
2419                         case NL80211_IFTYPE_P2P_GO:
2420                                 p2p_go_supported = 1;
2421                                 break;
2422                         case NL80211_IFTYPE_P2P_CLIENT:
2423                                 p2p_client_supported = 1;
2424                                 break;
2425                         case NL80211_IFTYPE_MONITOR:
2426                                 info->monitor_supported = 1;
2427                                 break;
2428                         }
2429                 }
2430         }
2431
2432         if (tb[NL80211_ATTR_INTERFACE_COMBINATIONS]) {
2433                 struct nlattr *nl_combi;
2434                 int rem_combi;
2435
2436                 nla_for_each_nested(nl_combi,
2437                                     tb[NL80211_ATTR_INTERFACE_COMBINATIONS],
2438                                     rem_combi) {
2439                         struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
2440                         struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
2441                         struct nlattr *nl_limit, *nl_mode;
2442                         int err, rem_limit, rem_mode;
2443                         int combination_has_p2p = 0, combination_has_mgd = 0;
2444
2445                         err = nla_parse_nested(tb_comb, MAX_NL80211_IFACE_COMB,
2446                                                nl_combi,
2447                                                iface_combination_policy);
2448                         if (err || !tb_comb[NL80211_IFACE_COMB_LIMITS] ||
2449                             !tb_comb[NL80211_IFACE_COMB_MAXNUM] ||
2450                             !tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS])
2451                                 goto broken_combination;
2452
2453                         nla_for_each_nested(nl_limit,
2454                                             tb_comb[NL80211_IFACE_COMB_LIMITS],
2455                                             rem_limit) {
2456                                 err = nla_parse_nested(tb_limit,
2457                                                        MAX_NL80211_IFACE_LIMIT,
2458                                                        nl_limit,
2459                                                        iface_limit_policy);
2460                                 if (err ||
2461                                     !tb_limit[NL80211_IFACE_LIMIT_TYPES])
2462                                         goto broken_combination;
2463
2464                                 nla_for_each_nested(
2465                                         nl_mode,
2466                                         tb_limit[NL80211_IFACE_LIMIT_TYPES],
2467                                         rem_mode) {
2468                                         int ift = nla_type(nl_mode);
2469                                         if (ift == NL80211_IFTYPE_P2P_GO ||
2470                                             ift == NL80211_IFTYPE_P2P_CLIENT)
2471                                                 combination_has_p2p = 1;
2472                                         if (ift == NL80211_IFTYPE_STATION)
2473                                                 combination_has_mgd = 1;
2474                                 }
2475                                 if (combination_has_p2p && combination_has_mgd)
2476                                         break;
2477                         }
2478
2479                         if (combination_has_p2p && combination_has_mgd) {
2480                                 p2p_concurrent = 1;
2481                                 break;
2482                         }
2483
2484 broken_combination:
2485                         ;
2486                 }
2487         }
2488
2489         if (tb[NL80211_ATTR_SUPPORTED_COMMANDS]) {
2490                 struct nlattr *nl_cmd;
2491                 int i;
2492
2493                 nla_for_each_nested(nl_cmd,
2494                                     tb[NL80211_ATTR_SUPPORTED_COMMANDS], i) {
2495                         switch (nla_get_u32(nl_cmd)) {
2496                         case NL80211_CMD_AUTHENTICATE:
2497                                 auth_supported = 1;
2498                                 break;
2499                         case NL80211_CMD_CONNECT:
2500                                 connect_supported = 1;
2501                                 break;
2502                         case NL80211_CMD_START_SCHED_SCAN:
2503                                 capa->sched_scan_supported = 1;
2504                                 break;
2505                         case NL80211_CMD_PROBE_CLIENT:
2506                                 info->poll_command_supported = 1;
2507                                 break;
2508                         }
2509                 }
2510         }
2511
2512         if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) {
2513                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
2514                            "off-channel TX");
2515                 capa->flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
2516         }
2517
2518         if (tb[NL80211_ATTR_ROAM_SUPPORT]) {
2519                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based roaming");
2520                 capa->flags |= WPA_DRIVER_FLAGS_BSS_SELECTION;
2521         }
2522
2523         /* default to 5000 since early versions of mac80211 don't set it */
2524         capa->max_remain_on_chan = 5000;
2525
2526         if (tb[NL80211_ATTR_SUPPORT_AP_UAPSD])
2527                 capa->flags |= WPA_DRIVER_FLAGS_AP_UAPSD;
2528
2529         if (tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION])
2530                 capa->max_remain_on_chan =
2531                         nla_get_u32(tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
2532
2533         if (auth_supported)
2534                 capa->flags |= WPA_DRIVER_FLAGS_SME;
2535         else if (!connect_supported) {
2536                 wpa_printf(MSG_INFO, "nl80211: Driver does not support "
2537                            "authentication/association or connect commands");
2538                 info->error = 1;
2539         }
2540
2541         if (p2p_go_supported && p2p_client_supported)
2542                 capa->flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
2543         if (p2p_concurrent) {
2544                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
2545                            "interface (driver advertised support)");
2546                 capa->flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
2547                 capa->flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
2548         }
2549
2550         if (tb[NL80211_ATTR_TDLS_SUPPORT]) {
2551                 wpa_printf(MSG_DEBUG, "nl80211: TDLS supported");
2552                 capa->flags |= WPA_DRIVER_FLAGS_TDLS_SUPPORT;
2553
2554                 if (tb[NL80211_ATTR_TDLS_EXTERNAL_SETUP]) {
2555                         wpa_printf(MSG_DEBUG, "nl80211: TDLS external setup");
2556                         capa->flags |=
2557                                 WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP;
2558                 }
2559         }
2560
2561         if (tb[NL80211_ATTR_DEVICE_AP_SME])
2562                 info->device_ap_sme = 1;
2563
2564         if (tb[NL80211_ATTR_FEATURE_FLAGS]) {
2565                 u32 flags = nla_get_u32(tb[NL80211_ATTR_FEATURE_FLAGS]);
2566
2567                 if (flags & NL80211_FEATURE_SK_TX_STATUS)
2568                         info->data_tx_status = 1;
2569
2570                 if (flags & NL80211_FEATURE_INACTIVITY_TIMER)
2571                         capa->flags |= WPA_DRIVER_FLAGS_INACTIVITY_TIMER;
2572         }
2573
2574         if (tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]) {
2575                 int protocols =
2576                         nla_get_u32(tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]);
2577                 wpa_printf(MSG_DEBUG, "nl80211: Supports Probe Response "
2578                            "offload in AP mode");
2579                 capa->flags |= WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD;
2580                 capa->probe_resp_offloads =
2581                         probe_resp_offload_support(protocols);
2582         }
2583
2584         return NL_SKIP;
2585 }
2586
2587
2588 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
2589                                        struct wiphy_info_data *info)
2590 {
2591         struct nl_msg *msg;
2592
2593         os_memset(info, 0, sizeof(*info));
2594         info->capa = &drv->capa;
2595
2596         msg = nlmsg_alloc();
2597         if (!msg)
2598                 return -1;
2599
2600         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
2601
2602         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->first_bss.ifindex);
2603
2604         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
2605                 return 0;
2606         msg = NULL;
2607 nla_put_failure:
2608         nlmsg_free(msg);
2609         return -1;
2610 }
2611
2612
2613 static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
2614 {
2615         struct wiphy_info_data info;
2616         if (wpa_driver_nl80211_get_info(drv, &info))
2617                 return -1;
2618
2619         if (info.error)
2620                 return -1;
2621
2622         drv->has_capability = 1;
2623         /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
2624         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
2625                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
2626                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
2627                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
2628         drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
2629                 WPA_DRIVER_CAPA_ENC_WEP104 |
2630                 WPA_DRIVER_CAPA_ENC_TKIP |
2631                 WPA_DRIVER_CAPA_ENC_CCMP;
2632         drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
2633                 WPA_DRIVER_AUTH_SHARED |
2634                 WPA_DRIVER_AUTH_LEAP;
2635
2636         drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES;
2637         drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
2638         drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
2639
2640         if (!info.device_ap_sme) {
2641                 drv->capa.flags |= WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS;
2642
2643                 /*
2644                  * No AP SME is currently assumed to also indicate no AP MLME
2645                  * in the driver/firmware.
2646                  */
2647                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_MLME;
2648         }
2649
2650         drv->device_ap_sme = info.device_ap_sme;
2651         drv->poll_command_supported = info.poll_command_supported;
2652         drv->data_tx_status = info.data_tx_status;
2653
2654         /*
2655          * If poll command is supported mac80211 is new enough to
2656          * have everything we need to not need monitor interfaces.
2657          */
2658         drv->use_monitor = !info.poll_command_supported;
2659
2660         if (drv->device_ap_sme && drv->use_monitor) {
2661                 /*
2662                  * Non-mac80211 drivers may not support monitor interface.
2663                  * Make sure we do not get stuck with incorrect capability here
2664                  * by explicitly testing this.
2665                  */
2666                 if (!info.monitor_supported) {
2667                         wpa_printf(MSG_DEBUG, "nl80211: Disable use_monitor "
2668                                    "with device_ap_sme since no monitor mode "
2669                                    "support detected");
2670                         drv->use_monitor = 0;
2671                 }
2672         }
2673
2674         /*
2675          * If we aren't going to use monitor interfaces, but the
2676          * driver doesn't support data TX status, we won't get TX
2677          * status for EAPOL frames.
2678          */
2679         if (!drv->use_monitor && !info.data_tx_status)
2680                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
2681
2682         return 0;
2683 }
2684
2685
2686 #ifdef ANDROID
2687 static int android_genl_ctrl_resolve(struct nl_handle *handle,
2688                                      const char *name)
2689 {
2690         /*
2691          * Android ICS has very minimal genl_ctrl_resolve() implementation, so
2692          * need to work around that.
2693          */
2694         struct nl_cache *cache = NULL;
2695         struct genl_family *nl80211 = NULL;
2696         int id = -1;
2697
2698         if (genl_ctrl_alloc_cache(handle, &cache) < 0) {
2699                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
2700                            "netlink cache");
2701                 goto fail;
2702         }
2703
2704         nl80211 = genl_ctrl_search_by_name(cache, name);
2705         if (nl80211 == NULL)
2706                 goto fail;
2707
2708         id = genl_family_get_id(nl80211);
2709
2710 fail:
2711         if (nl80211)
2712                 genl_family_put(nl80211);
2713         if (cache)
2714                 nl_cache_free(cache);
2715
2716         return id;
2717 }
2718 #define genl_ctrl_resolve android_genl_ctrl_resolve
2719 #endif /* ANDROID */
2720
2721
2722 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
2723 {
2724         int ret;
2725
2726         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
2727         if (global->nl_cb == NULL) {
2728                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
2729                            "callbacks");
2730                 return -1;
2731         }
2732
2733         global->nl = nl_create_handle(global->nl_cb, "nl");
2734         if (global->nl == NULL)
2735                 goto err;
2736
2737         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
2738         if (global->nl80211_id < 0) {
2739                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
2740                            "found");
2741                 goto err;
2742         }
2743
2744         global->nl_event = nl_create_handle(global->nl_cb, "event");
2745         if (global->nl_event == NULL)
2746                 goto err;
2747
2748         ret = nl_get_multicast_id(global, "nl80211", "scan");
2749         if (ret >= 0)
2750                 ret = nl_socket_add_membership(global->nl_event, ret);
2751         if (ret < 0) {
2752                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
2753                            "membership for scan events: %d (%s)",
2754                            ret, strerror(-ret));
2755                 goto err;
2756         }
2757
2758         ret = nl_get_multicast_id(global, "nl80211", "mlme");
2759         if (ret >= 0)
2760                 ret = nl_socket_add_membership(global->nl_event, ret);
2761         if (ret < 0) {
2762                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
2763                            "membership for mlme events: %d (%s)",
2764                            ret, strerror(-ret));
2765                 goto err;
2766         }
2767
2768         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
2769         if (ret >= 0)
2770                 ret = nl_socket_add_membership(global->nl_event, ret);
2771         if (ret < 0) {
2772                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
2773                            "membership for regulatory events: %d (%s)",
2774                            ret, strerror(-ret));
2775                 /* Continue without regulatory events */
2776         }
2777
2778         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
2779                   no_seq_check, NULL);
2780         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
2781                   process_global_event, global);
2782
2783         eloop_register_read_sock(nl_socket_get_fd(global->nl_event),
2784                                  wpa_driver_nl80211_event_receive,
2785                                  global->nl_cb, global->nl_event);
2786
2787         return 0;
2788
2789 err:
2790         nl_destroy_handles(&global->nl_event);
2791         nl_destroy_handles(&global->nl);
2792         nl_cb_put(global->nl_cb);
2793         global->nl_cb = NULL;
2794         return -1;
2795 }
2796
2797
2798 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
2799 {
2800         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
2801         if (!drv->nl_cb) {
2802                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
2803                 return -1;
2804         }
2805
2806         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
2807                   no_seq_check, NULL);
2808         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
2809                   process_drv_event, drv);
2810
2811         return 0;
2812 }
2813
2814
2815 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
2816 {
2817         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
2818         /*
2819          * This may be for any interface; use ifdown event to disable
2820          * interface.
2821          */
2822 }
2823
2824
2825 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
2826 {
2827         struct wpa_driver_nl80211_data *drv = ctx;
2828         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
2829         if (linux_set_iface_flags(drv->global->ioctl_sock,
2830                                   drv->first_bss.ifname, 1)) {
2831                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
2832                            "after rfkill unblock");
2833                 return;
2834         }
2835         /* rtnetlink ifup handler will report interface as enabled */
2836 }
2837
2838
2839 static void nl80211_get_phy_name(struct wpa_driver_nl80211_data *drv)
2840 {
2841         /* Find phy (radio) to which this interface belongs */
2842         char buf[90], *pos;
2843         int f, rv;
2844
2845         drv->phyname[0] = '\0';
2846         snprintf(buf, sizeof(buf) - 1, "/sys/class/net/%s/phy80211/name",
2847                  drv->first_bss.ifname);
2848         f = open(buf, O_RDONLY);
2849         if (f < 0) {
2850                 wpa_printf(MSG_DEBUG, "Could not open file %s: %s",
2851                            buf, strerror(errno));
2852                 return;
2853         }
2854
2855         rv = read(f, drv->phyname, sizeof(drv->phyname) - 1);
2856         close(f);
2857         if (rv < 0) {
2858                 wpa_printf(MSG_DEBUG, "Could not read file %s: %s",
2859                            buf, strerror(errno));
2860                 return;
2861         }
2862
2863         drv->phyname[rv] = '\0';
2864         pos = os_strchr(drv->phyname, '\n');
2865         if (pos)
2866                 *pos = '\0';
2867         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2868                    drv->first_bss.ifname, drv->phyname);
2869 }
2870
2871
2872 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
2873                                                       void *eloop_ctx,
2874                                                       void *handle)
2875 {
2876         struct wpa_driver_nl80211_data *drv = eloop_ctx;
2877         u8 data[2048];
2878         struct msghdr msg;
2879         struct iovec entry;
2880         u8 control[512];
2881         struct cmsghdr *cmsg;
2882         int res, found_ee = 0, found_wifi = 0, acked = 0;
2883         union wpa_event_data event;
2884
2885         memset(&msg, 0, sizeof(msg));
2886         msg.msg_iov = &entry;
2887         msg.msg_iovlen = 1;
2888         entry.iov_base = data;
2889         entry.iov_len = sizeof(data);
2890         msg.msg_control = &control;
2891         msg.msg_controllen = sizeof(control);
2892
2893         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
2894         /* if error or not fitting 802.3 header, return */
2895         if (res < 14)
2896                 return;
2897
2898         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
2899         {
2900                 if (cmsg->cmsg_level == SOL_SOCKET &&
2901                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
2902                         int *ack;
2903
2904                         found_wifi = 1;
2905                         ack = (void *)CMSG_DATA(cmsg);
2906                         acked = *ack;
2907                 }
2908
2909                 if (cmsg->cmsg_level == SOL_PACKET &&
2910                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
2911                         struct sock_extended_err *err =
2912                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
2913
2914                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
2915                                 found_ee = 1;
2916                 }
2917         }
2918
2919         if (!found_ee || !found_wifi)
2920                 return;
2921
2922         memset(&event, 0, sizeof(event));
2923         event.eapol_tx_status.dst = data;
2924         event.eapol_tx_status.data = data + 14;
2925         event.eapol_tx_status.data_len = res - 14;
2926         event.eapol_tx_status.ack = acked;
2927         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
2928 }
2929
2930
2931 static int nl80211_init_bss(struct i802_bss *bss)
2932 {
2933         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
2934         if (!bss->nl_cb)
2935                 return -1;
2936
2937         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
2938                   no_seq_check, NULL);
2939         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
2940                   process_bss_event, bss);
2941
2942         return 0;
2943 }
2944
2945
2946 static void nl80211_destroy_bss(struct i802_bss *bss)
2947 {
2948         nl_cb_put(bss->nl_cb);
2949         bss->nl_cb = NULL;
2950 }
2951
2952
2953 /**
2954  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
2955  * @ctx: context to be used when calling wpa_supplicant functions,
2956  * e.g., wpa_supplicant_event()
2957  * @ifname: interface name, e.g., wlan0
2958  * @global_priv: private driver global data from global_init()
2959  * Returns: Pointer to private data, %NULL on failure
2960  */
2961 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
2962                                       void *global_priv)
2963 {
2964         struct wpa_driver_nl80211_data *drv;
2965         struct rfkill_config *rcfg;
2966         struct i802_bss *bss;
2967
2968         if (global_priv == NULL)
2969                 return NULL;
2970         drv = os_zalloc(sizeof(*drv));
2971         if (drv == NULL)
2972                 return NULL;
2973         drv->global = global_priv;
2974         drv->ctx = ctx;
2975         bss = &drv->first_bss;
2976         bss->drv = drv;
2977         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
2978         drv->monitor_ifidx = -1;
2979         drv->monitor_sock = -1;
2980         drv->eapol_tx_sock = -1;
2981         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2982
2983         if (wpa_driver_nl80211_init_nl(drv)) {
2984                 os_free(drv);
2985                 return NULL;
2986         }
2987
2988         if (nl80211_init_bss(bss))
2989                 goto failed;
2990
2991         nl80211_get_phy_name(drv);
2992
2993         rcfg = os_zalloc(sizeof(*rcfg));
2994         if (rcfg == NULL)
2995                 goto failed;
2996         rcfg->ctx = drv;
2997         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
2998         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
2999         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
3000         drv->rfkill = rfkill_init(rcfg);
3001         if (drv->rfkill == NULL) {
3002                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
3003                 os_free(rcfg);
3004         }
3005
3006         if (wpa_driver_nl80211_finish_drv_init(drv))
3007                 goto failed;
3008
3009         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
3010         if (drv->eapol_tx_sock < 0)
3011                 goto failed;
3012
3013         if (drv->data_tx_status) {
3014                 int enabled = 1;
3015
3016                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
3017                                &enabled, sizeof(enabled)) < 0) {
3018                         wpa_printf(MSG_DEBUG,
3019                                 "nl80211: wifi status sockopt failed\n");
3020                         drv->data_tx_status = 0;
3021                         if (!drv->use_monitor)
3022                                 drv->capa.flags &=
3023                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3024                 } else {
3025                         eloop_register_read_sock(drv->eapol_tx_sock,
3026                                 wpa_driver_nl80211_handle_eapol_tx_status,
3027                                 drv, NULL);
3028                 }
3029         }
3030
3031         if (drv->global) {
3032                 dl_list_add(&drv->global->interfaces, &drv->list);
3033                 drv->in_interface_list = 1;
3034         }
3035
3036         return bss;
3037
3038 failed:
3039         wpa_driver_nl80211_deinit(bss);
3040         return NULL;
3041 }
3042
3043
3044 static int nl80211_register_frame(struct i802_bss *bss,
3045                                   struct nl_handle *nl_handle,
3046                                   u16 type, const u8 *match, size_t match_len)
3047 {
3048         struct wpa_driver_nl80211_data *drv = bss->drv;
3049         struct nl_msg *msg;
3050         int ret = -1;
3051
3052         msg = nlmsg_alloc();
3053         if (!msg)
3054                 return -1;
3055
3056         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x nl_handle=%p",
3057                    type, nl_handle);
3058         wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3059                     match, match_len);
3060
3061         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
3062
3063         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
3064         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
3065         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
3066
3067         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
3068         msg = NULL;
3069         if (ret) {
3070                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
3071                            "failed (type=%u): ret=%d (%s)",
3072                            type, ret, strerror(-ret));
3073                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3074                             match, match_len);
3075                 goto nla_put_failure;
3076         }
3077         ret = 0;
3078 nla_put_failure:
3079         nlmsg_free(msg);
3080         return ret;
3081 }
3082
3083
3084 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
3085 {
3086         struct wpa_driver_nl80211_data *drv = bss->drv;
3087
3088         if (bss->nl_mgmt) {
3089                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
3090                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
3091                 return -1;
3092         }
3093
3094         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
3095         if (bss->nl_mgmt == NULL)
3096                 return -1;
3097
3098         eloop_register_read_sock(nl_socket_get_fd(bss->nl_mgmt),
3099                                  wpa_driver_nl80211_event_receive, bss->nl_cb,
3100                                  bss->nl_mgmt);
3101
3102         return 0;
3103 }
3104
3105
3106 static int nl80211_register_action_frame(struct i802_bss *bss,
3107                                          const u8 *match, size_t match_len)
3108 {
3109         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
3110         return nl80211_register_frame(bss, bss->nl_mgmt,
3111                                       type, match, match_len);
3112 }
3113
3114
3115 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
3116 {
3117         struct wpa_driver_nl80211_data *drv = bss->drv;
3118
3119         if (nl80211_alloc_mgmt_handle(bss))
3120                 return -1;
3121         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
3122                    "handle %p", bss->nl_mgmt);
3123
3124 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
3125         /* GAS Initial Request */
3126         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
3127                 return -1;
3128         /* GAS Initial Response */
3129         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
3130                 return -1;
3131         /* GAS Comeback Request */
3132         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
3133                 return -1;
3134         /* GAS Comeback Response */
3135         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
3136                 return -1;
3137 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
3138 #ifdef CONFIG_P2P
3139         /* P2P Public Action */
3140         if (nl80211_register_action_frame(bss,
3141                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
3142                                           6) < 0)
3143                 return -1;
3144         /* P2P Action */
3145         if (nl80211_register_action_frame(bss,
3146                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
3147                                           5) < 0)
3148                 return -1;
3149 #endif /* CONFIG_P2P */
3150 #ifdef CONFIG_IEEE80211W
3151         /* SA Query Response */
3152         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
3153                 return -1;
3154 #endif /* CONFIG_IEEE80211W */
3155 #ifdef CONFIG_TDLS
3156         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
3157                 /* TDLS Discovery Response */
3158                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
3159                     0)
3160                         return -1;
3161         }
3162 #endif /* CONFIG_TDLS */
3163
3164         /* FT Action frames */
3165         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
3166                 return -1;
3167         else
3168                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
3169                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
3170
3171         /* WNM - BSS Transition Management Request */
3172         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
3173                 return -1;
3174
3175         return 0;
3176 }
3177
3178
3179 static int nl80211_register_spurious_class3(struct i802_bss *bss)
3180 {
3181         struct wpa_driver_nl80211_data *drv = bss->drv;
3182         struct nl_msg *msg;
3183         int ret = -1;
3184
3185         msg = nlmsg_alloc();
3186         if (!msg)
3187                 return -1;
3188
3189         nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
3190
3191         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
3192
3193         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
3194         msg = NULL;
3195         if (ret) {
3196                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
3197                            "failed: ret=%d (%s)",
3198                            ret, strerror(-ret));
3199                 goto nla_put_failure;
3200         }
3201         ret = 0;
3202 nla_put_failure:
3203         nlmsg_free(msg);
3204         return ret;
3205 }
3206
3207
3208 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
3209 {
3210         static const int stypes[] = {
3211                 WLAN_FC_STYPE_AUTH,
3212                 WLAN_FC_STYPE_ASSOC_REQ,
3213                 WLAN_FC_STYPE_REASSOC_REQ,
3214                 WLAN_FC_STYPE_DISASSOC,
3215                 WLAN_FC_STYPE_DEAUTH,
3216                 WLAN_FC_STYPE_ACTION,
3217                 WLAN_FC_STYPE_PROBE_REQ,
3218 /* Beacon doesn't work as mac80211 doesn't currently allow
3219  * it, but it wouldn't really be the right thing anyway as
3220  * it isn't per interface ... maybe just dump the scan
3221  * results periodically for OLBC?
3222  */
3223 //              WLAN_FC_STYPE_BEACON,
3224         };
3225         unsigned int i;
3226
3227         if (nl80211_alloc_mgmt_handle(bss))
3228                 return -1;
3229         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
3230                    "handle %p", bss->nl_mgmt);
3231
3232         for (i = 0; i < sizeof(stypes) / sizeof(stypes[0]); i++) {
3233                 if (nl80211_register_frame(bss, bss->nl_mgmt,
3234                                            (WLAN_FC_TYPE_MGMT << 2) |
3235                                            (stypes[i] << 4),
3236                                            NULL, 0) < 0) {
3237                         goto out_err;
3238                 }
3239         }
3240
3241         if (nl80211_register_spurious_class3(bss))
3242                 goto out_err;
3243
3244         if (nl80211_get_wiphy_data_ap(bss) == NULL)
3245                 goto out_err;
3246
3247         return 0;
3248
3249 out_err:
3250         eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3251         nl_destroy_handles(&bss->nl_mgmt);
3252         return -1;
3253 }
3254
3255
3256 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
3257 {
3258         if (nl80211_alloc_mgmt_handle(bss))
3259                 return -1;
3260         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
3261                    "handle %p (device SME)", bss->nl_mgmt);
3262
3263         if (nl80211_register_frame(bss, bss->nl_mgmt,
3264                                    (WLAN_FC_TYPE_MGMT << 2) |
3265                                    (WLAN_FC_STYPE_ACTION << 4),
3266                                    NULL, 0) < 0)
3267                 goto out_err;
3268
3269         return 0;
3270
3271 out_err:
3272         eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3273         nl_destroy_handles(&bss->nl_mgmt);
3274         return -1;
3275 }
3276
3277
3278 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
3279 {
3280         if (bss->nl_mgmt == NULL)
3281                 return;
3282         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
3283                    "(%s)", bss->nl_mgmt, reason);
3284         eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3285         nl_destroy_handles(&bss->nl_mgmt);
3286
3287         nl80211_put_wiphy_data_ap(bss);
3288 }
3289
3290
3291 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
3292 {
3293         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
3294 }
3295
3296
3297 static int
3298 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
3299 {
3300         struct i802_bss *bss = &drv->first_bss;
3301         int send_rfkill_event = 0;
3302
3303         drv->ifindex = if_nametoindex(bss->ifname);
3304         drv->first_bss.ifindex = drv->ifindex;
3305
3306 #ifndef HOSTAPD
3307         /*
3308          * Make sure the interface starts up in station mode unless this is a
3309          * dynamically added interface (e.g., P2P) that was already configured
3310          * with proper iftype.
3311          */
3312         if (drv->ifindex != drv->global->if_add_ifindex &&
3313             wpa_driver_nl80211_set_mode(bss, NL80211_IFTYPE_STATION) < 0) {
3314                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver to "
3315                            "use managed mode");
3316                 return -1;
3317         }
3318
3319         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
3320                 if (rfkill_is_blocked(drv->rfkill)) {
3321                         wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
3322                                    "interface '%s' due to rfkill",
3323                                    bss->ifname);
3324                         drv->if_disabled = 1;
3325                         send_rfkill_event = 1;
3326                 } else {
3327                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
3328                                    "interface '%s' UP", bss->ifname);
3329                         return -1;
3330                 }
3331         }
3332
3333         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
3334                                1, IF_OPER_DORMANT);
3335 #endif /* HOSTAPD */
3336
3337         if (wpa_driver_nl80211_capa(drv))
3338                 return -1;
3339
3340         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
3341                                bss->addr))
3342                 return -1;
3343
3344         if (send_rfkill_event) {
3345                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
3346                                        drv, drv->ctx);
3347         }
3348
3349         return 0;
3350 }
3351
3352
3353 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
3354 {
3355         struct nl_msg *msg;
3356
3357         msg = nlmsg_alloc();
3358         if (!msg)
3359                 return -ENOMEM;
3360
3361         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
3362         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3363
3364         return send_and_recv_msgs(drv, msg, NULL, NULL);
3365  nla_put_failure:
3366         nlmsg_free(msg);
3367         return -ENOBUFS;
3368 }
3369
3370
3371 /**
3372  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
3373  * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
3374  *
3375  * Shut down driver interface and processing of driver events. Free
3376  * private data buffer if one was allocated in wpa_driver_nl80211_init().
3377  */
3378 static void wpa_driver_nl80211_deinit(void *priv)
3379 {
3380         struct i802_bss *bss = priv;
3381         struct wpa_driver_nl80211_data *drv = bss->drv;
3382
3383         bss->in_deinit = 1;
3384         if (drv->data_tx_status)
3385                 eloop_unregister_read_sock(drv->eapol_tx_sock);
3386         if (drv->eapol_tx_sock >= 0)
3387                 close(drv->eapol_tx_sock);
3388
3389         if (bss->nl_preq)
3390                 wpa_driver_nl80211_probe_req_report(bss, 0);
3391         if (bss->added_if_into_bridge) {
3392                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
3393                                     bss->ifname) < 0)
3394                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
3395                                    "interface %s from bridge %s: %s",
3396                                    bss->ifname, bss->brname, strerror(errno));
3397         }
3398         if (bss->added_bridge) {
3399                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
3400                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
3401                                    "bridge %s: %s",
3402                                    bss->brname, strerror(errno));
3403         }
3404
3405         nl80211_remove_monitor_interface(drv);
3406
3407         if (is_ap_interface(drv->nlmode))
3408                 wpa_driver_nl80211_del_beacon(drv);
3409
3410 #ifdef HOSTAPD
3411         if (drv->last_freq_ht) {
3412                 /* Clear HT flags from the driver */
3413                 struct hostapd_freq_params freq;
3414                 os_memset(&freq, 0, sizeof(freq));
3415                 freq.freq = drv->last_freq;
3416                 i802_set_freq(priv, &freq);
3417         }
3418
3419         if (drv->eapol_sock >= 0) {
3420                 eloop_unregister_read_sock(drv->eapol_sock);
3421                 close(drv->eapol_sock);
3422         }
3423
3424         if (drv->if_indices != drv->default_if_indices)
3425                 os_free(drv->if_indices);
3426 #endif /* HOSTAPD */
3427
3428         if (drv->disabled_11b_rates)
3429                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
3430
3431         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
3432                                IF_OPER_UP);
3433         rfkill_deinit(drv->rfkill);
3434
3435         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
3436
3437         (void) linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0);
3438         wpa_driver_nl80211_set_mode(bss, NL80211_IFTYPE_STATION);
3439         nl80211_mgmt_unsubscribe(bss, "deinit");
3440
3441         nl_cb_put(drv->nl_cb);
3442
3443         nl80211_destroy_bss(&drv->first_bss);
3444
3445         os_free(drv->filter_ssids);
3446
3447         os_free(drv->auth_ie);
3448
3449         if (drv->in_interface_list)
3450                 dl_list_del(&drv->list);
3451
3452         os_free(drv);
3453 }
3454
3455
3456 /**
3457  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
3458  * @eloop_ctx: Driver private data
3459  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
3460  *
3461  * This function can be used as registered timeout when starting a scan to
3462  * generate a scan completed event if the driver does not report this.
3463  */
3464 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
3465 {
3466         struct wpa_driver_nl80211_data *drv = eloop_ctx;
3467         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
3468                 wpa_driver_nl80211_set_mode(&drv->first_bss,
3469                                             drv->ap_scan_as_station);
3470                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
3471         }
3472         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
3473         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
3474 }
3475
3476
3477 static struct nl_msg *
3478 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
3479                     struct wpa_driver_scan_params *params)
3480 {
3481         struct nl_msg *msg;
3482         int err;
3483         size_t i;
3484
3485         msg = nlmsg_alloc();
3486         if (!msg)
3487                 return NULL;
3488
3489         nl80211_cmd(drv, msg, 0, cmd);
3490
3491         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, drv->ifindex) < 0)
3492                 goto fail;
3493
3494         if (params->num_ssids) {
3495                 struct nl_msg *ssids = nlmsg_alloc();
3496                 if (ssids == NULL)
3497                         goto fail;
3498                 for (i = 0; i < params->num_ssids; i++) {
3499                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
3500                                           params->ssids[i].ssid,
3501                                           params->ssids[i].ssid_len);
3502                         if (nla_put(ssids, i + 1, params->ssids[i].ssid_len,
3503                                     params->ssids[i].ssid) < 0) {
3504                                 nlmsg_free(ssids);
3505                                 goto fail;
3506                         }
3507                 }
3508                 err = nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
3509                 nlmsg_free(ssids);
3510                 if (err < 0)
3511                         goto fail;
3512         }
3513
3514         if (params->extra_ies) {
3515                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
3516                             params->extra_ies, params->extra_ies_len);
3517                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
3518                             params->extra_ies) < 0)
3519                         goto fail;
3520         }
3521
3522         if (params->freqs) {
3523                 struct nl_msg *freqs = nlmsg_alloc();
3524                 if (freqs == NULL)
3525                         goto fail;
3526                 for (i = 0; params->freqs[i]; i++) {
3527                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
3528                                    "MHz", params->freqs[i]);
3529                         if (nla_put_u32(freqs, i + 1, params->freqs[i]) < 0) {
3530                                 nlmsg_free(freqs);
3531                                 goto fail;
3532                         }
3533                 }
3534                 err = nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES,
3535                                      freqs);
3536                 nlmsg_free(freqs);
3537                 if (err < 0)
3538                         goto fail;
3539         }
3540
3541         os_free(drv->filter_ssids);
3542         drv->filter_ssids = params->filter_ssids;
3543         params->filter_ssids = NULL;
3544         drv->num_filter_ssids = params->num_filter_ssids;
3545
3546         return msg;
3547
3548 fail:
3549         nlmsg_free(msg);
3550         return NULL;
3551 }
3552
3553
3554 /**
3555  * wpa_driver_nl80211_scan - Request the driver to initiate scan
3556  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
3557  * @params: Scan parameters
3558  * Returns: 0 on success, -1 on failure
3559  */
3560 static int wpa_driver_nl80211_scan(void *priv,
3561                                    struct wpa_driver_scan_params *params)
3562 {
3563         struct i802_bss *bss = priv;
3564         struct wpa_driver_nl80211_data *drv = bss->drv;
3565         int ret = -1, timeout;
3566         struct nl_msg *msg, *rates = NULL;
3567
3568         drv->scan_for_auth = 0;
3569
3570         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params);
3571         if (!msg)
3572                 return -1;
3573
3574         if (params->p2p_probe) {
3575                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
3576
3577                 rates = nlmsg_alloc();
3578                 if (rates == NULL)
3579                         goto nla_put_failure;
3580
3581                 /*
3582                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
3583                  * by masking out everything else apart from the OFDM rates 6,
3584                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
3585                  * rates are left enabled.
3586                  */
3587                 NLA_PUT(rates, NL80211_BAND_2GHZ, 8,
3588                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
3589                 if (nla_put_nested(msg, NL80211_ATTR_SCAN_SUPP_RATES, rates) <
3590                     0)
3591                         goto nla_put_failure;
3592
3593                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
3594         }
3595
3596         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3597         msg = NULL;
3598         if (ret) {
3599                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
3600                            "(%s)", ret, strerror(-ret));
3601 #ifdef HOSTAPD
3602                 if (is_ap_interface(drv->nlmode)) {
3603                         /*
3604                          * mac80211 does not allow scan requests in AP mode, so
3605                          * try to do this in station mode.
3606                          */
3607                         if (wpa_driver_nl80211_set_mode(
3608                                     bss, NL80211_IFTYPE_STATION))
3609                                 goto nla_put_failure;
3610
3611                         if (wpa_driver_nl80211_scan(drv, params)) {
3612                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
3613                                 goto nla_put_failure;
3614                         }
3615
3616                         /* Restore AP mode when processing scan results */
3617                         drv->ap_scan_as_station = drv->nlmode;
3618                         ret = 0;
3619                 } else
3620                         goto nla_put_failure;
3621 #else /* HOSTAPD */
3622                 goto nla_put_failure;
3623 #endif /* HOSTAPD */
3624         }
3625
3626         /* Not all drivers generate "scan completed" wireless event, so try to
3627          * read results after a timeout. */
3628         timeout = 10;
3629         if (drv->scan_complete_events) {
3630                 /*
3631                  * The driver seems to deliver events to notify when scan is
3632                  * complete, so use longer timeout to avoid race conditions
3633                  * with scanning and following association request.
3634                  */
3635                 timeout = 30;
3636         }
3637         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
3638                    "seconds", ret, timeout);
3639         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
3640         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
3641                                drv, drv->ctx);
3642
3643 nla_put_failure:
3644         nlmsg_free(msg);
3645         nlmsg_free(rates);
3646         return ret;
3647 }
3648
3649
3650 /**
3651  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
3652  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
3653  * @params: Scan parameters
3654  * @interval: Interval between scan cycles in milliseconds
3655  * Returns: 0 on success, -1 on failure or if not supported
3656  */
3657 static int wpa_driver_nl80211_sched_scan(void *priv,
3658                                          struct wpa_driver_scan_params *params,
3659                                          u32 interval)
3660 {
3661         struct i802_bss *bss = priv;
3662         struct wpa_driver_nl80211_data *drv = bss->drv;
3663         int ret = -1;
3664         struct nl_msg *msg;
3665         struct nl_msg *match_set_ssid = NULL, *match_sets = NULL;
3666         struct nl_msg *match_set_rssi = NULL;
3667         size_t i;
3668
3669 #ifdef ANDROID
3670         if (!drv->capa.sched_scan_supported)
3671                 return android_pno_start(bss, params);
3672 #endif /* ANDROID */
3673
3674         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params);
3675         if (!msg)
3676                 goto nla_put_failure;
3677
3678         NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
3679
3680         if ((drv->num_filter_ssids &&
3681             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
3682             params->filter_rssi) {
3683                 match_sets = nlmsg_alloc();
3684                 if (match_sets == NULL)
3685                         goto nla_put_failure;
3686
3687                 for (i = 0; i < drv->num_filter_ssids; i++) {
3688                         wpa_hexdump_ascii(MSG_MSGDUMP,
3689                                           "nl80211: Sched scan filter SSID",
3690                                           drv->filter_ssids[i].ssid,
3691                                           drv->filter_ssids[i].ssid_len);
3692
3693                         match_set_ssid = nlmsg_alloc();
3694                         if (match_set_ssid == NULL)
3695                                 goto nla_put_failure;
3696                         NLA_PUT(match_set_ssid,
3697                                 NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
3698                                 drv->filter_ssids[i].ssid_len,
3699                                 drv->filter_ssids[i].ssid);
3700
3701                         if (nla_put_nested(match_sets, i + 1, match_set_ssid) <
3702                             0)
3703                                 goto nla_put_failure;
3704                 }
3705
3706                 if (params->filter_rssi) {
3707                         match_set_rssi = nlmsg_alloc();
3708                         if (match_set_rssi == NULL)
3709                                 goto nla_put_failure;
3710                         NLA_PUT_U32(match_set_rssi,
3711                                     NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
3712                                     params->filter_rssi);
3713                         wpa_printf(MSG_MSGDUMP,
3714                                    "nl80211: Sched scan RSSI filter %d dBm",
3715                                    params->filter_rssi);
3716                         if (nla_put_nested(match_sets, 0, match_set_rssi) < 0)
3717                                 goto nla_put_failure;
3718                 }
3719
3720                 if (nla_put_nested(msg, NL80211_ATTR_SCHED_SCAN_MATCH,
3721                                    match_sets) < 0)
3722                         goto nla_put_failure;
3723         }
3724
3725         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3726
3727         /* TODO: if we get an error here, we should fall back to normal scan */
3728
3729         msg = NULL;
3730         if (ret) {
3731                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
3732                            "ret=%d (%s)", ret, strerror(-ret));
3733                 goto nla_put_failure;
3734         }
3735
3736         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
3737                    "scan interval %d msec", ret, interval);
3738
3739 nla_put_failure:
3740         nlmsg_free(match_set_ssid);
3741         nlmsg_free(match_sets);
3742         nlmsg_free(match_set_rssi);
3743         nlmsg_free(msg);
3744         return ret;
3745 }
3746
3747
3748 /**
3749  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
3750  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
3751  * Returns: 0 on success, -1 on failure or if not supported
3752  */
3753 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
3754 {
3755         struct i802_bss *bss = priv;
3756         struct wpa_driver_nl80211_data *drv = bss->drv;
3757         int ret = 0;
3758         struct nl_msg *msg;
3759
3760 #ifdef ANDROID
3761         if (!drv->capa.sched_scan_supported)
3762                 return android_pno_stop(bss);
3763 #endif /* ANDROID */
3764
3765         msg = nlmsg_alloc();
3766         if (!msg)
3767                 return -1;
3768
3769         nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
3770
3771         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3772
3773         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3774         msg = NULL;
3775         if (ret) {
3776                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
3777                            "ret=%d (%s)", ret, strerror(-ret));
3778                 goto nla_put_failure;
3779         }
3780
3781         wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
3782
3783 nla_put_failure:
3784         nlmsg_free(msg);
3785         return ret;
3786 }
3787
3788
3789 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
3790 {
3791         const u8 *end, *pos;
3792
3793         if (ies == NULL)
3794                 return NULL;
3795
3796         pos = ies;
3797         end = ies + ies_len;
3798
3799         while (pos + 1 < end) {
3800                 if (pos + 2 + pos[1] > end)
3801                         break;
3802                 if (pos[0] == ie)
3803                         return pos;
3804                 pos += 2 + pos[1];
3805         }
3806
3807         return NULL;
3808 }
3809
3810
3811 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
3812                                  const u8 *ie, size_t ie_len)
3813 {
3814         const u8 *ssid;
3815         size_t i;
3816
3817         if (drv->filter_ssids == NULL)
3818                 return 0;
3819
3820         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
3821         if (ssid == NULL)
3822                 return 1;
3823
3824         for (i = 0; i < drv->num_filter_ssids; i++) {
3825                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
3826                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
3827                     0)
3828                         return 0;
3829         }
3830
3831         return 1;
3832 }
3833
3834
3835 static int bss_info_handler(struct nl_msg *msg, void *arg)
3836 {
3837         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3838         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3839         struct nlattr *bss[NL80211_BSS_MAX + 1];
3840         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
3841                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
3842                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
3843                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
3844                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
3845                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
3846                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
3847                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
3848                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
3849                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
3850                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
3851                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
3852         };
3853         struct nl80211_bss_info_arg *_arg = arg;
3854         struct wpa_scan_results *res = _arg->res;
3855         struct wpa_scan_res **tmp;
3856         struct wpa_scan_res *r;
3857         const u8 *ie, *beacon_ie;
3858         size_t ie_len, beacon_ie_len;
3859         u8 *pos;
3860         size_t i;
3861
3862         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3863                   genlmsg_attrlen(gnlh, 0), NULL);
3864         if (!tb[NL80211_ATTR_BSS])
3865                 return NL_SKIP;
3866         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
3867                              bss_policy))
3868                 return NL_SKIP;
3869         if (bss[NL80211_BSS_STATUS]) {
3870                 enum nl80211_bss_status status;
3871                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
3872                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
3873                     bss[NL80211_BSS_FREQUENCY]) {
3874                         _arg->assoc_freq =
3875                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
3876                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
3877                                    _arg->assoc_freq);
3878                 }
3879                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
3880                     bss[NL80211_BSS_BSSID]) {
3881                         os_memcpy(_arg->assoc_bssid,
3882                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
3883                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
3884                                    MACSTR, MAC2STR(_arg->assoc_bssid));
3885                 }
3886         }
3887         if (!res)
3888                 return NL_SKIP;
3889         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
3890                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
3891                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
3892         } else {
3893                 ie = NULL;
3894                 ie_len = 0;
3895         }
3896         if (bss[NL80211_BSS_BEACON_IES]) {
3897                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
3898                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
3899         } else {
3900                 beacon_ie = NULL;
3901                 beacon_ie_len = 0;
3902         }
3903
3904         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
3905                                   ie ? ie_len : beacon_ie_len))
3906                 return NL_SKIP;
3907
3908         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
3909         if (r == NULL)
3910                 return NL_SKIP;
3911         if (bss[NL80211_BSS_BSSID])
3912                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
3913                           ETH_ALEN);
3914         if (bss[NL80211_BSS_FREQUENCY])
3915                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
3916         if (bss[NL80211_BSS_BEACON_INTERVAL])
3917                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
3918         if (bss[NL80211_BSS_CAPABILITY])
3919                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
3920         r->flags |= WPA_SCAN_NOISE_INVALID;
3921         if (bss[NL80211_BSS_SIGNAL_MBM]) {
3922                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
3923                 r->level /= 100; /* mBm to dBm */
3924                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
3925         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
3926                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
3927                 r->flags |= WPA_SCAN_QUAL_INVALID;
3928         } else
3929                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
3930         if (bss[NL80211_BSS_TSF])
3931                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
3932         if (bss[NL80211_BSS_SEEN_MS_AGO])
3933                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
3934         r->ie_len = ie_len;
3935         pos = (u8 *) (r + 1);
3936         if (ie) {
3937                 os_memcpy(pos, ie, ie_len);
3938                 pos += ie_len;
3939         }
3940         r->beacon_ie_len = beacon_ie_len;
3941         if (beacon_ie)
3942                 os_memcpy(pos, beacon_ie, beacon_ie_len);
3943
3944         if (bss[NL80211_BSS_STATUS]) {
3945                 enum nl80211_bss_status status;
3946                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
3947                 switch (status) {
3948                 case NL80211_BSS_STATUS_AUTHENTICATED:
3949                         r->flags |= WPA_SCAN_AUTHENTICATED;
3950                         break;
3951                 case NL80211_BSS_STATUS_ASSOCIATED:
3952                         r->flags |= WPA_SCAN_ASSOCIATED;
3953                         break;
3954                 default:
3955                         break;
3956                 }
3957         }
3958
3959         /*
3960          * cfg80211 maintains separate BSS table entries for APs if the same
3961          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
3962          * not use frequency as a separate key in the BSS table, so filter out
3963          * duplicated entries. Prefer associated BSS entry in such a case in
3964          * order to get the correct frequency into the BSS table.
3965          */
3966         for (i = 0; i < res->num; i++) {
3967                 const u8 *s1, *s2;
3968                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
3969                         continue;
3970
3971                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
3972                                     res->res[i]->ie_len, WLAN_EID_SSID);
3973                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
3974                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
3975                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
3976                         continue;
3977
3978                 /* Same BSSID,SSID was already included in scan results */
3979                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
3980                            "for " MACSTR, MAC2STR(r->bssid));
3981
3982                 if ((r->flags & WPA_SCAN_ASSOCIATED) &&
3983                     !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) {
3984                         os_free(res->res[i]);
3985                         res->res[i] = r;
3986                 } else
3987                         os_free(r);
3988                 return NL_SKIP;
3989         }
3990
3991         tmp = os_realloc_array(res->res, res->num + 1,
3992                                sizeof(struct wpa_scan_res *));
3993         if (tmp == NULL) {
3994                 os_free(r);
3995                 return NL_SKIP;
3996         }
3997         tmp[res->num++] = r;
3998         res->res = tmp;
3999
4000         return NL_SKIP;
4001 }
4002
4003
4004 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
4005                                  const u8 *addr)
4006 {
4007         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
4008                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
4009                            "mismatch (" MACSTR ")", MAC2STR(addr));
4010                 wpa_driver_nl80211_mlme(drv, addr,
4011                                         NL80211_CMD_DEAUTHENTICATE,
4012                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
4013         }
4014 }
4015
4016
4017 static void wpa_driver_nl80211_check_bss_status(
4018         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
4019 {
4020         size_t i;
4021
4022         for (i = 0; i < res->num; i++) {
4023                 struct wpa_scan_res *r = res->res[i];
4024                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
4025                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4026                                    "indicates BSS status with " MACSTR
4027                                    " as authenticated",
4028                                    MAC2STR(r->bssid));
4029                         if (is_sta_interface(drv->nlmode) &&
4030                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
4031                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
4032                             0) {
4033                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
4034                                            " in local state (auth=" MACSTR
4035                                            " assoc=" MACSTR ")",
4036                                            MAC2STR(drv->auth_bssid),
4037                                            MAC2STR(drv->bssid));
4038                                 clear_state_mismatch(drv, r->bssid);
4039                         }
4040                 }
4041
4042                 if (r->flags & WPA_SCAN_ASSOCIATED) {
4043                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4044                                    "indicate BSS status with " MACSTR
4045                                    " as associated",
4046                                    MAC2STR(r->bssid));
4047                         if (is_sta_interface(drv->nlmode) &&
4048                             !drv->associated) {
4049                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4050                                            "(not associated) does not match "
4051                                            "with BSS state");
4052                                 clear_state_mismatch(drv, r->bssid);
4053                         } else if (is_sta_interface(drv->nlmode) &&
4054                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
4055                                    0) {
4056                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4057                                            "(associated with " MACSTR ") does "
4058                                            "not match with BSS state",
4059                                            MAC2STR(drv->bssid));
4060                                 clear_state_mismatch(drv, r->bssid);
4061                                 clear_state_mismatch(drv, drv->bssid);
4062                         }
4063                 }
4064         }
4065 }
4066
4067
4068 static struct wpa_scan_results *
4069 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
4070 {
4071         struct nl_msg *msg;
4072         struct wpa_scan_results *res;
4073         int ret;
4074         struct nl80211_bss_info_arg arg;
4075
4076         res = os_zalloc(sizeof(*res));
4077         if (res == NULL)
4078                 return NULL;
4079         msg = nlmsg_alloc();
4080         if (!msg)
4081                 goto nla_put_failure;
4082
4083         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
4084         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4085
4086         arg.drv = drv;
4087         arg.res = res;
4088         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
4089         msg = NULL;
4090         if (ret == 0) {
4091                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
4092                            "BSSes)", (unsigned long) res->num);
4093                 nl80211_get_noise_for_scan_results(drv, res);
4094                 return res;
4095         }
4096         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
4097                    "(%s)", ret, strerror(-ret));
4098 nla_put_failure:
4099         nlmsg_free(msg);
4100         wpa_scan_results_free(res);
4101         return NULL;
4102 }
4103
4104
4105 /**
4106  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
4107  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
4108  * Returns: Scan results on success, -1 on failure
4109  */
4110 static struct wpa_scan_results *
4111 wpa_driver_nl80211_get_scan_results(void *priv)
4112 {
4113         struct i802_bss *bss = priv;
4114         struct wpa_driver_nl80211_data *drv = bss->drv;
4115         struct wpa_scan_results *res;
4116
4117         res = nl80211_get_scan_results(drv);
4118         if (res)
4119                 wpa_driver_nl80211_check_bss_status(drv, res);
4120         return res;
4121 }
4122
4123
4124 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
4125 {
4126         struct wpa_scan_results *res;
4127         size_t i;
4128
4129         res = nl80211_get_scan_results(drv);
4130         if (res == NULL) {
4131                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
4132                 return;
4133         }
4134
4135         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
4136         for (i = 0; i < res->num; i++) {
4137                 struct wpa_scan_res *r = res->res[i];
4138                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
4139                            (int) i, (int) res->num, MAC2STR(r->bssid),
4140                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
4141                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
4142         }
4143
4144         wpa_scan_results_free(res);
4145 }
4146
4147
4148 static int wpa_driver_nl80211_set_key(const char *ifname, void *priv,
4149                                       enum wpa_alg alg, const u8 *addr,
4150                                       int key_idx, int set_tx,
4151                                       const u8 *seq, size_t seq_len,
4152                                       const u8 *key, size_t key_len)
4153 {
4154         struct i802_bss *bss = priv;
4155         struct wpa_driver_nl80211_data *drv = bss->drv;
4156         int ifindex = if_nametoindex(ifname);
4157         struct nl_msg *msg;
4158         int ret;
4159
4160         wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d "
4161                    "set_tx=%d seq_len=%lu key_len=%lu",
4162                    __func__, ifindex, alg, addr, key_idx, set_tx,
4163                    (unsigned long) seq_len, (unsigned long) key_len);
4164 #ifdef CONFIG_TDLS
4165         if (key_idx == -1)
4166                 key_idx = 0;
4167 #endif /* CONFIG_TDLS */
4168
4169         msg = nlmsg_alloc();
4170         if (!msg)
4171                 return -ENOMEM;
4172
4173         if (alg == WPA_ALG_NONE) {
4174                 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
4175         } else {
4176                 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
4177                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
4178                 switch (alg) {
4179                 case WPA_ALG_WEP:
4180                         if (key_len == 5)
4181                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4182                                             WLAN_CIPHER_SUITE_WEP40);
4183                         else
4184                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4185                                             WLAN_CIPHER_SUITE_WEP104);
4186                         break;
4187                 case WPA_ALG_TKIP:
4188                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4189                                     WLAN_CIPHER_SUITE_TKIP);
4190                         break;
4191                 case WPA_ALG_CCMP:
4192                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4193                                     WLAN_CIPHER_SUITE_CCMP);
4194                         break;
4195                 case WPA_ALG_IGTK:
4196                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4197                                     WLAN_CIPHER_SUITE_AES_CMAC);
4198                         break;
4199                 default:
4200                         wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
4201                                    "algorithm %d", __func__, alg);
4202                         nlmsg_free(msg);
4203                         return -1;
4204                 }
4205         }
4206
4207         if (seq && seq_len)
4208                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
4209
4210         if (addr && !is_broadcast_ether_addr(addr)) {
4211                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
4212                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4213
4214                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
4215                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
4216                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
4217                                     NL80211_KEYTYPE_GROUP);
4218                 }
4219         } else if (addr && is_broadcast_ether_addr(addr)) {
4220                 struct nl_msg *types;
4221                 int err;
4222                 wpa_printf(MSG_DEBUG, "   broadcast key");
4223                 types = nlmsg_alloc();
4224                 if (!types)
4225                         goto nla_put_failure;
4226                 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
4227                 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4228                                      types);
4229                 nlmsg_free(types);
4230                 if (err)
4231                         goto nla_put_failure;
4232         }
4233         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
4234         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4235
4236         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4237         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
4238                 ret = 0;
4239         if (ret)
4240                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
4241                            ret, strerror(-ret));
4242
4243         /*
4244          * If we failed or don't need to set the default TX key (below),
4245          * we're done here.
4246          */
4247         if (ret || !set_tx || alg == WPA_ALG_NONE)
4248                 return ret;
4249         if (is_ap_interface(drv->nlmode) && addr &&
4250             !is_broadcast_ether_addr(addr))
4251                 return ret;
4252
4253         msg = nlmsg_alloc();
4254         if (!msg)
4255                 return -ENOMEM;
4256
4257         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
4258         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
4259         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4260         if (alg == WPA_ALG_IGTK)
4261                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
4262         else
4263                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
4264         if (addr && is_broadcast_ether_addr(addr)) {
4265                 struct nl_msg *types;
4266                 int err;
4267                 types = nlmsg_alloc();
4268                 if (!types)
4269                         goto nla_put_failure;
4270                 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
4271                 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4272                                      types);
4273                 nlmsg_free(types);
4274                 if (err)
4275                         goto nla_put_failure;
4276         } else if (addr) {
4277                 struct nl_msg *types;
4278                 int err;
4279                 types = nlmsg_alloc();
4280                 if (!types)
4281                         goto nla_put_failure;
4282                 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_UNICAST);
4283                 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4284                                      types);
4285                 nlmsg_free(types);
4286                 if (err)
4287                         goto nla_put_failure;
4288         }
4289
4290         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4291         if (ret == -ENOENT)
4292                 ret = 0;
4293         if (ret)
4294                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
4295                            "err=%d %s)", ret, strerror(-ret));
4296         return ret;
4297
4298 nla_put_failure:
4299         nlmsg_free(msg);
4300         return -ENOBUFS;
4301 }
4302
4303
4304 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
4305                       int key_idx, int defkey,
4306                       const u8 *seq, size_t seq_len,
4307                       const u8 *key, size_t key_len)
4308 {
4309         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
4310         if (!key_attr)
4311                 return -1;
4312
4313         if (defkey && alg == WPA_ALG_IGTK)
4314                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
4315         else if (defkey)
4316                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
4317
4318         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
4319
4320         switch (alg) {
4321         case WPA_ALG_WEP:
4322                 if (key_len == 5)
4323                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4324                                     WLAN_CIPHER_SUITE_WEP40);
4325                 else
4326                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4327                                     WLAN_CIPHER_SUITE_WEP104);
4328                 break;
4329         case WPA_ALG_TKIP:
4330                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP);
4331                 break;
4332         case WPA_ALG_CCMP:
4333                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP);
4334                 break;
4335         case WPA_ALG_IGTK:
4336                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4337                             WLAN_CIPHER_SUITE_AES_CMAC);
4338                 break;
4339         default:
4340                 wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
4341                            "algorithm %d", __func__, alg);
4342                 return -1;
4343         }
4344
4345         if (seq && seq_len)
4346                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
4347
4348         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
4349
4350         nla_nest_end(msg, key_attr);
4351
4352         return 0;
4353  nla_put_failure:
4354         return -1;
4355 }
4356
4357
4358 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
4359                                  struct nl_msg *msg)
4360 {
4361         int i, privacy = 0;
4362         struct nlattr *nl_keys, *nl_key;
4363
4364         for (i = 0; i < 4; i++) {
4365                 if (!params->wep_key[i])
4366                         continue;
4367                 privacy = 1;
4368                 break;
4369         }
4370         if (params->wps == WPS_MODE_PRIVACY)
4371                 privacy = 1;
4372         if (params->pairwise_suite &&
4373             params->pairwise_suite != WPA_CIPHER_NONE)
4374                 privacy = 1;
4375
4376         if (!privacy)
4377                 return 0;
4378
4379         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
4380
4381         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
4382         if (!nl_keys)
4383                 goto nla_put_failure;
4384
4385         for (i = 0; i < 4; i++) {
4386                 if (!params->wep_key[i])
4387                         continue;
4388
4389                 nl_key = nla_nest_start(msg, i);
4390                 if (!nl_key)
4391                         goto nla_put_failure;
4392
4393                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
4394                         params->wep_key[i]);
4395                 if (params->wep_key_len[i] == 5)
4396                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4397                                     WLAN_CIPHER_SUITE_WEP40);
4398                 else
4399                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4400                                     WLAN_CIPHER_SUITE_WEP104);
4401
4402                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
4403
4404                 if (i == params->wep_tx_keyidx)
4405                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
4406
4407                 nla_nest_end(msg, nl_key);
4408         }
4409         nla_nest_end(msg, nl_keys);
4410
4411         return 0;
4412
4413 nla_put_failure:
4414         return -ENOBUFS;
4415 }
4416
4417
4418 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
4419                                    const u8 *addr, int cmd, u16 reason_code,
4420                                    int local_state_change)
4421 {
4422         int ret = -1;
4423         struct nl_msg *msg;
4424
4425         msg = nlmsg_alloc();
4426         if (!msg)
4427                 return -1;
4428
4429         nl80211_cmd(drv, msg, 0, cmd);
4430
4431         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4432         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
4433         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4434         if (local_state_change)
4435                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
4436
4437         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4438         msg = NULL;
4439         if (ret) {
4440                 wpa_dbg(drv->ctx, MSG_DEBUG,
4441                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
4442                         reason_code, ret, strerror(-ret));
4443                 goto nla_put_failure;
4444         }
4445         ret = 0;
4446
4447 nla_put_failure:
4448         nlmsg_free(msg);
4449         return ret;
4450 }
4451
4452
4453 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
4454                                          const u8 *addr, int reason_code)
4455 {
4456         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
4457                    __func__, MAC2STR(addr), reason_code);
4458         drv->associated = 0;
4459         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISCONNECT,
4460                                        reason_code, 0);
4461 }
4462
4463
4464 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
4465                                              int reason_code)
4466 {
4467         struct i802_bss *bss = priv;
4468         struct wpa_driver_nl80211_data *drv = bss->drv;
4469         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
4470                 return wpa_driver_nl80211_disconnect(drv, addr, reason_code);
4471         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
4472                    __func__, MAC2STR(addr), reason_code);
4473         drv->associated = 0;
4474         if (drv->nlmode == NL80211_IFTYPE_ADHOC)
4475                 return nl80211_leave_ibss(drv);
4476         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
4477                                        reason_code, 0);
4478 }
4479
4480
4481 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
4482                                            int reason_code)
4483 {
4484         struct i802_bss *bss = priv;
4485         struct wpa_driver_nl80211_data *drv = bss->drv;
4486         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
4487                 return wpa_driver_nl80211_disconnect(drv, addr, reason_code);
4488         wpa_printf(MSG_DEBUG, "%s", __func__);
4489         drv->associated = 0;
4490         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
4491                                        reason_code, 0);
4492 }
4493
4494
4495 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
4496                                      struct wpa_driver_auth_params *params)
4497 {
4498         int i;
4499
4500         drv->auth_freq = params->freq;
4501         drv->auth_alg = params->auth_alg;
4502         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
4503         drv->auth_local_state_change = params->local_state_change;
4504         drv->auth_p2p = params->p2p;
4505
4506         if (params->bssid)
4507                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
4508         else
4509                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
4510
4511         if (params->ssid) {
4512                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
4513                 drv->auth_ssid_len = params->ssid_len;
4514         } else
4515                 drv->auth_ssid_len = 0;
4516
4517
4518         os_free(drv->auth_ie);
4519         drv->auth_ie = NULL;
4520         drv->auth_ie_len = 0;
4521         if (params->ie) {
4522                 drv->auth_ie = os_malloc(params->ie_len);
4523                 if (drv->auth_ie) {
4524                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
4525                         drv->auth_ie_len = params->ie_len;
4526                 }
4527         }
4528
4529         for (i = 0; i < 4; i++) {
4530                 if (params->wep_key[i] && params->wep_key_len[i] &&
4531                     params->wep_key_len[i] <= 16) {
4532                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
4533                                   params->wep_key_len[i]);
4534                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
4535                 } else
4536                         drv->auth_wep_key_len[i] = 0;
4537         }
4538 }
4539
4540
4541 static int wpa_driver_nl80211_authenticate(
4542         void *priv, struct wpa_driver_auth_params *params)
4543 {
4544         struct i802_bss *bss = priv;
4545         struct wpa_driver_nl80211_data *drv = bss->drv;
4546         int ret = -1, i;
4547         struct nl_msg *msg;
4548         enum nl80211_auth_type type;
4549         enum nl80211_iftype nlmode;
4550         int count = 0;
4551         int is_retry;
4552
4553         is_retry = drv->retry_auth;
4554         drv->retry_auth = 0;
4555
4556         drv->associated = 0;
4557         os_memset(drv->auth_bssid, 0, ETH_ALEN);
4558         /* FIX: IBSS mode */
4559         nlmode = params->p2p ?
4560                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
4561         if (drv->nlmode != nlmode &&
4562             wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
4563                 return -1;
4564
4565 retry:
4566         msg = nlmsg_alloc();
4567         if (!msg)
4568                 return -1;
4569
4570         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
4571                    drv->ifindex);
4572
4573         nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
4574
4575         for (i = 0; i < 4; i++) {
4576                 if (!params->wep_key[i])
4577                         continue;
4578                 wpa_driver_nl80211_set_key(bss->ifname, priv, WPA_ALG_WEP,
4579                                            NULL, i,
4580                                            i == params->wep_tx_keyidx, NULL, 0,
4581                                            params->wep_key[i],
4582                                            params->wep_key_len[i]);
4583                 if (params->wep_tx_keyidx != i)
4584                         continue;
4585                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
4586                                params->wep_key[i], params->wep_key_len[i])) {
4587                         nlmsg_free(msg);
4588                         return -1;
4589                 }
4590         }
4591
4592         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4593         if (params->bssid) {
4594                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
4595                            MAC2STR(params->bssid));
4596                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
4597         }
4598         if (params->freq) {
4599                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
4600                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
4601         }
4602         if (params->ssid) {
4603                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4604                                   params->ssid, params->ssid_len);
4605                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
4606                         params->ssid);
4607         }
4608         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
4609         if (params->ie)
4610                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
4611         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4612                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
4613         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4614                 type = NL80211_AUTHTYPE_SHARED_KEY;
4615         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4616                 type = NL80211_AUTHTYPE_NETWORK_EAP;
4617         else if (params->auth_alg & WPA_AUTH_ALG_FT)
4618                 type = NL80211_AUTHTYPE_FT;
4619         else
4620                 goto nla_put_failure;
4621         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
4622         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
4623         if (params->local_state_change) {
4624                 wpa_printf(MSG_DEBUG, "  * Local state change only");
4625                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
4626         }
4627
4628         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4629         msg = NULL;
4630         if (ret) {
4631                 wpa_dbg(drv->ctx, MSG_DEBUG,
4632                         "nl80211: MLME command failed (auth): ret=%d (%s)",
4633                         ret, strerror(-ret));
4634                 count++;
4635                 if (ret == -EALREADY && count == 1 && params->bssid &&
4636                     !params->local_state_change) {
4637                         /*
4638                          * mac80211 does not currently accept new
4639                          * authentication if we are already authenticated. As a
4640                          * workaround, force deauthentication and try again.
4641                          */
4642                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
4643                                    "after forced deauthentication");
4644                         wpa_driver_nl80211_deauthenticate(
4645                                 bss, params->bssid,
4646                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
4647                         nlmsg_free(msg);
4648                         goto retry;
4649                 }
4650
4651                 if (ret == -ENOENT && params->freq && !is_retry) {
4652                         /*
4653                          * cfg80211 has likely expired the BSS entry even
4654                          * though it was previously available in our internal
4655                          * BSS table. To recover quickly, start a single
4656                          * channel scan on the specified channel.
4657                          */
4658                         struct wpa_driver_scan_params scan;
4659                         int freqs[2];
4660
4661                         os_memset(&scan, 0, sizeof(scan));
4662                         scan.num_ssids = 1;
4663                         if (params->ssid) {
4664                                 scan.ssids[0].ssid = params->ssid;
4665                                 scan.ssids[0].ssid_len = params->ssid_len;
4666                         }
4667                         freqs[0] = params->freq;
4668                         freqs[1] = 0;
4669                         scan.freqs = freqs;
4670                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
4671                                    "channel scan to refresh cfg80211 BSS "
4672                                    "entry");
4673                         ret = wpa_driver_nl80211_scan(bss, &scan);
4674                         if (ret == 0) {
4675                                 nl80211_copy_auth_params(drv, params);
4676                                 drv->scan_for_auth = 1;
4677                         }
4678                 } else if (is_retry) {
4679                         /*
4680                          * Need to indicate this with an event since the return
4681                          * value from the retry is not delivered to core code.
4682                          */
4683                         union wpa_event_data event;
4684                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
4685                                    "failed");
4686                         os_memset(&event, 0, sizeof(event));
4687                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
4688                                   ETH_ALEN);
4689                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
4690                                              &event);
4691                 }
4692
4693                 goto nla_put_failure;
4694         }
4695         ret = 0;
4696         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
4697                    "successfully");
4698
4699 nla_put_failure:
4700         nlmsg_free(msg);
4701         return ret;
4702 }
4703
4704
4705 static int wpa_driver_nl80211_authenticate_retry(
4706         struct wpa_driver_nl80211_data *drv)
4707 {
4708         struct wpa_driver_auth_params params;
4709         struct i802_bss *bss = &drv->first_bss;
4710         int i;
4711
4712         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
4713
4714         os_memset(&params, 0, sizeof(params));
4715         params.freq = drv->auth_freq;
4716         params.auth_alg = drv->auth_alg;
4717         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
4718         params.local_state_change = drv->auth_local_state_change;
4719         params.p2p = drv->auth_p2p;
4720
4721         if (!is_zero_ether_addr(drv->auth_bssid_))
4722                 params.bssid = drv->auth_bssid_;
4723
4724         if (drv->auth_ssid_len) {
4725                 params.ssid = drv->auth_ssid;
4726                 params.ssid_len = drv->auth_ssid_len;
4727         }
4728
4729         params.ie = drv->auth_ie;
4730         params.ie_len = drv->auth_ie_len;
4731
4732         for (i = 0; i < 4; i++) {
4733                 if (drv->auth_wep_key_len[i]) {
4734                         params.wep_key[i] = drv->auth_wep_key[i];
4735                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
4736                 }
4737         }
4738
4739         drv->retry_auth = 1;
4740         return wpa_driver_nl80211_authenticate(bss, &params);
4741 }
4742
4743
4744 struct phy_info_arg {
4745         u16 *num_modes;
4746         struct hostapd_hw_modes *modes;
4747 };
4748
4749 static int phy_info_handler(struct nl_msg *msg, void *arg)
4750 {
4751         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
4752         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4753         struct phy_info_arg *phy_info = arg;
4754
4755         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
4756
4757         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
4758         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
4759                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
4760                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
4761                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
4762                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
4763                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
4764                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
4765         };
4766
4767         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
4768         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
4769                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
4770                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG },
4771         };
4772
4773         struct nlattr *nl_band;
4774         struct nlattr *nl_freq;
4775         struct nlattr *nl_rate;
4776         int rem_band, rem_freq, rem_rate;
4777         struct hostapd_hw_modes *mode;
4778         int idx, mode_is_set;
4779
4780         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4781                   genlmsg_attrlen(gnlh, 0), NULL);
4782
4783         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
4784                 return NL_SKIP;
4785
4786         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) {
4787                 mode = os_realloc_array(phy_info->modes,
4788                                         *phy_info->num_modes + 1,
4789                                         sizeof(*mode));
4790                 if (!mode)
4791                         return NL_SKIP;
4792                 phy_info->modes = mode;
4793
4794                 mode_is_set = 0;
4795
4796                 mode = &phy_info->modes[*(phy_info->num_modes)];
4797                 memset(mode, 0, sizeof(*mode));
4798                 mode->flags = HOSTAPD_MODE_FLAG_HT_INFO_KNOWN;
4799                 *(phy_info->num_modes) += 1;
4800
4801                 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
4802                           nla_len(nl_band), NULL);
4803
4804                 if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) {
4805                         mode->ht_capab = nla_get_u16(
4806                                 tb_band[NL80211_BAND_ATTR_HT_CAPA]);
4807                 }
4808
4809                 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) {
4810                         mode->a_mpdu_params |= nla_get_u8(
4811                                 tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) &
4812                                 0x03;
4813                 }
4814
4815                 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) {
4816                         mode->a_mpdu_params |= nla_get_u8(
4817                                 tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) <<
4818                                 2;
4819                 }
4820
4821                 if (tb_band[NL80211_BAND_ATTR_HT_MCS_SET] &&
4822                     nla_len(tb_band[NL80211_BAND_ATTR_HT_MCS_SET])) {
4823                         u8 *mcs;
4824                         mcs = nla_data(tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
4825                         os_memcpy(mode->mcs_set, mcs, 16);
4826                 }
4827
4828                 if (tb_band[NL80211_BAND_ATTR_VHT_CAPA]) {
4829                         mode->vht_capab = nla_get_u32(
4830                                 tb_band[NL80211_BAND_ATTR_VHT_CAPA]);
4831                 }
4832
4833                 if (tb_band[NL80211_BAND_ATTR_VHT_MCS_SET] &&
4834                     nla_len(tb_band[NL80211_BAND_ATTR_VHT_MCS_SET])) {
4835                         u8 *mcs;
4836                         mcs = nla_data(tb_band[NL80211_BAND_ATTR_VHT_MCS_SET]);
4837                         os_memcpy(mode->vht_mcs_set, mcs, 8);
4838                 }
4839
4840                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
4841                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
4842                                   nla_len(nl_freq), freq_policy);
4843                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
4844                                 continue;
4845                         mode->num_channels++;
4846                 }
4847
4848                 mode->channels = os_calloc(mode->num_channels,
4849                                            sizeof(struct hostapd_channel_data));
4850                 if (!mode->channels)
4851                         return NL_SKIP;
4852
4853                 idx = 0;
4854
4855                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
4856                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
4857                                   nla_len(nl_freq), freq_policy);
4858                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
4859                                 continue;
4860
4861                         mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
4862                         mode->channels[idx].flag = 0;
4863
4864                         if (!mode_is_set) {
4865                                 /* crude heuristic */
4866                                 if (mode->channels[idx].freq < 4000)
4867                                         mode->mode = HOSTAPD_MODE_IEEE80211B;
4868                                 else
4869                                         mode->mode = HOSTAPD_MODE_IEEE80211A;
4870                                 mode_is_set = 1;
4871                         }
4872
4873                         /* crude heuristic */
4874                         if (mode->channels[idx].freq < 4000)
4875                                 if (mode->channels[idx].freq == 2484)
4876                                         mode->channels[idx].chan = 14;
4877                                 else
4878                                         mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5;
4879                         else
4880                                 mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000;
4881
4882                         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
4883                                 mode->channels[idx].flag |=
4884                                         HOSTAPD_CHAN_DISABLED;
4885                         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
4886                                 mode->channels[idx].flag |=
4887                                         HOSTAPD_CHAN_PASSIVE_SCAN;
4888                         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
4889                                 mode->channels[idx].flag |=
4890                                         HOSTAPD_CHAN_NO_IBSS;
4891                         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
4892                                 mode->channels[idx].flag |=
4893                                         HOSTAPD_CHAN_RADAR;
4894
4895                         if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
4896                             !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
4897                                 mode->channels[idx].max_tx_power =
4898                                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100;
4899
4900                         idx++;
4901                 }
4902
4903                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
4904                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
4905                                   nla_len(nl_rate), rate_policy);
4906                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
4907                                 continue;
4908                         mode->num_rates++;
4909                 }
4910
4911                 mode->rates = os_calloc(mode->num_rates, sizeof(int));
4912                 if (!mode->rates)
4913                         return NL_SKIP;
4914
4915                 idx = 0;
4916
4917                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
4918                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
4919                                   nla_len(nl_rate), rate_policy);
4920                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
4921                                 continue;
4922                         mode->rates[idx] = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]);
4923
4924                         /* crude heuristic */
4925                         if (mode->mode == HOSTAPD_MODE_IEEE80211B &&
4926                             mode->rates[idx] > 200)
4927                                 mode->mode = HOSTAPD_MODE_IEEE80211G;
4928
4929                         idx++;
4930                 }
4931         }
4932
4933         return NL_SKIP;
4934 }
4935
4936 static struct hostapd_hw_modes *
4937 wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes)
4938 {
4939         u16 m;
4940         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
4941         int i, mode11g_idx = -1;
4942
4943         /* If only 802.11g mode is included, use it to construct matching
4944          * 802.11b mode data. */
4945
4946         for (m = 0; m < *num_modes; m++) {
4947                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
4948                         return modes; /* 802.11b already included */
4949                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
4950                         mode11g_idx = m;
4951         }
4952
4953         if (mode11g_idx < 0)
4954                 return modes; /* 2.4 GHz band not supported at all */
4955
4956         nmodes = os_realloc_array(modes, *num_modes + 1, sizeof(*nmodes));
4957         if (nmodes == NULL)
4958                 return modes; /* Could not add 802.11b mode */
4959
4960         mode = &nmodes[*num_modes];
4961         os_memset(mode, 0, sizeof(*mode));
4962         (*num_modes)++;
4963         modes = nmodes;
4964
4965         mode->mode = HOSTAPD_MODE_IEEE80211B;
4966
4967         mode11g = &modes[mode11g_idx];
4968         mode->num_channels = mode11g->num_channels;
4969         mode->channels = os_malloc(mode11g->num_channels *
4970                                    sizeof(struct hostapd_channel_data));
4971         if (mode->channels == NULL) {
4972                 (*num_modes)--;
4973                 return modes; /* Could not add 802.11b mode */
4974         }
4975         os_memcpy(mode->channels, mode11g->channels,
4976                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
4977
4978         mode->num_rates = 0;
4979         mode->rates = os_malloc(4 * sizeof(int));
4980         if (mode->rates == NULL) {
4981                 os_free(mode->channels);
4982                 (*num_modes)--;
4983                 return modes; /* Could not add 802.11b mode */
4984         }
4985
4986         for (i = 0; i < mode11g->num_rates; i++) {
4987                 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
4988                     mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
4989                         continue;
4990                 mode->rates[mode->num_rates] = mode11g->rates[i];
4991                 mode->num_rates++;
4992                 if (mode->num_rates == 4)
4993                         break;
4994         }
4995
4996         if (mode->num_rates == 0) {
4997                 os_free(mode->channels);
4998                 os_free(mode->rates);
4999                 (*num_modes)--;
5000                 return modes; /* No 802.11b rates */
5001         }
5002
5003         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
5004                    "information");
5005
5006         return modes;
5007 }
5008
5009
5010 static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
5011                                   int end)
5012 {
5013         int c;
5014
5015         for (c = 0; c < mode->num_channels; c++) {
5016                 struct hostapd_channel_data *chan = &mode->channels[c];
5017                 if (chan->freq - 10 >= start && chan->freq + 10 <= end)
5018                         chan->flag |= HOSTAPD_CHAN_HT40;
5019         }
5020 }
5021
5022
5023 static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
5024                                       int end)
5025 {
5026         int c;
5027
5028         for (c = 0; c < mode->num_channels; c++) {
5029                 struct hostapd_channel_data *chan = &mode->channels[c];
5030                 if (!(chan->flag & HOSTAPD_CHAN_HT40))
5031                         continue;
5032                 if (chan->freq - 30 >= start && chan->freq - 10 <= end)
5033                         chan->flag |= HOSTAPD_CHAN_HT40MINUS;
5034                 if (chan->freq + 10 >= start && chan->freq + 30 <= end)
5035                         chan->flag |= HOSTAPD_CHAN_HT40PLUS;
5036         }
5037 }
5038
5039
5040 static void nl80211_reg_rule_ht40(struct nlattr *tb[],
5041                                   struct phy_info_arg *results)
5042 {
5043         u32 start, end, max_bw;
5044         u16 m;
5045
5046         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
5047             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
5048             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
5049                 return;
5050
5051         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
5052         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
5053         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
5054
5055         wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz",
5056                    start, end, max_bw);
5057         if (max_bw < 40)
5058                 return;
5059
5060         for (m = 0; m < *results->num_modes; m++) {
5061                 if (!(results->modes[m].ht_capab &
5062                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5063                         continue;
5064                 nl80211_set_ht40_mode(&results->modes[m], start, end);
5065         }
5066 }
5067
5068
5069 static void nl80211_reg_rule_sec(struct nlattr *tb[],
5070                                  struct phy_info_arg *results)
5071 {
5072         u32 start, end, max_bw;
5073         u16 m;
5074
5075         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
5076             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
5077             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
5078                 return;
5079
5080         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
5081         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
5082         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
5083
5084         if (max_bw < 20)
5085                 return;
5086
5087         for (m = 0; m < *results->num_modes; m++) {
5088                 if (!(results->modes[m].ht_capab &
5089                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5090                         continue;
5091                 nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
5092         }
5093 }
5094
5095
5096 static int nl80211_get_reg(struct nl_msg *msg, void *arg)
5097 {
5098         struct phy_info_arg *results = arg;
5099         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
5100         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5101         struct nlattr *nl_rule;
5102         struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
5103         int rem_rule;
5104         static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
5105                 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
5106                 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
5107                 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
5108                 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
5109                 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
5110                 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
5111         };
5112
5113         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5114                   genlmsg_attrlen(gnlh, 0), NULL);
5115         if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
5116             !tb_msg[NL80211_ATTR_REG_RULES]) {
5117                 wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
5118                            "available");
5119                 return NL_SKIP;
5120         }
5121
5122         wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
5123                    (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
5124
5125         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
5126         {
5127                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
5128                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
5129                 nl80211_reg_rule_ht40(tb_rule, results);
5130         }
5131
5132         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
5133         {
5134                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
5135                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
5136                 nl80211_reg_rule_sec(tb_rule, results);
5137         }
5138
5139         return NL_SKIP;
5140 }
5141
5142
5143 static int nl80211_set_ht40_flags(struct wpa_driver_nl80211_data *drv,
5144                                   struct phy_info_arg *results)
5145 {
5146         struct nl_msg *msg;
5147
5148         msg = nlmsg_alloc();
5149         if (!msg)
5150                 return -ENOMEM;
5151
5152         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
5153         return send_and_recv_msgs(drv, msg, nl80211_get_reg, results);
5154 }
5155
5156
5157 static struct hostapd_hw_modes *
5158 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
5159 {
5160         struct i802_bss *bss = priv;
5161         struct wpa_driver_nl80211_data *drv = bss->drv;
5162         struct nl_msg *msg;
5163         struct phy_info_arg result = {
5164                 .num_modes = num_modes,
5165                 .modes = NULL,
5166         };
5167
5168         *num_modes = 0;
5169         *flags = 0;
5170
5171         msg = nlmsg_alloc();
5172         if (!msg)
5173                 return NULL;
5174
5175         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
5176
5177         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5178
5179         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) {
5180                 nl80211_set_ht40_flags(drv, &result);
5181                 return wpa_driver_nl80211_add_11b(result.modes, num_modes);
5182         }
5183         msg = NULL;
5184  nla_put_failure:
5185         nlmsg_free(msg);
5186         return NULL;
5187 }
5188
5189
5190 static int wpa_driver_nl80211_send_mntr(struct wpa_driver_nl80211_data *drv,
5191                                         const void *data, size_t len,
5192                                         int encrypt, int noack)
5193 {
5194         __u8 rtap_hdr[] = {
5195                 0x00, 0x00, /* radiotap version */
5196                 0x0e, 0x00, /* radiotap length */
5197                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
5198                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
5199                 0x00,       /* padding */
5200                 0x00, 0x00, /* RX and TX flags to indicate that */
5201                 0x00, 0x00, /* this is the injected frame directly */
5202         };
5203         struct iovec iov[2] = {
5204                 {
5205                         .iov_base = &rtap_hdr,
5206                         .iov_len = sizeof(rtap_hdr),
5207                 },
5208                 {
5209                         .iov_base = (void *) data,
5210                         .iov_len = len,
5211                 }
5212         };
5213         struct msghdr msg = {
5214                 .msg_name = NULL,
5215                 .msg_namelen = 0,
5216                 .msg_iov = iov,
5217                 .msg_iovlen = 2,
5218                 .msg_control = NULL,
5219                 .msg_controllen = 0,
5220                 .msg_flags = 0,
5221         };
5222         int res;
5223         u16 txflags = 0;
5224
5225         if (encrypt)
5226                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
5227
5228         if (drv->monitor_sock < 0) {
5229                 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
5230                            "for %s", __func__);
5231                 return -1;
5232         }
5233
5234         if (noack)
5235                 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
5236         *(le16 *) &rtap_hdr[12] = host_to_le16(txflags);
5237
5238         res = sendmsg(drv->monitor_sock, &msg, 0);
5239         if (res < 0) {
5240                 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
5241                 return -1;
5242         }
5243         return 0;
5244 }
5245
5246
5247 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
5248                                          const void *data, size_t len,
5249                                          int encrypt, int noack,
5250                                          unsigned int freq, int no_cck,
5251                                          int offchanok, unsigned int wait_time)
5252 {
5253         struct wpa_driver_nl80211_data *drv = bss->drv;
5254         u64 cookie;
5255
5256         if (freq == 0)
5257                 freq = bss->freq;
5258
5259         if (drv->use_monitor)
5260                 return wpa_driver_nl80211_send_mntr(drv, data, len,
5261                                                     encrypt, noack);
5262
5263         return nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
5264                                       &cookie, no_cck, noack, offchanok);
5265 }
5266
5267
5268 static int wpa_driver_nl80211_send_mlme_freq(struct i802_bss *bss,
5269                                              const u8 *data,
5270                                              size_t data_len, int noack,
5271                                              unsigned int freq, int no_cck,
5272                                              int offchanok,
5273                                              unsigned int wait_time)
5274 {
5275         struct wpa_driver_nl80211_data *drv = bss->drv;
5276         struct ieee80211_mgmt *mgmt;
5277         int encrypt = 1;
5278         u16 fc;
5279
5280         mgmt = (struct ieee80211_mgmt *) data;
5281         fc = le_to_host16(mgmt->frame_control);
5282
5283         if (is_sta_interface(drv->nlmode) &&
5284             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
5285             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
5286                 /*
5287                  * The use of last_mgmt_freq is a bit of a hack,
5288                  * but it works due to the single-threaded nature
5289                  * of wpa_supplicant.
5290                  */
5291                 if (freq == 0)
5292                         freq = drv->last_mgmt_freq;
5293                 return nl80211_send_frame_cmd(bss, freq, 0,
5294                                               data, data_len, NULL, 1, noack,
5295                                               1);
5296         }
5297
5298         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
5299                 if (freq == 0)
5300                         freq = bss->freq;
5301                 return nl80211_send_frame_cmd(bss, freq,
5302                                               (int) freq == bss->freq ? 0 :
5303                                               wait_time,
5304                                               data, data_len,
5305                                               &drv->send_action_cookie,
5306                                               no_cck, noack, offchanok);
5307         }
5308
5309         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
5310             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
5311                 /*
5312                  * Only one of the authentication frame types is encrypted.
5313                  * In order for static WEP encryption to work properly (i.e.,
5314                  * to not encrypt the frame), we need to tell mac80211 about
5315                  * the frames that must not be encrypted.
5316                  */
5317                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
5318                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
5319                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
5320                         encrypt = 0;
5321         }
5322
5323         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
5324                                              noack, freq, no_cck, offchanok,
5325                                              wait_time);
5326 }
5327
5328
5329 static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
5330                                         size_t data_len, int noack)
5331 {
5332         struct i802_bss *bss = priv;
5333         return wpa_driver_nl80211_send_mlme_freq(bss, data, data_len, noack,
5334                                                  0, 0, 0, 0);
5335 }
5336
5337
5338 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
5339                            int slot, int ht_opmode, int ap_isolate,
5340                            int *basic_rates)
5341 {
5342         struct wpa_driver_nl80211_data *drv = bss->drv;
5343         struct nl_msg *msg;
5344
5345         msg = nlmsg_alloc();
5346         if (!msg)
5347                 return -ENOMEM;
5348
5349         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
5350
5351         if (cts >= 0)
5352                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
5353         if (preamble >= 0)
5354                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
5355         if (slot >= 0)
5356                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
5357         if (ht_opmode >= 0)
5358                 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
5359         if (ap_isolate >= 0)
5360                 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
5361
5362         if (basic_rates) {
5363                 u8 rates[NL80211_MAX_SUPP_RATES];
5364                 u8 rates_len = 0;
5365                 int i;
5366
5367                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
5368                      i++)
5369                         rates[rates_len++] = basic_rates[i] / 5;
5370
5371                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
5372         }
5373
5374         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
5375
5376         return send_and_recv_msgs(drv, msg, NULL, NULL);
5377  nla_put_failure:
5378         nlmsg_free(msg);
5379         return -ENOBUFS;
5380 }
5381
5382
5383 static int wpa_driver_nl80211_set_ap(void *priv,
5384                                      struct wpa_driver_ap_params *params)
5385 {
5386         struct i802_bss *bss = priv;
5387         struct wpa_driver_nl80211_data *drv = bss->drv;
5388         struct nl_msg *msg;
5389         u8 cmd = NL80211_CMD_NEW_BEACON;
5390         int ret;
5391         int beacon_set;
5392         int ifindex = if_nametoindex(bss->ifname);
5393         int num_suites;
5394         u32 suites[10];
5395         u32 ver;
5396
5397         beacon_set = bss->beacon_set;
5398
5399         msg = nlmsg_alloc();
5400         if (!msg)
5401                 return -ENOMEM;
5402
5403         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
5404                    beacon_set);
5405         if (beacon_set)
5406                 cmd = NL80211_CMD_SET_BEACON;
5407
5408         nl80211_cmd(drv, msg, 0, cmd);
5409         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
5410         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
5411         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5412         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
5413         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
5414         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5415                 params->ssid);
5416         if (params->proberesp && params->proberesp_len)
5417                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
5418                         params->proberesp);
5419         switch (params->hide_ssid) {
5420         case NO_SSID_HIDING:
5421                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5422                             NL80211_HIDDEN_SSID_NOT_IN_USE);
5423                 break;
5424         case HIDDEN_SSID_ZERO_LEN:
5425                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5426                             NL80211_HIDDEN_SSID_ZERO_LEN);
5427                 break;
5428         case HIDDEN_SSID_ZERO_CONTENTS:
5429                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5430                             NL80211_HIDDEN_SSID_ZERO_CONTENTS);
5431                 break;
5432         }
5433         if (params->privacy)
5434                 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
5435         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
5436             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
5437                 /* Leave out the attribute */
5438         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
5439                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
5440                             NL80211_AUTHTYPE_SHARED_KEY);
5441         else
5442                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
5443                             NL80211_AUTHTYPE_OPEN_SYSTEM);
5444
5445         ver = 0;
5446         if (params->wpa_version & WPA_PROTO_WPA)
5447                 ver |= NL80211_WPA_VERSION_1;
5448         if (params->wpa_version & WPA_PROTO_RSN)
5449                 ver |= NL80211_WPA_VERSION_2;
5450         if (ver)
5451                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
5452
5453         num_suites = 0;
5454         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
5455                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
5456         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
5457                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
5458         if (num_suites) {
5459                 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
5460                         num_suites * sizeof(u32), suites);
5461         }
5462
5463         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
5464             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
5465                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
5466
5467         num_suites = 0;
5468         if (params->pairwise_ciphers & WPA_CIPHER_CCMP)
5469                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
5470         if (params->pairwise_ciphers & WPA_CIPHER_TKIP)
5471                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
5472         if (params->pairwise_ciphers & WPA_CIPHER_WEP104)
5473                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
5474         if (params->pairwise_ciphers & WPA_CIPHER_WEP40)
5475                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
5476         if (num_suites) {
5477                 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
5478                         num_suites * sizeof(u32), suites);
5479         }
5480
5481         switch (params->group_cipher) {
5482         case WPA_CIPHER_CCMP:
5483                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5484                             WLAN_CIPHER_SUITE_CCMP);
5485                 break;
5486         case WPA_CIPHER_TKIP:
5487                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5488                             WLAN_CIPHER_SUITE_TKIP);
5489                 break;
5490         case WPA_CIPHER_WEP104:
5491                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5492                             WLAN_CIPHER_SUITE_WEP104);
5493                 break;
5494         case WPA_CIPHER_WEP40:
5495                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5496                             WLAN_CIPHER_SUITE_WEP40);
5497                 break;
5498         }
5499
5500         if (params->beacon_ies) {
5501                 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
5502                         wpabuf_head(params->beacon_ies));
5503         }
5504         if (params->proberesp_ies) {
5505                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
5506                         wpabuf_len(params->proberesp_ies),
5507                         wpabuf_head(params->proberesp_ies));
5508         }
5509         if (params->assocresp_ies) {
5510                 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
5511                         wpabuf_len(params->assocresp_ies),
5512                         wpabuf_head(params->assocresp_ies));
5513         }
5514
5515         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
5516                 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
5517                             params->ap_max_inactivity);
5518         }
5519
5520         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5521         if (ret) {
5522                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
5523                            ret, strerror(-ret));
5524         } else {
5525                 bss->beacon_set = 1;
5526                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
5527                                 params->short_slot_time, params->ht_opmode,
5528                                 params->isolate, params->basic_rates);
5529         }
5530         return ret;
5531  nla_put_failure:
5532         nlmsg_free(msg);
5533         return -ENOBUFS;
5534 }
5535
5536
5537 static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
5538                                        int freq, int ht_enabled,
5539                                        int sec_channel_offset)
5540 {
5541         struct wpa_driver_nl80211_data *drv = bss->drv;
5542         struct nl_msg *msg;
5543         int ret;
5544
5545         wpa_printf(MSG_DEBUG, "nl80211: Set freq %d (ht_enabled=%d "
5546                    "sec_channel_offset=%d)",
5547                    freq, ht_enabled, sec_channel_offset);
5548         msg = nlmsg_alloc();
5549         if (!msg)
5550                 return -1;
5551
5552         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
5553
5554         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5555         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5556         if (ht_enabled) {
5557                 switch (sec_channel_offset) {
5558                 case -1:
5559                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
5560                                     NL80211_CHAN_HT40MINUS);
5561                         break;
5562                 case 1:
5563                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
5564                                     NL80211_CHAN_HT40PLUS);
5565                         break;
5566                 default:
5567                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
5568                                     NL80211_CHAN_HT20);
5569                         break;
5570                 }
5571         }
5572
5573         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5574         msg = NULL;
5575         if (ret == 0) {
5576                 bss->freq = freq;
5577                 return 0;
5578         }
5579         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
5580                    "%d (%s)", freq, ret, strerror(-ret));
5581 nla_put_failure:
5582         nlmsg_free(msg);
5583         return -1;
5584 }
5585
5586
5587 static u32 sta_flags_nl80211(int flags)
5588 {
5589         u32 f = 0;
5590
5591         if (flags & WPA_STA_AUTHORIZED)
5592                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
5593         if (flags & WPA_STA_WMM)
5594                 f |= BIT(NL80211_STA_FLAG_WME);
5595         if (flags & WPA_STA_SHORT_PREAMBLE)
5596                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
5597         if (flags & WPA_STA_MFP)
5598                 f |= BIT(NL80211_STA_FLAG_MFP);
5599         if (flags & WPA_STA_TDLS_PEER)
5600                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
5601
5602         return f;
5603 }
5604
5605
5606 static int wpa_driver_nl80211_sta_add(void *priv,
5607                                       struct hostapd_sta_add_params *params)
5608 {
5609         struct i802_bss *bss = priv;
5610         struct wpa_driver_nl80211_data *drv = bss->drv;
5611         struct nl_msg *msg, *wme = NULL;
5612         struct nl80211_sta_flag_update upd;
5613         int ret = -ENOBUFS;
5614
5615         if ((params->flags & WPA_STA_TDLS_PEER) &&
5616             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
5617                 return -EOPNOTSUPP;
5618
5619         msg = nlmsg_alloc();
5620         if (!msg)
5621                 return -ENOMEM;
5622
5623         nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
5624                     NL80211_CMD_NEW_STATION);
5625
5626         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
5627         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
5628         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
5629                 params->supp_rates);
5630         if (!params->set) {
5631                 NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
5632                 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
5633                             params->listen_interval);
5634         }
5635         if (params->ht_capabilities) {
5636                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
5637                         sizeof(*params->ht_capabilities),
5638                         params->ht_capabilities);
5639         }
5640
5641         os_memset(&upd, 0, sizeof(upd));
5642         upd.mask = sta_flags_nl80211(params->flags);
5643         upd.set = upd.mask;
5644         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
5645
5646         if (params->flags & WPA_STA_WMM) {
5647                 wme = nlmsg_alloc();
5648                 if (!wme)
5649                         goto nla_put_failure;
5650
5651                 NLA_PUT_U8(wme, NL80211_STA_WME_UAPSD_QUEUES,
5652                                 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
5653                 NLA_PUT_U8(wme, NL80211_STA_WME_MAX_SP,
5654                                 (params->qosinfo > WMM_QOSINFO_STA_SP_SHIFT) &
5655                                 WMM_QOSINFO_STA_SP_MASK);
5656                 if (nla_put_nested(msg, NL80211_ATTR_STA_WME, wme) < 0)
5657                         goto nla_put_failure;
5658         }
5659
5660         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5661         msg = NULL;
5662         if (ret)
5663                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
5664                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
5665                            strerror(-ret));
5666         if (ret == -EEXIST)
5667                 ret = 0;
5668  nla_put_failure:
5669         nlmsg_free(wme);
5670         nlmsg_free(msg);
5671         return ret;
5672 }
5673
5674
5675 static int wpa_driver_nl80211_sta_remove(void *priv, const u8 *addr)
5676 {
5677         struct i802_bss *bss = priv;
5678         struct wpa_driver_nl80211_data *drv = bss->drv;
5679         struct nl_msg *msg;
5680         int ret;
5681
5682         msg = nlmsg_alloc();
5683         if (!msg)
5684                 return -ENOMEM;
5685
5686         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
5687
5688         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
5689                     if_nametoindex(bss->ifname));
5690         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5691
5692         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5693         if (ret == -ENOENT)
5694                 return 0;
5695         return ret;
5696  nla_put_failure:
5697         nlmsg_free(msg);
5698         return -ENOBUFS;
5699 }
5700
5701
5702 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
5703                                  int ifidx)
5704 {
5705         struct nl_msg *msg;
5706
5707         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
5708
5709         /* stop listening for EAPOL on this interface */
5710         del_ifidx(drv, ifidx);
5711
5712         msg = nlmsg_alloc();
5713         if (!msg)
5714                 goto nla_put_failure;
5715
5716         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
5717         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
5718
5719         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5720                 return;
5721         msg = NULL;
5722  nla_put_failure:
5723         nlmsg_free(msg);
5724         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
5725 }
5726
5727
5728 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
5729 {
5730         switch (mode) {
5731         case NL80211_IFTYPE_ADHOC:
5732                 return "ADHOC";
5733         case NL80211_IFTYPE_STATION:
5734                 return "STATION";
5735         case NL80211_IFTYPE_AP:
5736                 return "AP";
5737         case NL80211_IFTYPE_MONITOR:
5738                 return "MONITOR";
5739         case NL80211_IFTYPE_P2P_CLIENT:
5740                 return "P2P_CLIENT";
5741         case NL80211_IFTYPE_P2P_GO:
5742                 return "P2P_GO";
5743         default:
5744                 return "unknown";
5745         }
5746 }
5747
5748
5749 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
5750                                      const char *ifname,
5751                                      enum nl80211_iftype iftype,
5752                                      const u8 *addr, int wds)
5753 {
5754         struct nl_msg *msg, *flags = NULL;
5755         int ifidx;
5756         int ret = -ENOBUFS;
5757
5758         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
5759                    iftype, nl80211_iftype_str(iftype));
5760
5761         msg = nlmsg_alloc();
5762         if (!msg)
5763                 return -1;
5764
5765         nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
5766         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5767         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
5768         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
5769
5770         if (iftype == NL80211_IFTYPE_MONITOR) {
5771                 int err;
5772
5773                 flags = nlmsg_alloc();
5774                 if (!flags)
5775                         goto nla_put_failure;
5776
5777                 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
5778
5779                 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
5780
5781                 nlmsg_free(flags);
5782
5783                 if (err)
5784                         goto nla_put_failure;
5785         } else if (wds) {
5786                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
5787         }
5788
5789         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5790         msg = NULL;
5791         if (ret) {
5792  nla_put_failure:
5793                 nlmsg_free(msg);
5794                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
5795                            ifname, ret, strerror(-ret));
5796                 return ret;
5797         }
5798
5799         ifidx = if_nametoindex(ifname);
5800         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
5801                    ifname, ifidx);
5802
5803         if (ifidx <= 0)
5804                 return -1;
5805
5806         /* start listening for EAPOL on this interface */
5807         add_ifidx(drv, ifidx);
5808
5809         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
5810             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
5811                 nl80211_remove_iface(drv, ifidx);
5812                 return -1;
5813         }
5814
5815         return ifidx;
5816 }
5817
5818
5819 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
5820                                 const char *ifname, enum nl80211_iftype iftype,
5821                                 const u8 *addr, int wds)
5822 {
5823         int ret;
5824
5825         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds);
5826
5827         /* if error occurred and interface exists already */
5828         if (ret == -ENFILE && if_nametoindex(ifname)) {
5829                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
5830
5831                 /* Try to remove the interface that was already there. */
5832                 nl80211_remove_iface(drv, if_nametoindex(ifname));
5833
5834                 /* Try to create the interface again */
5835                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
5836                                                 wds);
5837         }
5838
5839         if (ret >= 0 && is_p2p_interface(iftype))
5840                 nl80211_disable_11b_rates(drv, ret, 1);
5841
5842         return ret;
5843 }
5844
5845
5846 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
5847 {
5848         struct ieee80211_hdr *hdr;
5849         u16 fc;
5850         union wpa_event_data event;
5851
5852         hdr = (struct ieee80211_hdr *) buf;
5853         fc = le_to_host16(hdr->frame_control);
5854
5855         os_memset(&event, 0, sizeof(event));
5856         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
5857         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
5858         event.tx_status.dst = hdr->addr1;
5859         event.tx_status.data = buf;
5860         event.tx_status.data_len = len;
5861         event.tx_status.ack = ok;
5862         wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
5863 }
5864
5865
5866 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
5867                              u8 *buf, size_t len)
5868 {
5869         struct ieee80211_hdr *hdr = (void *)buf;
5870         u16 fc;
5871         union wpa_event_data event;
5872
5873         if (len < sizeof(*hdr))
5874                 return;
5875
5876         fc = le_to_host16(hdr->frame_control);
5877
5878         os_memset(&event, 0, sizeof(event));
5879         event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
5880         event.rx_from_unknown.addr = hdr->addr2;
5881         event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
5882                 (WLAN_FC_FROMDS | WLAN_FC_TODS);
5883         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
5884 }
5885
5886
5887 static void handle_frame(struct wpa_driver_nl80211_data *drv,
5888                          u8 *buf, size_t len, int datarate, int ssi_signal)
5889 {
5890         struct ieee80211_hdr *hdr;
5891         u16 fc;
5892         union wpa_event_data event;
5893
5894         hdr = (struct ieee80211_hdr *) buf;
5895         fc = le_to_host16(hdr->frame_control);
5896
5897         switch (WLAN_FC_GET_TYPE(fc)) {
5898         case WLAN_FC_TYPE_MGMT:
5899                 os_memset(&event, 0, sizeof(event));
5900                 event.rx_mgmt.frame = buf;
5901                 event.rx_mgmt.frame_len = len;
5902                 event.rx_mgmt.datarate = datarate;
5903                 event.rx_mgmt.ssi_signal = ssi_signal;
5904                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
5905                 break;
5906         case WLAN_FC_TYPE_CTRL:
5907                 /* can only get here with PS-Poll frames */
5908                 wpa_printf(MSG_DEBUG, "CTRL");
5909                 from_unknown_sta(drv, buf, len);
5910                 break;
5911         case WLAN_FC_TYPE_DATA:
5912                 from_unknown_sta(drv, buf, len);
5913                 break;
5914         }
5915 }
5916
5917
5918 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
5919 {
5920         struct wpa_driver_nl80211_data *drv = eloop_ctx;
5921         int len;
5922         unsigned char buf[3000];
5923         struct ieee80211_radiotap_iterator iter;
5924         int ret;
5925         int datarate = 0, ssi_signal = 0;
5926         int injected = 0, failed = 0, rxflags = 0;
5927
5928         len = recv(sock, buf, sizeof(buf), 0);
5929         if (len < 0) {
5930                 perror("recv");
5931                 return;
5932         }
5933
5934         if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
5935                 printf("received invalid radiotap frame\n");
5936                 return;
5937         }
5938
5939         while (1) {
5940                 ret = ieee80211_radiotap_iterator_next(&iter);
5941                 if (ret == -ENOENT)
5942                         break;
5943                 if (ret) {
5944                         printf("received invalid radiotap frame (%d)\n", ret);
5945                         return;
5946                 }
5947                 switch (iter.this_arg_index) {
5948                 case IEEE80211_RADIOTAP_FLAGS:
5949                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
5950                                 len -= 4;
5951                         break;
5952                 case IEEE80211_RADIOTAP_RX_FLAGS:
5953                         rxflags = 1;
5954                         break;
5955                 case IEEE80211_RADIOTAP_TX_FLAGS:
5956                         injected = 1;
5957                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
5958                                         IEEE80211_RADIOTAP_F_TX_FAIL;
5959                         break;
5960                 case IEEE80211_RADIOTAP_DATA_RETRIES:
5961                         break;
5962                 case IEEE80211_RADIOTAP_CHANNEL:
5963                         /* TODO: convert from freq/flags to channel number */
5964                         break;
5965                 case IEEE80211_RADIOTAP_RATE:
5966                         datarate = *iter.this_arg * 5;
5967                         break;
5968                 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
5969                         ssi_signal = (s8) *iter.this_arg;
5970                         break;
5971                 }
5972         }
5973
5974         if (rxflags && injected)
5975                 return;
5976
5977         if (!injected)
5978                 handle_frame(drv, buf + iter.max_length,
5979                              len - iter.max_length, datarate, ssi_signal);
5980         else
5981                 handle_tx_callback(drv->ctx, buf + iter.max_length,
5982                                    len - iter.max_length, !failed);
5983 }
5984
5985
5986 /*
5987  * we post-process the filter code later and rewrite
5988  * this to the offset to the last instruction
5989  */
5990 #define PASS    0xFF
5991 #define FAIL    0xFE
5992
5993 static struct sock_filter msock_filter_insns[] = {
5994         /*
5995          * do a little-endian load of the radiotap length field
5996          */
5997         /* load lower byte into A */
5998         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
5999         /* put it into X (== index register) */
6000         BPF_STMT(BPF_MISC| BPF_TAX, 0),
6001         /* load upper byte into A */
6002         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
6003         /* left-shift it by 8 */
6004         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
6005         /* or with X */
6006         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
6007         /* put result into X */
6008         BPF_STMT(BPF_MISC| BPF_TAX, 0),
6009
6010         /*
6011          * Allow management frames through, this also gives us those
6012          * management frames that we sent ourselves with status
6013          */
6014         /* load the lower byte of the IEEE 802.11 frame control field */
6015         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
6016         /* mask off frame type and version */
6017         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
6018         /* accept frame if it's both 0, fall through otherwise */
6019         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
6020
6021         /*
6022          * TODO: add a bit to radiotap RX flags that indicates
6023          * that the sending station is not associated, then
6024          * add a filter here that filters on our DA and that flag
6025          * to allow us to deauth frames to that bad station.
6026          *
6027          * For now allow all To DS data frames through.
6028          */
6029         /* load the IEEE 802.11 frame control field */
6030         BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
6031         /* mask off frame type, version and DS status */
6032         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
6033         /* accept frame if version 0, type 2 and To DS, fall through otherwise
6034          */
6035         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
6036
6037 #if 0
6038         /*
6039          * drop non-data frames
6040          */
6041         /* load the lower byte of the frame control field */
6042         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
6043         /* mask off QoS bit */
6044         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
6045         /* drop non-data frames */
6046         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
6047 #endif
6048         /* load the upper byte of the frame control field */
6049         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
6050         /* mask off toDS/fromDS */
6051         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
6052         /* accept WDS frames */
6053         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
6054
6055         /*
6056          * add header length to index
6057          */
6058         /* load the lower byte of the frame control field */
6059         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
6060         /* mask off QoS bit */
6061         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
6062         /* right shift it by 6 to give 0 or 2 */
6063         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
6064         /* add data frame header length */
6065         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
6066         /* add index, was start of 802.11 header */
6067         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
6068         /* move to index, now start of LL header */
6069         BPF_STMT(BPF_MISC | BPF_TAX, 0),
6070
6071         /*
6072          * Accept empty data frames, we use those for
6073          * polling activity.
6074          */
6075         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
6076         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
6077
6078         /*
6079          * Accept EAPOL frames
6080          */
6081         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
6082         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
6083         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
6084         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
6085
6086         /* keep these last two statements or change the code below */
6087         /* return 0 == "DROP" */
6088         BPF_STMT(BPF_RET | BPF_K, 0),
6089         /* return ~0 == "keep all" */
6090         BPF_STMT(BPF_RET | BPF_K, ~0),
6091 };
6092
6093 static struct sock_fprog msock_filter = {
6094         .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]),
6095         .filter = msock_filter_insns,
6096 };
6097
6098
6099 static int add_monitor_filter(int s)
6100 {
6101         int idx;
6102
6103         /* rewrite all PASS/FAIL jump offsets */
6104         for (idx = 0; idx < msock_filter.len; idx++) {
6105                 struct sock_filter *insn = &msock_filter_insns[idx];
6106
6107                 if (BPF_CLASS(insn->code) == BPF_JMP) {
6108                         if (insn->code == (BPF_JMP|BPF_JA)) {
6109                                 if (insn->k == PASS)
6110                                         insn->k = msock_filter.len - idx - 2;
6111                                 else if (insn->k == FAIL)
6112                                         insn->k = msock_filter.len - idx - 3;
6113                         }
6114
6115                         if (insn->jt == PASS)
6116                                 insn->jt = msock_filter.len - idx - 2;
6117                         else if (insn->jt == FAIL)
6118                                 insn->jt = msock_filter.len - idx - 3;
6119
6120                         if (insn->jf == PASS)
6121                                 insn->jf = msock_filter.len - idx - 2;
6122                         else if (insn->jf == FAIL)
6123                                 insn->jf = msock_filter.len - idx - 3;
6124                 }
6125         }
6126
6127         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
6128                        &msock_filter, sizeof(msock_filter))) {
6129                 perror("SO_ATTACH_FILTER");
6130                 return -1;
6131         }
6132
6133         return 0;
6134 }
6135
6136
6137 static void nl80211_remove_monitor_interface(
6138         struct wpa_driver_nl80211_data *drv)
6139 {
6140         drv->monitor_refcount--;
6141         if (drv->monitor_refcount > 0)
6142                 return;
6143
6144         if (drv->monitor_ifidx >= 0) {
6145                 nl80211_remove_iface(drv, drv->monitor_ifidx);
6146                 drv->monitor_ifidx = -1;
6147         }
6148         if (drv->monitor_sock >= 0) {
6149                 eloop_unregister_read_sock(drv->monitor_sock);
6150                 close(drv->monitor_sock);
6151                 drv->monitor_sock = -1;
6152         }
6153 }
6154
6155
6156 static int
6157 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
6158 {
6159         char buf[IFNAMSIZ];
6160         struct sockaddr_ll ll;
6161         int optval;
6162         socklen_t optlen;
6163
6164         if (drv->monitor_ifidx >= 0) {
6165                 drv->monitor_refcount++;
6166                 return 0;
6167         }
6168
6169         if (os_strncmp(drv->first_bss.ifname, "p2p-", 4) == 0) {
6170                 /*
6171                  * P2P interface name is of the format p2p-%s-%d. For monitor
6172                  * interface name corresponding to P2P GO, replace "p2p-" with
6173                  * "mon-" to retain the same interface name length and to
6174                  * indicate that it is a monitor interface.
6175                  */
6176                 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss.ifname + 4);
6177         } else {
6178                 /* Non-P2P interface with AP functionality. */
6179                 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss.ifname);
6180         }
6181
6182         buf[IFNAMSIZ - 1] = '\0';
6183
6184         drv->monitor_ifidx =
6185                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
6186                                      0);
6187
6188         if (drv->monitor_ifidx == -EOPNOTSUPP) {
6189                 /*
6190                  * This is backward compatibility for a few versions of
6191                  * the kernel only that didn't advertise the right
6192                  * attributes for the only driver that then supported
6193                  * AP mode w/o monitor -- ath6kl.
6194                  */
6195                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
6196                            "monitor interface type - try to run without it");
6197                 drv->device_ap_sme = 1;
6198         }
6199
6200         if (drv->monitor_ifidx < 0)
6201                 return -1;
6202
6203         if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
6204                 goto error;
6205
6206         memset(&ll, 0, sizeof(ll));
6207         ll.sll_family = AF_PACKET;
6208         ll.sll_ifindex = drv->monitor_ifidx;
6209         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
6210         if (drv->monitor_sock < 0) {
6211                 perror("socket[PF_PACKET,SOCK_RAW]");
6212                 goto error;
6213         }
6214
6215         if (add_monitor_filter(drv->monitor_sock)) {
6216                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
6217                            "interface; do filtering in user space");
6218                 /* This works, but will cost in performance. */
6219         }
6220
6221         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
6222                 perror("monitor socket bind");
6223                 goto error;
6224         }
6225
6226         optlen = sizeof(optval);
6227         optval = 20;
6228         if (setsockopt
6229             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
6230                 perror("Failed to set socket priority");
6231                 goto error;
6232         }
6233
6234         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
6235                                      drv, NULL)) {
6236                 printf("Could not register monitor read socket\n");
6237                 goto error;
6238         }
6239
6240         return 0;
6241  error:
6242         nl80211_remove_monitor_interface(drv);
6243         return -1;
6244 }
6245
6246
6247 static int nl80211_setup_ap(struct i802_bss *bss)
6248 {
6249         struct wpa_driver_nl80211_data *drv = bss->drv;
6250
6251         wpa_printf(MSG_DEBUG, "nl80211: Setup AP - device_ap_sme=%d "
6252                    "use_monitor=%d", drv->device_ap_sme, drv->use_monitor);
6253
6254         /*
6255          * Disable Probe Request reporting unless we need it in this way for
6256          * devices that include the AP SME, in the other case (unless using
6257          * monitor iface) we'll get it through the nl_mgmt socket instead.
6258          */
6259         if (!drv->device_ap_sme)
6260                 wpa_driver_nl80211_probe_req_report(bss, 0);
6261
6262         if (!drv->device_ap_sme && !drv->use_monitor)
6263                 if (nl80211_mgmt_subscribe_ap(bss))
6264                         return -1;
6265
6266         if (drv->device_ap_sme && !drv->use_monitor)
6267                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
6268                         return -1;
6269
6270         if (!drv->device_ap_sme && drv->use_monitor &&
6271             nl80211_create_monitor_interface(drv) &&
6272             !drv->device_ap_sme)
6273                 return -1;
6274
6275         if (drv->device_ap_sme &&
6276             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
6277                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
6278                            "Probe Request frame reporting in AP mode");
6279                 /* Try to survive without this */
6280         }
6281
6282         return 0;
6283 }
6284
6285
6286 static void nl80211_teardown_ap(struct i802_bss *bss)
6287 {
6288         struct wpa_driver_nl80211_data *drv = bss->drv;
6289
6290         if (drv->device_ap_sme) {
6291                 wpa_driver_nl80211_probe_req_report(bss, 0);
6292                 if (!drv->use_monitor)
6293                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
6294         } else if (drv->use_monitor)
6295                 nl80211_remove_monitor_interface(drv);
6296         else
6297                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
6298
6299         bss->beacon_set = 0;
6300 }
6301
6302
6303 static int nl80211_send_eapol_data(struct i802_bss *bss,
6304                                    const u8 *addr, const u8 *data,
6305                                    size_t data_len)
6306 {
6307         struct sockaddr_ll ll;
6308         int ret;
6309
6310         if (bss->drv->eapol_tx_sock < 0) {
6311                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
6312                 return -1;
6313         }
6314
6315         os_memset(&ll, 0, sizeof(ll));
6316         ll.sll_family = AF_PACKET;
6317         ll.sll_ifindex = bss->ifindex;
6318         ll.sll_protocol = htons(ETH_P_PAE);
6319         ll.sll_halen = ETH_ALEN;
6320         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
6321         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
6322                      (struct sockaddr *) &ll, sizeof(ll));
6323         if (ret < 0)
6324                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
6325                            strerror(errno));
6326
6327         return ret;
6328 }
6329
6330
6331 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
6332
6333 static int wpa_driver_nl80211_hapd_send_eapol(
6334         void *priv, const u8 *addr, const u8 *data,
6335         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
6336 {
6337         struct i802_bss *bss = priv;
6338         struct wpa_driver_nl80211_data *drv = bss->drv;
6339         struct ieee80211_hdr *hdr;
6340         size_t len;
6341         u8 *pos;
6342         int res;
6343         int qos = flags & WPA_STA_WMM;
6344
6345         if (drv->device_ap_sme || !drv->use_monitor)
6346                 return nl80211_send_eapol_data(bss, addr, data, data_len);
6347
6348         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
6349                 data_len;
6350         hdr = os_zalloc(len);
6351         if (hdr == NULL) {
6352                 printf("malloc() failed for i802_send_data(len=%lu)\n",
6353                        (unsigned long) len);
6354                 return -1;
6355         }
6356
6357         hdr->frame_control =
6358                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
6359         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
6360         if (encrypt)
6361                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
6362         if (qos) {
6363                 hdr->frame_control |=
6364                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
6365         }
6366
6367         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
6368         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
6369         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
6370         pos = (u8 *) (hdr + 1);
6371
6372         if (qos) {
6373                 /* add an empty QoS header if needed */
6374                 pos[0] = 0;
6375                 pos[1] = 0;
6376                 pos += 2;
6377         }
6378
6379         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
6380         pos += sizeof(rfc1042_header);
6381         WPA_PUT_BE16(pos, ETH_P_PAE);
6382         pos += 2;
6383         memcpy(pos, data, data_len);
6384
6385         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
6386                                             0, 0, 0, 0);
6387         if (res < 0) {
6388                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
6389                            "failed: %d (%s)",
6390                            (unsigned long) len, errno, strerror(errno));
6391         }
6392         os_free(hdr);
6393
6394         return res;
6395 }
6396
6397
6398 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
6399                                             int total_flags,
6400                                             int flags_or, int flags_and)
6401 {
6402         struct i802_bss *bss = priv;
6403         struct wpa_driver_nl80211_data *drv = bss->drv;
6404         struct nl_msg *msg, *flags = NULL;
6405         struct nl80211_sta_flag_update upd;
6406
6407         msg = nlmsg_alloc();
6408         if (!msg)
6409                 return -ENOMEM;
6410
6411         flags = nlmsg_alloc();
6412         if (!flags) {
6413                 nlmsg_free(msg);
6414                 return -ENOMEM;
6415         }
6416
6417         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
6418
6419         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
6420                     if_nametoindex(bss->ifname));
6421         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6422
6423         /*
6424          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
6425          * can be removed eventually.
6426          */
6427         if (total_flags & WPA_STA_AUTHORIZED)
6428                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
6429
6430         if (total_flags & WPA_STA_WMM)
6431                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
6432
6433         if (total_flags & WPA_STA_SHORT_PREAMBLE)
6434                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
6435
6436         if (total_flags & WPA_STA_MFP)
6437                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP);
6438
6439         if (total_flags & WPA_STA_TDLS_PEER)
6440                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_TDLS_PEER);
6441
6442         if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
6443                 goto nla_put_failure;
6444
6445         os_memset(&upd, 0, sizeof(upd));
6446         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
6447         upd.set = sta_flags_nl80211(flags_or);
6448         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
6449
6450         nlmsg_free(flags);
6451
6452         return send_and_recv_msgs(drv, msg, NULL, NULL);
6453  nla_put_failure:
6454         nlmsg_free(msg);
6455         nlmsg_free(flags);
6456         return -ENOBUFS;
6457 }
6458
6459
6460 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
6461                                  struct wpa_driver_associate_params *params)
6462 {
6463         enum nl80211_iftype nlmode;
6464
6465         if (params->p2p) {
6466                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
6467                            "group (GO)");
6468                 nlmode = NL80211_IFTYPE_P2P_GO;
6469         } else
6470                 nlmode = NL80211_IFTYPE_AP;
6471
6472         if (wpa_driver_nl80211_set_mode(&drv->first_bss, nlmode) ||
6473             wpa_driver_nl80211_set_freq(&drv->first_bss, params->freq, 0, 0)) {
6474                 nl80211_remove_monitor_interface(drv);
6475                 return -1;
6476         }
6477
6478         return 0;
6479 }
6480
6481
6482 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
6483 {
6484         struct nl_msg *msg;
6485         int ret = -1;
6486
6487         msg = nlmsg_alloc();
6488         if (!msg)
6489                 return -1;
6490
6491         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
6492         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6493         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6494         msg = NULL;
6495         if (ret) {
6496                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
6497                            "(%s)", ret, strerror(-ret));
6498                 goto nla_put_failure;
6499         }
6500
6501         ret = 0;
6502         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
6503
6504 nla_put_failure:
6505         nlmsg_free(msg);
6506         return ret;
6507 }
6508
6509
6510 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
6511                                    struct wpa_driver_associate_params *params)
6512 {
6513         struct nl_msg *msg;
6514         int ret = -1;
6515         int count = 0;
6516
6517         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
6518
6519         if (wpa_driver_nl80211_set_mode(&drv->first_bss,
6520                                         NL80211_IFTYPE_ADHOC)) {
6521                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
6522                            "IBSS mode");
6523                 return -1;
6524         }
6525
6526 retry:
6527         msg = nlmsg_alloc();
6528         if (!msg)
6529                 return -1;
6530
6531         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
6532         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6533
6534         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
6535                 goto nla_put_failure;
6536
6537         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6538                           params->ssid, params->ssid_len);
6539         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6540                 params->ssid);
6541         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
6542         drv->ssid_len = params->ssid_len;
6543
6544         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6545         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6546
6547         ret = nl80211_set_conn_keys(params, msg);
6548         if (ret)
6549                 goto nla_put_failure;
6550
6551         if (params->bssid && params->fixed_bssid) {
6552                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
6553                            MAC2STR(params->bssid));
6554                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6555         }
6556
6557         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
6558             params->key_mgmt_suite == KEY_MGMT_PSK ||
6559             params->key_mgmt_suite == KEY_MGMT_802_1X_SHA256 ||
6560             params->key_mgmt_suite == KEY_MGMT_PSK_SHA256) {
6561                 wpa_printf(MSG_DEBUG, "  * control port");
6562                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
6563         }
6564
6565         if (params->wpa_ie) {
6566                 wpa_hexdump(MSG_DEBUG,
6567                             "  * Extra IEs for Beacon/Probe Response frames",
6568                             params->wpa_ie, params->wpa_ie_len);
6569                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
6570                         params->wpa_ie);
6571         }
6572
6573         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6574         msg = NULL;
6575         if (ret) {
6576                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
6577                            ret, strerror(-ret));
6578                 count++;
6579                 if (ret == -EALREADY && count == 1) {
6580                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
6581                                    "forced leave");
6582                         nl80211_leave_ibss(drv);
6583                         nlmsg_free(msg);
6584                         goto retry;
6585                 }
6586
6587                 goto nla_put_failure;
6588         }
6589         ret = 0;
6590         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
6591
6592 nla_put_failure:
6593         nlmsg_free(msg);
6594         return ret;
6595 }
6596
6597
6598 static unsigned int nl80211_get_assoc_bssid(struct wpa_driver_nl80211_data *drv,
6599                                             u8 *bssid)
6600 {
6601         struct nl_msg *msg;
6602         int ret;
6603         struct nl80211_bss_info_arg arg;
6604
6605         os_memset(&arg, 0, sizeof(arg));
6606         msg = nlmsg_alloc();
6607         if (!msg)
6608                 goto nla_put_failure;
6609
6610         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
6611         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6612
6613         arg.drv = drv;
6614         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
6615         msg = NULL;
6616         if (ret == 0) {
6617                 if (is_zero_ether_addr(arg.assoc_bssid))
6618                         return -ENOTCONN;
6619                 os_memcpy(bssid, arg.assoc_bssid, ETH_ALEN);
6620                 return 0;
6621         }
6622         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
6623                    "(%s)", ret, strerror(-ret));
6624 nla_put_failure:
6625         nlmsg_free(msg);
6626         return drv->assoc_freq;
6627 }
6628
6629
6630 static int nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
6631                               const u8 *bssid)
6632 {
6633         u8 addr[ETH_ALEN];
6634
6635         if (bssid == NULL) {
6636                 int res = nl80211_get_assoc_bssid(drv, addr);
6637                 if (res)
6638                         return res;
6639                 bssid = addr;
6640         }
6641
6642         return wpa_driver_nl80211_disconnect(drv, bssid,
6643                                              WLAN_REASON_PREV_AUTH_NOT_VALID);
6644 }
6645
6646
6647 static int wpa_driver_nl80211_connect(
6648         struct wpa_driver_nl80211_data *drv,
6649         struct wpa_driver_associate_params *params)
6650 {
6651         struct nl_msg *msg;
6652         enum nl80211_auth_type type;
6653         int ret = 0;
6654         int algs;
6655
6656         msg = nlmsg_alloc();
6657         if (!msg)
6658                 return -1;
6659
6660         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
6661         nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
6662
6663         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6664         if (params->bssid) {
6665                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
6666                            MAC2STR(params->bssid));
6667                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6668         }
6669         if (params->freq) {
6670                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6671                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6672         }
6673         if (params->bg_scan_period >= 0) {
6674                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
6675                            params->bg_scan_period);
6676                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
6677                             params->bg_scan_period);
6678         }
6679         if (params->ssid) {
6680                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6681                                   params->ssid, params->ssid_len);
6682                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6683                         params->ssid);
6684                 if (params->ssid_len > sizeof(drv->ssid))
6685                         goto nla_put_failure;
6686                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
6687                 drv->ssid_len = params->ssid_len;
6688         }
6689         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
6690         if (params->wpa_ie)
6691                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
6692                         params->wpa_ie);
6693
6694         algs = 0;
6695         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
6696                 algs++;
6697         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
6698                 algs++;
6699         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
6700                 algs++;
6701         if (algs > 1) {
6702                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
6703                            "selection");
6704                 goto skip_auth_type;
6705         }
6706
6707         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
6708                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
6709         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
6710                 type = NL80211_AUTHTYPE_SHARED_KEY;
6711         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
6712                 type = NL80211_AUTHTYPE_NETWORK_EAP;
6713         else if (params->auth_alg & WPA_AUTH_ALG_FT)
6714                 type = NL80211_AUTHTYPE_FT;
6715         else
6716                 goto nla_put_failure;
6717
6718         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
6719         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
6720
6721 skip_auth_type:
6722         if (params->wpa_proto) {
6723                 enum nl80211_wpa_versions ver = 0;
6724
6725                 if (params->wpa_proto & WPA_PROTO_WPA)
6726                         ver |= NL80211_WPA_VERSION_1;
6727                 if (params->wpa_proto & WPA_PROTO_RSN)
6728                         ver |= NL80211_WPA_VERSION_2;
6729
6730                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
6731                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
6732         }
6733
6734         if (params->pairwise_suite != CIPHER_NONE) {
6735                 int cipher;
6736
6737                 switch (params->pairwise_suite) {
6738                 case CIPHER_WEP40:
6739                         cipher = WLAN_CIPHER_SUITE_WEP40;
6740                         break;
6741                 case CIPHER_WEP104:
6742                         cipher = WLAN_CIPHER_SUITE_WEP104;
6743                         break;
6744                 case CIPHER_CCMP:
6745                         cipher = WLAN_CIPHER_SUITE_CCMP;
6746                         break;
6747                 case CIPHER_TKIP:
6748                 default:
6749                         cipher = WLAN_CIPHER_SUITE_TKIP;
6750                         break;
6751                 }
6752                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
6753         }
6754
6755         if (params->group_suite != CIPHER_NONE) {
6756                 int cipher;
6757
6758                 switch (params->group_suite) {
6759                 case CIPHER_WEP40:
6760                         cipher = WLAN_CIPHER_SUITE_WEP40;
6761                         break;
6762                 case CIPHER_WEP104:
6763                         cipher = WLAN_CIPHER_SUITE_WEP104;
6764                         break;
6765                 case CIPHER_CCMP:
6766                         cipher = WLAN_CIPHER_SUITE_CCMP;
6767                         break;
6768                 case CIPHER_TKIP:
6769                 default:
6770                         cipher = WLAN_CIPHER_SUITE_TKIP;
6771                         break;
6772                 }
6773                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
6774         }
6775
6776         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
6777             params->key_mgmt_suite == KEY_MGMT_PSK) {
6778                 int mgmt = WLAN_AKM_SUITE_PSK;
6779
6780                 switch (params->key_mgmt_suite) {
6781                 case KEY_MGMT_802_1X:
6782                         mgmt = WLAN_AKM_SUITE_8021X;
6783                         break;
6784                 case KEY_MGMT_PSK:
6785                 default:
6786                         mgmt = WLAN_AKM_SUITE_PSK;
6787                         break;
6788                 }
6789                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
6790         }
6791
6792         if (params->disable_ht)
6793                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
6794
6795         if (params->htcaps && params->htcaps_mask) {
6796                 int sz = sizeof(struct ieee80211_ht_capabilities);
6797                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
6798                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
6799                         params->htcaps_mask);
6800         }
6801
6802         ret = nl80211_set_conn_keys(params, msg);
6803         if (ret)
6804                 goto nla_put_failure;
6805
6806         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6807         msg = NULL;
6808         if (ret) {
6809                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
6810                            "(%s)", ret, strerror(-ret));
6811                 /*
6812                  * cfg80211 does not currently accept new connection if we are
6813                  * already connected. As a workaround, force disconnection and
6814                  * try again once the driver indicates it completed
6815                  * disconnection.
6816                  */
6817                 if (ret == -EALREADY)
6818                         nl80211_disconnect(drv, params->bssid);
6819                 goto nla_put_failure;
6820         }
6821         ret = 0;
6822         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
6823
6824 nla_put_failure:
6825         nlmsg_free(msg);
6826         return ret;
6827
6828 }
6829
6830
6831 static int wpa_driver_nl80211_associate(
6832         void *priv, struct wpa_driver_associate_params *params)
6833 {
6834         struct i802_bss *bss = priv;
6835         struct wpa_driver_nl80211_data *drv = bss->drv;
6836         int ret = -1;
6837         struct nl_msg *msg;
6838
6839         if (params->mode == IEEE80211_MODE_AP)
6840                 return wpa_driver_nl80211_ap(drv, params);
6841
6842         if (params->mode == IEEE80211_MODE_IBSS)
6843                 return wpa_driver_nl80211_ibss(drv, params);
6844
6845         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
6846                 enum nl80211_iftype nlmode = params->p2p ?
6847                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
6848
6849                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
6850                         return -1;
6851                 return wpa_driver_nl80211_connect(drv, params);
6852         }
6853
6854         drv->associated = 0;
6855
6856         msg = nlmsg_alloc();
6857         if (!msg)
6858                 return -1;
6859
6860         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
6861                    drv->ifindex);
6862         nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
6863
6864         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6865         if (params->bssid) {
6866                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
6867                            MAC2STR(params->bssid));
6868                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6869         }
6870         if (params->freq) {
6871                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6872                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6873                 drv->assoc_freq = params->freq;
6874         } else
6875                 drv->assoc_freq = 0;
6876         if (params->bg_scan_period >= 0) {
6877                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
6878                            params->bg_scan_period);
6879                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
6880                             params->bg_scan_period);
6881         }
6882         if (params->ssid) {
6883                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6884                                   params->ssid, params->ssid_len);
6885                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6886                         params->ssid);
6887                 if (params->ssid_len > sizeof(drv->ssid))
6888                         goto nla_put_failure;
6889                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
6890                 drv->ssid_len = params->ssid_len;
6891         }
6892         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
6893         if (params->wpa_ie)
6894                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
6895                         params->wpa_ie);
6896
6897         if (params->pairwise_suite != CIPHER_NONE) {
6898                 int cipher;
6899
6900                 switch (params->pairwise_suite) {
6901                 case CIPHER_WEP40:
6902                         cipher = WLAN_CIPHER_SUITE_WEP40;
6903                         break;
6904                 case CIPHER_WEP104:
6905                         cipher = WLAN_CIPHER_SUITE_WEP104;
6906                         break;
6907                 case CIPHER_CCMP:
6908                         cipher = WLAN_CIPHER_SUITE_CCMP;
6909                         break;
6910                 case CIPHER_TKIP:
6911                 default:
6912                         cipher = WLAN_CIPHER_SUITE_TKIP;
6913                         break;
6914                 }
6915                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
6916                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
6917         }
6918
6919         if (params->group_suite != CIPHER_NONE) {
6920                 int cipher;
6921
6922                 switch (params->group_suite) {
6923                 case CIPHER_WEP40:
6924                         cipher = WLAN_CIPHER_SUITE_WEP40;
6925                         break;
6926                 case CIPHER_WEP104:
6927                         cipher = WLAN_CIPHER_SUITE_WEP104;
6928                         break;
6929                 case CIPHER_CCMP:
6930                         cipher = WLAN_CIPHER_SUITE_CCMP;
6931                         break;
6932                 case CIPHER_TKIP:
6933                 default:
6934                         cipher = WLAN_CIPHER_SUITE_TKIP;
6935                         break;
6936                 }
6937                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
6938                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
6939         }
6940
6941 #ifdef CONFIG_IEEE80211W
6942         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
6943                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
6944 #endif /* CONFIG_IEEE80211W */
6945
6946         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
6947
6948         if (params->prev_bssid) {
6949                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
6950                            MAC2STR(params->prev_bssid));
6951                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
6952                         params->prev_bssid);
6953         }
6954
6955         if (params->disable_ht)
6956                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
6957
6958         if (params->htcaps && params->htcaps_mask) {
6959                 int sz = sizeof(struct ieee80211_ht_capabilities);
6960                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
6961                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
6962                         params->htcaps_mask);
6963         }
6964
6965         if (params->p2p)
6966                 wpa_printf(MSG_DEBUG, "  * P2P group");
6967
6968         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6969         msg = NULL;
6970         if (ret) {
6971                 wpa_dbg(drv->ctx, MSG_DEBUG,
6972                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
6973                         ret, strerror(-ret));
6974                 nl80211_dump_scan(drv);
6975                 goto nla_put_failure;
6976         }
6977         ret = 0;
6978         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
6979                    "successfully");
6980
6981 nla_put_failure:
6982         nlmsg_free(msg);
6983         return ret;
6984 }
6985
6986
6987 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
6988                             int ifindex, enum nl80211_iftype mode)
6989 {
6990         struct nl_msg *msg;
6991         int ret = -ENOBUFS;
6992
6993         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
6994                    ifindex, mode, nl80211_iftype_str(mode));
6995
6996         msg = nlmsg_alloc();
6997         if (!msg)
6998                 return -ENOMEM;
6999
7000         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
7001         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
7002         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
7003
7004         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7005         msg = NULL;
7006         if (!ret)
7007                 return 0;
7008 nla_put_failure:
7009         nlmsg_free(msg);
7010         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
7011                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
7012         return ret;
7013 }
7014
7015
7016 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
7017                                        enum nl80211_iftype nlmode)
7018 {
7019         struct wpa_driver_nl80211_data *drv = bss->drv;
7020         int ret = -1;
7021         int i;
7022         int was_ap = is_ap_interface(drv->nlmode);
7023         int res;
7024
7025         res = nl80211_set_mode(drv, drv->ifindex, nlmode);
7026         if (res == 0) {
7027                 drv->nlmode = nlmode;
7028                 ret = 0;
7029                 goto done;
7030         }
7031
7032         if (res == -ENODEV)
7033                 return -1;
7034
7035         if (nlmode == drv->nlmode) {
7036                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
7037                            "requested mode - ignore error");
7038                 ret = 0;
7039                 goto done; /* Already in the requested mode */
7040         }
7041
7042         /* mac80211 doesn't allow mode changes while the device is up, so
7043          * take the device down, try to set the mode again, and bring the
7044          * device back up.
7045          */
7046         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
7047                    "interface down");
7048         for (i = 0; i < 10; i++) {
7049                 res = linux_set_iface_flags(drv->global->ioctl_sock,
7050                                             bss->ifname, 0);
7051                 if (res == -EACCES || res == -ENODEV)
7052                         break;
7053                 if (res == 0) {
7054                         /* Try to set the mode again while the interface is
7055                          * down */
7056                         ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
7057                         if (ret == -EACCES)
7058                                 break;
7059                         res = linux_set_iface_flags(drv->global->ioctl_sock,
7060                                                     bss->ifname, 1);
7061                         if (res && !ret)
7062                                 ret = -1;
7063                         else if (ret != -EBUSY)
7064                                 break;
7065                 } else
7066                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
7067                                    "interface down");
7068                 os_sleep(0, 100000);
7069         }
7070
7071         if (!ret) {
7072                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
7073                            "interface is down");
7074                 drv->nlmode = nlmode;
7075                 drv->ignore_if_down_event = 1;
7076         }
7077
7078 done:
7079         if (ret) {
7080                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
7081                            "from %d failed", nlmode, drv->nlmode);
7082                 return ret;
7083         }
7084
7085         if (is_p2p_interface(nlmode))
7086                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
7087         else if (drv->disabled_11b_rates)
7088                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
7089
7090         if (is_ap_interface(nlmode)) {
7091                 nl80211_mgmt_unsubscribe(bss, "start AP");
7092                 /* Setup additional AP mode functionality if needed */
7093                 if (nl80211_setup_ap(bss))
7094                         return -1;
7095         } else if (was_ap) {
7096                 /* Remove additional AP mode functionality */
7097                 nl80211_teardown_ap(bss);
7098         } else {
7099                 nl80211_mgmt_unsubscribe(bss, "mode change");
7100         }
7101
7102         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
7103             nl80211_mgmt_subscribe_non_ap(bss) < 0)
7104                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
7105                            "frame processing - ignore for now");
7106
7107         return 0;
7108 }
7109
7110
7111 static int wpa_driver_nl80211_get_capa(void *priv,
7112                                        struct wpa_driver_capa *capa)
7113 {
7114         struct i802_bss *bss = priv;
7115         struct wpa_driver_nl80211_data *drv = bss->drv;
7116         if (!drv->has_capability)
7117                 return -1;
7118         os_memcpy(capa, &drv->capa, sizeof(*capa));
7119         return 0;
7120 }
7121
7122
7123 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
7124 {
7125         struct i802_bss *bss = priv;
7126         struct wpa_driver_nl80211_data *drv = bss->drv;
7127
7128         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
7129                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
7130         drv->operstate = state;
7131         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
7132                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
7133 }
7134
7135
7136 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
7137 {
7138         struct i802_bss *bss = priv;
7139         struct wpa_driver_nl80211_data *drv = bss->drv;
7140         struct nl_msg *msg;
7141         struct nl80211_sta_flag_update upd;
7142
7143         msg = nlmsg_alloc();
7144         if (!msg)
7145                 return -ENOMEM;
7146
7147         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
7148
7149         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7150                     if_nametoindex(bss->ifname));
7151         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
7152
7153         os_memset(&upd, 0, sizeof(upd));
7154         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
7155         if (authorized)
7156                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
7157         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
7158
7159         return send_and_recv_msgs(drv, msg, NULL, NULL);
7160  nla_put_failure:
7161         nlmsg_free(msg);
7162         return -ENOBUFS;
7163 }
7164
7165
7166 /* Set kernel driver on given frequency (MHz) */
7167 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
7168 {
7169         struct i802_bss *bss = priv;
7170         return wpa_driver_nl80211_set_freq(bss, freq->freq, freq->ht_enabled,
7171                                            freq->sec_channel_offset);
7172 }
7173
7174
7175 #if defined(HOSTAPD) || defined(CONFIG_AP)
7176
7177 static inline int min_int(int a, int b)
7178 {
7179         if (a < b)
7180                 return a;
7181         return b;
7182 }
7183
7184
7185 static int get_key_handler(struct nl_msg *msg, void *arg)
7186 {
7187         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7188         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7189
7190         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7191                   genlmsg_attrlen(gnlh, 0), NULL);
7192
7193         /*
7194          * TODO: validate the key index and mac address!
7195          * Otherwise, there's a race condition as soon as
7196          * the kernel starts sending key notifications.
7197          */
7198
7199         if (tb[NL80211_ATTR_KEY_SEQ])
7200                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
7201                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
7202         return NL_SKIP;
7203 }
7204
7205
7206 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
7207                            int idx, u8 *seq)
7208 {
7209         struct i802_bss *bss = priv;
7210         struct wpa_driver_nl80211_data *drv = bss->drv;
7211         struct nl_msg *msg;
7212
7213         msg = nlmsg_alloc();
7214         if (!msg)
7215                 return -ENOMEM;
7216
7217         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
7218
7219         if (addr)
7220                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7221         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
7222         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
7223
7224         memset(seq, 0, 6);
7225
7226         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
7227  nla_put_failure:
7228         nlmsg_free(msg);
7229         return -ENOBUFS;
7230 }
7231
7232
7233 static int i802_set_rts(void *priv, int rts)
7234 {
7235         struct i802_bss *bss = priv;
7236         struct wpa_driver_nl80211_data *drv = bss->drv;
7237         struct nl_msg *msg;
7238         int ret = -ENOBUFS;
7239         u32 val;
7240
7241         msg = nlmsg_alloc();
7242         if (!msg)
7243                 return -ENOMEM;
7244
7245         if (rts >= 2347)
7246                 val = (u32) -1;
7247         else
7248                 val = rts;
7249
7250         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7251         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7252         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
7253
7254         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7255         msg = NULL;
7256         if (!ret)
7257                 return 0;
7258 nla_put_failure:
7259         nlmsg_free(msg);
7260         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
7261                    "%d (%s)", rts, ret, strerror(-ret));
7262         return ret;
7263 }
7264
7265
7266 static int i802_set_frag(void *priv, int frag)
7267 {
7268         struct i802_bss *bss = priv;
7269         struct wpa_driver_nl80211_data *drv = bss->drv;
7270         struct nl_msg *msg;
7271         int ret = -ENOBUFS;
7272         u32 val;
7273
7274         msg = nlmsg_alloc();
7275         if (!msg)
7276                 return -ENOMEM;
7277
7278         if (frag >= 2346)
7279                 val = (u32) -1;
7280         else
7281                 val = frag;
7282
7283         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7284         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7285         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
7286
7287         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7288         msg = NULL;
7289         if (!ret)
7290                 return 0;
7291 nla_put_failure:
7292         nlmsg_free(msg);
7293         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
7294                    "%d: %d (%s)", frag, ret, strerror(-ret));
7295         return ret;
7296 }
7297
7298
7299 static int i802_flush(void *priv)
7300 {
7301         struct i802_bss *bss = priv;
7302         struct wpa_driver_nl80211_data *drv = bss->drv;
7303         struct nl_msg *msg;
7304         int res;
7305
7306         msg = nlmsg_alloc();
7307         if (!msg)
7308                 return -1;
7309
7310         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
7311
7312         /*
7313          * XXX: FIX! this needs to flush all VLANs too
7314          */
7315         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7316                     if_nametoindex(bss->ifname));
7317
7318         res = send_and_recv_msgs(drv, msg, NULL, NULL);
7319         if (res) {
7320                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
7321                            "(%s)", res, strerror(-res));
7322         }
7323         return res;
7324  nla_put_failure:
7325         nlmsg_free(msg);
7326         return -ENOBUFS;
7327 }
7328
7329
7330 static int get_sta_handler(struct nl_msg *msg, void *arg)
7331 {
7332         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7333         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7334         struct hostap_sta_driver_data *data = arg;
7335         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
7336         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
7337                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
7338                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
7339                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
7340                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
7341                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
7342         };
7343
7344         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7345                   genlmsg_attrlen(gnlh, 0), NULL);
7346
7347         /*
7348          * TODO: validate the interface and mac address!
7349          * Otherwise, there's a race condition as soon as
7350          * the kernel starts sending station notifications.
7351          */
7352
7353         if (!tb[NL80211_ATTR_STA_INFO]) {
7354                 wpa_printf(MSG_DEBUG, "sta stats missing!");
7355                 return NL_SKIP;
7356         }
7357         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
7358                              tb[NL80211_ATTR_STA_INFO],
7359                              stats_policy)) {
7360                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
7361                 return NL_SKIP;
7362         }
7363
7364         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
7365                 data->inactive_msec =
7366                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
7367         if (stats[NL80211_STA_INFO_RX_BYTES])
7368                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
7369         if (stats[NL80211_STA_INFO_TX_BYTES])
7370                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
7371         if (stats[NL80211_STA_INFO_RX_PACKETS])
7372                 data->rx_packets =
7373                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
7374         if (stats[NL80211_STA_INFO_TX_PACKETS])
7375                 data->tx_packets =
7376                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
7377
7378         return NL_SKIP;
7379 }
7380
7381 static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data,
7382                               const u8 *addr)
7383 {
7384         struct i802_bss *bss = priv;
7385         struct wpa_driver_nl80211_data *drv = bss->drv;
7386         struct nl_msg *msg;
7387
7388         os_memset(data, 0, sizeof(*data));
7389         msg = nlmsg_alloc();
7390         if (!msg)
7391                 return -ENOMEM;
7392
7393         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
7394
7395         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7396         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7397
7398         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
7399  nla_put_failure:
7400         nlmsg_free(msg);
7401         return -ENOBUFS;
7402 }
7403
7404
7405 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
7406                                     int cw_min, int cw_max, int burst_time)
7407 {
7408         struct i802_bss *bss = priv;
7409         struct wpa_driver_nl80211_data *drv = bss->drv;
7410         struct nl_msg *msg;
7411         struct nlattr *txq, *params;
7412
7413         msg = nlmsg_alloc();
7414         if (!msg)
7415                 return -1;
7416
7417         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7418
7419         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7420
7421         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
7422         if (!txq)
7423                 goto nla_put_failure;
7424
7425         /* We are only sending parameters for a single TXQ at a time */
7426         params = nla_nest_start(msg, 1);
7427         if (!params)
7428                 goto nla_put_failure;
7429
7430         switch (queue) {
7431         case 0:
7432                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
7433                 break;
7434         case 1:
7435                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
7436                 break;
7437         case 2:
7438                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
7439                 break;
7440         case 3:
7441                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
7442                 break;
7443         }
7444         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
7445          * 32 usec, so need to convert the value here. */
7446         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
7447         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
7448         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
7449         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
7450
7451         nla_nest_end(msg, params);
7452
7453         nla_nest_end(msg, txq);
7454
7455         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
7456                 return 0;
7457         msg = NULL;
7458  nla_put_failure:
7459         nlmsg_free(msg);
7460         return -1;
7461 }
7462
7463
7464 static int i802_set_sta_vlan(void *priv, const u8 *addr,
7465                              const char *ifname, int vlan_id)
7466 {
7467         struct i802_bss *bss = priv;
7468         struct wpa_driver_nl80211_data *drv = bss->drv;
7469         struct nl_msg *msg;
7470         int ret = -ENOBUFS;
7471
7472         msg = nlmsg_alloc();
7473         if (!msg)
7474                 return -ENOMEM;
7475
7476         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
7477
7478         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7479                     if_nametoindex(bss->ifname));
7480         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7481         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
7482                     if_nametoindex(ifname));
7483
7484         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7485         msg = NULL;
7486         if (ret < 0) {
7487                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
7488                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
7489                            MAC2STR(addr), ifname, vlan_id, ret,
7490                            strerror(-ret));
7491         }
7492  nla_put_failure:
7493         nlmsg_free(msg);
7494         return ret;
7495 }
7496
7497
7498 static int i802_get_inact_sec(void *priv, const u8 *addr)
7499 {
7500         struct hostap_sta_driver_data data;
7501         int ret;
7502
7503         data.inactive_msec = (unsigned long) -1;
7504         ret = i802_read_sta_data(priv, &data, addr);
7505         if (ret || data.inactive_msec == (unsigned long) -1)
7506                 return -1;
7507         return data.inactive_msec / 1000;
7508 }
7509
7510
7511 static int i802_sta_clear_stats(void *priv, const u8 *addr)
7512 {
7513 #if 0
7514         /* TODO */
7515 #endif
7516         return 0;
7517 }
7518
7519
7520 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
7521                            int reason)
7522 {
7523         struct i802_bss *bss = priv;
7524         struct wpa_driver_nl80211_data *drv = bss->drv;
7525         struct ieee80211_mgmt mgmt;
7526
7527         if (drv->device_ap_sme)
7528                 return wpa_driver_nl80211_sta_remove(bss, addr);
7529
7530         memset(&mgmt, 0, sizeof(mgmt));
7531         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
7532                                           WLAN_FC_STYPE_DEAUTH);
7533         memcpy(mgmt.da, addr, ETH_ALEN);
7534         memcpy(mgmt.sa, own_addr, ETH_ALEN);
7535         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
7536         mgmt.u.deauth.reason_code = host_to_le16(reason);
7537         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
7538                                             IEEE80211_HDRLEN +
7539                                             sizeof(mgmt.u.deauth), 0);
7540 }
7541
7542
7543 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
7544                              int reason)
7545 {
7546         struct i802_bss *bss = priv;
7547         struct wpa_driver_nl80211_data *drv = bss->drv;
7548         struct ieee80211_mgmt mgmt;
7549
7550         if (drv->device_ap_sme)
7551                 return wpa_driver_nl80211_sta_remove(bss, addr);
7552
7553         memset(&mgmt, 0, sizeof(mgmt));
7554         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
7555                                           WLAN_FC_STYPE_DISASSOC);
7556         memcpy(mgmt.da, addr, ETH_ALEN);
7557         memcpy(mgmt.sa, own_addr, ETH_ALEN);
7558         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
7559         mgmt.u.disassoc.reason_code = host_to_le16(reason);
7560         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
7561                                             IEEE80211_HDRLEN +
7562                                             sizeof(mgmt.u.disassoc), 0);
7563 }
7564
7565 #endif /* HOSTAPD || CONFIG_AP */
7566
7567 #ifdef HOSTAPD
7568
7569 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
7570 {
7571         int i;
7572         int *old;
7573
7574         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
7575                    ifidx);
7576         for (i = 0; i < drv->num_if_indices; i++) {
7577                 if (drv->if_indices[i] == 0) {
7578                         drv->if_indices[i] = ifidx;
7579                         return;
7580                 }
7581         }
7582
7583         if (drv->if_indices != drv->default_if_indices)
7584                 old = drv->if_indices;
7585         else
7586                 old = NULL;
7587
7588         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
7589                                            sizeof(int));
7590         if (!drv->if_indices) {
7591                 if (!old)
7592                         drv->if_indices = drv->default_if_indices;
7593                 else
7594                         drv->if_indices = old;
7595                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
7596                            "interfaces");
7597                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
7598                 return;
7599         } else if (!old)
7600                 os_memcpy(drv->if_indices, drv->default_if_indices,
7601                           sizeof(drv->default_if_indices));
7602         drv->if_indices[drv->num_if_indices] = ifidx;
7603         drv->num_if_indices++;
7604 }
7605
7606
7607 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
7608 {
7609         int i;
7610
7611         for (i = 0; i < drv->num_if_indices; i++) {
7612                 if (drv->if_indices[i] == ifidx) {
7613                         drv->if_indices[i] = 0;
7614                         break;
7615                 }
7616         }
7617 }
7618
7619
7620 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
7621 {
7622         int i;
7623
7624         for (i = 0; i < drv->num_if_indices; i++)
7625                 if (drv->if_indices[i] == ifidx)
7626                         return 1;
7627
7628         return 0;
7629 }
7630
7631
7632 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
7633                             const char *bridge_ifname)
7634 {
7635         struct i802_bss *bss = priv;
7636         struct wpa_driver_nl80211_data *drv = bss->drv;
7637         char name[IFNAMSIZ + 1];
7638
7639         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
7640         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
7641                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
7642         if (val) {
7643                 if (!if_nametoindex(name)) {
7644                         if (nl80211_create_iface(drv, name,
7645                                                  NL80211_IFTYPE_AP_VLAN,
7646                                                  NULL, 1) < 0)
7647                                 return -1;
7648                         if (bridge_ifname &&
7649                             linux_br_add_if(drv->global->ioctl_sock,
7650                                             bridge_ifname, name) < 0)
7651                                 return -1;
7652                 }
7653                 linux_set_iface_flags(drv->global->ioctl_sock, name, 1);
7654                 return i802_set_sta_vlan(priv, addr, name, 0);
7655         } else {
7656                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
7657                 return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
7658                                                     name);
7659         }
7660 }
7661
7662
7663 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
7664 {
7665         struct wpa_driver_nl80211_data *drv = eloop_ctx;
7666         struct sockaddr_ll lladdr;
7667         unsigned char buf[3000];
7668         int len;
7669         socklen_t fromlen = sizeof(lladdr);
7670
7671         len = recvfrom(sock, buf, sizeof(buf), 0,
7672                        (struct sockaddr *)&lladdr, &fromlen);
7673         if (len < 0) {
7674                 perror("recv");
7675                 return;
7676         }
7677
7678         if (have_ifidx(drv, lladdr.sll_ifindex))
7679                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
7680 }
7681
7682
7683 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
7684                              struct i802_bss *bss,
7685                              const char *brname, const char *ifname)
7686 {
7687         int ifindex;
7688         char in_br[IFNAMSIZ];
7689
7690         os_strlcpy(bss->brname, brname, IFNAMSIZ);
7691         ifindex = if_nametoindex(brname);
7692         if (ifindex == 0) {
7693                 /*
7694                  * Bridge was configured, but the bridge device does
7695                  * not exist. Try to add it now.
7696                  */
7697                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
7698                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
7699                                    "bridge interface %s: %s",
7700                                    brname, strerror(errno));
7701                         return -1;
7702                 }
7703                 bss->added_bridge = 1;
7704                 add_ifidx(drv, if_nametoindex(brname));
7705         }
7706
7707         if (linux_br_get(in_br, ifname) == 0) {
7708                 if (os_strcmp(in_br, brname) == 0)
7709                         return 0; /* already in the bridge */
7710
7711                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
7712                            "bridge %s", ifname, in_br);
7713                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
7714                     0) {
7715                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
7716                                    "remove interface %s from bridge "
7717                                    "%s: %s",
7718                                    ifname, brname, strerror(errno));
7719                         return -1;
7720                 }
7721         }
7722
7723         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
7724                    ifname, brname);
7725         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
7726                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
7727                            "into bridge %s: %s",
7728                            ifname, brname, strerror(errno));
7729                 return -1;
7730         }
7731         bss->added_if_into_bridge = 1;
7732
7733         return 0;
7734 }
7735
7736
7737 static void *i802_init(struct hostapd_data *hapd,
7738                        struct wpa_init_params *params)
7739 {
7740         struct wpa_driver_nl80211_data *drv;
7741         struct i802_bss *bss;
7742         size_t i;
7743         char brname[IFNAMSIZ];
7744         int ifindex, br_ifindex;
7745         int br_added = 0;
7746
7747         bss = wpa_driver_nl80211_init(hapd, params->ifname,
7748                                       params->global_priv);
7749         if (bss == NULL)
7750                 return NULL;
7751
7752         drv = bss->drv;
7753         drv->nlmode = NL80211_IFTYPE_AP;
7754         drv->eapol_sock = -1;
7755
7756         if (linux_br_get(brname, params->ifname) == 0) {
7757                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
7758                            params->ifname, brname);
7759                 br_ifindex = if_nametoindex(brname);
7760         } else {
7761                 brname[0] = '\0';
7762                 br_ifindex = 0;
7763         }
7764
7765         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
7766         drv->if_indices = drv->default_if_indices;
7767         for (i = 0; i < params->num_bridge; i++) {
7768                 if (params->bridge[i]) {
7769                         ifindex = if_nametoindex(params->bridge[i]);
7770                         if (ifindex)
7771                                 add_ifidx(drv, ifindex);
7772                         if (ifindex == br_ifindex)
7773                                 br_added = 1;
7774                 }
7775         }
7776         if (!br_added && br_ifindex &&
7777             (params->num_bridge == 0 || !params->bridge[0]))
7778                 add_ifidx(drv, br_ifindex);
7779
7780         /* start listening for EAPOL on the default AP interface */
7781         add_ifidx(drv, drv->ifindex);
7782
7783         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0))
7784                 goto failed;
7785
7786         if (params->bssid) {
7787                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7788                                        params->bssid))
7789                         goto failed;
7790         }
7791
7792         if (wpa_driver_nl80211_set_mode(bss, drv->nlmode)) {
7793                 wpa_printf(MSG_ERROR, "nl80211: Failed to set interface %s "
7794                            "into AP mode", bss->ifname);
7795                 goto failed;
7796         }
7797
7798         if (params->num_bridge && params->bridge[0] &&
7799             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
7800                 goto failed;
7801
7802         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1))
7803                 goto failed;
7804
7805         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
7806         if (drv->eapol_sock < 0) {
7807                 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
7808                 goto failed;
7809         }
7810
7811         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
7812         {
7813                 printf("Could not register read socket for eapol\n");
7814                 goto failed;
7815         }
7816
7817         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7818                                params->own_addr))
7819                 goto failed;
7820
7821         memcpy(bss->addr, params->own_addr, ETH_ALEN);
7822
7823         return bss;
7824
7825 failed:
7826         wpa_driver_nl80211_deinit(bss);
7827         return NULL;
7828 }
7829
7830
7831 static void i802_deinit(void *priv)
7832 {
7833         wpa_driver_nl80211_deinit(priv);
7834 }
7835
7836 #endif /* HOSTAPD */
7837
7838
7839 static enum nl80211_iftype wpa_driver_nl80211_if_type(
7840         enum wpa_driver_if_type type)
7841 {
7842         switch (type) {
7843         case WPA_IF_STATION:
7844                 return NL80211_IFTYPE_STATION;
7845         case WPA_IF_P2P_CLIENT:
7846         case WPA_IF_P2P_GROUP:
7847                 return NL80211_IFTYPE_P2P_CLIENT;
7848         case WPA_IF_AP_VLAN:
7849                 return NL80211_IFTYPE_AP_VLAN;
7850         case WPA_IF_AP_BSS:
7851                 return NL80211_IFTYPE_AP;
7852         case WPA_IF_P2P_GO:
7853                 return NL80211_IFTYPE_P2P_GO;
7854         }
7855         return -1;
7856 }
7857
7858
7859 #ifdef CONFIG_P2P
7860
7861 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
7862 {
7863         struct wpa_driver_nl80211_data *drv;
7864         dl_list_for_each(drv, &global->interfaces,
7865                          struct wpa_driver_nl80211_data, list) {
7866                 if (os_memcmp(addr, drv->first_bss.addr, ETH_ALEN) == 0)
7867                         return 1;
7868         }
7869         return 0;
7870 }
7871
7872
7873 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
7874                                       u8 *new_addr)
7875 {
7876         unsigned int idx;
7877
7878         if (!drv->global)
7879                 return -1;
7880
7881         os_memcpy(new_addr, drv->first_bss.addr, ETH_ALEN);
7882         for (idx = 0; idx < 64; idx++) {
7883                 new_addr[0] = drv->first_bss.addr[0] | 0x02;
7884                 new_addr[0] ^= idx << 2;
7885                 if (!nl80211_addr_in_use(drv->global, new_addr))
7886                         break;
7887         }
7888         if (idx == 64)
7889                 return -1;
7890
7891         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
7892                    MACSTR, MAC2STR(new_addr));
7893
7894         return 0;
7895 }
7896
7897 #endif /* CONFIG_P2P */
7898
7899
7900 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
7901                                      const char *ifname, const u8 *addr,
7902                                      void *bss_ctx, void **drv_priv,
7903                                      char *force_ifname, u8 *if_addr,
7904                                      const char *bridge)
7905 {
7906         struct i802_bss *bss = priv;
7907         struct wpa_driver_nl80211_data *drv = bss->drv;
7908         int ifidx;
7909 #ifdef HOSTAPD
7910         struct i802_bss *new_bss = NULL;
7911
7912         if (type == WPA_IF_AP_BSS) {
7913                 new_bss = os_zalloc(sizeof(*new_bss));
7914                 if (new_bss == NULL)
7915                         return -1;
7916         }
7917 #endif /* HOSTAPD */
7918
7919         if (addr)
7920                 os_memcpy(if_addr, addr, ETH_ALEN);
7921         ifidx = nl80211_create_iface(drv, ifname,
7922                                      wpa_driver_nl80211_if_type(type), addr,
7923                                      0);
7924         if (ifidx < 0) {
7925 #ifdef HOSTAPD
7926                 os_free(new_bss);
7927 #endif /* HOSTAPD */
7928                 return -1;
7929         }
7930
7931         if (!addr &&
7932             linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7933                                if_addr) < 0) {
7934                 nl80211_remove_iface(drv, ifidx);
7935                 return -1;
7936         }
7937
7938 #ifdef CONFIG_P2P
7939         if (!addr &&
7940             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
7941              type == WPA_IF_P2P_GO)) {
7942                 /* Enforce unique P2P Interface Address */
7943                 u8 new_addr[ETH_ALEN], own_addr[ETH_ALEN];
7944
7945                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7946                                        own_addr) < 0 ||
7947                     linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
7948                                        new_addr) < 0) {
7949                         nl80211_remove_iface(drv, ifidx);
7950                         return -1;
7951                 }
7952                 if (os_memcmp(own_addr, new_addr, ETH_ALEN) == 0) {
7953                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
7954                                    "for P2P group interface");
7955                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
7956                                 nl80211_remove_iface(drv, ifidx);
7957                                 return -1;
7958                         }
7959                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
7960                                                new_addr) < 0) {
7961                                 nl80211_remove_iface(drv, ifidx);
7962                                 return -1;
7963                         }
7964                 }
7965                 os_memcpy(if_addr, new_addr, ETH_ALEN);
7966         }
7967 #endif /* CONFIG_P2P */
7968
7969 #ifdef HOSTAPD
7970         if (bridge &&
7971             i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
7972                 wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
7973                            "interface %s to a bridge %s", ifname, bridge);
7974                 nl80211_remove_iface(drv, ifidx);
7975                 os_free(new_bss);
7976                 return -1;
7977         }
7978
7979         if (type == WPA_IF_AP_BSS) {
7980                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
7981                 {
7982                         nl80211_remove_iface(drv, ifidx);
7983                         os_free(new_bss);
7984                         return -1;
7985                 }
7986                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
7987                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
7988                 new_bss->ifindex = ifidx;
7989                 new_bss->drv = drv;
7990                 new_bss->next = drv->first_bss.next;
7991                 new_bss->freq = drv->first_bss.freq;
7992                 drv->first_bss.next = new_bss;
7993                 if (drv_priv)
7994                         *drv_priv = new_bss;
7995                 nl80211_init_bss(new_bss);
7996
7997                 /* Subscribe management frames for this WPA_IF_AP_BSS */
7998                 if (nl80211_setup_ap(new_bss))
7999                         return -1;
8000         }
8001 #endif /* HOSTAPD */
8002
8003         if (drv->global)
8004                 drv->global->if_add_ifindex = ifidx;
8005
8006         return 0;
8007 }
8008
8009
8010 static int wpa_driver_nl80211_if_remove(void *priv,
8011                                         enum wpa_driver_if_type type,
8012                                         const char *ifname)
8013 {
8014         struct i802_bss *bss = priv;
8015         struct wpa_driver_nl80211_data *drv = bss->drv;
8016         int ifindex = if_nametoindex(ifname);
8017
8018         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d",
8019                    __func__, type, ifname, ifindex);
8020         if (ifindex <= 0)
8021                 return -1;
8022
8023 #ifdef HOSTAPD
8024         if (bss->added_if_into_bridge) {
8025                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
8026                                     bss->ifname) < 0)
8027                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
8028                                    "interface %s from bridge %s: %s",
8029                                    bss->ifname, bss->brname, strerror(errno));
8030         }
8031         if (bss->added_bridge) {
8032                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
8033                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
8034                                    "bridge %s: %s",
8035                                    bss->brname, strerror(errno));
8036         }
8037 #endif /* HOSTAPD */
8038
8039         nl80211_remove_iface(drv, ifindex);
8040
8041 #ifdef HOSTAPD
8042         if (type != WPA_IF_AP_BSS)
8043                 return 0;
8044
8045         if (bss != &drv->first_bss) {
8046                 struct i802_bss *tbss;
8047
8048                 for (tbss = &drv->first_bss; tbss; tbss = tbss->next) {
8049                         if (tbss->next == bss) {
8050                                 tbss->next = bss->next;
8051                                 /* Unsubscribe management frames */
8052                                 nl80211_teardown_ap(bss);
8053                                 nl80211_destroy_bss(bss);
8054                                 os_free(bss);
8055                                 bss = NULL;
8056                                 break;
8057                         }
8058                 }
8059                 if (bss)
8060                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
8061                                    "BSS %p in the list", __func__, bss);
8062         }
8063 #endif /* HOSTAPD */
8064
8065         return 0;
8066 }
8067
8068
8069 static int cookie_handler(struct nl_msg *msg, void *arg)
8070 {
8071         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8072         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8073         u64 *cookie = arg;
8074         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8075                   genlmsg_attrlen(gnlh, 0), NULL);
8076         if (tb[NL80211_ATTR_COOKIE])
8077                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
8078         return NL_SKIP;
8079 }
8080
8081
8082 static int nl80211_send_frame_cmd(struct i802_bss *bss,
8083                                   unsigned int freq, unsigned int wait,
8084                                   const u8 *buf, size_t buf_len,
8085                                   u64 *cookie_out, int no_cck, int no_ack,
8086                                   int offchanok)
8087 {
8088         struct wpa_driver_nl80211_data *drv = bss->drv;
8089         struct nl_msg *msg;
8090         u64 cookie;
8091         int ret = -1;
8092
8093         msg = nlmsg_alloc();
8094         if (!msg)
8095                 return -1;
8096
8097         wpa_printf(MSG_DEBUG, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
8098                    "no_ack=%d offchanok=%d",
8099                    freq, wait, no_cck, no_ack, offchanok);
8100         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
8101
8102         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8103         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
8104         if (wait)
8105                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
8106         if (offchanok && (drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX))
8107                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
8108         if (no_cck)
8109                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
8110         if (no_ack)
8111                 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
8112
8113         NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
8114
8115         cookie = 0;
8116         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
8117         msg = NULL;
8118         if (ret) {
8119                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
8120                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
8121                            freq, wait);
8122                 goto nla_put_failure;
8123         }
8124         wpa_printf(MSG_DEBUG, "nl80211: Frame TX command accepted%s; "
8125                    "cookie 0x%llx", no_ack ? " (no ACK)" : "",
8126                    (long long unsigned int) cookie);
8127
8128         if (cookie_out)
8129                 *cookie_out = no_ack ? (u64) -1 : cookie;
8130
8131 nla_put_failure:
8132         nlmsg_free(msg);
8133         return ret;
8134 }
8135
8136
8137 static int wpa_driver_nl80211_send_action(void *priv, unsigned int freq,
8138                                           unsigned int wait_time,
8139                                           const u8 *dst, const u8 *src,
8140                                           const u8 *bssid,
8141                                           const u8 *data, size_t data_len,
8142                                           int no_cck)
8143 {
8144         struct i802_bss *bss = priv;
8145         struct wpa_driver_nl80211_data *drv = bss->drv;
8146         int ret = -1;
8147         u8 *buf;
8148         struct ieee80211_hdr *hdr;
8149
8150         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
8151                    "freq=%u MHz wait=%d ms no_cck=%d)",
8152                    drv->ifindex, freq, wait_time, no_cck);
8153
8154         buf = os_zalloc(24 + data_len);
8155         if (buf == NULL)
8156                 return ret;
8157         os_memcpy(buf + 24, data, data_len);
8158         hdr = (struct ieee80211_hdr *) buf;
8159         hdr->frame_control =
8160                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
8161         os_memcpy(hdr->addr1, dst, ETH_ALEN);
8162         os_memcpy(hdr->addr2, src, ETH_ALEN);
8163         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
8164
8165         if (is_ap_interface(drv->nlmode))
8166                 ret = wpa_driver_nl80211_send_mlme_freq(priv, buf,
8167                                                         24 + data_len,
8168                                                         0, freq, no_cck, 1,
8169                                                         wait_time);
8170         else
8171                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
8172                                              24 + data_len,
8173                                              &drv->send_action_cookie,
8174                                              no_cck, 0, 1);
8175
8176         os_free(buf);
8177         return ret;
8178 }
8179
8180
8181 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
8182 {
8183         struct i802_bss *bss = priv;
8184         struct wpa_driver_nl80211_data *drv = bss->drv;
8185         struct nl_msg *msg;
8186         int ret;
8187
8188         msg = nlmsg_alloc();
8189         if (!msg)
8190                 return;
8191
8192         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
8193
8194         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8195         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
8196
8197         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8198         msg = NULL;
8199         if (ret)
8200                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
8201                            "(%s)", ret, strerror(-ret));
8202
8203  nla_put_failure:
8204         nlmsg_free(msg);
8205 }
8206
8207
8208 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
8209                                                 unsigned int duration)
8210 {
8211         struct i802_bss *bss = priv;
8212         struct wpa_driver_nl80211_data *drv = bss->drv;
8213         struct nl_msg *msg;
8214         int ret;
8215         u64 cookie;
8216
8217         msg = nlmsg_alloc();
8218         if (!msg)
8219                 return -1;
8220
8221         nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
8222
8223         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8224         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
8225         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
8226
8227         cookie = 0;
8228         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
8229         msg = NULL;
8230         if (ret == 0) {
8231                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
8232                            "0x%llx for freq=%u MHz duration=%u",
8233                            (long long unsigned int) cookie, freq, duration);
8234                 drv->remain_on_chan_cookie = cookie;
8235                 drv->pending_remain_on_chan = 1;
8236                 return 0;
8237         }
8238         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
8239                    "(freq=%d duration=%u): %d (%s)",
8240                    freq, duration, ret, strerror(-ret));
8241 nla_put_failure:
8242         nlmsg_free(msg);
8243         return -1;
8244 }
8245
8246
8247 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
8248 {
8249         struct i802_bss *bss = priv;
8250         struct wpa_driver_nl80211_data *drv = bss->drv;
8251         struct nl_msg *msg;
8252         int ret;
8253
8254         if (!drv->pending_remain_on_chan) {
8255                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
8256                            "to cancel");
8257                 return -1;
8258         }
8259
8260         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
8261                    "0x%llx",
8262                    (long long unsigned int) drv->remain_on_chan_cookie);
8263
8264         msg = nlmsg_alloc();
8265         if (!msg)
8266                 return -1;
8267
8268         nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
8269
8270         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8271         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
8272
8273         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8274         msg = NULL;
8275         if (ret == 0)
8276                 return 0;
8277         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
8278                    "%d (%s)", ret, strerror(-ret));
8279 nla_put_failure:
8280         nlmsg_free(msg);
8281         return -1;
8282 }
8283
8284
8285 static int wpa_driver_nl80211_probe_req_report(void *priv, int report)
8286 {
8287         struct i802_bss *bss = priv;
8288         struct wpa_driver_nl80211_data *drv = bss->drv;
8289
8290         if (!report) {
8291                 if (bss->nl_preq && drv->device_ap_sme &&
8292                     is_ap_interface(drv->nlmode)) {
8293                         /*
8294                          * Do not disable Probe Request reporting that was
8295                          * enabled in nl80211_setup_ap().
8296                          */
8297                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
8298                                    "Probe Request reporting nl_preq=%p while "
8299                                    "in AP mode", bss->nl_preq);
8300                 } else if (bss->nl_preq) {
8301                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
8302                                    "reporting nl_preq=%p", bss->nl_preq);
8303                         eloop_unregister_read_sock(
8304                                 nl_socket_get_fd(bss->nl_preq));
8305                         nl_destroy_handles(&bss->nl_preq);
8306                 }
8307                 return 0;
8308         }
8309
8310         if (bss->nl_preq) {
8311                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
8312                            "already on! nl_preq=%p", bss->nl_preq);
8313                 return 0;
8314         }
8315
8316         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
8317         if (bss->nl_preq == NULL)
8318                 return -1;
8319         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
8320                    "reporting nl_preq=%p", bss->nl_preq);
8321
8322         if (nl80211_register_frame(bss, bss->nl_preq,
8323                                    (WLAN_FC_TYPE_MGMT << 2) |
8324                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
8325                                    NULL, 0) < 0)
8326                 goto out_err;
8327
8328         eloop_register_read_sock(nl_socket_get_fd(bss->nl_preq),
8329                                  wpa_driver_nl80211_event_receive, bss->nl_cb,
8330                                  bss->nl_preq);
8331
8332         return 0;
8333
8334  out_err:
8335         nl_destroy_handles(&bss->nl_preq);
8336         return -1;
8337 }
8338
8339
8340 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
8341                                      int ifindex, int disabled)
8342 {
8343         struct nl_msg *msg;
8344         struct nlattr *bands, *band;
8345         int ret;
8346
8347         msg = nlmsg_alloc();
8348         if (!msg)
8349                 return -1;
8350
8351         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
8352         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
8353
8354         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
8355         if (!bands)
8356                 goto nla_put_failure;
8357
8358         /*
8359          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
8360          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
8361          * rates. All 5 GHz rates are left enabled.
8362          */
8363         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
8364         if (!band)
8365                 goto nla_put_failure;
8366         if (disabled) {
8367                 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
8368                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
8369         }
8370         nla_nest_end(msg, band);
8371
8372         nla_nest_end(msg, bands);
8373
8374         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8375         msg = NULL;
8376         if (ret) {
8377                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
8378                            "(%s)", ret, strerror(-ret));
8379         } else
8380                 drv->disabled_11b_rates = disabled;
8381
8382         return ret;
8383
8384 nla_put_failure:
8385         nlmsg_free(msg);
8386         return -1;
8387 }
8388
8389
8390 static int wpa_driver_nl80211_deinit_ap(void *priv)
8391 {
8392         struct i802_bss *bss = priv;
8393         struct wpa_driver_nl80211_data *drv = bss->drv;
8394         if (!is_ap_interface(drv->nlmode))
8395                 return -1;
8396         wpa_driver_nl80211_del_beacon(drv);
8397         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
8398 }
8399
8400
8401 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
8402 {
8403         struct i802_bss *bss = priv;
8404         struct wpa_driver_nl80211_data *drv = bss->drv;
8405         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
8406                 return -1;
8407         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
8408 }
8409
8410
8411 static void wpa_driver_nl80211_resume(void *priv)
8412 {
8413         struct i802_bss *bss = priv;
8414         struct wpa_driver_nl80211_data *drv = bss->drv;
8415         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
8416                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on "
8417                            "resume event");
8418         }
8419 }
8420
8421
8422 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
8423                                   const u8 *ies, size_t ies_len)
8424 {
8425         struct i802_bss *bss = priv;
8426         struct wpa_driver_nl80211_data *drv = bss->drv;
8427         int ret;
8428         u8 *data, *pos;
8429         size_t data_len;
8430         const u8 *own_addr = bss->addr;
8431
8432         if (action != 1) {
8433                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
8434                            "action %d", action);
8435                 return -1;
8436         }
8437
8438         /*
8439          * Action frame payload:
8440          * Category[1] = 6 (Fast BSS Transition)
8441          * Action[1] = 1 (Fast BSS Transition Request)
8442          * STA Address
8443          * Target AP Address
8444          * FT IEs
8445          */
8446
8447         data_len = 2 + 2 * ETH_ALEN + ies_len;
8448         data = os_malloc(data_len);
8449         if (data == NULL)
8450                 return -1;
8451         pos = data;
8452         *pos++ = 0x06; /* FT Action category */
8453         *pos++ = action;
8454         os_memcpy(pos, own_addr, ETH_ALEN);
8455         pos += ETH_ALEN;
8456         os_memcpy(pos, target_ap, ETH_ALEN);
8457         pos += ETH_ALEN;
8458         os_memcpy(pos, ies, ies_len);
8459
8460         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
8461                                              drv->bssid, own_addr, drv->bssid,
8462                                              data, data_len, 0);
8463         os_free(data);
8464
8465         return ret;
8466 }
8467
8468
8469 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
8470 {
8471         struct i802_bss *bss = priv;
8472         struct wpa_driver_nl80211_data *drv = bss->drv;
8473         struct nl_msg *msg, *cqm = NULL;
8474         int ret = -1;
8475
8476         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
8477                    "hysteresis=%d", threshold, hysteresis);
8478
8479         msg = nlmsg_alloc();
8480         if (!msg)
8481                 return -1;
8482
8483         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
8484
8485         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8486
8487         cqm = nlmsg_alloc();
8488         if (cqm == NULL)
8489                 goto nla_put_failure;
8490
8491         NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
8492         NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
8493         if (nla_put_nested(msg, NL80211_ATTR_CQM, cqm) < 0)
8494                 goto nla_put_failure;
8495
8496         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8497         msg = NULL;
8498
8499 nla_put_failure:
8500         nlmsg_free(cqm);
8501         nlmsg_free(msg);
8502         return ret;
8503 }
8504
8505
8506 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
8507 {
8508         struct i802_bss *bss = priv;
8509         struct wpa_driver_nl80211_data *drv = bss->drv;
8510         int res;
8511
8512         os_memset(si, 0, sizeof(*si));
8513         res = nl80211_get_link_signal(drv, si);
8514         if (res != 0)
8515                 return res;
8516
8517         return nl80211_get_link_noise(drv, si);
8518 }
8519
8520
8521 static int wpa_driver_nl80211_shared_freq(void *priv)
8522 {
8523         struct i802_bss *bss = priv;
8524         struct wpa_driver_nl80211_data *drv = bss->drv;
8525         struct wpa_driver_nl80211_data *driver;
8526         int freq = 0;
8527
8528         /*
8529          * If the same PHY is in connected state with some other interface,
8530          * then retrieve the assoc freq.
8531          */
8532         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
8533                    drv->phyname);
8534
8535         dl_list_for_each(driver, &drv->global->interfaces,
8536                          struct wpa_driver_nl80211_data, list) {
8537                 if (drv == driver ||
8538                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
8539                     !driver->associated)
8540                         continue;
8541
8542                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
8543                            MACSTR,
8544                            driver->phyname, driver->first_bss.ifname,
8545                            MAC2STR(driver->first_bss.addr));
8546                 if (is_ap_interface(driver->nlmode))
8547                         freq = driver->first_bss.freq;
8548                 else
8549                         freq = nl80211_get_assoc_freq(driver);
8550                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
8551                            drv->phyname, freq);
8552         }
8553
8554         if (!freq)
8555                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
8556                            "PHY (%s) in associated state", drv->phyname);
8557
8558         return freq;
8559 }
8560
8561
8562 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
8563                               int encrypt)
8564 {
8565         struct i802_bss *bss = priv;
8566         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
8567                                              0, 0, 0, 0);
8568 }
8569
8570
8571 static int nl80211_set_param(void *priv, const char *param)
8572 {
8573         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
8574         if (param == NULL)
8575                 return 0;
8576
8577 #ifdef CONFIG_P2P
8578         if (os_strstr(param, "use_p2p_group_interface=1")) {
8579                 struct i802_bss *bss = priv;
8580                 struct wpa_driver_nl80211_data *drv = bss->drv;
8581
8582                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
8583                            "interface");
8584                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
8585                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
8586         }
8587 #endif /* CONFIG_P2P */
8588
8589         return 0;
8590 }
8591
8592
8593 static void * nl80211_global_init(void)
8594 {
8595         struct nl80211_global *global;
8596         struct netlink_config *cfg;
8597
8598         global = os_zalloc(sizeof(*global));
8599         if (global == NULL)
8600                 return NULL;
8601         global->ioctl_sock = -1;
8602         dl_list_init(&global->interfaces);
8603         global->if_add_ifindex = -1;
8604
8605         cfg = os_zalloc(sizeof(*cfg));
8606         if (cfg == NULL)
8607                 goto err;
8608
8609         cfg->ctx = global;
8610         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
8611         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
8612         global->netlink = netlink_init(cfg);
8613         if (global->netlink == NULL) {
8614                 os_free(cfg);
8615                 goto err;
8616         }
8617
8618         if (wpa_driver_nl80211_init_nl_global(global) < 0)
8619                 goto err;
8620
8621         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
8622         if (global->ioctl_sock < 0) {
8623                 perror("socket(PF_INET,SOCK_DGRAM)");
8624                 goto err;
8625         }
8626
8627         return global;
8628
8629 err:
8630         nl80211_global_deinit(global);
8631         return NULL;
8632 }
8633
8634
8635 static void nl80211_global_deinit(void *priv)
8636 {
8637         struct nl80211_global *global = priv;
8638         if (global == NULL)
8639                 return;
8640         if (!dl_list_empty(&global->interfaces)) {
8641                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
8642                            "nl80211_global_deinit",
8643                            dl_list_len(&global->interfaces));
8644         }
8645
8646         if (global->netlink)
8647                 netlink_deinit(global->netlink);
8648
8649         nl_destroy_handles(&global->nl);
8650
8651         if (global->nl_event) {
8652                 eloop_unregister_read_sock(
8653                         nl_socket_get_fd(global->nl_event));
8654                 nl_destroy_handles(&global->nl_event);
8655         }
8656
8657         nl_cb_put(global->nl_cb);
8658
8659         if (global->ioctl_sock >= 0)
8660                 close(global->ioctl_sock);
8661
8662         os_free(global);
8663 }
8664
8665
8666 static const char * nl80211_get_radio_name(void *priv)
8667 {
8668         struct i802_bss *bss = priv;
8669         struct wpa_driver_nl80211_data *drv = bss->drv;
8670         return drv->phyname;
8671 }
8672
8673
8674 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
8675                          const u8 *pmkid)
8676 {
8677         struct nl_msg *msg;
8678
8679         msg = nlmsg_alloc();
8680         if (!msg)
8681                 return -ENOMEM;
8682
8683         nl80211_cmd(bss->drv, msg, 0, cmd);
8684
8685         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
8686         if (pmkid)
8687                 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
8688         if (bssid)
8689                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
8690
8691         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
8692  nla_put_failure:
8693         nlmsg_free(msg);
8694         return -ENOBUFS;
8695 }
8696
8697
8698 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
8699 {
8700         struct i802_bss *bss = priv;
8701         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
8702         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
8703 }
8704
8705
8706 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
8707 {
8708         struct i802_bss *bss = priv;
8709         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
8710                    MAC2STR(bssid));
8711         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
8712 }
8713
8714
8715 static int nl80211_flush_pmkid(void *priv)
8716 {
8717         struct i802_bss *bss = priv;
8718         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
8719         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
8720 }
8721
8722
8723 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
8724                                    const u8 *replay_ctr)
8725 {
8726         struct i802_bss *bss = priv;
8727         struct wpa_driver_nl80211_data *drv = bss->drv;
8728         struct nlattr *replay_nested;
8729         struct nl_msg *msg;
8730
8731         msg = nlmsg_alloc();
8732         if (!msg)
8733                 return;
8734
8735         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8736
8737         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8738
8739         replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8740         if (!replay_nested)
8741                 goto nla_put_failure;
8742
8743         NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
8744         NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
8745         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
8746                 replay_ctr);
8747
8748         nla_nest_end(msg, replay_nested);
8749
8750         send_and_recv_msgs(drv, msg, NULL, NULL);
8751         return;
8752  nla_put_failure:
8753         nlmsg_free(msg);
8754 }
8755
8756
8757 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
8758                                     const u8 *addr, int qos)
8759 {
8760         /* send data frame to poll STA and check whether
8761          * this frame is ACKed */
8762         struct {
8763                 struct ieee80211_hdr hdr;
8764                 u16 qos_ctl;
8765         } STRUCT_PACKED nulldata;
8766         size_t size;
8767
8768         /* Send data frame to poll STA and check whether this frame is ACKed */
8769
8770         os_memset(&nulldata, 0, sizeof(nulldata));
8771
8772         if (qos) {
8773                 nulldata.hdr.frame_control =
8774                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
8775                                      WLAN_FC_STYPE_QOS_NULL);
8776                 size = sizeof(nulldata);
8777         } else {
8778                 nulldata.hdr.frame_control =
8779                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
8780                                      WLAN_FC_STYPE_NULLFUNC);
8781                 size = sizeof(struct ieee80211_hdr);
8782         }
8783
8784         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
8785         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
8786         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
8787         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
8788
8789         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0) < 0)
8790                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
8791                            "send poll frame");
8792 }
8793
8794 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
8795                                 int qos)
8796 {
8797         struct i802_bss *bss = priv;
8798         struct wpa_driver_nl80211_data *drv = bss->drv;
8799         struct nl_msg *msg;
8800
8801         if (!drv->poll_command_supported) {
8802                 nl80211_send_null_frame(bss, own_addr, addr, qos);
8803                 return;
8804         }
8805
8806         msg = nlmsg_alloc();
8807         if (!msg)
8808                 return;
8809
8810         nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
8811
8812         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8813         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8814
8815         send_and_recv_msgs(drv, msg, NULL, NULL);
8816         return;
8817  nla_put_failure:
8818         nlmsg_free(msg);
8819 }
8820
8821
8822 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
8823 {
8824         struct nl_msg *msg;
8825
8826         msg = nlmsg_alloc();
8827         if (!msg)
8828                 return -ENOMEM;
8829
8830         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
8831         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8832         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
8833                     enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
8834         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
8835 nla_put_failure:
8836         nlmsg_free(msg);
8837         return -ENOBUFS;
8838 }
8839
8840
8841 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
8842                                      int ctwindow)
8843 {
8844         struct i802_bss *bss = priv;
8845
8846         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
8847                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
8848
8849         if (opp_ps != -1 || ctwindow != -1)
8850                 return -1; /* Not yet supported */
8851
8852         if (legacy_ps == -1)
8853                 return 0;
8854         if (legacy_ps != 0 && legacy_ps != 1)
8855                 return -1; /* Not yet supported */
8856
8857         return nl80211_set_power_save(bss, legacy_ps);
8858 }
8859
8860
8861 #ifdef CONFIG_TDLS
8862
8863 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
8864                                   u8 dialog_token, u16 status_code,
8865                                   const u8 *buf, size_t len)
8866 {
8867         struct i802_bss *bss = priv;
8868         struct wpa_driver_nl80211_data *drv = bss->drv;
8869         struct nl_msg *msg;
8870
8871         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
8872                 return -EOPNOTSUPP;
8873
8874         if (!dst)
8875                 return -EINVAL;
8876
8877         msg = nlmsg_alloc();
8878         if (!msg)
8879                 return -ENOMEM;
8880
8881         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
8882         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8883         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
8884         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
8885         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
8886         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
8887         NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
8888
8889         return send_and_recv_msgs(drv, msg, NULL, NULL);
8890
8891 nla_put_failure:
8892         nlmsg_free(msg);
8893         return -ENOBUFS;
8894 }
8895
8896
8897 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
8898 {
8899         struct i802_bss *bss = priv;
8900         struct wpa_driver_nl80211_data *drv = bss->drv;
8901         struct nl_msg *msg;
8902         enum nl80211_tdls_operation nl80211_oper;
8903
8904         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
8905                 return -EOPNOTSUPP;
8906
8907         switch (oper) {
8908         case TDLS_DISCOVERY_REQ:
8909                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
8910                 break;
8911         case TDLS_SETUP:
8912                 nl80211_oper = NL80211_TDLS_SETUP;
8913                 break;
8914         case TDLS_TEARDOWN:
8915                 nl80211_oper = NL80211_TDLS_TEARDOWN;
8916                 break;
8917         case TDLS_ENABLE_LINK:
8918                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
8919                 break;
8920         case TDLS_DISABLE_LINK:
8921                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
8922                 break;
8923         case TDLS_ENABLE:
8924                 return 0;
8925         case TDLS_DISABLE:
8926                 return 0;
8927         default:
8928                 return -EINVAL;
8929         }
8930
8931         msg = nlmsg_alloc();
8932         if (!msg)
8933                 return -ENOMEM;
8934
8935         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
8936         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
8937         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8938         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
8939
8940         return send_and_recv_msgs(drv, msg, NULL, NULL);
8941
8942 nla_put_failure:
8943         nlmsg_free(msg);
8944         return -ENOBUFS;
8945 }
8946
8947 #endif /* CONFIG TDLS */
8948
8949
8950 #ifdef ANDROID
8951
8952 typedef struct android_wifi_priv_cmd {
8953         char *buf;
8954         int used_len;
8955         int total_len;
8956 } android_wifi_priv_cmd;
8957
8958 static int drv_errors = 0;
8959
8960 static void wpa_driver_send_hang_msg(struct wpa_driver_nl80211_data *drv)
8961 {
8962         drv_errors++;
8963         if (drv_errors > DRV_NUMBER_SEQUENTIAL_ERRORS) {
8964                 drv_errors = 0;
8965                 wpa_msg(drv->ctx, MSG_INFO, WPA_EVENT_DRIVER_STATE "HANGED");
8966         }
8967 }
8968
8969
8970 static int android_priv_cmd(struct i802_bss *bss, const char *cmd)
8971 {
8972         struct wpa_driver_nl80211_data *drv = bss->drv;
8973         struct ifreq ifr;
8974         android_wifi_priv_cmd priv_cmd;
8975         char buf[MAX_DRV_CMD_SIZE];
8976         int ret;
8977
8978         os_memset(&ifr, 0, sizeof(ifr));
8979         os_memset(&priv_cmd, 0, sizeof(priv_cmd));
8980         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
8981
8982         os_memset(buf, 0, sizeof(buf));
8983         os_strlcpy(buf, cmd, sizeof(buf));
8984
8985         priv_cmd.buf = buf;
8986         priv_cmd.used_len = sizeof(buf);
8987         priv_cmd.total_len = sizeof(buf);
8988         ifr.ifr_data = &priv_cmd;
8989
8990         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
8991         if (ret < 0) {
8992                 wpa_printf(MSG_ERROR, "%s: failed to issue private commands",
8993                            __func__);
8994                 wpa_driver_send_hang_msg(drv);
8995                 return ret;
8996         }
8997
8998         drv_errors = 0;
8999         return 0;
9000 }
9001
9002
9003 static int android_pno_start(struct i802_bss *bss,
9004                              struct wpa_driver_scan_params *params)
9005 {
9006         struct wpa_driver_nl80211_data *drv = bss->drv;
9007         struct ifreq ifr;
9008         android_wifi_priv_cmd priv_cmd;
9009         int ret = 0, i = 0, bp;
9010         char buf[WEXT_PNO_MAX_COMMAND_SIZE];
9011
9012         bp = WEXT_PNOSETUP_HEADER_SIZE;
9013         os_memcpy(buf, WEXT_PNOSETUP_HEADER, bp);
9014         buf[bp++] = WEXT_PNO_TLV_PREFIX;
9015         buf[bp++] = WEXT_PNO_TLV_VERSION;
9016         buf[bp++] = WEXT_PNO_TLV_SUBVERSION;
9017         buf[bp++] = WEXT_PNO_TLV_RESERVED;
9018
9019         while (i < WEXT_PNO_AMOUNT && (size_t) i < params->num_ssids) {
9020                 /* Check that there is enough space needed for 1 more SSID, the
9021                  * other sections and null termination */
9022                 if ((bp + WEXT_PNO_SSID_HEADER_SIZE + MAX_SSID_LEN +
9023                      WEXT_PNO_NONSSID_SECTIONS_SIZE + 1) >= (int) sizeof(buf))
9024                         break;
9025                 wpa_hexdump_ascii(MSG_DEBUG, "For PNO Scan",
9026                                   params->ssids[i].ssid,
9027                                   params->ssids[i].ssid_len);
9028                 buf[bp++] = WEXT_PNO_SSID_SECTION;
9029                 buf[bp++] = params->ssids[i].ssid_len;
9030                 os_memcpy(&buf[bp], params->ssids[i].ssid,
9031                           params->ssids[i].ssid_len);
9032                 bp += params->ssids[i].ssid_len;
9033                 i++;
9034         }
9035
9036         buf[bp++] = WEXT_PNO_SCAN_INTERVAL_SECTION;
9037         os_snprintf(&buf[bp], WEXT_PNO_SCAN_INTERVAL_LENGTH + 1, "%x",
9038                     WEXT_PNO_SCAN_INTERVAL);
9039         bp += WEXT_PNO_SCAN_INTERVAL_LENGTH;
9040
9041         buf[bp++] = WEXT_PNO_REPEAT_SECTION;
9042         os_snprintf(&buf[bp], WEXT_PNO_REPEAT_LENGTH + 1, "%x",
9043                     WEXT_PNO_REPEAT);
9044         bp += WEXT_PNO_REPEAT_LENGTH;
9045
9046         buf[bp++] = WEXT_PNO_MAX_REPEAT_SECTION;
9047         os_snprintf(&buf[bp], WEXT_PNO_MAX_REPEAT_LENGTH + 1, "%x",
9048                     WEXT_PNO_MAX_REPEAT);
9049         bp += WEXT_PNO_MAX_REPEAT_LENGTH + 1;
9050
9051         memset(&ifr, 0, sizeof(ifr));
9052         memset(&priv_cmd, 0, sizeof(priv_cmd));
9053         os_strncpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
9054
9055         priv_cmd.buf = buf;
9056         priv_cmd.used_len = bp;
9057         priv_cmd.total_len = bp;
9058         ifr.ifr_data = &priv_cmd;
9059
9060         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
9061
9062         if (ret < 0) {
9063                 wpa_printf(MSG_ERROR, "ioctl[SIOCSIWPRIV] (pnosetup): %d",
9064                            ret);
9065                 wpa_driver_send_hang_msg(drv);
9066                 return ret;
9067         }
9068
9069         drv_errors = 0;
9070
9071         return android_priv_cmd(bss, "PNOFORCE 1");
9072 }
9073
9074
9075 static int android_pno_stop(struct i802_bss *bss)
9076 {
9077         return android_priv_cmd(bss, "PNOFORCE 0");
9078 }
9079
9080 #endif /* ANDROID */
9081
9082
9083 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
9084         .name = "nl80211",
9085         .desc = "Linux nl80211/cfg80211",
9086         .get_bssid = wpa_driver_nl80211_get_bssid,
9087         .get_ssid = wpa_driver_nl80211_get_ssid,
9088         .set_key = wpa_driver_nl80211_set_key,
9089         .scan2 = wpa_driver_nl80211_scan,
9090         .sched_scan = wpa_driver_nl80211_sched_scan,
9091         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
9092         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
9093         .deauthenticate = wpa_driver_nl80211_deauthenticate,
9094         .disassociate = wpa_driver_nl80211_disassociate,
9095         .authenticate = wpa_driver_nl80211_authenticate,
9096         .associate = wpa_driver_nl80211_associate,
9097         .global_init = nl80211_global_init,
9098         .global_deinit = nl80211_global_deinit,
9099         .init2 = wpa_driver_nl80211_init,
9100         .deinit = wpa_driver_nl80211_deinit,
9101         .get_capa = wpa_driver_nl80211_get_capa,
9102         .set_operstate = wpa_driver_nl80211_set_operstate,
9103         .set_supp_port = wpa_driver_nl80211_set_supp_port,
9104         .set_country = wpa_driver_nl80211_set_country,
9105         .set_ap = wpa_driver_nl80211_set_ap,
9106         .if_add = wpa_driver_nl80211_if_add,
9107         .if_remove = wpa_driver_nl80211_if_remove,
9108         .send_mlme = wpa_driver_nl80211_send_mlme,
9109         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
9110         .sta_add = wpa_driver_nl80211_sta_add,
9111         .sta_remove = wpa_driver_nl80211_sta_remove,
9112         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
9113         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
9114 #ifdef HOSTAPD
9115         .hapd_init = i802_init,
9116         .hapd_deinit = i802_deinit,
9117         .set_wds_sta = i802_set_wds_sta,
9118 #endif /* HOSTAPD */
9119 #if defined(HOSTAPD) || defined(CONFIG_AP)
9120         .get_seqnum = i802_get_seqnum,
9121         .flush = i802_flush,
9122         .read_sta_data = i802_read_sta_data,
9123         .get_inact_sec = i802_get_inact_sec,
9124         .sta_clear_stats = i802_sta_clear_stats,
9125         .set_rts = i802_set_rts,
9126         .set_frag = i802_set_frag,
9127         .set_tx_queue_params = i802_set_tx_queue_params,
9128         .set_sta_vlan = i802_set_sta_vlan,
9129         .sta_deauth = i802_sta_deauth,
9130         .sta_disassoc = i802_sta_disassoc,
9131 #endif /* HOSTAPD || CONFIG_AP */
9132         .set_freq = i802_set_freq,
9133         .send_action = wpa_driver_nl80211_send_action,
9134         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
9135         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
9136         .cancel_remain_on_channel =
9137         wpa_driver_nl80211_cancel_remain_on_channel,
9138         .probe_req_report = wpa_driver_nl80211_probe_req_report,
9139         .deinit_ap = wpa_driver_nl80211_deinit_ap,
9140         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
9141         .resume = wpa_driver_nl80211_resume,
9142         .send_ft_action = nl80211_send_ft_action,
9143         .signal_monitor = nl80211_signal_monitor,
9144         .signal_poll = nl80211_signal_poll,
9145         .send_frame = nl80211_send_frame,
9146         .shared_freq = wpa_driver_nl80211_shared_freq,
9147         .set_param = nl80211_set_param,
9148         .get_radio_name = nl80211_get_radio_name,
9149         .add_pmkid = nl80211_add_pmkid,
9150         .remove_pmkid = nl80211_remove_pmkid,
9151         .flush_pmkid = nl80211_flush_pmkid,
9152         .set_rekey_info = nl80211_set_rekey_info,
9153         .poll_client = nl80211_poll_client,
9154         .set_p2p_powersave = nl80211_set_p2p_powersave,
9155 #ifdef CONFIG_TDLS
9156         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
9157         .tdls_oper = nl80211_tdls_oper,
9158 #endif /* CONFIG_TDLS */
9159 };