src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/types.h>
  15 #include <fcntl.h>
  16 #include <net/if.h>
  17 #include <netlink/genl/genl.h>
  18 #include <netlink/genl/ctrl.h>
  19 #ifdef CONFIG_LIBNL3_ROUTE
  20 #include <netlink/route/neighbour.h>
  21 #endif /* CONFIG_LIBNL3_ROUTE */
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/errqueue.h>
  25
  26 #include "common.h"
  27 #include "eloop.h"
  28 #include "common/qca-vendor.h"
  29 #include "common/qca-vendor-attr.h"
  30 #include "common/ieee802_11_defs.h"
  31 #include "common/ieee802_11_common.h"
  32 #include "l2_packet/l2_packet.h"
  33 #include "netlink.h"
  34 #include "linux_defines.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver_nl80211.h"
  40
  41
  42 #ifndef CONFIG_LIBNL20
  43 /*
  44  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  45  * but when you free a socket again it will mess up its bitmap and
  46  * and use the wrong number the next time it needs a socket ID.
  47  * Therefore, we wrap the handle alloc/destroy and add our own pid
  48  * accounting.
  49  */
  50 static uint32_t port_bitmap[32] = { 0 };
  51
  52 static struct nl_handle *nl80211_handle_alloc(void *cb)
  53 {
  54         struct nl_handle *handle;
  55         uint32_t pid = getpid() & 0x3FFFFF;
  56         int i;
  57
  58         handle = nl_handle_alloc_cb(cb);
  59
  60         for (i = 0; i < 1024; i++) {
  61                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  62                         continue;
  63                 port_bitmap[i / 32] |= 1 << (i % 32);
  64                 pid += i << 22;
  65                 break;
  66         }
  67
  68         nl_socket_set_local_port(handle, pid);
  69
  70         return handle;
  71 }
  72
  73 static void nl80211_handle_destroy(struct nl_handle *handle)
  74 {
  75         uint32_t port = nl_socket_get_local_port(handle);
  76
  77         port >>= 22;
  78         port_bitmap[port / 32] &= ~(1 << (port % 32));
  79
  80         nl_handle_destroy(handle);
  81 }
  82 #endif /* CONFIG_LIBNL20 */
  83
  84
  85 #ifdef ANDROID
  86 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
  87 #undef nl_socket_set_nonblocking
  88 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
  89
  90 #define genl_ctrl_resolve android_genl_ctrl_resolve
  91 #endif /* ANDROID */
  92
  93
  94 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
  95 {
  96         struct nl_handle *handle;
  97
  98         handle = nl80211_handle_alloc(cb);
  99         if (handle == NULL) {
 100                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 101                            "callbacks (%s)", dbg);
 102                 return NULL;
 103         }
 104
 105         if (genl_connect(handle)) {
 106                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 107                            "netlink (%s)", dbg);
 108                 nl80211_handle_destroy(handle);
 109                 return NULL;
 110         }
 111
 112         return handle;
 113 }
 114
 115
 116 static void nl_destroy_handles(struct nl_handle **handle)
 117 {
 118         if (*handle == NULL)
 119                 return;
 120         nl80211_handle_destroy(*handle);
 121         *handle = NULL;
 122 }
 123
 124
 125 #if __WORDSIZE == 64
 126 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 127 #else
 128 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 129 #endif
 130
 131 static void nl80211_register_eloop_read(struct nl_handle **handle,
 132                                         eloop_sock_handler handler,
 133                                         void *eloop_data)
 134 {
 135         nl_socket_set_nonblocking(*handle);
 136         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 137                                  eloop_data, *handle);
 138         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 139 }
 140
 141
 142 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 143 {
 144         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 145         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 146         nl_destroy_handles(handle);
 147 }
 148
 149
 150 static void nl80211_global_deinit(void *priv);
 151
 152 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 153 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
 154                                             struct hostapd_freq_params *freq);
 155
 156 static int
 157 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 158                                    const u8 *set_addr, int first,
 159                                    const char *driver_params);
 160 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 161                                    const u8 *addr, int cmd, u16 reason_code,
 162                                    int local_state_change);
 163 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 164                                   unsigned int freq, unsigned int wait,
 165                                   const u8 *buf, size_t buf_len, u64 *cookie,
 166                                   int no_cck, int no_ack, int offchanok);
 167 static int nl80211_register_frame(struct i802_bss *bss,
 168                                   struct nl_handle *hl_handle,
 169                                   u16 type, const u8 *match, size_t match_len);
 170 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 171                                                int report);
 172
 173 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 174 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 175 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 176 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
 177                                         enum wpa_driver_if_type type,
 178                                         const char *ifname);
 179
 180 static int nl80211_set_channel(struct i802_bss *bss,
 181                                struct hostapd_freq_params *freq, int set_chan);
 182 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 183                                      int ifindex, int disabled);
 184
 185 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 186
 187 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
 188 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 189 static int nl80211_set_param(void *priv, const char *param);
 190
 191
 192 /* Converts nl80211_chan_width to a common format */
 193 enum chan_width convert2width(int width)
 194 {
 195         switch (width) {
 196         case NL80211_CHAN_WIDTH_20_NOHT:
 197                 return CHAN_WIDTH_20_NOHT;
 198         case NL80211_CHAN_WIDTH_20:
 199                 return CHAN_WIDTH_20;
 200         case NL80211_CHAN_WIDTH_40:
 201                 return CHAN_WIDTH_40;
 202         case NL80211_CHAN_WIDTH_80:
 203                 return CHAN_WIDTH_80;
 204         case NL80211_CHAN_WIDTH_80P80:
 205                 return CHAN_WIDTH_80P80;
 206         case NL80211_CHAN_WIDTH_160:
 207                 return CHAN_WIDTH_160;
 208         }
 209         return CHAN_WIDTH_UNKNOWN;
 210 }
 211
 212
 213 int is_ap_interface(enum nl80211_iftype nlmode)
 214 {
 215         return nlmode == NL80211_IFTYPE_AP ||
 216                 nlmode == NL80211_IFTYPE_P2P_GO;
 217 }
 218
 219
 220 static int is_sta_interface(enum nl80211_iftype nlmode)
 221 {
 222         return nlmode == NL80211_IFTYPE_STATION ||
 223                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 224 }
 225
 226
 227 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 228 {
 229         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 230                 nlmode == NL80211_IFTYPE_P2P_GO;
 231 }
 232
 233
 234 struct i802_bss * get_bss_ifindex(struct wpa_driver_nl80211_data *drv,
 235                                   int ifindex)
 236 {
 237         struct i802_bss *bss;
 238
 239         for (bss = drv->first_bss; bss; bss = bss->next) {
 240                 if (bss->ifindex == ifindex)
 241                         return bss;
 242         }
 243
 244         return NULL;
 245 }
 246
 247
 248 static int is_mesh_interface(enum nl80211_iftype nlmode)
 249 {
 250         return nlmode == NL80211_IFTYPE_MESH_POINT;
 251 }
 252
 253
 254 void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 255 {
 256         if (drv->associated)
 257                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 258         drv->associated = 0;
 259         os_memset(drv->bssid, 0, ETH_ALEN);
 260 }
 261
 262
 263 struct nl80211_bss_info_arg {
 264         struct wpa_driver_nl80211_data *drv;
 265         struct wpa_scan_results *res;
 266         unsigned int assoc_freq;
 267         unsigned int ibss_freq;
 268         u8 assoc_bssid[ETH_ALEN];
 269 };
 270
 271 static int bss_info_handler(struct nl_msg *msg, void *arg);
 272
 273
 274 /* nl80211 code */
 275 static int ack_handler(struct nl_msg *msg, void *arg)
 276 {
 277         int *err = arg;
 278         *err = 0;
 279         return NL_STOP;
 280 }
 281
 282 static int finish_handler(struct nl_msg *msg, void *arg)
 283 {
 284         int *ret = arg;
 285         *ret = 0;
 286         return NL_SKIP;
 287 }
 288
 289 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 290                          void *arg)
 291 {
 292         int *ret = arg;
 293         *ret = err->error;
 294         return NL_SKIP;
 295 }
 296
 297
 298 static int no_seq_check(struct nl_msg *msg, void *arg)
 299 {
 300         return NL_OK;
 301 }
 302
 303
 304 static int send_and_recv(struct nl80211_global *global,
 305                          struct nl_handle *nl_handle, struct nl_msg *msg,
 306                          int (*valid_handler)(struct nl_msg *, void *),
 307                          void *valid_data)
 308 {
 309         struct nl_cb *cb;
 310         int err = -ENOMEM;
 311
 312         cb = nl_cb_clone(global->nl_cb);
 313         if (!cb)
 314                 goto out;
 315
 316         err = nl_send_auto_complete(nl_handle, msg);
 317         if (err < 0)
 318                 goto out;
 319
 320         err = 1;
 321
 322         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 323         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 324         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 325
 326         if (valid_handler)
 327                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 328                           valid_handler, valid_data);
 329
 330         while (err > 0) {
 331                 int res = nl_recvmsgs(nl_handle, cb);
 332                 if (res < 0) {
 333                         wpa_printf(MSG_INFO,
 334                                    "nl80211: %s->nl_recvmsgs failed: %d",
 335                                    __func__, res);
 336                 }
 337         }
 338  out:
 339         nl_cb_put(cb);
 340         nlmsg_free(msg);
 341         return err;
 342 }
 343
 344
 345 static int send_and_recv_msgs_global(struct nl80211_global *global,
 346                                      struct nl_msg *msg,
 347                                      int (*valid_handler)(struct nl_msg *, void *),
 348                                      void *valid_data)
 349 {
 350         return send_and_recv(global, global->nl, msg, valid_handler,
 351                              valid_data);
 352 }
 353
 354
 355 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 356                        struct nl_msg *msg,
 357                        int (*valid_handler)(struct nl_msg *, void *),
 358                        void *valid_data)
 359 {
 360         return send_and_recv(drv->global, drv->global->nl, msg,
 361                              valid_handler, valid_data);
 362 }
 363
 364
 365 struct family_data {
 366         const char *group;
 367         int id;
 368 };
 369
 370
 371 int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 372 {
 373         if (bss->wdev_id_set)
 374                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 375         else
 376                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 377         return 0;
 378
 379 nla_put_failure:
 380         return -1;
 381 }
 382
 383
 384 static int family_handler(struct nl_msg *msg, void *arg)
 385 {
 386         struct family_data *res = arg;
 387         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 388         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 389         struct nlattr *mcgrp;
 390         int i;
 391
 392         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 393                   genlmsg_attrlen(gnlh, 0), NULL);
 394         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 395                 return NL_SKIP;
 396
 397         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 398                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 399                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 400                           nla_len(mcgrp), NULL);
 401                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 402                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 403                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 404                                res->group,
 405                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 406                         continue;
 407                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 408                 break;
 409         };
 410
 411         return NL_SKIP;
 412 }
 413
 414
 415 static int nl_get_multicast_id(struct nl80211_global *global,
 416                                const char *family, const char *group)
 417 {
 418         struct nl_msg *msg;
 419         int ret = -1;
 420         struct family_data res = { group, -ENOENT };
 421
 422         msg = nlmsg_alloc();
 423         if (!msg)
 424                 return -ENOMEM;
 425         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 426                     0, 0, CTRL_CMD_GETFAMILY, 0);
 427         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 428
 429         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 430         msg = NULL;
 431         if (ret == 0)
 432                 ret = res.id;
 433
 434 nla_put_failure:
 435         nlmsg_free(msg);
 436         return ret;
 437 }
 438
 439
 440 void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 441                    struct nl_msg *msg, int flags, uint8_t cmd)
 442 {
 443         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 444                            0, flags, cmd, 0);
 445 }
 446
 447
 448 struct wiphy_idx_data {
 449         int wiphy_idx;
 450         enum nl80211_iftype nlmode;
 451         u8 *macaddr;
 452 };
 453
 454
 455 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 456 {
 457         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 458         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 459         struct wiphy_idx_data *info = arg;
 460
 461         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 462                   genlmsg_attrlen(gnlh, 0), NULL);
 463
 464         if (tb[NL80211_ATTR_WIPHY])
 465                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 466
 467         if (tb[NL80211_ATTR_IFTYPE])
 468                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 469
 470         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 471                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 472                           ETH_ALEN);
 473
 474         return NL_SKIP;
 475 }
 476
 477
 478 int nl80211_get_wiphy_index(struct i802_bss *bss)
 479 {
 480         struct nl_msg *msg;
 481         struct wiphy_idx_data data = {
 482                 .wiphy_idx = -1,
 483                 .macaddr = NULL,
 484         };
 485
 486         msg = nlmsg_alloc();
 487         if (!msg)
 488                 return NL80211_IFTYPE_UNSPECIFIED;
 489
 490         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 491
 492         if (nl80211_set_iface_id(msg, bss) < 0)
 493                 goto nla_put_failure;
 494
 495         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 496                 return data.wiphy_idx;
 497         msg = NULL;
 498 nla_put_failure:
 499         nlmsg_free(msg);
 500         return -1;
 501 }
 502
 503
 504 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 505 {
 506         struct nl_msg *msg;
 507         struct wiphy_idx_data data = {
 508                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 509                 .macaddr = NULL,
 510         };
 511
 512         msg = nlmsg_alloc();
 513         if (!msg)
 514                 return -1;
 515
 516         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 517
 518         if (nl80211_set_iface_id(msg, bss) < 0)
 519                 goto nla_put_failure;
 520
 521         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 522                 return data.nlmode;
 523         msg = NULL;
 524 nla_put_failure:
 525         nlmsg_free(msg);
 526         return NL80211_IFTYPE_UNSPECIFIED;
 527 }
 528
 529
 530 static int nl80211_get_macaddr(struct i802_bss *bss)
 531 {
 532         struct nl_msg *msg;
 533         struct wiphy_idx_data data = {
 534                 .macaddr = bss->addr,
 535         };
 536
 537         msg = nlmsg_alloc();
 538         if (!msg)
 539                 return NL80211_IFTYPE_UNSPECIFIED;
 540
 541         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 542         if (nl80211_set_iface_id(msg, bss) < 0)
 543                 goto nla_put_failure;
 544
 545         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 546
 547 nla_put_failure:
 548         nlmsg_free(msg);
 549         return NL80211_IFTYPE_UNSPECIFIED;
 550 }
 551
 552
 553 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 554                                     struct nl80211_wiphy_data *w)
 555 {
 556         struct nl_msg *msg;
 557         int ret = -1;
 558
 559         msg = nlmsg_alloc();
 560         if (!msg)
 561                 return -1;
 562
 563         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
 564
 565         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
 566
 567         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 568         msg = NULL;
 569         if (ret) {
 570                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 571                            "failed: ret=%d (%s)",
 572                            ret, strerror(-ret));
 573                 goto nla_put_failure;
 574         }
 575         ret = 0;
 576 nla_put_failure:
 577         nlmsg_free(msg);
 578         return ret;
 579 }
 580
 581
 582 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 583 {
 584         struct nl80211_wiphy_data *w = eloop_ctx;
 585         int res;
 586
 587         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 588
 589         res = nl_recvmsgs(handle, w->nl_cb);
 590         if (res < 0) {
 591                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 592                            __func__, res);
 593         }
 594 }
 595
 596
 597 static int process_beacon_event(struct nl_msg *msg, void *arg)
 598 {
 599         struct nl80211_wiphy_data *w = arg;
 600         struct wpa_driver_nl80211_data *drv;
 601         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 602         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 603         union wpa_event_data event;
 604
 605         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 606                   genlmsg_attrlen(gnlh, 0), NULL);
 607
 608         if (gnlh->cmd != NL80211_CMD_FRAME) {
 609                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 610                            gnlh->cmd);
 611                 return NL_SKIP;
 612         }
 613
 614         if (!tb[NL80211_ATTR_FRAME])
 615                 return NL_SKIP;
 616
 617         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 618                          wiphy_list) {
 619                 os_memset(&event, 0, sizeof(event));
 620                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 621                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 622                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 623         }
 624
 625         return NL_SKIP;
 626 }
 627
 628
 629 static struct nl80211_wiphy_data *
 630 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 631 {
 632         static DEFINE_DL_LIST(nl80211_wiphys);
 633         struct nl80211_wiphy_data *w;
 634         int wiphy_idx, found = 0;
 635         struct i802_bss *tmp_bss;
 636
 637         if (bss->wiphy_data != NULL)
 638                 return bss->wiphy_data;
 639
 640         wiphy_idx = nl80211_get_wiphy_index(bss);
 641
 642         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 643                 if (w->wiphy_idx == wiphy_idx)
 644                         goto add;
 645         }
 646
 647         /* alloc new one */
 648         w = os_zalloc(sizeof(*w));
 649         if (w == NULL)
 650                 return NULL;
 651         w->wiphy_idx = wiphy_idx;
 652         dl_list_init(&w->bsss);
 653         dl_list_init(&w->drvs);
 654
 655         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 656         if (!w->nl_cb) {
 657                 os_free(w);
 658                 return NULL;
 659         }
 660         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 661         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 662                   w);
 663
 664         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 665                                          "wiphy beacons");
 666         if (w->nl_beacons == NULL) {
 667                 os_free(w);
 668                 return NULL;
 669         }
 670
 671         if (nl80211_register_beacons(bss->drv, w)) {
 672                 nl_destroy_handles(&w->nl_beacons);
 673                 os_free(w);
 674                 return NULL;
 675         }
 676
 677         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 678
 679         dl_list_add(&nl80211_wiphys, &w->list);
 680
 681 add:
 682         /* drv entry for this bss already there? */
 683         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 684                 if (tmp_bss->drv == bss->drv) {
 685                         found = 1;
 686                         break;
 687                 }
 688         }
 689         /* if not add it */
 690         if (!found)
 691                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 692
 693         dl_list_add(&w->bsss, &bss->wiphy_list);
 694         bss->wiphy_data = w;
 695         return w;
 696 }
 697
 698
 699 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 700 {
 701         struct nl80211_wiphy_data *w = bss->wiphy_data;
 702         struct i802_bss *tmp_bss;
 703         int found = 0;
 704
 705         if (w == NULL)
 706                 return;
 707         bss->wiphy_data = NULL;
 708         dl_list_del(&bss->wiphy_list);
 709
 710         /* still any for this drv present? */
 711         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 712                 if (tmp_bss->drv == bss->drv) {
 713                         found = 1;
 714                         break;
 715                 }
 716         }
 717         /* if not remove it */
 718         if (!found)
 719                 dl_list_del(&bss->drv->wiphy_list);
 720
 721         if (!dl_list_empty(&w->bsss))
 722                 return;
 723
 724         nl80211_destroy_eloop_handle(&w->nl_beacons);
 725
 726         nl_cb_put(w->nl_cb);
 727         dl_list_del(&w->list);
 728         os_free(w);
 729 }
 730
 731
 732 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 733 {
 734         struct i802_bss *bss = priv;
 735         struct wpa_driver_nl80211_data *drv = bss->drv;
 736         if (!drv->associated)
 737                 return -1;
 738         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 739         return 0;
 740 }
 741
 742
 743 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 744 {
 745         struct i802_bss *bss = priv;
 746         struct wpa_driver_nl80211_data *drv = bss->drv;
 747         if (!drv->associated)
 748                 return -1;
 749         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 750         return drv->ssid_len;
 751 }
 752
 753
 754 static void wpa_driver_nl80211_event_newlink(
 755         struct wpa_driver_nl80211_data *drv, char *ifname)
 756 {
 757         union wpa_event_data event;
 758
 759         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 760                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
 761                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
 762                                    drv->first_bss->ifname);
 763                         return;
 764                 }
 765                 if (!drv->if_removed)
 766                         return;
 767                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
 768                            drv->first_bss->ifname);
 769                 drv->if_removed = 0;
 770         }
 771
 772         os_memset(&event, 0, sizeof(event));
 773         os_strlcpy(event.interface_status.ifname, ifname,
 774                    sizeof(event.interface_status.ifname));
 775         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
 776         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 777 }
 778
 779
 780 static void wpa_driver_nl80211_event_dellink(
 781         struct wpa_driver_nl80211_data *drv, char *ifname)
 782 {
 783         union wpa_event_data event;
 784
 785         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 786                 if (drv->if_removed) {
 787                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
 788                                    ifname);
 789                         return;
 790                 }
 791                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
 792                            ifname);
 793                 drv->if_removed = 1;
 794         } else {
 795                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
 796                            ifname);
 797         }
 798
 799         os_memset(&event, 0, sizeof(event));
 800         os_strlcpy(event.interface_status.ifname, ifname,
 801                    sizeof(event.interface_status.ifname));
 802         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
 803         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 804 }
 805
 806
 807 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 808                                          u8 *buf, size_t len)
 809 {
 810         int attrlen, rta_len;
 811         struct rtattr *attr;
 812
 813         attrlen = len;
 814         attr = (struct rtattr *) buf;
 815
 816         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 817         while (RTA_OK(attr, attrlen)) {
 818                 if (attr->rta_type == IFLA_IFNAME) {
 819                         if (os_strcmp(((char *) attr) + rta_len,
 820                                       drv->first_bss->ifname) == 0)
 821                                 return 1;
 822                         else
 823                                 break;
 824                 }
 825                 attr = RTA_NEXT(attr, attrlen);
 826         }
 827
 828         return 0;
 829 }
 830
 831
 832 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 833                                           int ifindex, u8 *buf, size_t len)
 834 {
 835         if (drv->ifindex == ifindex)
 836                 return 1;
 837
 838         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 839                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 840                            "interface");
 841                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0, NULL);
 842                 return 1;
 843         }
 844
 845         return 0;
 846 }
 847
 848
 849 static struct wpa_driver_nl80211_data *
 850 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 851 {
 852         struct wpa_driver_nl80211_data *drv;
 853         dl_list_for_each(drv, &global->interfaces,
 854                          struct wpa_driver_nl80211_data, list) {
 855                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 856                     have_ifidx(drv, idx))
 857                         return drv;
 858         }
 859         return NULL;
 860 }
 861
 862
 863 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 864                                                  struct ifinfomsg *ifi,
 865                                                  u8 *buf, size_t len)
 866 {
 867         struct nl80211_global *global = ctx;
 868         struct wpa_driver_nl80211_data *drv;
 869         int attrlen;
 870         struct rtattr *attr;
 871         u32 brid = 0;
 872         char namebuf[IFNAMSIZ];
 873         char ifname[IFNAMSIZ + 1];
 874         char extra[100], *pos, *end;
 875
 876         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 877         if (!drv) {
 878                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_NEWLINK event for foreign ifindex %d",
 879                            ifi->ifi_index);
 880                 return;
 881         }
 882
 883         extra[0] = '\0';
 884         pos = extra;
 885         end = pos + sizeof(extra);
 886         ifname[0] = '\0';
 887
 888         attrlen = len;
 889         attr = (struct rtattr *) buf;
 890         while (RTA_OK(attr, attrlen)) {
 891                 switch (attr->rta_type) {
 892                 case IFLA_IFNAME:
 893                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
 894                                 break;
 895                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
 896                         ifname[RTA_PAYLOAD(attr)] = '\0';
 897                         break;
 898                 case IFLA_MASTER:
 899                         brid = nla_get_u32((struct nlattr *) attr);
 900                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
 901                         break;
 902                 case IFLA_WIRELESS:
 903                         pos += os_snprintf(pos, end - pos, " wext");
 904                         break;
 905                 case IFLA_OPERSTATE:
 906                         pos += os_snprintf(pos, end - pos, " operstate=%u",
 907                                            nla_get_u32((struct nlattr *) attr));
 908                         break;
 909                 case IFLA_LINKMODE:
 910                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
 911                                            nla_get_u32((struct nlattr *) attr));
 912                         break;
 913                 }
 914                 attr = RTA_NEXT(attr, attrlen);
 915         }
 916         extra[sizeof(extra) - 1] = '\0';
 917
 918         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
 919                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
 920                    ifi->ifi_flags,
 921                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 922                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 923                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 924                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 925
 926         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 927                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 928                     linux_iface_up(drv->global->ioctl_sock,
 929                                    drv->first_bss->ifname) > 0) {
 930                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 931                                    "event since interface %s is up", namebuf);
 932                         drv->ignore_if_down_event = 0;
 933                         return;
 934                 }
 935                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
 936                 if (drv->ignore_if_down_event) {
 937                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 938                                    "event generated by mode change");
 939                         drv->ignore_if_down_event = 0;
 940                 } else {
 941                         drv->if_disabled = 1;
 942                         wpa_supplicant_event(drv->ctx,
 943                                              EVENT_INTERFACE_DISABLED, NULL);
 944
 945                         /*
 946                          * Try to get drv again, since it may be removed as
 947                          * part of the EVENT_INTERFACE_DISABLED handling for
 948                          * dynamic interfaces
 949                          */
 950                         drv = nl80211_find_drv(global, ifi->ifi_index,
 951                                                buf, len);
 952                         if (!drv)
 953                                 return;
 954                 }
 955         }
 956
 957         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 958                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 959                     linux_iface_up(drv->global->ioctl_sock,
 960                                    drv->first_bss->ifname) == 0) {
 961                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 962                                    "event since interface %s is down",
 963                                    namebuf);
 964                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
 965                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 966                                    "event since interface %s does not exist",
 967                                    drv->first_bss->ifname);
 968                 } else if (drv->if_removed) {
 969                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 970                                    "event since interface %s is marked "
 971                                    "removed", drv->first_bss->ifname);
 972                 } else {
 973                         struct i802_bss *bss;
 974                         u8 addr[ETH_ALEN];
 975
 976                         /* Re-read MAC address as it may have changed */
 977                         bss = get_bss_ifindex(drv, ifi->ifi_index);
 978                         if (bss &&
 979                             linux_get_ifhwaddr(drv->global->ioctl_sock,
 980                                                bss->ifname, addr) < 0) {
 981                                 wpa_printf(MSG_DEBUG,
 982                                            "nl80211: %s: failed to re-read MAC address",
 983                                            bss->ifname);
 984                         } else if (bss &&
 985                                    os_memcmp(addr, bss->addr, ETH_ALEN) != 0) {
 986                                 wpa_printf(MSG_DEBUG,
 987                                            "nl80211: Own MAC address on ifindex %d (%s) changed from "
 988                                            MACSTR " to " MACSTR,
 989                                            ifi->ifi_index, bss->ifname,
 990                                            MAC2STR(bss->addr),
 991                                            MAC2STR(addr));
 992                                 os_memcpy(bss->addr, addr, ETH_ALEN);
 993                         }
 994
 995                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
 996                         drv->if_disabled = 0;
 997                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
 998                                              NULL);
 999                 }
1000         }
1001
1002         /*
1003          * Some drivers send the association event before the operup event--in
1004          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1005          * fails. This will hit us when wpa_supplicant does not need to do
1006          * IEEE 802.1X authentication
1007          */
1008         if (drv->operstate == 1 &&
1009             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1010             !(ifi->ifi_flags & IFF_RUNNING)) {
1011                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1012                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1013                                        -1, IF_OPER_UP);
1014         }
1015
1016         if (ifname[0])
1017                 wpa_driver_nl80211_event_newlink(drv, ifname);
1018
1019         if (ifi->ifi_family == AF_BRIDGE && brid) {
1020                 struct i802_bss *bss;
1021
1022                 /* device has been added to bridge */
1023                 if_indextoname(brid, namebuf);
1024                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1025                            brid, namebuf);
1026                 add_ifidx(drv, brid);
1027
1028                 for (bss = drv->first_bss; bss; bss = bss->next) {
1029                         if (os_strcmp(ifname, bss->ifname) == 0) {
1030                                 os_strlcpy(bss->brname, namebuf, IFNAMSIZ);
1031                                 break;
1032                         }
1033                 }
1034         }
1035 }
1036
1037
1038 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1039                                                  struct ifinfomsg *ifi,
1040                                                  u8 *buf, size_t len)
1041 {
1042         struct nl80211_global *global = ctx;
1043         struct wpa_driver_nl80211_data *drv;
1044         int attrlen;
1045         struct rtattr *attr;
1046         u32 brid = 0;
1047         char ifname[IFNAMSIZ + 1];
1048         char extra[100], *pos, *end;
1049
1050         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1051         if (!drv) {
1052                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_DELLINK event for foreign ifindex %d",
1053                            ifi->ifi_index);
1054                 return;
1055         }
1056
1057         extra[0] = '\0';
1058         pos = extra;
1059         end = pos + sizeof(extra);
1060         ifname[0] = '\0';
1061
1062         attrlen = len;
1063         attr = (struct rtattr *) buf;
1064         while (RTA_OK(attr, attrlen)) {
1065                 switch (attr->rta_type) {
1066                 case IFLA_IFNAME:
1067                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1068                                 break;
1069                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1070                         ifname[RTA_PAYLOAD(attr)] = '\0';
1071                         break;
1072                 case IFLA_MASTER:
1073                         brid = nla_get_u32((struct nlattr *) attr);
1074                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1075                         break;
1076                 case IFLA_OPERSTATE:
1077                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1078                                            nla_get_u32((struct nlattr *) attr));
1079                         break;
1080                 case IFLA_LINKMODE:
1081                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1082                                            nla_get_u32((struct nlattr *) attr));
1083                         break;
1084                 }
1085                 attr = RTA_NEXT(attr, attrlen);
1086         }
1087         extra[sizeof(extra) - 1] = '\0';
1088
1089         wpa_printf(MSG_DEBUG, "RTM_DELLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
1090                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
1091                    ifi->ifi_flags,
1092                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1093                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1094                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1095                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1096
1097         if (ifname[0] && (ifi->ifi_family != AF_BRIDGE || !brid))
1098                 wpa_driver_nl80211_event_dellink(drv, ifname);
1099
1100         if (ifi->ifi_family == AF_BRIDGE && brid) {
1101                 /* device has been removed from bridge */
1102                 char namebuf[IFNAMSIZ];
1103                 if_indextoname(brid, namebuf);
1104                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1105                            "%s", brid, namebuf);
1106                 del_ifidx(drv, brid);
1107         }
1108 }
1109
1110
1111 unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1112 {
1113         struct nl_msg *msg;
1114         int ret;
1115         struct nl80211_bss_info_arg arg;
1116
1117         os_memset(&arg, 0, sizeof(arg));
1118         msg = nlmsg_alloc();
1119         if (!msg)
1120                 goto nla_put_failure;
1121
1122         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1123         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1124
1125         arg.drv = drv;
1126         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1127         msg = NULL;
1128         if (ret == 0) {
1129                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1130                         arg.ibss_freq : arg.assoc_freq;
1131                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1132                            "associated BSS from scan results: %u MHz", freq);
1133                 if (freq)
1134                         drv->assoc_freq = freq;
1135                 return drv->assoc_freq;
1136         }
1137         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1138                    "(%s)", ret, strerror(-ret));
1139 nla_put_failure:
1140         nlmsg_free(msg);
1141         return drv->assoc_freq;
1142 }
1143
1144
1145 static int get_link_signal(struct nl_msg *msg, void *arg)
1146 {
1147         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1148         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1149         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1150         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1151                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1152                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
1153         };
1154         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1155         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1156                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1157                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1158                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1159                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1160         };
1161         struct wpa_signal_info *sig_change = arg;
1162
1163         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1164                   genlmsg_attrlen(gnlh, 0), NULL);
1165         if (!tb[NL80211_ATTR_STA_INFO] ||
1166             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1167                              tb[NL80211_ATTR_STA_INFO], policy))
1168                 return NL_SKIP;
1169         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1170                 return NL_SKIP;
1171
1172         sig_change->current_signal =
1173                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1174
1175         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
1176                 sig_change->avg_signal =
1177                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
1178         else
1179                 sig_change->avg_signal = 0;
1180
1181         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1182                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1183                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1184                                      rate_policy)) {
1185                         sig_change->current_txrate = 0;
1186                 } else {
1187                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1188                                 sig_change->current_txrate =
1189                                         nla_get_u16(rinfo[
1190                                              NL80211_RATE_INFO_BITRATE]) * 100;
1191                         }
1192                 }
1193         }
1194
1195         return NL_SKIP;
1196 }
1197
1198
1199 int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1200                             struct wpa_signal_info *sig)
1201 {
1202         struct nl_msg *msg;
1203
1204         sig->current_signal = -9999;
1205         sig->current_txrate = 0;
1206
1207         msg = nlmsg_alloc();
1208         if (!msg)
1209                 return -ENOMEM;
1210
1211         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
1212
1213         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1214         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
1215
1216         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1217  nla_put_failure:
1218         nlmsg_free(msg);
1219         return -ENOBUFS;
1220 }
1221
1222
1223 static int get_link_noise(struct nl_msg *msg, void *arg)
1224 {
1225         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1226         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1227         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1228         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1229                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1230                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1231         };
1232         struct wpa_signal_info *sig_change = arg;
1233
1234         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1235                   genlmsg_attrlen(gnlh, 0), NULL);
1236
1237         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1238                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1239                 return NL_SKIP;
1240         }
1241
1242         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1243                              tb[NL80211_ATTR_SURVEY_INFO],
1244                              survey_policy)) {
1245                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1246                            "attributes!");
1247                 return NL_SKIP;
1248         }
1249
1250         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1251                 return NL_SKIP;
1252
1253         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1254             sig_change->frequency)
1255                 return NL_SKIP;
1256
1257         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1258                 return NL_SKIP;
1259
1260         sig_change->current_noise =
1261                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1262
1263         return NL_SKIP;
1264 }
1265
1266
1267 int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1268                            struct wpa_signal_info *sig_change)
1269 {
1270         struct nl_msg *msg;
1271
1272         sig_change->current_noise = 9999;
1273         sig_change->frequency = drv->assoc_freq;
1274
1275         msg = nlmsg_alloc();
1276         if (!msg)
1277                 return -ENOMEM;
1278
1279         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1280
1281         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1282
1283         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1284  nla_put_failure:
1285         nlmsg_free(msg);
1286         return -ENOBUFS;
1287 }
1288
1289
1290 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
1291 {
1292         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1293         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1294         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1295         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1296                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1297                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1298         };
1299         struct wpa_scan_results *scan_results = arg;
1300         struct wpa_scan_res *scan_res;
1301         size_t i;
1302
1303         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1304                   genlmsg_attrlen(gnlh, 0), NULL);
1305
1306         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1307                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
1308                 return NL_SKIP;
1309         }
1310
1311         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1312                              tb[NL80211_ATTR_SURVEY_INFO],
1313                              survey_policy)) {
1314                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
1315                            "attributes");
1316                 return NL_SKIP;
1317         }
1318
1319         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1320                 return NL_SKIP;
1321
1322         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1323                 return NL_SKIP;
1324
1325         for (i = 0; i < scan_results->num; ++i) {
1326                 scan_res = scan_results->res[i];
1327                 if (!scan_res)
1328                         continue;
1329                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1330                     scan_res->freq)
1331                         continue;
1332                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
1333                         continue;
1334                 scan_res->noise = (s8)
1335                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1336                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
1337         }
1338
1339         return NL_SKIP;
1340 }
1341
1342
1343 static int nl80211_get_noise_for_scan_results(
1344         struct wpa_driver_nl80211_data *drv,
1345         struct wpa_scan_results *scan_res)
1346 {
1347         struct nl_msg *msg;
1348
1349         msg = nlmsg_alloc();
1350         if (!msg)
1351                 return -ENOMEM;
1352
1353         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1354
1355         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1356
1357         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
1358                                   scan_res);
1359  nla_put_failure:
1360         nlmsg_free(msg);
1361         return -ENOBUFS;
1362 }
1363
1364
1365 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1366                                              void *handle)
1367 {
1368         struct nl_cb *cb = eloop_ctx;
1369         int res;
1370
1371         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
1372
1373         res = nl_recvmsgs(handle, cb);
1374         if (res < 0) {
1375                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
1376                            __func__, res);
1377         }
1378 }
1379
1380
1381 /**
1382  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1383  * @priv: driver_nl80211 private data
1384  * @alpha2_arg: country to which to switch to
1385  * Returns: 0 on success, -1 on failure
1386  *
1387  * This asks nl80211 to set the regulatory domain for given
1388  * country ISO / IEC alpha2.
1389  */
1390 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1391 {
1392         struct i802_bss *bss = priv;
1393         struct wpa_driver_nl80211_data *drv = bss->drv;
1394         char alpha2[3];
1395         struct nl_msg *msg;
1396
1397         msg = nlmsg_alloc();
1398         if (!msg)
1399                 return -ENOMEM;
1400
1401         alpha2[0] = alpha2_arg[0];
1402         alpha2[1] = alpha2_arg[1];
1403         alpha2[2] = '\0';
1404
1405         nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
1406
1407         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
1408         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1409                 return -EINVAL;
1410         return 0;
1411 nla_put_failure:
1412         nlmsg_free(msg);
1413         return -EINVAL;
1414 }
1415
1416
1417 static int nl80211_get_country(struct nl_msg *msg, void *arg)
1418 {
1419         char *alpha2 = arg;
1420         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1421         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1422
1423         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1424                   genlmsg_attrlen(gnlh, 0), NULL);
1425         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
1426                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
1427                 return NL_SKIP;
1428         }
1429         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
1430         return NL_SKIP;
1431 }
1432
1433
1434 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
1435 {
1436         struct i802_bss *bss = priv;
1437         struct wpa_driver_nl80211_data *drv = bss->drv;
1438         struct nl_msg *msg;
1439         int ret;
1440
1441         msg = nlmsg_alloc();
1442         if (!msg)
1443                 return -ENOMEM;
1444
1445         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
1446         alpha2[0] = '\0';
1447         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
1448         if (!alpha2[0])
1449                 ret = -1;
1450
1451         return ret;
1452 }
1453
1454
1455 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
1456 {
1457         int ret;
1458
1459         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1460         if (global->nl_cb == NULL) {
1461                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1462                            "callbacks");
1463                 return -1;
1464         }
1465
1466         global->nl = nl_create_handle(global->nl_cb, "nl");
1467         if (global->nl == NULL)
1468                 goto err;
1469
1470         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
1471         if (global->nl80211_id < 0) {
1472                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1473                            "found");
1474                 goto err;
1475         }
1476
1477         global->nl_event = nl_create_handle(global->nl_cb, "event");
1478         if (global->nl_event == NULL)
1479                 goto err;
1480
1481         ret = nl_get_multicast_id(global, "nl80211", "scan");
1482         if (ret >= 0)
1483                 ret = nl_socket_add_membership(global->nl_event, ret);
1484         if (ret < 0) {
1485                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1486                            "membership for scan events: %d (%s)",
1487                            ret, strerror(-ret));
1488                 goto err;
1489         }
1490
1491         ret = nl_get_multicast_id(global, "nl80211", "mlme");
1492         if (ret >= 0)
1493                 ret = nl_socket_add_membership(global->nl_event, ret);
1494         if (ret < 0) {
1495                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1496                            "membership for mlme events: %d (%s)",
1497                            ret, strerror(-ret));
1498                 goto err;
1499         }
1500
1501         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
1502         if (ret >= 0)
1503                 ret = nl_socket_add_membership(global->nl_event, ret);
1504         if (ret < 0) {
1505                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1506                            "membership for regulatory events: %d (%s)",
1507                            ret, strerror(-ret));
1508                 /* Continue without regulatory events */
1509         }
1510
1511         ret = nl_get_multicast_id(global, "nl80211", "vendor");
1512         if (ret >= 0)
1513                 ret = nl_socket_add_membership(global->nl_event, ret);
1514         if (ret < 0) {
1515                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1516                            "membership for vendor events: %d (%s)",
1517                            ret, strerror(-ret));
1518                 /* Continue without vendor events */
1519         }
1520
1521         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1522                   no_seq_check, NULL);
1523         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1524                   process_global_event, global);
1525
1526         nl80211_register_eloop_read(&global->nl_event,
1527                                     wpa_driver_nl80211_event_receive,
1528                                     global->nl_cb);
1529
1530         return 0;
1531
1532 err:
1533         nl_destroy_handles(&global->nl_event);
1534         nl_destroy_handles(&global->nl);
1535         nl_cb_put(global->nl_cb);
1536         global->nl_cb = NULL;
1537         return -1;
1538 }
1539
1540
1541 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
1542 {
1543         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1544         if (!drv->nl_cb) {
1545                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
1546                 return -1;
1547         }
1548
1549         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1550                   no_seq_check, NULL);
1551         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1552                   process_drv_event, drv);
1553
1554         return 0;
1555 }
1556
1557
1558 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1559 {
1560         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1561         /*
1562          * This may be for any interface; use ifdown event to disable
1563          * interface.
1564          */
1565 }
1566
1567
1568 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1569 {
1570         struct wpa_driver_nl80211_data *drv = ctx;
1571         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1572         if (i802_set_iface_flags(drv->first_bss, 1)) {
1573                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1574                            "after rfkill unblock");
1575                 return;
1576         }
1577         /* rtnetlink ifup handler will report interface as enabled */
1578 }
1579
1580
1581 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
1582                                                       void *eloop_ctx,
1583                                                       void *handle)
1584 {
1585         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1586         u8 data[2048];
1587         struct msghdr msg;
1588         struct iovec entry;
1589         u8 control[512];
1590         struct cmsghdr *cmsg;
1591         int res, found_ee = 0, found_wifi = 0, acked = 0;
1592         union wpa_event_data event;
1593
1594         memset(&msg, 0, sizeof(msg));
1595         msg.msg_iov = &entry;
1596         msg.msg_iovlen = 1;
1597         entry.iov_base = data;
1598         entry.iov_len = sizeof(data);
1599         msg.msg_control = &control;
1600         msg.msg_controllen = sizeof(control);
1601
1602         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
1603         /* if error or not fitting 802.3 header, return */
1604         if (res < 14)
1605                 return;
1606
1607         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
1608         {
1609                 if (cmsg->cmsg_level == SOL_SOCKET &&
1610                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
1611                         int *ack;
1612
1613                         found_wifi = 1;
1614                         ack = (void *)CMSG_DATA(cmsg);
1615                         acked = *ack;
1616                 }
1617
1618                 if (cmsg->cmsg_level == SOL_PACKET &&
1619                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
1620                         struct sock_extended_err *err =
1621                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
1622
1623                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
1624                                 found_ee = 1;
1625                 }
1626         }
1627
1628         if (!found_ee || !found_wifi)
1629                 return;
1630
1631         memset(&event, 0, sizeof(event));
1632         event.eapol_tx_status.dst = data;
1633         event.eapol_tx_status.data = data + 14;
1634         event.eapol_tx_status.data_len = res - 14;
1635         event.eapol_tx_status.ack = acked;
1636         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
1637 }
1638
1639
1640 static int nl80211_init_bss(struct i802_bss *bss)
1641 {
1642         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1643         if (!bss->nl_cb)
1644                 return -1;
1645
1646         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1647                   no_seq_check, NULL);
1648         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1649                   process_bss_event, bss);
1650
1651         return 0;
1652 }
1653
1654
1655 static void nl80211_destroy_bss(struct i802_bss *bss)
1656 {
1657         nl_cb_put(bss->nl_cb);
1658         bss->nl_cb = NULL;
1659 }
1660
1661
1662 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
1663                                           void *global_priv, int hostapd,
1664                                           const u8 *set_addr,
1665                                           const char *driver_params)
1666 {
1667         struct wpa_driver_nl80211_data *drv;
1668         struct rfkill_config *rcfg;
1669         struct i802_bss *bss;
1670
1671         if (global_priv == NULL)
1672                 return NULL;
1673         drv = os_zalloc(sizeof(*drv));
1674         if (drv == NULL)
1675                 return NULL;
1676         drv->global = global_priv;
1677         drv->ctx = ctx;
1678         drv->hostapd = !!hostapd;
1679         drv->eapol_sock = -1;
1680         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
1681         drv->if_indices = drv->default_if_indices;
1682
1683         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
1684         if (!drv->first_bss) {
1685                 os_free(drv);
1686                 return NULL;
1687         }
1688         bss = drv->first_bss;
1689         bss->drv = drv;
1690         bss->ctx = ctx;
1691
1692         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1693         drv->monitor_ifidx = -1;
1694         drv->monitor_sock = -1;
1695         drv->eapol_tx_sock = -1;
1696         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
1697
1698         if (wpa_driver_nl80211_init_nl(drv)) {
1699                 os_free(drv);
1700                 return NULL;
1701         }
1702
1703         if (nl80211_init_bss(bss))
1704                 goto failed;
1705
1706         rcfg = os_zalloc(sizeof(*rcfg));
1707         if (rcfg == NULL)
1708                 goto failed;
1709         rcfg->ctx = drv;
1710         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
1711         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1712         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1713         drv->rfkill = rfkill_init(rcfg);
1714         if (drv->rfkill == NULL) {
1715                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1716                 os_free(rcfg);
1717         }
1718
1719         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
1720                 drv->start_iface_up = 1;
1721
1722         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1, driver_params))
1723                 goto failed;
1724
1725         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
1726         if (drv->eapol_tx_sock < 0)
1727                 goto failed;
1728
1729         if (drv->data_tx_status) {
1730                 int enabled = 1;
1731
1732                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
1733                                &enabled, sizeof(enabled)) < 0) {
1734                         wpa_printf(MSG_DEBUG,
1735                                 "nl80211: wifi status sockopt failed\n");
1736                         drv->data_tx_status = 0;
1737                         if (!drv->use_monitor)
1738                                 drv->capa.flags &=
1739                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1740                 } else {
1741                         eloop_register_read_sock(drv->eapol_tx_sock,
1742                                 wpa_driver_nl80211_handle_eapol_tx_status,
1743                                 drv, NULL);
1744                 }
1745         }
1746
1747         if (drv->global) {
1748                 dl_list_add(&drv->global->interfaces, &drv->list);
1749                 drv->in_interface_list = 1;
1750         }
1751
1752         return bss;
1753
1754 failed:
1755         wpa_driver_nl80211_deinit(bss);
1756         return NULL;
1757 }
1758
1759
1760 /**
1761  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1762  * @ctx: context to be used when calling wpa_supplicant functions,
1763  * e.g., wpa_supplicant_event()
1764  * @ifname: interface name, e.g., wlan0
1765  * @global_priv: private driver global data from global_init()
1766  * Returns: Pointer to private data, %NULL on failure
1767  */
1768 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
1769                                       void *global_priv)
1770 {
1771         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL,
1772                                            NULL);
1773 }
1774
1775
1776 static int nl80211_register_frame(struct i802_bss *bss,
1777                                   struct nl_handle *nl_handle,
1778                                   u16 type, const u8 *match, size_t match_len)
1779 {
1780         struct wpa_driver_nl80211_data *drv = bss->drv;
1781         struct nl_msg *msg;
1782         int ret = -1;
1783         char buf[30];
1784
1785         msg = nlmsg_alloc();
1786         if (!msg)
1787                 return -1;
1788
1789         buf[0] = '\0';
1790         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
1791         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
1792                    type, fc2str(type), nl_handle, buf);
1793
1794         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
1795
1796         if (nl80211_set_iface_id(msg, bss) < 0)
1797                 goto nla_put_failure;
1798
1799         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
1800         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
1801
1802         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
1803         msg = NULL;
1804         if (ret) {
1805                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
1806                            "failed (type=%u): ret=%d (%s)",
1807                            type, ret, strerror(-ret));
1808                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
1809                             match, match_len);
1810                 goto nla_put_failure;
1811         }
1812         ret = 0;
1813 nla_put_failure:
1814         nlmsg_free(msg);
1815         return ret;
1816 }
1817
1818
1819 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
1820 {
1821         struct wpa_driver_nl80211_data *drv = bss->drv;
1822
1823         if (bss->nl_mgmt) {
1824                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
1825                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
1826                 return -1;
1827         }
1828
1829         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
1830         if (bss->nl_mgmt == NULL)
1831                 return -1;
1832
1833         return 0;
1834 }
1835
1836
1837 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
1838 {
1839         nl80211_register_eloop_read(&bss->nl_mgmt,
1840                                     wpa_driver_nl80211_event_receive,
1841                                     bss->nl_cb);
1842 }
1843
1844
1845 static int nl80211_register_action_frame(struct i802_bss *bss,
1846                                          const u8 *match, size_t match_len)
1847 {
1848         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
1849         return nl80211_register_frame(bss, bss->nl_mgmt,
1850                                       type, match, match_len);
1851 }
1852
1853
1854 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
1855 {
1856         struct wpa_driver_nl80211_data *drv = bss->drv;
1857         int ret = 0;
1858
1859         if (nl80211_alloc_mgmt_handle(bss))
1860                 return -1;
1861         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
1862                    "handle %p", bss->nl_mgmt);
1863
1864         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
1865                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
1866
1867                 /* register for any AUTH message */
1868                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
1869         }
1870
1871 #ifdef CONFIG_INTERWORKING
1872         /* QoS Map Configure */
1873         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
1874                 ret = -1;
1875 #endif /* CONFIG_INTERWORKING */
1876 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
1877         /* GAS Initial Request */
1878         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
1879                 ret = -1;
1880         /* GAS Initial Response */
1881         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
1882                 ret = -1;
1883         /* GAS Comeback Request */
1884         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
1885                 ret = -1;
1886         /* GAS Comeback Response */
1887         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
1888                 ret = -1;
1889         /* Protected GAS Initial Request */
1890         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
1891                 ret = -1;
1892         /* Protected GAS Initial Response */
1893         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
1894                 ret = -1;
1895         /* Protected GAS Comeback Request */
1896         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
1897                 ret = -1;
1898         /* Protected GAS Comeback Response */
1899         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
1900                 ret = -1;
1901 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
1902 #ifdef CONFIG_P2P
1903         /* P2P Public Action */
1904         if (nl80211_register_action_frame(bss,
1905                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
1906                                           6) < 0)
1907                 ret = -1;
1908         /* P2P Action */
1909         if (nl80211_register_action_frame(bss,
1910                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
1911                                           5) < 0)
1912                 ret = -1;
1913 #endif /* CONFIG_P2P */
1914 #ifdef CONFIG_IEEE80211W
1915         /* SA Query Response */
1916         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
1917                 ret = -1;
1918 #endif /* CONFIG_IEEE80211W */
1919 #ifdef CONFIG_TDLS
1920         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
1921                 /* TDLS Discovery Response */
1922                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
1923                     0)
1924                         ret = -1;
1925         }
1926 #endif /* CONFIG_TDLS */
1927
1928         /* FT Action frames */
1929         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
1930                 ret = -1;
1931         else
1932                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1933                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1934
1935         /* WNM - BSS Transition Management Request */
1936         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
1937                 ret = -1;
1938         /* WNM-Sleep Mode Response */
1939         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
1940                 ret = -1;
1941
1942 #ifdef CONFIG_HS20
1943         /* WNM-Notification */
1944         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
1945                 ret = -1;
1946 #endif /* CONFIG_HS20 */
1947
1948         /* WMM-AC ADDTS Response */
1949         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x01", 2) < 0)
1950                 return -1;
1951
1952         /* WMM-AC DELTS */
1953         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x02", 2) < 0)
1954                 return -1;
1955
1956         /* Radio Measurement - Neighbor Report Response */
1957         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x05", 2) < 0)
1958                 ret = -1;
1959
1960         /* Radio Measurement - Link Measurement Request */
1961         if ((drv->capa.rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION) &&
1962             (nl80211_register_action_frame(bss, (u8 *) "\x05\x02", 2) < 0))
1963                 ret = -1;
1964
1965         nl80211_mgmt_handle_register_eloop(bss);
1966
1967         return ret;
1968 }
1969
1970
1971 static int nl80211_mgmt_subscribe_mesh(struct i802_bss *bss)
1972 {
1973         int ret = 0;
1974
1975         if (nl80211_alloc_mgmt_handle(bss))
1976                 return -1;
1977
1978         wpa_printf(MSG_DEBUG,
1979                    "nl80211: Subscribe to mgmt frames with mesh handle %p",
1980                    bss->nl_mgmt);
1981
1982         /* Auth frames for mesh SAE */
1983         if (nl80211_register_frame(bss, bss->nl_mgmt,
1984                                    (WLAN_FC_TYPE_MGMT << 2) |
1985                                    (WLAN_FC_STYPE_AUTH << 4),
1986                                    NULL, 0) < 0)
1987                 ret = -1;
1988
1989         /* Mesh peering open */
1990         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x01", 2) < 0)
1991                 ret = -1;
1992         /* Mesh peering confirm */
1993         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x02", 2) < 0)
1994                 ret = -1;
1995         /* Mesh peering close */
1996         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x03", 2) < 0)
1997                 ret = -1;
1998
1999         nl80211_mgmt_handle_register_eloop(bss);
2000
2001         return ret;
2002 }
2003
2004
2005 static int nl80211_register_spurious_class3(struct i802_bss *bss)
2006 {
2007         struct wpa_driver_nl80211_data *drv = bss->drv;
2008         struct nl_msg *msg;
2009         int ret = -1;
2010
2011         msg = nlmsg_alloc();
2012         if (!msg)
2013                 return -1;
2014
2015         nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
2016
2017         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
2018
2019         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
2020         msg = NULL;
2021         if (ret) {
2022                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
2023                            "failed: ret=%d (%s)",
2024                            ret, strerror(-ret));
2025                 goto nla_put_failure;
2026         }
2027         ret = 0;
2028 nla_put_failure:
2029         nlmsg_free(msg);
2030         return ret;
2031 }
2032
2033
2034 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
2035 {
2036         static const int stypes[] = {
2037                 WLAN_FC_STYPE_AUTH,
2038                 WLAN_FC_STYPE_ASSOC_REQ,
2039                 WLAN_FC_STYPE_REASSOC_REQ,
2040                 WLAN_FC_STYPE_DISASSOC,
2041                 WLAN_FC_STYPE_DEAUTH,
2042                 WLAN_FC_STYPE_ACTION,
2043                 WLAN_FC_STYPE_PROBE_REQ,
2044 /* Beacon doesn't work as mac80211 doesn't currently allow
2045  * it, but it wouldn't really be the right thing anyway as
2046  * it isn't per interface ... maybe just dump the scan
2047  * results periodically for OLBC?
2048  */
2049                 /* WLAN_FC_STYPE_BEACON, */
2050         };
2051         unsigned int i;
2052
2053         if (nl80211_alloc_mgmt_handle(bss))
2054                 return -1;
2055         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2056                    "handle %p", bss->nl_mgmt);
2057
2058         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
2059                 if (nl80211_register_frame(bss, bss->nl_mgmt,
2060                                            (WLAN_FC_TYPE_MGMT << 2) |
2061                                            (stypes[i] << 4),
2062                                            NULL, 0) < 0) {
2063                         goto out_err;
2064                 }
2065         }
2066
2067         if (nl80211_register_spurious_class3(bss))
2068                 goto out_err;
2069
2070         if (nl80211_get_wiphy_data_ap(bss) == NULL)
2071                 goto out_err;
2072
2073         nl80211_mgmt_handle_register_eloop(bss);
2074         return 0;
2075
2076 out_err:
2077         nl_destroy_handles(&bss->nl_mgmt);
2078         return -1;
2079 }
2080
2081
2082 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
2083 {
2084         if (nl80211_alloc_mgmt_handle(bss))
2085                 return -1;
2086         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2087                    "handle %p (device SME)", bss->nl_mgmt);
2088
2089         if (nl80211_register_frame(bss, bss->nl_mgmt,
2090                                    (WLAN_FC_TYPE_MGMT << 2) |
2091                                    (WLAN_FC_STYPE_ACTION << 4),
2092                                    NULL, 0) < 0)
2093                 goto out_err;
2094
2095         nl80211_mgmt_handle_register_eloop(bss);
2096         return 0;
2097
2098 out_err:
2099         nl_destroy_handles(&bss->nl_mgmt);
2100         return -1;
2101 }
2102
2103
2104 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
2105 {
2106         if (bss->nl_mgmt == NULL)
2107                 return;
2108         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
2109                    "(%s)", bss->nl_mgmt, reason);
2110         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
2111
2112         nl80211_put_wiphy_data_ap(bss);
2113 }
2114
2115
2116 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
2117 {
2118         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
2119 }
2120
2121
2122 static void nl80211_del_p2pdev(struct i802_bss *bss)
2123 {
2124         struct wpa_driver_nl80211_data *drv = bss->drv;
2125         struct nl_msg *msg;
2126         int ret;
2127
2128         msg = nlmsg_alloc();
2129         if (!msg)
2130                 return;
2131
2132         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
2133         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
2134
2135         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2136         msg = NULL;
2137
2138         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
2139                    bss->ifname, (long long unsigned int) bss->wdev_id,
2140                    strerror(-ret));
2141
2142 nla_put_failure:
2143         nlmsg_free(msg);
2144 }
2145
2146
2147 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
2148 {
2149         struct wpa_driver_nl80211_data *drv = bss->drv;
2150         struct nl_msg *msg;
2151         int ret = -1;
2152
2153         msg = nlmsg_alloc();
2154         if (!msg)
2155                 return -1;
2156
2157         if (start)
2158                 nl80211_cmd(drv, msg, 0, NL80211_CMD_START_P2P_DEVICE);
2159         else
2160                 nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_P2P_DEVICE);
2161
2162         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
2163
2164         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2165         msg = NULL;
2166
2167         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
2168                    start ? "Start" : "Stop",
2169                    bss->ifname, (long long unsigned int) bss->wdev_id,
2170                    strerror(-ret));
2171
2172 nla_put_failure:
2173         nlmsg_free(msg);
2174         return ret;
2175 }
2176
2177
2178 static int i802_set_iface_flags(struct i802_bss *bss, int up)
2179 {
2180         enum nl80211_iftype nlmode;
2181
2182         nlmode = nl80211_get_ifmode(bss);
2183         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2184                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
2185                                              bss->ifname, up);
2186         }
2187
2188         /* P2P Device has start/stop which is equivalent */
2189         return nl80211_set_p2pdev(bss, up);
2190 }
2191
2192
2193 static int
2194 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
2195                                    const u8 *set_addr, int first,
2196                                    const char *driver_params)
2197 {
2198         struct i802_bss *bss = drv->first_bss;
2199         int send_rfkill_event = 0;
2200         enum nl80211_iftype nlmode;
2201
2202         drv->ifindex = if_nametoindex(bss->ifname);
2203         bss->ifindex = drv->ifindex;
2204         bss->wdev_id = drv->global->if_add_wdevid;
2205         bss->wdev_id_set = drv->global->if_add_wdevid_set;
2206
2207         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
2208         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
2209         drv->global->if_add_wdevid_set = 0;
2210
2211         if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2212                 bss->static_ap = 1;
2213
2214         if (wpa_driver_nl80211_capa(drv))
2215                 return -1;
2216
2217         if (driver_params && nl80211_set_param(bss, driver_params) < 0)
2218                 return -1;
2219
2220         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2221                    bss->ifname, drv->phyname);
2222
2223         if (set_addr &&
2224             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
2225              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2226                                 set_addr)))
2227                 return -1;
2228
2229         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2230                 drv->start_mode_ap = 1;
2231
2232         if (drv->hostapd || bss->static_ap)
2233                 nlmode = NL80211_IFTYPE_AP;
2234         else if (bss->if_dynamic)
2235                 nlmode = nl80211_get_ifmode(bss);
2236         else
2237                 nlmode = NL80211_IFTYPE_STATION;
2238
2239         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
2240                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
2241                 return -1;
2242         }
2243
2244         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2245                 nl80211_get_macaddr(bss);
2246
2247         if (!rfkill_is_blocked(drv->rfkill)) {
2248                 int ret = i802_set_iface_flags(bss, 1);
2249                 if (ret) {
2250                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
2251                                    "interface '%s' UP", bss->ifname);
2252                         return ret;
2253                 }
2254                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2255                         return ret;
2256         } else {
2257                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
2258                            "interface '%s' due to rfkill", bss->ifname);
2259                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2260                         return 0;
2261                 drv->if_disabled = 1;
2262                 send_rfkill_event = 1;
2263         }
2264
2265         if (!drv->hostapd)
2266                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
2267                                        1, IF_OPER_DORMANT);
2268
2269         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2270                                bss->addr))
2271                 return -1;
2272         os_memcpy(drv->perm_addr, bss->addr, ETH_ALEN);
2273
2274         if (send_rfkill_event) {
2275                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
2276                                        drv, drv->ctx);
2277         }
2278
2279         return 0;
2280 }
2281
2282
2283 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
2284 {
2285         struct nl_msg *msg;
2286
2287         msg = nlmsg_alloc();
2288         if (!msg)
2289                 return -ENOMEM;
2290
2291         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
2292                    drv->ifindex);
2293         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
2294         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2295
2296         return send_and_recv_msgs(drv, msg, NULL, NULL);
2297  nla_put_failure:
2298         nlmsg_free(msg);
2299         return -ENOBUFS;
2300 }
2301
2302
2303 /**
2304  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
2305  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
2306  *
2307  * Shut down driver interface and processing of driver events. Free
2308  * private data buffer if one was allocated in wpa_driver_nl80211_init().
2309  */
2310 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
2311 {
2312         struct wpa_driver_nl80211_data *drv = bss->drv;
2313
2314         bss->in_deinit = 1;
2315         if (drv->data_tx_status)
2316                 eloop_unregister_read_sock(drv->eapol_tx_sock);
2317         if (drv->eapol_tx_sock >= 0)
2318                 close(drv->eapol_tx_sock);
2319
2320         if (bss->nl_preq)
2321                 wpa_driver_nl80211_probe_req_report(bss, 0);
2322         if (bss->added_if_into_bridge) {
2323                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
2324                                     bss->ifname) < 0)
2325                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2326                                    "interface %s from bridge %s: %s",
2327                                    bss->ifname, bss->brname, strerror(errno));
2328                 if (drv->rtnl_sk)
2329                         nl80211_handle_destroy(drv->rtnl_sk);
2330         }
2331         if (bss->added_bridge) {
2332                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
2333                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2334                                    "bridge %s: %s",
2335                                    bss->brname, strerror(errno));
2336         }
2337
2338         nl80211_remove_monitor_interface(drv);
2339
2340         if (is_ap_interface(drv->nlmode))
2341                 wpa_driver_nl80211_del_beacon(drv);
2342
2343         if (drv->eapol_sock >= 0) {
2344                 eloop_unregister_read_sock(drv->eapol_sock);
2345                 close(drv->eapol_sock);
2346         }
2347
2348         if (drv->if_indices != drv->default_if_indices)
2349                 os_free(drv->if_indices);
2350
2351         if (drv->disabled_11b_rates)
2352                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2353
2354         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
2355                                IF_OPER_UP);
2356         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
2357         rfkill_deinit(drv->rfkill);
2358
2359         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2360
2361         if (!drv->start_iface_up)
2362                 (void) i802_set_iface_flags(bss, 0);
2363
2364         if (drv->addr_changed) {
2365                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
2366                                           0) < 0) {
2367                         wpa_printf(MSG_DEBUG,
2368                                    "nl80211: Could not set interface down to restore permanent MAC address");
2369                 }
2370                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2371                                        drv->perm_addr) < 0) {
2372                         wpa_printf(MSG_DEBUG,
2373                                    "nl80211: Could not restore permanent MAC address");
2374                 }
2375         }
2376
2377         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2378                 if (!drv->hostapd || !drv->start_mode_ap)
2379                         wpa_driver_nl80211_set_mode(bss,
2380                                                     NL80211_IFTYPE_STATION);
2381                 nl80211_mgmt_unsubscribe(bss, "deinit");
2382         } else {
2383                 nl80211_mgmt_unsubscribe(bss, "deinit");
2384                 nl80211_del_p2pdev(bss);
2385         }
2386         nl_cb_put(drv->nl_cb);
2387
2388         nl80211_destroy_bss(drv->first_bss);
2389
2390         os_free(drv->filter_ssids);
2391
2392         os_free(drv->auth_ie);
2393
2394         if (drv->in_interface_list)
2395                 dl_list_del(&drv->list);
2396
2397         os_free(drv->extended_capa);
2398         os_free(drv->extended_capa_mask);
2399         os_free(drv->first_bss);
2400         os_free(drv);
2401 }
2402
2403
2404 /**
2405  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
2406  * @eloop_ctx: Driver private data
2407  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
2408  *
2409  * This function can be used as registered timeout when starting a scan to
2410  * generate a scan completed event if the driver does not report this.
2411  */
2412 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
2413 {
2414         struct wpa_driver_nl80211_data *drv = eloop_ctx;
2415         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
2416                 wpa_driver_nl80211_set_mode(drv->first_bss,
2417                                             drv->ap_scan_as_station);
2418                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2419         }
2420         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
2421         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
2422 }
2423
2424
2425 static struct nl_msg *
2426 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
2427                     struct wpa_driver_scan_params *params, u64 *wdev_id)
2428 {
2429         struct nl_msg *msg;
2430         size_t i;
2431         u32 scan_flags = 0;
2432
2433         msg = nlmsg_alloc();
2434         if (!msg)
2435                 return NULL;
2436
2437         nl80211_cmd(drv, msg, 0, cmd);
2438
2439         if (!wdev_id)
2440                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2441         else
2442                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, *wdev_id);
2443
2444         if (params->num_ssids) {
2445                 struct nlattr *ssids;
2446
2447                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
2448                 if (ssids == NULL)
2449                         goto fail;
2450                 for (i = 0; i < params->num_ssids; i++) {
2451                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
2452                                           params->ssids[i].ssid,
2453                                           params->ssids[i].ssid_len);
2454                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
2455                                     params->ssids[i].ssid) < 0)
2456                                 goto fail;
2457                 }
2458                 nla_nest_end(msg, ssids);
2459         }
2460
2461         if (params->extra_ies) {
2462                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
2463                             params->extra_ies, params->extra_ies_len);
2464                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
2465                             params->extra_ies) < 0)
2466                         goto fail;
2467         }
2468
2469         if (params->freqs) {
2470                 struct nlattr *freqs;
2471                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
2472                 if (freqs == NULL)
2473                         goto fail;
2474                 for (i = 0; params->freqs[i]; i++) {
2475                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
2476                                    "MHz", params->freqs[i]);
2477                         if (nla_put_u32(msg, i + 1, params->freqs[i]) < 0)
2478                                 goto fail;
2479                 }
2480                 nla_nest_end(msg, freqs);
2481         }
2482
2483         os_free(drv->filter_ssids);
2484         drv->filter_ssids = params->filter_ssids;
2485         params->filter_ssids = NULL;
2486         drv->num_filter_ssids = params->num_filter_ssids;
2487
2488         if (params->only_new_results) {
2489                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
2490                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
2491         }
2492
2493         if (params->low_priority && drv->have_low_prio_scan) {
2494                 wpa_printf(MSG_DEBUG,
2495                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
2496                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
2497         }
2498
2499         if (scan_flags)
2500                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags);
2501
2502         return msg;
2503
2504 fail:
2505 nla_put_failure:
2506         nlmsg_free(msg);
2507         return NULL;
2508 }
2509
2510
2511 /**
2512  * wpa_driver_nl80211_scan - Request the driver to initiate scan
2513  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
2514  * @params: Scan parameters
2515  * Returns: 0 on success, -1 on failure
2516  */
2517 static int wpa_driver_nl80211_scan(struct i802_bss *bss,
2518                                    struct wpa_driver_scan_params *params)
2519 {
2520         struct wpa_driver_nl80211_data *drv = bss->drv;
2521         int ret = -1, timeout;
2522         struct nl_msg *msg = NULL;
2523
2524         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
2525         drv->scan_for_auth = 0;
2526
2527         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params,
2528                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
2529         if (!msg)
2530                 return -1;
2531
2532         if (params->p2p_probe) {
2533                 struct nlattr *rates;
2534
2535                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
2536
2537                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
2538                 if (rates == NULL)
2539                         goto nla_put_failure;
2540
2541                 /*
2542                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
2543                  * by masking out everything else apart from the OFDM rates 6,
2544                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
2545                  * rates are left enabled.
2546                  */
2547                 NLA_PUT(msg, NL80211_BAND_2GHZ, 8,
2548                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
2549                 nla_nest_end(msg, rates);
2550
2551                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
2552         }
2553
2554         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2555         msg = NULL;
2556         if (ret) {
2557                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
2558                            "(%s)", ret, strerror(-ret));
2559                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
2560                         enum nl80211_iftype old_mode = drv->nlmode;
2561
2562                         /*
2563                          * mac80211 does not allow scan requests in AP mode, so
2564                          * try to do this in station mode.
2565                          */
2566                         if (wpa_driver_nl80211_set_mode(
2567                                     bss, NL80211_IFTYPE_STATION))
2568                                 goto nla_put_failure;
2569
2570                         if (wpa_driver_nl80211_scan(bss, params)) {
2571                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
2572                                 goto nla_put_failure;
2573                         }
2574
2575                         /* Restore AP mode when processing scan results */
2576                         drv->ap_scan_as_station = old_mode;
2577                         ret = 0;
2578                 } else
2579                         goto nla_put_failure;
2580         }
2581
2582         drv->scan_state = SCAN_REQUESTED;
2583         /* Not all drivers generate "scan completed" wireless event, so try to
2584          * read results after a timeout. */
2585         timeout = 10;
2586         if (drv->scan_complete_events) {
2587                 /*
2588                  * The driver seems to deliver events to notify when scan is
2589                  * complete, so use longer timeout to avoid race conditions
2590                  * with scanning and following association request.
2591                  */
2592                 timeout = 30;
2593         }
2594         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
2595                    "seconds", ret, timeout);
2596         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2597         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
2598                                drv, drv->ctx);
2599
2600 nla_put_failure:
2601         nlmsg_free(msg);
2602         return ret;
2603 }
2604
2605
2606 /**
2607  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
2608  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
2609  * @params: Scan parameters
2610  * @interval: Interval between scan cycles in milliseconds
2611  * Returns: 0 on success, -1 on failure or if not supported
2612  */
2613 static int wpa_driver_nl80211_sched_scan(void *priv,
2614                                          struct wpa_driver_scan_params *params,
2615                                          u32 interval)
2616 {
2617         struct i802_bss *bss = priv;
2618         struct wpa_driver_nl80211_data *drv = bss->drv;
2619         int ret = -1;
2620         struct nl_msg *msg;
2621         size_t i;
2622
2623         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
2624
2625 #ifdef ANDROID
2626         if (!drv->capa.sched_scan_supported)
2627                 return android_pno_start(bss, params);
2628 #endif /* ANDROID */
2629
2630         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params,
2631                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
2632         if (!msg)
2633                 goto nla_put_failure;
2634
2635         NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
2636
2637         if ((drv->num_filter_ssids &&
2638             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
2639             params->filter_rssi) {
2640                 struct nlattr *match_sets;
2641                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
2642                 if (match_sets == NULL)
2643                         goto nla_put_failure;
2644
2645                 for (i = 0; i < drv->num_filter_ssids; i++) {
2646                         struct nlattr *match_set_ssid;
2647                         wpa_hexdump_ascii(MSG_MSGDUMP,
2648                                           "nl80211: Sched scan filter SSID",
2649                                           drv->filter_ssids[i].ssid,
2650                                           drv->filter_ssids[i].ssid_len);
2651
2652                         match_set_ssid = nla_nest_start(msg, i + 1);
2653                         if (match_set_ssid == NULL)
2654                                 goto nla_put_failure;
2655                         NLA_PUT(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
2656                                 drv->filter_ssids[i].ssid_len,
2657                                 drv->filter_ssids[i].ssid);
2658                         if (params->filter_rssi)
2659                                 NLA_PUT_U32(msg,
2660                                             NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
2661                                             params->filter_rssi);
2662
2663                         nla_nest_end(msg, match_set_ssid);
2664                 }
2665
2666                 /*
2667                  * Due to backward compatibility code, newer kernels treat this
2668                  * matchset (with only an RSSI filter) as the default for all
2669                  * other matchsets, unless it's the only one, in which case the
2670                  * matchset will actually allow all SSIDs above the RSSI.
2671                  */
2672                 if (params->filter_rssi) {
2673                         struct nlattr *match_set_rssi;
2674                         match_set_rssi = nla_nest_start(msg, 0);
2675                         if (match_set_rssi == NULL)
2676                                 goto nla_put_failure;
2677                         NLA_PUT_U32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
2678                                     params->filter_rssi);
2679                         wpa_printf(MSG_MSGDUMP,
2680                                    "nl80211: Sched scan RSSI filter %d dBm",
2681                                    params->filter_rssi);
2682                         nla_nest_end(msg, match_set_rssi);
2683                 }
2684
2685                 nla_nest_end(msg, match_sets);
2686         }
2687
2688         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2689
2690         /* TODO: if we get an error here, we should fall back to normal scan */
2691
2692         msg = NULL;
2693         if (ret) {
2694                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
2695                            "ret=%d (%s)", ret, strerror(-ret));
2696                 goto nla_put_failure;
2697         }
2698
2699         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
2700                    "scan interval %d msec", ret, interval);
2701
2702 nla_put_failure:
2703         nlmsg_free(msg);
2704         return ret;
2705 }
2706
2707
2708 /**
2709  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
2710  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
2711  * Returns: 0 on success, -1 on failure or if not supported
2712  */
2713 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
2714 {
2715         struct i802_bss *bss = priv;
2716         struct wpa_driver_nl80211_data *drv = bss->drv;
2717         int ret = 0;
2718         struct nl_msg *msg;
2719
2720 #ifdef ANDROID
2721         if (!drv->capa.sched_scan_supported)
2722                 return android_pno_stop(bss);
2723 #endif /* ANDROID */
2724
2725         msg = nlmsg_alloc();
2726         if (!msg)
2727                 return -1;
2728
2729         nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
2730
2731         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2732
2733         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2734         msg = NULL;
2735         if (ret) {
2736                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
2737                            "ret=%d (%s)", ret, strerror(-ret));
2738                 goto nla_put_failure;
2739         }
2740
2741         wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
2742
2743 nla_put_failure:
2744         nlmsg_free(msg);
2745         return ret;
2746 }
2747
2748
2749 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
2750 {
2751         const u8 *end, *pos;
2752
2753         if (ies == NULL)
2754                 return NULL;
2755
2756         pos = ies;
2757         end = ies + ies_len;
2758
2759         while (pos + 1 < end) {
2760                 if (pos + 2 + pos[1] > end)
2761                         break;
2762                 if (pos[0] == ie)
2763                         return pos;
2764                 pos += 2 + pos[1];
2765         }
2766
2767         return NULL;
2768 }
2769
2770
2771 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
2772                                  const u8 *ie, size_t ie_len)
2773 {
2774         const u8 *ssid;
2775         size_t i;
2776
2777         if (drv->filter_ssids == NULL)
2778                 return 0;
2779
2780         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
2781         if (ssid == NULL)
2782                 return 1;
2783
2784         for (i = 0; i < drv->num_filter_ssids; i++) {
2785                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
2786                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
2787                     0)
2788                         return 0;
2789         }
2790
2791         return 1;
2792 }
2793
2794
2795 static int bss_info_handler(struct nl_msg *msg, void *arg)
2796 {
2797         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2798         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2799         struct nlattr *bss[NL80211_BSS_MAX + 1];
2800         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
2801                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
2802                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
2803                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
2804                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
2805                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
2806                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
2807                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
2808                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
2809                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
2810                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
2811                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
2812         };
2813         struct nl80211_bss_info_arg *_arg = arg;
2814         struct wpa_scan_results *res = _arg->res;
2815         struct wpa_scan_res **tmp;
2816         struct wpa_scan_res *r;
2817         const u8 *ie, *beacon_ie;
2818         size_t ie_len, beacon_ie_len;
2819         u8 *pos;
2820         size_t i;
2821
2822         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2823                   genlmsg_attrlen(gnlh, 0), NULL);
2824         if (!tb[NL80211_ATTR_BSS])
2825                 return NL_SKIP;
2826         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
2827                              bss_policy))
2828                 return NL_SKIP;
2829         if (bss[NL80211_BSS_STATUS]) {
2830                 enum nl80211_bss_status status;
2831                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
2832                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
2833                     bss[NL80211_BSS_FREQUENCY]) {
2834                         _arg->assoc_freq =
2835                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2836                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
2837                                    _arg->assoc_freq);
2838                 }
2839                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
2840                     bss[NL80211_BSS_FREQUENCY]) {
2841                         _arg->ibss_freq =
2842                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2843                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
2844                                    _arg->ibss_freq);
2845                 }
2846                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
2847                     bss[NL80211_BSS_BSSID]) {
2848                         os_memcpy(_arg->assoc_bssid,
2849                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
2850                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
2851                                    MACSTR, MAC2STR(_arg->assoc_bssid));
2852                 }
2853         }
2854         if (!res)
2855                 return NL_SKIP;
2856         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
2857                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
2858                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
2859         } else {
2860                 ie = NULL;
2861                 ie_len = 0;
2862         }
2863         if (bss[NL80211_BSS_BEACON_IES]) {
2864                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
2865                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
2866         } else {
2867                 beacon_ie = NULL;
2868                 beacon_ie_len = 0;
2869         }
2870
2871         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
2872                                   ie ? ie_len : beacon_ie_len))
2873                 return NL_SKIP;
2874
2875         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
2876         if (r == NULL)
2877                 return NL_SKIP;
2878         if (bss[NL80211_BSS_BSSID])
2879                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
2880                           ETH_ALEN);
2881         if (bss[NL80211_BSS_FREQUENCY])
2882                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2883         if (bss[NL80211_BSS_BEACON_INTERVAL])
2884                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
2885         if (bss[NL80211_BSS_CAPABILITY])
2886                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
2887         r->flags |= WPA_SCAN_NOISE_INVALID;
2888         if (bss[NL80211_BSS_SIGNAL_MBM]) {
2889                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
2890                 r->level /= 100; /* mBm to dBm */
2891                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
2892         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
2893                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
2894                 r->flags |= WPA_SCAN_QUAL_INVALID;
2895         } else
2896                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
2897         if (bss[NL80211_BSS_TSF])
2898                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
2899         if (bss[NL80211_BSS_SEEN_MS_AGO])
2900                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
2901         r->ie_len = ie_len;
2902         pos = (u8 *) (r + 1);
2903         if (ie) {
2904                 os_memcpy(pos, ie, ie_len);
2905                 pos += ie_len;
2906         }
2907         r->beacon_ie_len = beacon_ie_len;
2908         if (beacon_ie)
2909                 os_memcpy(pos, beacon_ie, beacon_ie_len);
2910
2911         if (bss[NL80211_BSS_STATUS]) {
2912                 enum nl80211_bss_status status;
2913                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
2914                 switch (status) {
2915                 case NL80211_BSS_STATUS_AUTHENTICATED:
2916                         r->flags |= WPA_SCAN_AUTHENTICATED;
2917                         break;
2918                 case NL80211_BSS_STATUS_ASSOCIATED:
2919                         r->flags |= WPA_SCAN_ASSOCIATED;
2920                         break;
2921                 default:
2922                         break;
2923                 }
2924         }
2925
2926         /*
2927          * cfg80211 maintains separate BSS table entries for APs if the same
2928          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
2929          * not use frequency as a separate key in the BSS table, so filter out
2930          * duplicated entries. Prefer associated BSS entry in such a case in
2931          * order to get the correct frequency into the BSS table. Similarly,
2932          * prefer newer entries over older.
2933          */
2934         for (i = 0; i < res->num; i++) {
2935                 const u8 *s1, *s2;
2936                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
2937                         continue;
2938
2939                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
2940                                     res->res[i]->ie_len, WLAN_EID_SSID);
2941                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
2942                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
2943                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
2944                         continue;
2945
2946                 /* Same BSSID,SSID was already included in scan results */
2947                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
2948                            "for " MACSTR, MAC2STR(r->bssid));
2949
2950                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
2951                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
2952                     r->age < res->res[i]->age) {
2953                         os_free(res->res[i]);
2954                         res->res[i] = r;
2955                 } else
2956                         os_free(r);
2957                 return NL_SKIP;
2958         }
2959
2960         tmp = os_realloc_array(res->res, res->num + 1,
2961                                sizeof(struct wpa_scan_res *));
2962         if (tmp == NULL) {
2963                 os_free(r);
2964                 return NL_SKIP;
2965         }
2966         tmp[res->num++] = r;
2967         res->res = tmp;
2968
2969         return NL_SKIP;
2970 }
2971
2972
2973 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
2974                                  const u8 *addr)
2975 {
2976         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
2977                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
2978                            "mismatch (" MACSTR ")", MAC2STR(addr));
2979                 wpa_driver_nl80211_mlme(drv, addr,
2980                                         NL80211_CMD_DEAUTHENTICATE,
2981                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
2982         }
2983 }
2984
2985
2986 static void wpa_driver_nl80211_check_bss_status(
2987         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
2988 {
2989         size_t i;
2990
2991         for (i = 0; i < res->num; i++) {
2992                 struct wpa_scan_res *r = res->res[i];
2993                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
2994                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
2995                                    "indicates BSS status with " MACSTR
2996                                    " as authenticated",
2997                                    MAC2STR(r->bssid));
2998                         if (is_sta_interface(drv->nlmode) &&
2999                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
3000                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
3001                             0) {
3002                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
3003                                            " in local state (auth=" MACSTR
3004                                            " assoc=" MACSTR ")",
3005                                            MAC2STR(drv->auth_bssid),
3006                                            MAC2STR(drv->bssid));
3007                                 clear_state_mismatch(drv, r->bssid);
3008                         }
3009                 }
3010
3011                 if (r->flags & WPA_SCAN_ASSOCIATED) {
3012                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
3013                                    "indicate BSS status with " MACSTR
3014                                    " as associated",
3015                                    MAC2STR(r->bssid));
3016                         if (is_sta_interface(drv->nlmode) &&
3017                             !drv->associated) {
3018                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
3019                                            "(not associated) does not match "
3020                                            "with BSS state");
3021                                 clear_state_mismatch(drv, r->bssid);
3022                         } else if (is_sta_interface(drv->nlmode) &&
3023                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
3024                                    0) {
3025                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
3026                                            "(associated with " MACSTR ") does "
3027                                            "not match with BSS state",
3028                                            MAC2STR(drv->bssid));
3029                                 clear_state_mismatch(drv, r->bssid);
3030                                 clear_state_mismatch(drv, drv->bssid);
3031                         }
3032                 }
3033         }
3034 }
3035
3036
3037 static struct wpa_scan_results *
3038 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
3039 {
3040         struct nl_msg *msg;
3041         struct wpa_scan_results *res;
3042         int ret;
3043         struct nl80211_bss_info_arg arg;
3044
3045         res = os_zalloc(sizeof(*res));
3046         if (res == NULL)
3047                 return NULL;
3048         msg = nlmsg_alloc();
3049         if (!msg)
3050                 goto nla_put_failure;
3051
3052         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
3053         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
3054                 goto nla_put_failure;
3055
3056         arg.drv = drv;
3057         arg.res = res;
3058         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
3059         msg = NULL;
3060         if (ret == 0) {
3061                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
3062                            "BSSes)", (unsigned long) res->num);
3063                 nl80211_get_noise_for_scan_results(drv, res);
3064                 return res;
3065         }
3066         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
3067                    "(%s)", ret, strerror(-ret));
3068 nla_put_failure:
3069         nlmsg_free(msg);
3070         wpa_scan_results_free(res);
3071         return NULL;
3072 }
3073
3074
3075 /**
3076  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
3077  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
3078  * Returns: Scan results on success, -1 on failure
3079  */
3080 static struct wpa_scan_results *
3081 wpa_driver_nl80211_get_scan_results(void *priv)
3082 {
3083         struct i802_bss *bss = priv;
3084         struct wpa_driver_nl80211_data *drv = bss->drv;
3085         struct wpa_scan_results *res;
3086
3087         res = nl80211_get_scan_results(drv);
3088         if (res)
3089                 wpa_driver_nl80211_check_bss_status(drv, res);
3090         return res;
3091 }
3092
3093
3094 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
3095 {
3096         struct wpa_scan_results *res;
3097         size_t i;
3098
3099         res = nl80211_get_scan_results(drv);
3100         if (res == NULL) {
3101                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
3102                 return;
3103         }
3104
3105         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
3106         for (i = 0; i < res->num; i++) {
3107                 struct wpa_scan_res *r = res->res[i];
3108                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
3109                            (int) i, (int) res->num, MAC2STR(r->bssid),
3110                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
3111                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
3112         }
3113
3114         wpa_scan_results_free(res);
3115 }
3116
3117
3118 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
3119 {
3120         switch (alg) {
3121         case WPA_ALG_WEP:
3122                 if (key_len == 5)
3123                         return WLAN_CIPHER_SUITE_WEP40;
3124                 return WLAN_CIPHER_SUITE_WEP104;
3125         case WPA_ALG_TKIP:
3126                 return WLAN_CIPHER_SUITE_TKIP;
3127         case WPA_ALG_CCMP:
3128                 return WLAN_CIPHER_SUITE_CCMP;
3129         case WPA_ALG_GCMP:
3130                 return WLAN_CIPHER_SUITE_GCMP;
3131         case WPA_ALG_CCMP_256:
3132                 return WLAN_CIPHER_SUITE_CCMP_256;
3133         case WPA_ALG_GCMP_256:
3134                 return WLAN_CIPHER_SUITE_GCMP_256;
3135         case WPA_ALG_IGTK:
3136                 return WLAN_CIPHER_SUITE_AES_CMAC;
3137         case WPA_ALG_BIP_GMAC_128:
3138                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
3139         case WPA_ALG_BIP_GMAC_256:
3140                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
3141         case WPA_ALG_BIP_CMAC_256:
3142                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
3143         case WPA_ALG_SMS4:
3144                 return WLAN_CIPHER_SUITE_SMS4;
3145         case WPA_ALG_KRK:
3146                 return WLAN_CIPHER_SUITE_KRK;
3147         case WPA_ALG_NONE:
3148         case WPA_ALG_PMK:
3149                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
3150                            alg);
3151                 return 0;
3152         }
3153
3154         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
3155                    alg);
3156         return 0;
3157 }
3158
3159
3160 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
3161 {
3162         switch (cipher) {
3163         case WPA_CIPHER_CCMP_256:
3164                 return WLAN_CIPHER_SUITE_CCMP_256;
3165         case WPA_CIPHER_GCMP_256:
3166                 return WLAN_CIPHER_SUITE_GCMP_256;
3167         case WPA_CIPHER_CCMP:
3168                 return WLAN_CIPHER_SUITE_CCMP;
3169         case WPA_CIPHER_GCMP:
3170                 return WLAN_CIPHER_SUITE_GCMP;
3171         case WPA_CIPHER_TKIP:
3172                 return WLAN_CIPHER_SUITE_TKIP;
3173         case WPA_CIPHER_WEP104:
3174                 return WLAN_CIPHER_SUITE_WEP104;
3175         case WPA_CIPHER_WEP40:
3176                 return WLAN_CIPHER_SUITE_WEP40;
3177         case WPA_CIPHER_GTK_NOT_USED:
3178                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
3179         }
3180
3181         return 0;
3182 }
3183
3184
3185 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
3186                                        int max_suites)
3187 {
3188         int num_suites = 0;
3189
3190         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
3191                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
3192         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
3193                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
3194         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
3195                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
3196         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
3197                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
3198         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
3199                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
3200         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
3201                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
3202         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
3203                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
3204
3205         return num_suites;
3206 }
3207
3208
3209 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
3210                                   const u8 *key, size_t key_len)
3211 {
3212         struct nl_msg *msg;
3213         int ret = 0;
3214
3215         if (!drv->key_mgmt_set_key_vendor_cmd_avail)
3216                 return 0;
3217
3218         msg = nlmsg_alloc();
3219         if (!msg)
3220                 return -1;
3221
3222         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
3223         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3224         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA);
3225         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD,
3226                     QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_SET_KEY);
3227         NLA_PUT(msg, NL80211_ATTR_VENDOR_DATA, key_len, key);
3228         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3229         msg = NULL;
3230         if (ret) {
3231                 wpa_printf(MSG_DEBUG,
3232                            "nl80211: Key management set key failed: ret=%d (%s)",
3233                            ret, strerror(-ret));
3234         }
3235
3236 nla_put_failure:
3237         nlmsg_free(msg);
3238         return ret;
3239 }
3240
3241
3242 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
3243                                       enum wpa_alg alg, const u8 *addr,
3244                                       int key_idx, int set_tx,
3245                                       const u8 *seq, size_t seq_len,
3246                                       const u8 *key, size_t key_len)
3247 {
3248         struct wpa_driver_nl80211_data *drv = bss->drv;
3249         int ifindex;
3250         struct nl_msg *msg;
3251         int ret;
3252         int tdls = 0;
3253
3254         /* Ignore for P2P Device */
3255         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
3256                 return 0;
3257
3258         ifindex = if_nametoindex(ifname);
3259         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
3260                    "set_tx=%d seq_len=%lu key_len=%lu",
3261                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
3262                    (unsigned long) seq_len, (unsigned long) key_len);
3263 #ifdef CONFIG_TDLS
3264         if (key_idx == -1) {
3265                 key_idx = 0;
3266                 tdls = 1;
3267         }
3268 #endif /* CONFIG_TDLS */
3269
3270         if (alg == WPA_ALG_PMK && drv->key_mgmt_set_key_vendor_cmd_avail) {
3271                 wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
3272                            __func__);
3273                 ret = issue_key_mgmt_set_key(drv, key, key_len);
3274                 return ret;
3275         }
3276
3277         msg = nlmsg_alloc();
3278         if (!msg)
3279                 return -ENOMEM;
3280
3281         if (alg == WPA_ALG_NONE) {
3282                 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
3283         } else {
3284                 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
3285                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
3286                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
3287                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
3288                             wpa_alg_to_cipher_suite(alg, key_len));
3289         }
3290
3291         if (seq && seq_len) {
3292                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
3293                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
3294         }
3295
3296         if (addr && !is_broadcast_ether_addr(addr)) {
3297                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
3298                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3299
3300                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
3301                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
3302                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
3303                                     NL80211_KEYTYPE_GROUP);
3304                 }
3305         } else if (addr && is_broadcast_ether_addr(addr)) {
3306                 struct nlattr *types;
3307
3308                 wpa_printf(MSG_DEBUG, "   broadcast key");
3309
3310                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3311                 if (!types)
3312                         goto nla_put_failure;
3313                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
3314                 nla_nest_end(msg, types);
3315         }
3316         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
3317         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
3318
3319         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3320         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
3321                 ret = 0;
3322         if (ret)
3323                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
3324                            ret, strerror(-ret));
3325
3326         /*
3327          * If we failed or don't need to set the default TX key (below),
3328          * we're done here.
3329          */
3330         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
3331                 return ret;
3332         if (is_ap_interface(drv->nlmode) && addr &&
3333             !is_broadcast_ether_addr(addr))
3334                 return ret;
3335
3336         msg = nlmsg_alloc();
3337         if (!msg)
3338                 return -ENOMEM;
3339
3340         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
3341         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
3342         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
3343         if (alg == WPA_ALG_IGTK)
3344                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
3345         else
3346                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
3347         if (addr && is_broadcast_ether_addr(addr)) {
3348                 struct nlattr *types;
3349
3350                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3351                 if (!types)
3352                         goto nla_put_failure;
3353                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
3354                 nla_nest_end(msg, types);
3355         } else if (addr) {
3356                 struct nlattr *types;
3357
3358                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3359                 if (!types)
3360                         goto nla_put_failure;
3361                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST);
3362                 nla_nest_end(msg, types);
3363         }
3364
3365         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3366         if (ret == -ENOENT)
3367                 ret = 0;
3368         if (ret)
3369                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
3370                            "err=%d %s)", ret, strerror(-ret));
3371         return ret;
3372
3373 nla_put_failure:
3374         nlmsg_free(msg);
3375         return -ENOBUFS;
3376 }
3377
3378
3379 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
3380                       int key_idx, int defkey,
3381                       const u8 *seq, size_t seq_len,
3382                       const u8 *key, size_t key_len)
3383 {
3384         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
3385         if (!key_attr)
3386                 return -1;
3387
3388         if (defkey && alg == WPA_ALG_IGTK)
3389                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
3390         else if (defkey)
3391                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
3392
3393         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
3394
3395         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
3396                     wpa_alg_to_cipher_suite(alg, key_len));
3397
3398         if (seq && seq_len)
3399                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
3400
3401         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
3402
3403         nla_nest_end(msg, key_attr);
3404
3405         return 0;
3406  nla_put_failure:
3407         return -1;
3408 }
3409
3410
3411 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
3412                                  struct nl_msg *msg)
3413 {
3414         int i, privacy = 0;
3415         struct nlattr *nl_keys, *nl_key;
3416
3417         for (i = 0; i < 4; i++) {
3418                 if (!params->wep_key[i])
3419                         continue;
3420                 privacy = 1;
3421                 break;
3422         }
3423         if (params->wps == WPS_MODE_PRIVACY)
3424                 privacy = 1;
3425         if (params->pairwise_suite &&
3426             params->pairwise_suite != WPA_CIPHER_NONE)
3427                 privacy = 1;
3428
3429         if (!privacy)
3430                 return 0;
3431
3432         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
3433
3434         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
3435         if (!nl_keys)
3436                 goto nla_put_failure;
3437
3438         for (i = 0; i < 4; i++) {
3439                 if (!params->wep_key[i])
3440                         continue;
3441
3442                 nl_key = nla_nest_start(msg, i);
3443                 if (!nl_key)
3444                         goto nla_put_failure;
3445
3446                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
3447                         params->wep_key[i]);
3448                 if (params->wep_key_len[i] == 5)
3449                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
3450                                     WLAN_CIPHER_SUITE_WEP40);
3451                 else
3452                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
3453                                     WLAN_CIPHER_SUITE_WEP104);
3454
3455                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
3456
3457                 if (i == params->wep_tx_keyidx)
3458                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
3459
3460                 nla_nest_end(msg, nl_key);
3461         }
3462         nla_nest_end(msg, nl_keys);
3463
3464         return 0;
3465
3466 nla_put_failure:
3467         return -ENOBUFS;
3468 }
3469
3470
3471 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
3472                                    const u8 *addr, int cmd, u16 reason_code,
3473                                    int local_state_change)
3474 {
3475         int ret = -1;
3476         struct nl_msg *msg;
3477
3478         msg = nlmsg_alloc();
3479         if (!msg)
3480                 return -1;
3481
3482         nl80211_cmd(drv, msg, 0, cmd);
3483
3484         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3485         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
3486         if (addr)
3487                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3488         if (local_state_change)
3489                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
3490
3491         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3492         msg = NULL;
3493         if (ret) {
3494                 wpa_dbg(drv->ctx, MSG_DEBUG,
3495                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
3496                         reason_code, ret, strerror(-ret));
3497                 goto nla_put_failure;
3498         }
3499         ret = 0;
3500
3501 nla_put_failure:
3502         nlmsg_free(msg);
3503         return ret;
3504 }
3505
3506
3507 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
3508                                          int reason_code)
3509 {
3510         int ret;
3511
3512         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
3513         nl80211_mark_disconnected(drv);
3514         /* Disconnect command doesn't need BSSID - it uses cached value */
3515         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
3516                                       reason_code, 0);
3517         /*
3518          * For locally generated disconnect, supplicant already generates a
3519          * DEAUTH event, so ignore the event from NL80211.
3520          */
3521         drv->ignore_next_local_disconnect = ret == 0;
3522
3523         return ret;
3524 }
3525
3526
3527 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
3528                                              const u8 *addr, int reason_code)
3529 {
3530         struct wpa_driver_nl80211_data *drv = bss->drv;
3531         int ret;
3532
3533         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
3534                 nl80211_mark_disconnected(drv);
3535                 return nl80211_leave_ibss(drv);
3536         }
3537         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
3538                 return wpa_driver_nl80211_disconnect(drv, reason_code);
3539         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
3540                    __func__, MAC2STR(addr), reason_code);
3541         nl80211_mark_disconnected(drv);
3542         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
3543                                       reason_code, 0);
3544         /*
3545          * For locally generated deauthenticate, supplicant already generates a
3546          * DEAUTH event, so ignore the event from NL80211.
3547          */
3548         drv->ignore_next_local_deauth = ret == 0;
3549         return ret;
3550 }
3551
3552
3553 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
3554                                      struct wpa_driver_auth_params *params)
3555 {
3556         int i;
3557
3558         drv->auth_freq = params->freq;
3559         drv->auth_alg = params->auth_alg;
3560         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
3561         drv->auth_local_state_change = params->local_state_change;
3562         drv->auth_p2p = params->p2p;
3563
3564         if (params->bssid)
3565                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
3566         else
3567                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
3568
3569         if (params->ssid) {
3570                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
3571                 drv->auth_ssid_len = params->ssid_len;
3572         } else
3573                 drv->auth_ssid_len = 0;
3574
3575
3576         os_free(drv->auth_ie);
3577         drv->auth_ie = NULL;
3578         drv->auth_ie_len = 0;
3579         if (params->ie) {
3580                 drv->auth_ie = os_malloc(params->ie_len);
3581                 if (drv->auth_ie) {
3582                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
3583                         drv->auth_ie_len = params->ie_len;
3584                 }
3585         }
3586
3587         for (i = 0; i < 4; i++) {
3588                 if (params->wep_key[i] && params->wep_key_len[i] &&
3589                     params->wep_key_len[i] <= 16) {
3590                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
3591                                   params->wep_key_len[i]);
3592                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
3593                 } else
3594                         drv->auth_wep_key_len[i] = 0;
3595         }
3596 }
3597
3598
3599 static int wpa_driver_nl80211_authenticate(
3600         struct i802_bss *bss, struct wpa_driver_auth_params *params)
3601 {
3602         struct wpa_driver_nl80211_data *drv = bss->drv;
3603         int ret = -1, i;
3604         struct nl_msg *msg;
3605         enum nl80211_auth_type type;
3606         enum nl80211_iftype nlmode;
3607         int count = 0;
3608         int is_retry;
3609
3610         is_retry = drv->retry_auth;
3611         drv->retry_auth = 0;
3612         drv->ignore_deauth_event = 0;
3613
3614         nl80211_mark_disconnected(drv);
3615         os_memset(drv->auth_bssid, 0, ETH_ALEN);
3616         if (params->bssid)
3617                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
3618         else
3619                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
3620         /* FIX: IBSS mode */
3621         nlmode = params->p2p ?
3622                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
3623         if (drv->nlmode != nlmode &&
3624             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
3625                 return -1;
3626
3627 retry:
3628         msg = nlmsg_alloc();
3629         if (!msg)
3630                 return -1;
3631
3632         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
3633                    drv->ifindex);
3634
3635         nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
3636
3637         for (i = 0; i < 4; i++) {
3638                 if (!params->wep_key[i])
3639                         continue;
3640                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
3641                                            NULL, i,
3642                                            i == params->wep_tx_keyidx, NULL, 0,
3643                                            params->wep_key[i],
3644                                            params->wep_key_len[i]);
3645                 if (params->wep_tx_keyidx != i)
3646                         continue;
3647                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
3648                                params->wep_key[i], params->wep_key_len[i])) {
3649                         nlmsg_free(msg);
3650                         return -1;
3651                 }
3652         }
3653
3654         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3655         if (params->bssid) {
3656                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
3657                            MAC2STR(params->bssid));
3658                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
3659         }
3660         if (params->freq) {
3661                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
3662                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
3663         }
3664         if (params->ssid) {
3665                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
3666                                   params->ssid, params->ssid_len);
3667                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
3668                         params->ssid);
3669         }
3670         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
3671         if (params->ie)
3672                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
3673         if (params->sae_data) {
3674                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
3675                             params->sae_data_len);
3676                 NLA_PUT(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
3677                         params->sae_data);
3678         }
3679         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
3680                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3681         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
3682                 type = NL80211_AUTHTYPE_SHARED_KEY;
3683         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
3684                 type = NL80211_AUTHTYPE_NETWORK_EAP;
3685         else if (params->auth_alg & WPA_AUTH_ALG_FT)
3686                 type = NL80211_AUTHTYPE_FT;
3687         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
3688                 type = NL80211_AUTHTYPE_SAE;
3689         else
3690                 goto nla_put_failure;
3691         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
3692         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
3693         if (params->local_state_change) {
3694                 wpa_printf(MSG_DEBUG, "  * Local state change only");
3695                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
3696         }
3697
3698         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3699         msg = NULL;
3700         if (ret) {
3701                 wpa_dbg(drv->ctx, MSG_DEBUG,
3702                         "nl80211: MLME command failed (auth): ret=%d (%s)",
3703                         ret, strerror(-ret));
3704                 count++;
3705                 if (ret == -EALREADY && count == 1 && params->bssid &&
3706                     !params->local_state_change) {
3707                         /*
3708                          * mac80211 does not currently accept new
3709                          * authentication if we are already authenticated. As a
3710                          * workaround, force deauthentication and try again.
3711                          */
3712                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
3713                                    "after forced deauthentication");
3714                         drv->ignore_deauth_event = 1;
3715                         wpa_driver_nl80211_deauthenticate(
3716                                 bss, params->bssid,
3717                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
3718                         nlmsg_free(msg);
3719                         goto retry;
3720                 }
3721
3722                 if (ret == -ENOENT && params->freq && !is_retry) {
3723                         /*
3724                          * cfg80211 has likely expired the BSS entry even
3725                          * though it was previously available in our internal
3726                          * BSS table. To recover quickly, start a single
3727                          * channel scan on the specified channel.
3728                          */
3729                         struct wpa_driver_scan_params scan;
3730                         int freqs[2];
3731
3732                         os_memset(&scan, 0, sizeof(scan));
3733                         scan.num_ssids = 1;
3734                         if (params->ssid) {
3735                                 scan.ssids[0].ssid = params->ssid;
3736                                 scan.ssids[0].ssid_len = params->ssid_len;
3737                         }
3738                         freqs[0] = params->freq;
3739                         freqs[1] = 0;
3740                         scan.freqs = freqs;
3741                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
3742                                    "channel scan to refresh cfg80211 BSS "
3743                                    "entry");
3744                         ret = wpa_driver_nl80211_scan(bss, &scan);
3745                         if (ret == 0) {
3746                                 nl80211_copy_auth_params(drv, params);
3747                                 drv->scan_for_auth = 1;
3748                         }
3749                 } else if (is_retry) {
3750                         /*
3751                          * Need to indicate this with an event since the return
3752                          * value from the retry is not delivered to core code.
3753                          */
3754                         union wpa_event_data event;
3755                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
3756                                    "failed");
3757                         os_memset(&event, 0, sizeof(event));
3758                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
3759                                   ETH_ALEN);
3760                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
3761                                              &event);
3762                 }
3763
3764                 goto nla_put_failure;
3765         }
3766         ret = 0;
3767         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
3768                    "successfully");
3769
3770 nla_put_failure:
3771         nlmsg_free(msg);
3772         return ret;
3773 }
3774
3775
3776 int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
3777 {
3778         struct wpa_driver_auth_params params;
3779         struct i802_bss *bss = drv->first_bss;
3780         int i;
3781
3782         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
3783
3784         os_memset(&params, 0, sizeof(params));
3785         params.freq = drv->auth_freq;
3786         params.auth_alg = drv->auth_alg;
3787         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
3788         params.local_state_change = drv->auth_local_state_change;
3789         params.p2p = drv->auth_p2p;
3790
3791         if (!is_zero_ether_addr(drv->auth_bssid_))
3792                 params.bssid = drv->auth_bssid_;
3793
3794         if (drv->auth_ssid_len) {
3795                 params.ssid = drv->auth_ssid;
3796                 params.ssid_len = drv->auth_ssid_len;
3797         }
3798
3799         params.ie = drv->auth_ie;
3800         params.ie_len = drv->auth_ie_len;
3801
3802         for (i = 0; i < 4; i++) {
3803                 if (drv->auth_wep_key_len[i]) {
3804                         params.wep_key[i] = drv->auth_wep_key[i];
3805                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
3806                 }
3807         }
3808
3809         drv->retry_auth = 1;
3810         return wpa_driver_nl80211_authenticate(bss, &params);
3811 }
3812
3813
3814 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
3815                                          const void *data, size_t len,
3816                                          int encrypt, int noack,
3817                                          unsigned int freq, int no_cck,
3818                                          int offchanok, unsigned int wait_time)
3819 {
3820         struct wpa_driver_nl80211_data *drv = bss->drv;
3821         u64 cookie;
3822         int res;
3823
3824         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
3825                 freq = nl80211_get_assoc_freq(drv);
3826                 wpa_printf(MSG_DEBUG,
3827                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
3828                            freq);
3829         }
3830         if (freq == 0) {
3831                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
3832                            bss->freq);
3833                 freq = bss->freq;
3834         }
3835
3836         if (drv->use_monitor) {
3837                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
3838                            freq, bss->freq);
3839                 return nl80211_send_monitor(drv, data, len, encrypt, noack);
3840         }
3841
3842         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
3843         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
3844                                      &cookie, no_cck, noack, offchanok);
3845         if (res == 0 && !noack) {
3846                 const struct ieee80211_mgmt *mgmt;
3847                 u16 fc;
3848
3849                 mgmt = (const struct ieee80211_mgmt *) data;
3850                 fc = le_to_host16(mgmt->frame_control);
3851                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3852                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
3853                         wpa_printf(MSG_MSGDUMP,
3854                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
3855                                    (long long unsigned int)
3856                                    drv->send_action_cookie,
3857                                    (long long unsigned int) cookie);
3858                         drv->send_action_cookie = cookie;
3859                 }
3860         }
3861
3862         return res;
3863 }
3864
3865
3866 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
3867                                         size_t data_len, int noack,
3868                                         unsigned int freq, int no_cck,
3869                                         int offchanok,
3870                                         unsigned int wait_time)
3871 {
3872         struct wpa_driver_nl80211_data *drv = bss->drv;
3873         struct ieee80211_mgmt *mgmt;
3874         int encrypt = 1;
3875         u16 fc;
3876
3877         mgmt = (struct ieee80211_mgmt *) data;
3878         fc = le_to_host16(mgmt->frame_control);
3879         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
3880                    " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
3881                    MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
3882                    fc, fc2str(fc), drv->nlmode);
3883
3884         if ((is_sta_interface(drv->nlmode) ||
3885              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
3886             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3887             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
3888                 /*
3889                  * The use of last_mgmt_freq is a bit of a hack,
3890                  * but it works due to the single-threaded nature
3891                  * of wpa_supplicant.
3892                  */
3893                 if (freq == 0) {
3894                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
3895                                    drv->last_mgmt_freq);
3896                         freq = drv->last_mgmt_freq;
3897                 }
3898                 return nl80211_send_frame_cmd(bss, freq, 0,
3899                                               data, data_len, NULL, 1, noack,
3900                                               1);
3901         }
3902
3903         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
3904                 if (freq == 0) {
3905                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
3906                                    bss->freq);
3907                         freq = bss->freq;
3908                 }
3909                 return nl80211_send_frame_cmd(bss, freq,
3910                                               (int) freq == bss->freq ? 0 :
3911                                               wait_time,
3912                                               data, data_len,
3913                                               &drv->send_action_cookie,
3914                                               no_cck, noack, offchanok);
3915         }
3916
3917         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3918             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
3919                 /*
3920                  * Only one of the authentication frame types is encrypted.
3921                  * In order for static WEP encryption to work properly (i.e.,
3922                  * to not encrypt the frame), we need to tell mac80211 about
3923                  * the frames that must not be encrypted.
3924                  */
3925                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3926                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
3927                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
3928                         encrypt = 0;
3929         }
3930
3931         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
3932         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
3933                                              noack, freq, no_cck, offchanok,
3934                                              wait_time);
3935 }
3936
3937
3938 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
3939                            int slot, int ht_opmode, int ap_isolate,
3940                            int *basic_rates)
3941 {
3942         struct wpa_driver_nl80211_data *drv = bss->drv;
3943         struct nl_msg *msg;
3944
3945         msg = nlmsg_alloc();
3946         if (!msg)
3947                 return -ENOMEM;
3948
3949         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
3950
3951         if (cts >= 0)
3952                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
3953         if (preamble >= 0)
3954                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
3955         if (slot >= 0)
3956                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
3957         if (ht_opmode >= 0)
3958                 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
3959         if (ap_isolate >= 0)
3960                 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
3961
3962         if (basic_rates) {
3963                 u8 rates[NL80211_MAX_SUPP_RATES];
3964                 u8 rates_len = 0;
3965                 int i;
3966
3967                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
3968                      i++)
3969                         rates[rates_len++] = basic_rates[i] / 5;
3970
3971                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3972         }
3973
3974         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
3975
3976         return send_and_recv_msgs(drv, msg, NULL, NULL);
3977  nla_put_failure:
3978         nlmsg_free(msg);
3979         return -ENOBUFS;
3980 }
3981
3982
3983 static int wpa_driver_nl80211_set_acl(void *priv,
3984                                       struct hostapd_acl_params *params)
3985 {
3986         struct i802_bss *bss = priv;
3987         struct wpa_driver_nl80211_data *drv = bss->drv;
3988         struct nl_msg *msg;
3989         struct nlattr *acl;
3990         unsigned int i;
3991         int ret = 0;
3992
3993         if (!(drv->capa.max_acl_mac_addrs))
3994                 return -ENOTSUP;
3995
3996         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
3997                 return -ENOTSUP;
3998
3999         msg = nlmsg_alloc();
4000         if (!msg)
4001                 return -ENOMEM;
4002
4003         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
4004                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
4005
4006         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_MAC_ACL);
4007
4008         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4009
4010         NLA_PUT_U32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
4011                     NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
4012                     NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED);
4013
4014         acl = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
4015         if (acl == NULL)
4016                 goto nla_put_failure;
4017
4018         for (i = 0; i < params->num_mac_acl; i++)
4019                 NLA_PUT(msg, i + 1, ETH_ALEN, params->mac_acl[i].addr);
4020
4021         nla_nest_end(msg, acl);
4022
4023         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4024         msg = NULL;
4025         if (ret) {
4026                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
4027                            ret, strerror(-ret));
4028         }
4029
4030 nla_put_failure:
4031         nlmsg_free(msg);
4032
4033         return ret;
4034 }
4035
4036
4037 static int wpa_driver_nl80211_set_ap(void *priv,
4038                                      struct wpa_driver_ap_params *params)
4039 {
4040         struct i802_bss *bss = priv;
4041         struct wpa_driver_nl80211_data *drv = bss->drv;
4042         struct nl_msg *msg;
4043         u8 cmd = NL80211_CMD_NEW_BEACON;
4044         int ret;
4045         int beacon_set;
4046         int ifindex = if_nametoindex(bss->ifname);
4047         int num_suites;
4048         int smps_mode;
4049         u32 suites[10], suite;
4050         u32 ver;
4051
4052         beacon_set = bss->beacon_set;
4053
4054         msg = nlmsg_alloc();
4055         if (!msg)
4056                 return -ENOMEM;
4057
4058         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
4059                    beacon_set);
4060         if (beacon_set)
4061                 cmd = NL80211_CMD_SET_BEACON;
4062
4063         nl80211_cmd(drv, msg, 0, cmd);
4064         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
4065                     params->head, params->head_len);
4066         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
4067         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
4068                     params->tail, params->tail_len);
4069         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
4070         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", ifindex);
4071         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4072         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
4073         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
4074         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
4075         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
4076         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
4077                           params->ssid, params->ssid_len);
4078         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
4079                 params->ssid);
4080         if (params->proberesp && params->proberesp_len) {
4081                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
4082                             params->proberesp, params->proberesp_len);
4083                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
4084                         params->proberesp);
4085         }
4086         switch (params->hide_ssid) {
4087         case NO_SSID_HIDING:
4088                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
4089                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
4090                             NL80211_HIDDEN_SSID_NOT_IN_USE);
4091                 break;
4092         case HIDDEN_SSID_ZERO_LEN:
4093                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
4094                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
4095                             NL80211_HIDDEN_SSID_ZERO_LEN);
4096                 break;
4097         case HIDDEN_SSID_ZERO_CONTENTS:
4098                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
4099                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
4100                             NL80211_HIDDEN_SSID_ZERO_CONTENTS);
4101                 break;
4102         }
4103         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
4104         if (params->privacy)
4105                 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
4106         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
4107         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
4108             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
4109                 /* Leave out the attribute */
4110         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
4111                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
4112                             NL80211_AUTHTYPE_SHARED_KEY);
4113         else
4114                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
4115                             NL80211_AUTHTYPE_OPEN_SYSTEM);
4116
4117         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
4118         ver = 0;
4119         if (params->wpa_version & WPA_PROTO_WPA)
4120                 ver |= NL80211_WPA_VERSION_1;
4121         if (params->wpa_version & WPA_PROTO_RSN)
4122                 ver |= NL80211_WPA_VERSION_2;
4123         if (ver)
4124                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
4125
4126         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
4127                    params->key_mgmt_suites);
4128         num_suites = 0;
4129         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
4130                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
4131         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
4132                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
4133         if (num_suites) {
4134                 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
4135                         num_suites * sizeof(u32), suites);
4136         }
4137
4138         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
4139             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
4140                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
4141
4142         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
4143                    params->pairwise_ciphers);
4144         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
4145                                                  suites, ARRAY_SIZE(suites));
4146         if (num_suites) {
4147                 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
4148                         num_suites * sizeof(u32), suites);
4149         }
4150
4151         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
4152                    params->group_cipher);
4153         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
4154         if (suite)
4155                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite);
4156
4157         switch (params->smps_mode) {
4158         case HT_CAP_INFO_SMPS_DYNAMIC:
4159                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
4160                 smps_mode = NL80211_SMPS_DYNAMIC;
4161                 break;
4162         case HT_CAP_INFO_SMPS_STATIC:
4163                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
4164                 smps_mode = NL80211_SMPS_STATIC;
4165                 break;
4166         default:
4167                 /* invalid - fallback to smps off */
4168         case HT_CAP_INFO_SMPS_DISABLED:
4169                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
4170                 smps_mode = NL80211_SMPS_OFF;
4171                 break;
4172         }
4173         NLA_PUT_U32(msg, NL80211_ATTR_SMPS_MODE, smps_mode);
4174
4175         if (params->beacon_ies) {
4176                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
4177                                 params->beacon_ies);
4178                 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
4179                         wpabuf_head(params->beacon_ies));
4180         }
4181         if (params->proberesp_ies) {
4182                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
4183                                 params->proberesp_ies);
4184                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
4185                         wpabuf_len(params->proberesp_ies),
4186                         wpabuf_head(params->proberesp_ies));
4187         }
4188         if (params->assocresp_ies) {
4189                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
4190                                 params->assocresp_ies);
4191                 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
4192                         wpabuf_len(params->assocresp_ies),
4193                         wpabuf_head(params->assocresp_ies));
4194         }
4195
4196         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
4197                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
4198                            params->ap_max_inactivity);
4199                 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
4200                             params->ap_max_inactivity);
4201         }
4202
4203         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4204         if (ret) {
4205                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
4206                            ret, strerror(-ret));
4207         } else {
4208                 bss->beacon_set = 1;
4209                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
4210                                 params->short_slot_time, params->ht_opmode,
4211                                 params->isolate, params->basic_rates);
4212                 if (beacon_set && params->freq &&
4213                     params->freq->bandwidth != bss->bandwidth) {
4214                         wpa_printf(MSG_DEBUG,
4215                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
4216                                    bss->ifname, bss->bandwidth,
4217                                    params->freq->bandwidth);
4218                         ret = nl80211_set_channel(bss, params->freq, 1);
4219                         if (ret) {
4220                                 wpa_printf(MSG_DEBUG,
4221                                            "nl80211: Frequency set failed: %d (%s)",
4222                                            ret, strerror(-ret));
4223                         } else {
4224                                 wpa_printf(MSG_DEBUG,
4225                                            "nl80211: Frequency set succeeded for ht2040 coex");
4226                                 bss->bandwidth = params->freq->bandwidth;
4227                         }
4228                 } else if (!beacon_set) {
4229                         /*
4230                          * cfg80211 updates the driver on frequence change in AP
4231                          * mode only at the point when beaconing is started, so
4232                          * set the initial value here.
4233                          */
4234                         bss->bandwidth = params->freq->bandwidth;
4235                 }
4236         }
4237         return ret;
4238  nla_put_failure:
4239         nlmsg_free(msg);
4240         return -ENOBUFS;
4241 }
4242
4243
4244 static int nl80211_put_freq_params(struct nl_msg *msg,
4245                                    struct hostapd_freq_params *freq)
4246 {
4247         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
4248         if (freq->vht_enabled) {
4249                 switch (freq->bandwidth) {
4250                 case 20:
4251                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4252                                     NL80211_CHAN_WIDTH_20);
4253                         break;
4254                 case 40:
4255                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4256                                     NL80211_CHAN_WIDTH_40);
4257                         break;
4258                 case 80:
4259                         if (freq->center_freq2)
4260                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4261                                             NL80211_CHAN_WIDTH_80P80);
4262                         else
4263                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4264                                             NL80211_CHAN_WIDTH_80);
4265                         break;
4266                 case 160:
4267                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
4268                                     NL80211_CHAN_WIDTH_160);
4269                         break;
4270                 default:
4271                         return -EINVAL;
4272                 }
4273                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
4274                 if (freq->center_freq2)
4275                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
4276                                     freq->center_freq2);
4277         } else if (freq->ht_enabled) {
4278                 switch (freq->sec_channel_offset) {
4279                 case -1:
4280                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4281                                     NL80211_CHAN_HT40MINUS);
4282                         break;
4283                 case 1:
4284                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4285                                     NL80211_CHAN_HT40PLUS);
4286                         break;
4287                 default:
4288                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4289                                     NL80211_CHAN_HT20);
4290                         break;
4291                 }
4292         }
4293         return 0;
4294
4295 nla_put_failure:
4296         return -ENOBUFS;
4297 }
4298
4299
4300 static int nl80211_set_channel(struct i802_bss *bss,
4301                                struct hostapd_freq_params *freq, int set_chan)
4302 {
4303         struct wpa_driver_nl80211_data *drv = bss->drv;
4304         struct nl_msg *msg;
4305         int ret;
4306
4307         wpa_printf(MSG_DEBUG,
4308                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
4309                    freq->freq, freq->ht_enabled, freq->vht_enabled,
4310                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
4311         msg = nlmsg_alloc();
4312         if (!msg)
4313                 return -1;
4314
4315         nl80211_cmd(drv, msg, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
4316                     NL80211_CMD_SET_WIPHY);
4317
4318         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4319         if (nl80211_put_freq_params(msg, freq) < 0)
4320                 goto nla_put_failure;
4321
4322         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4323         msg = NULL;
4324         if (ret == 0) {
4325                 bss->freq = freq->freq;
4326                 return 0;
4327         }
4328         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
4329                    "%d (%s)", freq->freq, ret, strerror(-ret));
4330 nla_put_failure:
4331         nlmsg_free(msg);
4332         return -1;
4333 }
4334
4335
4336 static u32 sta_flags_nl80211(int flags)
4337 {
4338         u32 f = 0;
4339
4340         if (flags & WPA_STA_AUTHORIZED)
4341                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
4342         if (flags & WPA_STA_WMM)
4343                 f |= BIT(NL80211_STA_FLAG_WME);
4344         if (flags & WPA_STA_SHORT_PREAMBLE)
4345                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
4346         if (flags & WPA_STA_MFP)
4347                 f |= BIT(NL80211_STA_FLAG_MFP);
4348         if (flags & WPA_STA_TDLS_PEER)
4349                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
4350         if (flags & WPA_STA_AUTHENTICATED)
4351                 f |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
4352
4353         return f;
4354 }
4355
4356
4357 #ifdef CONFIG_MESH
4358 static u32 sta_plink_state_nl80211(enum mesh_plink_state state)
4359 {
4360         switch (state) {
4361         case PLINK_LISTEN:
4362                 return NL80211_PLINK_LISTEN;
4363         case PLINK_OPEN_SENT:
4364                 return NL80211_PLINK_OPN_SNT;
4365         case PLINK_OPEN_RCVD:
4366                 return NL80211_PLINK_OPN_RCVD;
4367         case PLINK_CNF_RCVD:
4368                 return NL80211_PLINK_CNF_RCVD;
4369         case PLINK_ESTAB:
4370                 return NL80211_PLINK_ESTAB;
4371         case PLINK_HOLDING:
4372                 return NL80211_PLINK_HOLDING;
4373         case PLINK_BLOCKED:
4374                 return NL80211_PLINK_BLOCKED;
4375         default:
4376                 wpa_printf(MSG_ERROR, "nl80211: Invalid mesh plink state %d",
4377                            state);
4378         }
4379         return -1;
4380 }
4381 #endif /* CONFIG_MESH */
4382
4383
4384 static int wpa_driver_nl80211_sta_add(void *priv,
4385                                       struct hostapd_sta_add_params *params)
4386 {
4387         struct i802_bss *bss = priv;
4388         struct wpa_driver_nl80211_data *drv = bss->drv;
4389         struct nl_msg *msg;
4390         struct nl80211_sta_flag_update upd;
4391         int ret = -ENOBUFS;
4392
4393         if ((params->flags & WPA_STA_TDLS_PEER) &&
4394             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
4395                 return -EOPNOTSUPP;
4396
4397         msg = nlmsg_alloc();
4398         if (!msg)
4399                 return -ENOMEM;
4400
4401         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
4402                    params->set ? "Set" : "Add", MAC2STR(params->addr));
4403         nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
4404                     NL80211_CMD_NEW_STATION);
4405
4406         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
4407         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
4408
4409         if (!params->set || (params->flags & WPA_STA_TDLS_PEER)) {
4410                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES,
4411                         params->supp_rates_len, params->supp_rates);
4412                 wpa_hexdump(MSG_DEBUG, "  * supported rates",
4413                             params->supp_rates, params->supp_rates_len);
4414
4415                 if (params->ht_capabilities) {
4416                         wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
4417                                     (u8 *) params->ht_capabilities,
4418                                     sizeof(*params->ht_capabilities));
4419                         NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
4420                                 sizeof(*params->ht_capabilities),
4421                                 params->ht_capabilities);
4422                 }
4423
4424                 if (params->vht_capabilities) {
4425                         wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
4426                                     (u8 *) params->vht_capabilities,
4427                                     sizeof(*params->vht_capabilities));
4428                         NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY,
4429                                 sizeof(*params->vht_capabilities),
4430                                 params->vht_capabilities);
4431                 }
4432
4433                 wpa_printf(MSG_DEBUG, "  * capability=0x%x",
4434                            params->capability);
4435                 NLA_PUT_U16(msg, NL80211_ATTR_STA_CAPABILITY,
4436                             params->capability);
4437
4438                 if (params->ext_capab) {
4439                         wpa_hexdump(MSG_DEBUG, "  * ext_capab",
4440                                     params->ext_capab, params->ext_capab_len);
4441                         NLA_PUT(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
4442                                 params->ext_capab_len, params->ext_capab);
4443                 }
4444         }
4445         if (!params->set) {
4446                 if (params->aid) {
4447                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
4448                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
4449                 } else {
4450                         /*
4451                          * cfg80211 validates that AID is non-zero, so we have
4452                          * to make this a non-zero value for the TDLS case where
4453                          * a dummy STA entry is used for now.
4454                          */
4455                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
4456                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, 1);
4457                 }
4458                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
4459                            params->listen_interval);
4460                 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
4461                             params->listen_interval);
4462         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
4463                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
4464                 NLA_PUT_U16(msg, NL80211_ATTR_PEER_AID, params->aid);
4465         }
4466
4467         if (params->vht_opmode_enabled) {
4468                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
4469                 NLA_PUT_U8(msg, NL80211_ATTR_OPMODE_NOTIF,
4470                            params->vht_opmode);
4471         }
4472
4473         if (params->supp_channels) {
4474                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
4475                             params->supp_channels, params->supp_channels_len);
4476                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
4477                         params->supp_channels_len, params->supp_channels);
4478         }
4479
4480         if (params->supp_oper_classes) {
4481                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
4482                             params->supp_oper_classes,
4483                             params->supp_oper_classes_len);
4484                 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
4485                         params->supp_oper_classes_len,
4486                         params->supp_oper_classes);
4487         }
4488
4489         os_memset(&upd, 0, sizeof(upd));
4490         upd.set = sta_flags_nl80211(params->flags);
4491         upd.mask = upd.set | sta_flags_nl80211(params->flags_mask);
4492         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
4493                    upd.set, upd.mask);
4494         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
4495
4496 #ifdef CONFIG_MESH
4497         if (params->plink_state)
4498                 NLA_PUT_U8(msg, NL80211_ATTR_STA_PLINK_STATE,
4499                            sta_plink_state_nl80211(params->plink_state));
4500 #endif /* CONFIG_MESH */
4501
4502         if (params->flags & WPA_STA_WMM) {
4503                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
4504
4505                 if (!wme)
4506                         goto nla_put_failure;
4507
4508                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
4509                 NLA_PUT_U8(msg, NL80211_STA_WME_UAPSD_QUEUES,
4510                                 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
4511                 NLA_PUT_U8(msg, NL80211_STA_WME_MAX_SP,
4512                                 (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
4513                                 WMM_QOSINFO_STA_SP_MASK);
4514                 nla_nest_end(msg, wme);
4515         }
4516
4517         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4518         msg = NULL;
4519         if (ret)
4520                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
4521                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
4522                            strerror(-ret));
4523         if (ret == -EEXIST)
4524                 ret = 0;
4525  nla_put_failure:
4526         nlmsg_free(msg);
4527         return ret;
4528 }
4529
4530
4531 static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
4532 {
4533 #ifdef CONFIG_LIBNL3_ROUTE
4534         struct wpa_driver_nl80211_data *drv = bss->drv;
4535         struct rtnl_neigh *rn;
4536         struct nl_addr *nl_addr;
4537         int err;
4538
4539         rn = rtnl_neigh_alloc();
4540         if (!rn)
4541                 return;
4542
4543         rtnl_neigh_set_family(rn, AF_BRIDGE);
4544         rtnl_neigh_set_ifindex(rn, bss->ifindex);
4545         nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
4546         if (!nl_addr) {
4547                 rtnl_neigh_put(rn);
4548                 return;
4549         }
4550         rtnl_neigh_set_lladdr(rn, nl_addr);
4551
4552         err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
4553         if (err < 0) {
4554                 wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
4555                            MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
4556                            bss->ifindex, nl_geterror(err));
4557         } else {
4558                 wpa_printf(MSG_DEBUG, "nl80211: deleted bridge FDB entry for "
4559                            MACSTR, MAC2STR(addr));
4560         }
4561
4562         nl_addr_put(nl_addr);
4563         rtnl_neigh_put(rn);
4564 #endif /* CONFIG_LIBNL3_ROUTE */
4565 }
4566
4567
4568 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr,
4569                                          int deauth, u16 reason_code)
4570 {
4571         struct wpa_driver_nl80211_data *drv = bss->drv;
4572         struct nl_msg *msg;
4573         int ret;
4574
4575         msg = nlmsg_alloc();
4576         if (!msg)
4577                 return -ENOMEM;
4578
4579         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
4580
4581         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
4582                     if_nametoindex(bss->ifname));
4583         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4584         if (deauth == 0)
4585                 NLA_PUT_U8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4586                            WLAN_FC_STYPE_DISASSOC);
4587         else if (deauth == 1)
4588                 NLA_PUT_U8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4589                            WLAN_FC_STYPE_DEAUTH);
4590         if (reason_code)
4591                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
4592
4593         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4594         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
4595                    " --> %d (%s)",
4596                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
4597
4598         if (drv->rtnl_sk)
4599                 rtnl_neigh_delete_fdb_entry(bss, addr);
4600
4601         if (ret == -ENOENT)
4602                 return 0;
4603         return ret;
4604  nla_put_failure:
4605         nlmsg_free(msg);
4606         return -ENOBUFS;
4607 }
4608
4609
4610 void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx)
4611 {
4612         struct nl_msg *msg;
4613         struct wpa_driver_nl80211_data *drv2;
4614
4615         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
4616
4617         /* stop listening for EAPOL on this interface */
4618         dl_list_for_each(drv2, &drv->global->interfaces,
4619                          struct wpa_driver_nl80211_data, list)
4620                 del_ifidx(drv2, ifidx);
4621
4622         msg = nlmsg_alloc();
4623         if (!msg)
4624                 goto nla_put_failure;
4625
4626         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
4627         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
4628
4629         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
4630                 return;
4631         msg = NULL;
4632  nla_put_failure:
4633         nlmsg_free(msg);
4634         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
4635 }
4636
4637
4638 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
4639 {
4640         switch (mode) {
4641         case NL80211_IFTYPE_ADHOC:
4642                 return "ADHOC";
4643         case NL80211_IFTYPE_STATION:
4644                 return "STATION";
4645         case NL80211_IFTYPE_AP:
4646                 return "AP";
4647         case NL80211_IFTYPE_AP_VLAN:
4648                 return "AP_VLAN";
4649         case NL80211_IFTYPE_WDS:
4650                 return "WDS";
4651         case NL80211_IFTYPE_MONITOR:
4652                 return "MONITOR";
4653         case NL80211_IFTYPE_MESH_POINT:
4654                 return "MESH_POINT";
4655         case NL80211_IFTYPE_P2P_CLIENT:
4656                 return "P2P_CLIENT";
4657         case NL80211_IFTYPE_P2P_GO:
4658                 return "P2P_GO";
4659         case NL80211_IFTYPE_P2P_DEVICE:
4660                 return "P2P_DEVICE";
4661         default:
4662                 return "unknown";
4663         }
4664 }
4665
4666
4667 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
4668                                      const char *ifname,
4669                                      enum nl80211_iftype iftype,
4670                                      const u8 *addr, int wds,
4671                                      int (*handler)(struct nl_msg *, void *),
4672                                      void *arg)
4673 {
4674         struct nl_msg *msg;
4675         int ifidx;
4676         int ret = -ENOBUFS;
4677
4678         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
4679                    iftype, nl80211_iftype_str(iftype));
4680
4681         msg = nlmsg_alloc();
4682         if (!msg)
4683                 return -1;
4684
4685         nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
4686         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
4687                 goto nla_put_failure;
4688         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
4689         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
4690
4691         if (iftype == NL80211_IFTYPE_MONITOR) {
4692                 struct nlattr *flags;
4693
4694                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
4695                 if (!flags)
4696                         goto nla_put_failure;
4697
4698                 NLA_PUT_FLAG(msg, NL80211_MNTR_FLAG_COOK_FRAMES);
4699
4700                 nla_nest_end(msg, flags);
4701         } else if (wds) {
4702                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
4703         }
4704
4705         /*
4706          * Tell cfg80211 that the interface belongs to the socket that created
4707          * it, and the interface should be deleted when the socket is closed.
4708          */
4709         NLA_PUT_FLAG(msg, NL80211_ATTR_IFACE_SOCKET_OWNER);
4710
4711         ret = send_and_recv_msgs(drv, msg, handler, arg);
4712         msg = NULL;
4713         if (ret) {
4714  nla_put_failure:
4715                 nlmsg_free(msg);
4716                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
4717                            ifname, ret, strerror(-ret));
4718                 return ret;
4719         }
4720
4721         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
4722                 return 0;
4723
4724         ifidx = if_nametoindex(ifname);
4725         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
4726                    ifname, ifidx);
4727
4728         if (ifidx <= 0)
4729                 return -1;
4730
4731         /*
4732          * Some virtual interfaces need to process EAPOL packets and events on
4733          * the parent interface. This is used mainly with hostapd.
4734          */
4735         if (drv->hostapd ||
4736             iftype == NL80211_IFTYPE_AP_VLAN ||
4737             iftype == NL80211_IFTYPE_WDS ||
4738             iftype == NL80211_IFTYPE_MONITOR) {
4739                 /* start listening for EAPOL on this interface */
4740                 add_ifidx(drv, ifidx);
4741         }
4742
4743         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4744             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
4745                 nl80211_remove_iface(drv, ifidx);
4746                 return -1;
4747         }
4748
4749         return ifidx;
4750 }
4751
4752
4753 int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
4754                          const char *ifname, enum nl80211_iftype iftype,
4755                          const u8 *addr, int wds,
4756                          int (*handler)(struct nl_msg *, void *),
4757                          void *arg, int use_existing)
4758 {
4759         int ret;
4760
4761         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
4762                                         arg);
4763
4764         /* if error occurred and interface exists already */
4765         if (ret == -ENFILE && if_nametoindex(ifname)) {
4766                 if (use_existing) {
4767                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
4768                                    ifname);
4769                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4770                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4771                                                addr) < 0 &&
4772                             (linux_set_iface_flags(drv->global->ioctl_sock,
4773                                                    ifname, 0) < 0 ||
4774                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4775                                                 addr) < 0 ||
4776                              linux_set_iface_flags(drv->global->ioctl_sock,
4777                                                    ifname, 1) < 0))
4778                                         return -1;
4779                         return -ENFILE;
4780                 }
4781                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
4782
4783                 /* Try to remove the interface that was already there. */
4784                 nl80211_remove_iface(drv, if_nametoindex(ifname));
4785
4786                 /* Try to create the interface again */
4787                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
4788                                                 wds, handler, arg);
4789         }
4790
4791         if (ret >= 0 && is_p2p_net_interface(iftype))
4792                 nl80211_disable_11b_rates(drv, ret, 1);
4793
4794         return ret;
4795 }
4796
4797
4798 static int nl80211_setup_ap(struct i802_bss *bss)
4799 {
4800         struct wpa_driver_nl80211_data *drv = bss->drv;
4801
4802         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
4803                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4804
4805         /*
4806          * Disable Probe Request reporting unless we need it in this way for
4807          * devices that include the AP SME, in the other case (unless using
4808          * monitor iface) we'll get it through the nl_mgmt socket instead.
4809          */
4810         if (!drv->device_ap_sme)
4811                 wpa_driver_nl80211_probe_req_report(bss, 0);
4812
4813         if (!drv->device_ap_sme && !drv->use_monitor)
4814                 if (nl80211_mgmt_subscribe_ap(bss))
4815                         return -1;
4816
4817         if (drv->device_ap_sme && !drv->use_monitor)
4818                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
4819                         return -1;
4820
4821         if (!drv->device_ap_sme && drv->use_monitor &&
4822             nl80211_create_monitor_interface(drv) &&
4823             !drv->device_ap_sme)
4824                 return -1;
4825
4826         if (drv->device_ap_sme &&
4827             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
4828                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
4829                            "Probe Request frame reporting in AP mode");
4830                 /* Try to survive without this */
4831         }
4832
4833         return 0;
4834 }
4835
4836
4837 static void nl80211_teardown_ap(struct i802_bss *bss)
4838 {
4839         struct wpa_driver_nl80211_data *drv = bss->drv;
4840
4841         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
4842                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4843         if (drv->device_ap_sme) {
4844                 wpa_driver_nl80211_probe_req_report(bss, 0);
4845                 if (!drv->use_monitor)
4846                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
4847         } else if (drv->use_monitor)
4848                 nl80211_remove_monitor_interface(drv);
4849         else
4850                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
4851
4852         bss->beacon_set = 0;
4853 }
4854
4855
4856 static int nl80211_send_eapol_data(struct i802_bss *bss,
4857                                    const u8 *addr, const u8 *data,
4858                                    size_t data_len)
4859 {
4860         struct sockaddr_ll ll;
4861         int ret;
4862
4863         if (bss->drv->eapol_tx_sock < 0) {
4864                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
4865                 return -1;
4866         }
4867
4868         os_memset(&ll, 0, sizeof(ll));
4869         ll.sll_family = AF_PACKET;
4870         ll.sll_ifindex = bss->ifindex;
4871         ll.sll_protocol = htons(ETH_P_PAE);
4872         ll.sll_halen = ETH_ALEN;
4873         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
4874         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
4875                      (struct sockaddr *) &ll, sizeof(ll));
4876         if (ret < 0)
4877                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
4878                            strerror(errno));
4879
4880         return ret;
4881 }
4882
4883
4884 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
4885
4886 static int wpa_driver_nl80211_hapd_send_eapol(
4887         void *priv, const u8 *addr, const u8 *data,
4888         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
4889 {
4890         struct i802_bss *bss = priv;
4891         struct wpa_driver_nl80211_data *drv = bss->drv;
4892         struct ieee80211_hdr *hdr;
4893         size_t len;
4894         u8 *pos;
4895         int res;
4896         int qos = flags & WPA_STA_WMM;
4897
4898         if (drv->device_ap_sme || !drv->use_monitor)
4899                 return nl80211_send_eapol_data(bss, addr, data, data_len);
4900
4901         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
4902                 data_len;
4903         hdr = os_zalloc(len);
4904         if (hdr == NULL) {
4905                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
4906                            (unsigned long) len);
4907                 return -1;
4908         }
4909
4910         hdr->frame_control =
4911                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
4912         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
4913         if (encrypt)
4914                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
4915         if (qos) {
4916                 hdr->frame_control |=
4917                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
4918         }
4919
4920         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
4921         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
4922         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
4923         pos = (u8 *) (hdr + 1);
4924
4925         if (qos) {
4926                 /* Set highest priority in QoS header */
4927                 pos[0] = 7;
4928                 pos[1] = 0;
4929                 pos += 2;
4930         }
4931
4932         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
4933         pos += sizeof(rfc1042_header);
4934         WPA_PUT_BE16(pos, ETH_P_PAE);
4935         pos += 2;
4936         memcpy(pos, data, data_len);
4937
4938         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
4939                                             0, 0, 0, 0);
4940         if (res < 0) {
4941                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
4942                            "failed: %d (%s)",
4943                            (unsigned long) len, errno, strerror(errno));
4944         }
4945         os_free(hdr);
4946
4947         return res;
4948 }
4949
4950
4951 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
4952                                             int total_flags,
4953                                             int flags_or, int flags_and)
4954 {
4955         struct i802_bss *bss = priv;
4956         struct wpa_driver_nl80211_data *drv = bss->drv;
4957         struct nl_msg *msg;
4958         struct nlattr *flags;
4959         struct nl80211_sta_flag_update upd;
4960
4961         wpa_printf(MSG_DEBUG, "nl80211: Set STA flags - ifname=%s addr=" MACSTR
4962                    " total_flags=0x%x flags_or=0x%x flags_and=0x%x authorized=%d",
4963                    bss->ifname, MAC2STR(addr), total_flags, flags_or, flags_and,
4964                    !!(total_flags & WPA_STA_AUTHORIZED));
4965
4966         msg = nlmsg_alloc();
4967         if (!msg)
4968                 return -ENOMEM;
4969
4970         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
4971
4972         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
4973                     if_nametoindex(bss->ifname));
4974         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4975
4976         /*
4977          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
4978          * can be removed eventually.
4979          */
4980         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
4981         if (!flags)
4982                 goto nla_put_failure;
4983         if (total_flags & WPA_STA_AUTHORIZED)
4984                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_AUTHORIZED);
4985
4986         if (total_flags & WPA_STA_WMM)
4987                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_WME);
4988
4989         if (total_flags & WPA_STA_SHORT_PREAMBLE)
4990                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_SHORT_PREAMBLE);
4991
4992         if (total_flags & WPA_STA_MFP)
4993                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_MFP);
4994
4995         if (total_flags & WPA_STA_TDLS_PEER)
4996                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_TDLS_PEER);
4997
4998         nla_nest_end(msg, flags);
4999
5000         os_memset(&upd, 0, sizeof(upd));
5001         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
5002         upd.set = sta_flags_nl80211(flags_or);
5003         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
5004
5005         return send_and_recv_msgs(drv, msg, NULL, NULL);
5006  nla_put_failure:
5007         nlmsg_free(msg);
5008         return -ENOBUFS;
5009 }
5010
5011
5012 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
5013                                  struct wpa_driver_associate_params *params)
5014 {
5015         enum nl80211_iftype nlmode, old_mode;
5016
5017         if (params->p2p) {
5018                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
5019                            "group (GO)");
5020                 nlmode = NL80211_IFTYPE_P2P_GO;
5021         } else
5022                 nlmode = NL80211_IFTYPE_AP;
5023
5024         old_mode = drv->nlmode;
5025         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
5026                 nl80211_remove_monitor_interface(drv);
5027                 return -1;
5028         }
5029
5030         if (nl80211_set_channel(drv->first_bss, &params->freq, 0)) {
5031                 if (old_mode != nlmode)
5032                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
5033                 nl80211_remove_monitor_interface(drv);
5034                 return -1;
5035         }
5036
5037         return 0;
5038 }
5039
5040
5041 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
5042 {
5043         struct nl_msg *msg;
5044         int ret = -1;
5045
5046         msg = nlmsg_alloc();
5047         if (!msg)
5048                 return -1;
5049
5050         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
5051         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5052         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5053         msg = NULL;
5054         if (ret) {
5055                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
5056                            "(%s)", ret, strerror(-ret));
5057                 goto nla_put_failure;
5058         }
5059
5060         ret = 0;
5061         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
5062
5063 nla_put_failure:
5064         if (wpa_driver_nl80211_set_mode(drv->first_bss,
5065                                         NL80211_IFTYPE_STATION)) {
5066                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
5067                            "station mode");
5068         }
5069
5070         nlmsg_free(msg);
5071         return ret;
5072 }
5073
5074
5075 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
5076                                    struct wpa_driver_associate_params *params)
5077 {
5078         struct nl_msg *msg;
5079         int ret = -1;
5080         int count = 0;
5081
5082         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
5083
5084         if (wpa_driver_nl80211_set_mode_ibss(drv->first_bss, &params->freq)) {
5085                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
5086                            "IBSS mode");
5087                 return -1;
5088         }
5089
5090 retry:
5091         msg = nlmsg_alloc();
5092         if (!msg)
5093                 return -1;
5094
5095         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
5096         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5097
5098         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
5099                 goto nla_put_failure;
5100
5101         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
5102                           params->ssid, params->ssid_len);
5103         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5104                 params->ssid);
5105         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
5106         drv->ssid_len = params->ssid_len;
5107
5108         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
5109         wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", params->freq.ht_enabled);
5110         wpa_printf(MSG_DEBUG, "  * sec_channel_offset=%d",
5111                    params->freq.sec_channel_offset);
5112         wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", params->freq.vht_enabled);
5113         wpa_printf(MSG_DEBUG, "  * center_freq1=%d", params->freq.center_freq1);
5114         wpa_printf(MSG_DEBUG, "  * center_freq2=%d", params->freq.center_freq2);
5115         wpa_printf(MSG_DEBUG, "  * bandwidth=%d", params->freq.bandwidth);
5116         if (nl80211_put_freq_params(msg, &params->freq) < 0)
5117                 goto nla_put_failure;
5118
5119         if (params->beacon_int > 0) {
5120                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", params->beacon_int);
5121                 NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL,
5122                             params->beacon_int);
5123         }
5124
5125         ret = nl80211_set_conn_keys(params, msg);
5126         if (ret)
5127                 goto nla_put_failure;
5128
5129         if (params->bssid && params->fixed_bssid) {
5130                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
5131                            MAC2STR(params->bssid));
5132                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
5133         }
5134
5135         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
5136             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5137             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
5138             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
5139                 wpa_printf(MSG_DEBUG, "  * control port");
5140                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
5141         }
5142
5143         if (params->wpa_ie) {
5144                 wpa_hexdump(MSG_DEBUG,
5145                             "  * Extra IEs for Beacon/Probe Response frames",
5146                             params->wpa_ie, params->wpa_ie_len);
5147                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
5148                         params->wpa_ie);
5149         }
5150
5151         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5152         msg = NULL;
5153         if (ret) {
5154                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
5155                            ret, strerror(-ret));
5156                 count++;
5157                 if (ret == -EALREADY && count == 1) {
5158                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
5159                                    "forced leave");
5160                         nl80211_leave_ibss(drv);
5161                         nlmsg_free(msg);
5162                         goto retry;
5163                 }
5164
5165                 goto nla_put_failure;
5166         }
5167         ret = 0;
5168         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
5169
5170 nla_put_failure:
5171         nlmsg_free(msg);
5172         return ret;
5173 }
5174
5175
5176 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
5177                                   struct wpa_driver_associate_params *params,
5178                                   struct nl_msg *msg)
5179 {
5180         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5181
5182         if (params->bssid) {
5183                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
5184                            MAC2STR(params->bssid));
5185                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
5186         }
5187
5188         if (params->bssid_hint) {
5189                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
5190                            MAC2STR(params->bssid_hint));
5191                 NLA_PUT(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
5192                         params->bssid_hint);
5193         }
5194
5195         if (params->freq.freq) {
5196                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
5197                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq.freq);
5198                 drv->assoc_freq = params->freq.freq;
5199         } else
5200                 drv->assoc_freq = 0;
5201
5202         if (params->freq_hint) {
5203                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
5204                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
5205                             params->freq_hint);
5206         }
5207
5208         if (params->bg_scan_period >= 0) {
5209                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
5210                            params->bg_scan_period);
5211                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
5212                             params->bg_scan_period);
5213         }
5214
5215         if (params->ssid) {
5216                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
5217                                   params->ssid, params->ssid_len);
5218                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5219                         params->ssid);
5220                 if (params->ssid_len > sizeof(drv->ssid))
5221                         goto nla_put_failure;
5222                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
5223                 drv->ssid_len = params->ssid_len;
5224         }
5225
5226         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
5227         if (params->wpa_ie)
5228                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
5229                         params->wpa_ie);
5230
5231         if (params->wpa_proto) {
5232                 enum nl80211_wpa_versions ver = 0;
5233
5234                 if (params->wpa_proto & WPA_PROTO_WPA)
5235                         ver |= NL80211_WPA_VERSION_1;
5236                 if (params->wpa_proto & WPA_PROTO_RSN)
5237                         ver |= NL80211_WPA_VERSION_2;
5238
5239                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
5240                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
5241         }
5242
5243         if (params->pairwise_suite != WPA_CIPHER_NONE) {
5244                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
5245                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
5246                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
5247         }
5248
5249         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
5250             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
5251                 /*
5252                  * This is likely to work even though many drivers do not
5253                  * advertise support for operations without GTK.
5254                  */
5255                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
5256         } else if (params->group_suite != WPA_CIPHER_NONE) {
5257                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
5258                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
5259                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
5260         }
5261
5262         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
5263             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5264             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
5265             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
5266             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
5267             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
5268             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
5269             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
5270             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
5271                 int mgmt = WLAN_AKM_SUITE_PSK;
5272
5273                 switch (params->key_mgmt_suite) {
5274                 case WPA_KEY_MGMT_CCKM:
5275                         mgmt = WLAN_AKM_SUITE_CCKM;
5276                         break;
5277                 case WPA_KEY_MGMT_IEEE8021X:
5278                         mgmt = WLAN_AKM_SUITE_8021X;
5279                         break;
5280                 case WPA_KEY_MGMT_FT_IEEE8021X:
5281                         mgmt = WLAN_AKM_SUITE_FT_8021X;
5282                         break;
5283                 case WPA_KEY_MGMT_FT_PSK:
5284                         mgmt = WLAN_AKM_SUITE_FT_PSK;
5285                         break;
5286                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
5287                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
5288                         break;
5289                 case WPA_KEY_MGMT_PSK_SHA256:
5290                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
5291                         break;
5292                 case WPA_KEY_MGMT_OSEN:
5293                         mgmt = WLAN_AKM_SUITE_OSEN;
5294                         break;
5295                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
5296                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B;
5297                         break;
5298                 case WPA_KEY_MGMT_PSK:
5299                 default:
5300                         mgmt = WLAN_AKM_SUITE_PSK;
5301                         break;
5302                 }
5303                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
5304                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
5305         }
5306
5307         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
5308
5309         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
5310                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
5311
5312         if (params->rrm_used) {
5313                 u32 drv_rrm_flags = drv->capa.rrm_flags;
5314                 if (!(drv_rrm_flags &
5315                       WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) ||
5316                     !(drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET))
5317                         goto nla_put_failure;
5318                 NLA_PUT_FLAG(msg, NL80211_ATTR_USE_RRM);
5319         }
5320
5321         if (params->disable_ht)
5322                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
5323
5324         if (params->htcaps && params->htcaps_mask) {
5325                 int sz = sizeof(struct ieee80211_ht_capabilities);
5326                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
5327                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
5328                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
5329                             params->htcaps_mask, sz);
5330                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
5331                         params->htcaps_mask);
5332         }
5333
5334 #ifdef CONFIG_VHT_OVERRIDES
5335         if (params->disable_vht) {
5336                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
5337                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
5338         }
5339
5340         if (params->vhtcaps && params->vhtcaps_mask) {
5341                 int sz = sizeof(struct ieee80211_vht_capabilities);
5342                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
5343                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
5344                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
5345                             params->vhtcaps_mask, sz);
5346                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
5347                         params->vhtcaps_mask);
5348         }
5349 #endif /* CONFIG_VHT_OVERRIDES */
5350
5351         if (params->p2p)
5352                 wpa_printf(MSG_DEBUG, "  * P2P group");
5353
5354         return 0;
5355 nla_put_failure:
5356         return -1;
5357 }
5358
5359
5360 static int wpa_driver_nl80211_try_connect(
5361         struct wpa_driver_nl80211_data *drv,
5362         struct wpa_driver_associate_params *params)
5363 {
5364         struct nl_msg *msg;
5365         enum nl80211_auth_type type;
5366         int ret;
5367         int algs;
5368
5369         if (params->req_key_mgmt_offload && params->psk &&
5370             (params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5371              params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
5372              params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
5373                 wpa_printf(MSG_DEBUG, "nl80211: Key management set PSK");
5374                 ret = issue_key_mgmt_set_key(drv, params->psk, 32);
5375                 if (ret)
5376                         return ret;
5377         }
5378
5379         msg = nlmsg_alloc();
5380         if (!msg)
5381                 return -1;
5382
5383         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
5384         nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
5385
5386         ret = nl80211_connect_common(drv, params, msg);
5387         if (ret)
5388                 goto nla_put_failure;
5389
5390         algs = 0;
5391         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5392                 algs++;
5393         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5394                 algs++;
5395         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5396                 algs++;
5397         if (algs > 1) {
5398                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
5399                            "selection");
5400                 goto skip_auth_type;
5401         }
5402
5403         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5404                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
5405         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5406                 type = NL80211_AUTHTYPE_SHARED_KEY;
5407         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5408                 type = NL80211_AUTHTYPE_NETWORK_EAP;
5409         else if (params->auth_alg & WPA_AUTH_ALG_FT)
5410                 type = NL80211_AUTHTYPE_FT;
5411         else
5412                 goto nla_put_failure;
5413
5414         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
5415         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
5416
5417 skip_auth_type:
5418         ret = nl80211_set_conn_keys(params, msg);
5419         if (ret)
5420                 goto nla_put_failure;
5421
5422         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5423         msg = NULL;
5424         if (ret) {
5425                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
5426                            "(%s)", ret, strerror(-ret));
5427                 goto nla_put_failure;
5428         }
5429         ret = 0;
5430         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
5431
5432 nla_put_failure:
5433         nlmsg_free(msg);
5434         return ret;
5435
5436 }
5437
5438
5439 static int wpa_driver_nl80211_connect(
5440         struct wpa_driver_nl80211_data *drv,
5441         struct wpa_driver_associate_params *params)
5442 {
5443         int ret = wpa_driver_nl80211_try_connect(drv, params);
5444         if (ret == -EALREADY) {
5445                 /*
5446                  * cfg80211 does not currently accept new connections if
5447                  * we are already connected. As a workaround, force
5448                  * disconnection and try again.
5449                  */
5450                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
5451                            "disconnecting before reassociation "
5452                            "attempt");
5453                 if (wpa_driver_nl80211_disconnect(
5454                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
5455                         return -1;
5456                 ret = wpa_driver_nl80211_try_connect(drv, params);
5457         }
5458         return ret;
5459 }
5460
5461
5462 static int wpa_driver_nl80211_associate(
5463         void *priv, struct wpa_driver_associate_params *params)
5464 {
5465         struct i802_bss *bss = priv;
5466         struct wpa_driver_nl80211_data *drv = bss->drv;
5467         int ret;
5468         struct nl_msg *msg;
5469
5470         if (params->mode == IEEE80211_MODE_AP)
5471                 return wpa_driver_nl80211_ap(drv, params);
5472
5473         if (params->mode == IEEE80211_MODE_IBSS)
5474                 return wpa_driver_nl80211_ibss(drv, params);
5475
5476         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
5477                 enum nl80211_iftype nlmode = params->p2p ?
5478                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
5479
5480                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
5481                         return -1;
5482                 return wpa_driver_nl80211_connect(drv, params);
5483         }
5484
5485         nl80211_mark_disconnected(drv);
5486
5487         msg = nlmsg_alloc();
5488         if (!msg)
5489                 return -1;
5490
5491         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
5492                    drv->ifindex);
5493         nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
5494
5495         ret = nl80211_connect_common(drv, params, msg);
5496         if (ret)
5497                 goto nla_put_failure;
5498
5499         if (params->prev_bssid) {
5500                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
5501                            MAC2STR(params->prev_bssid));
5502                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
5503                         params->prev_bssid);
5504         }
5505
5506         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5507         msg = NULL;
5508         if (ret) {
5509                 wpa_dbg(drv->ctx, MSG_DEBUG,
5510                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
5511                         ret, strerror(-ret));
5512                 nl80211_dump_scan(drv);
5513                 goto nla_put_failure;
5514         }
5515         ret = 0;
5516         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
5517                    "successfully");
5518
5519 nla_put_failure:
5520         nlmsg_free(msg);
5521         return ret;
5522 }
5523
5524
5525 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
5526                             int ifindex, enum nl80211_iftype mode)
5527 {
5528         struct nl_msg *msg;
5529         int ret = -ENOBUFS;
5530
5531         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
5532                    ifindex, mode, nl80211_iftype_str(mode));
5533
5534         msg = nlmsg_alloc();
5535         if (!msg)
5536                 return -ENOMEM;
5537
5538         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
5539         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
5540                 goto nla_put_failure;
5541         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
5542
5543         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5544         msg = NULL;
5545         if (!ret)
5546                 return 0;
5547 nla_put_failure:
5548         nlmsg_free(msg);
5549         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
5550                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
5551         return ret;
5552 }
5553
5554
5555 static int wpa_driver_nl80211_set_mode_impl(
5556                 struct i802_bss *bss,
5557                 enum nl80211_iftype nlmode,
5558                 struct hostapd_freq_params *desired_freq_params)
5559 {
5560         struct wpa_driver_nl80211_data *drv = bss->drv;
5561         int ret = -1;
5562         int i;
5563         int was_ap = is_ap_interface(drv->nlmode);
5564         int res;
5565         int mode_switch_res;
5566
5567         mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5568         if (mode_switch_res && nlmode == nl80211_get_ifmode(bss))
5569                 mode_switch_res = 0;
5570
5571         if (mode_switch_res == 0) {
5572                 drv->nlmode = nlmode;
5573                 ret = 0;
5574                 goto done;
5575         }
5576
5577         if (mode_switch_res == -ENODEV)
5578                 return -1;
5579
5580         if (nlmode == drv->nlmode) {
5581                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
5582                            "requested mode - ignore error");
5583                 ret = 0;
5584                 goto done; /* Already in the requested mode */
5585         }
5586
5587         /* mac80211 doesn't allow mode changes while the device is up, so
5588          * take the device down, try to set the mode again, and bring the
5589          * device back up.
5590          */
5591         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
5592                    "interface down");
5593         for (i = 0; i < 10; i++) {
5594                 res = i802_set_iface_flags(bss, 0);
5595                 if (res == -EACCES || res == -ENODEV)
5596                         break;
5597                 if (res != 0) {
5598                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
5599                                    "interface down");
5600                         os_sleep(0, 100000);
5601                         continue;
5602                 }
5603
5604                 /*
5605                  * Setting the mode will fail for some drivers if the phy is
5606                  * on a frequency that the mode is disallowed in.
5607                  */
5608                 if (desired_freq_params) {
5609                         res = i802_set_freq(bss, desired_freq_params);
5610                         if (res) {
5611                                 wpa_printf(MSG_DEBUG,
5612                                            "nl80211: Failed to set frequency on interface");
5613                         }
5614                 }
5615
5616                 /* Try to set the mode again while the interface is down */
5617                 mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5618                 if (mode_switch_res == -EBUSY) {
5619                         wpa_printf(MSG_DEBUG,
5620                                    "nl80211: Delaying mode set while interface going down");
5621                         os_sleep(0, 100000);
5622                         continue;
5623                 }
5624                 ret = mode_switch_res;
5625                 break;
5626         }
5627
5628         if (!ret) {
5629                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
5630                            "interface is down");
5631                 drv->nlmode = nlmode;
5632                 drv->ignore_if_down_event = 1;
5633         }
5634
5635         /* Bring the interface back up */
5636         res = linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1);
5637         if (res != 0) {
5638                 wpa_printf(MSG_DEBUG,
5639                            "nl80211: Failed to set interface up after switching mode");
5640                 ret = -1;
5641         }
5642
5643 done:
5644         if (ret) {
5645                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
5646                            "from %d failed", nlmode, drv->nlmode);
5647                 return ret;
5648         }
5649
5650         if (is_p2p_net_interface(nlmode))
5651                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
5652         else if (drv->disabled_11b_rates)
5653                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
5654
5655         if (is_ap_interface(nlmode)) {
5656                 nl80211_mgmt_unsubscribe(bss, "start AP");
5657                 /* Setup additional AP mode functionality if needed */
5658                 if (nl80211_setup_ap(bss))
5659                         return -1;
5660         } else if (was_ap) {
5661                 /* Remove additional AP mode functionality */
5662                 nl80211_teardown_ap(bss);
5663         } else {
5664                 nl80211_mgmt_unsubscribe(bss, "mode change");
5665         }
5666
5667         if (is_mesh_interface(nlmode) &&
5668             nl80211_mgmt_subscribe_mesh(bss))
5669                 return -1;
5670
5671         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
5672             !is_mesh_interface(nlmode) &&
5673             nl80211_mgmt_subscribe_non_ap(bss) < 0)
5674                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
5675                            "frame processing - ignore for now");
5676
5677         return 0;
5678 }
5679
5680
5681 int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
5682                                 enum nl80211_iftype nlmode)
5683 {
5684         return wpa_driver_nl80211_set_mode_impl(bss, nlmode, NULL);
5685 }
5686
5687
5688 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
5689                                             struct hostapd_freq_params *freq)
5690 {
5691         return wpa_driver_nl80211_set_mode_impl(bss, NL80211_IFTYPE_ADHOC,
5692                                                 freq);
5693 }
5694
5695
5696 static int wpa_driver_nl80211_get_capa(void *priv,
5697                                        struct wpa_driver_capa *capa)
5698 {
5699         struct i802_bss *bss = priv;
5700         struct wpa_driver_nl80211_data *drv = bss->drv;
5701
5702         if (!drv->has_capability)
5703                 return -1;
5704         os_memcpy(capa, &drv->capa, sizeof(*capa));
5705         if (drv->extended_capa && drv->extended_capa_mask) {
5706                 capa->extended_capa = drv->extended_capa;
5707                 capa->extended_capa_mask = drv->extended_capa_mask;
5708                 capa->extended_capa_len = drv->extended_capa_len;
5709         }
5710
5711         return 0;
5712 }
5713
5714
5715 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
5716 {
5717         struct i802_bss *bss = priv;
5718         struct wpa_driver_nl80211_data *drv = bss->drv;
5719
5720         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
5721                    bss->ifname, drv->operstate, state,
5722                    state ? "UP" : "DORMANT");
5723         drv->operstate = state;
5724         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
5725                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
5726 }
5727
5728
5729 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
5730 {
5731         struct i802_bss *bss = priv;
5732         struct wpa_driver_nl80211_data *drv = bss->drv;
5733         struct nl_msg *msg;
5734         struct nl80211_sta_flag_update upd;
5735         int ret = -ENOBUFS;
5736
5737         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
5738                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
5739                 return 0;
5740         }
5741
5742         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
5743                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
5744
5745         msg = nlmsg_alloc();
5746         if (!msg)
5747                 return -ENOMEM;
5748
5749         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
5750
5751         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
5752                     if_nametoindex(bss->ifname));
5753         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
5754
5755         os_memset(&upd, 0, sizeof(upd));
5756         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
5757         if (authorized)
5758                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
5759         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
5760
5761         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5762         msg = NULL;
5763         if (!ret)
5764                 return 0;
5765  nla_put_failure:
5766         nlmsg_free(msg);
5767         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
5768                    ret, strerror(-ret));
5769         return ret;
5770 }
5771
5772
5773 /* Set kernel driver on given frequency (MHz) */
5774 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
5775 {
5776         struct i802_bss *bss = priv;
5777         return nl80211_set_channel(bss, freq, 0);
5778 }
5779
5780
5781 static inline int min_int(int a, int b)
5782 {
5783         if (a < b)
5784                 return a;
5785         return b;
5786 }
5787
5788
5789 static int get_key_handler(struct nl_msg *msg, void *arg)
5790 {
5791         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5792         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5793
5794         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5795                   genlmsg_attrlen(gnlh, 0), NULL);
5796
5797         /*
5798          * TODO: validate the key index and mac address!
5799          * Otherwise, there's a race condition as soon as
5800          * the kernel starts sending key notifications.
5801          */
5802
5803         if (tb[NL80211_ATTR_KEY_SEQ])
5804                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
5805                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
5806         return NL_SKIP;
5807 }
5808
5809
5810 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
5811                            int idx, u8 *seq)
5812 {
5813         struct i802_bss *bss = priv;
5814         struct wpa_driver_nl80211_data *drv = bss->drv;
5815         struct nl_msg *msg;
5816
5817         msg = nlmsg_alloc();
5818         if (!msg)
5819                 return -ENOMEM;
5820
5821         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
5822
5823         if (addr)
5824                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5825         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
5826         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
5827
5828         memset(seq, 0, 6);
5829
5830         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
5831  nla_put_failure:
5832         nlmsg_free(msg);
5833         return -ENOBUFS;
5834 }
5835
5836
5837 static int i802_set_rts(void *priv, int rts)
5838 {
5839         struct i802_bss *bss = priv;
5840         struct wpa_driver_nl80211_data *drv = bss->drv;
5841         struct nl_msg *msg;
5842         int ret = -ENOBUFS;
5843         u32 val;
5844
5845         msg = nlmsg_alloc();
5846         if (!msg)
5847                 return -ENOMEM;
5848
5849         if (rts >= 2347)
5850                 val = (u32) -1;
5851         else
5852                 val = rts;
5853
5854         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
5855         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5856         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
5857
5858         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5859         msg = NULL;
5860         if (!ret)
5861                 return 0;
5862 nla_put_failure:
5863         nlmsg_free(msg);
5864         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
5865                    "%d (%s)", rts, ret, strerror(-ret));
5866         return ret;
5867 }
5868
5869
5870 static int i802_set_frag(void *priv, int frag)
5871 {
5872         struct i802_bss *bss = priv;
5873         struct wpa_driver_nl80211_data *drv = bss->drv;
5874         struct nl_msg *msg;
5875         int ret = -ENOBUFS;
5876         u32 val;
5877
5878         msg = nlmsg_alloc();
5879         if (!msg)
5880                 return -ENOMEM;
5881
5882         if (frag >= 2346)
5883                 val = (u32) -1;
5884         else
5885                 val = frag;
5886
5887         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
5888         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5889         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
5890
5891         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5892         msg = NULL;
5893         if (!ret)
5894                 return 0;
5895 nla_put_failure:
5896         nlmsg_free(msg);
5897         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
5898                    "%d: %d (%s)", frag, ret, strerror(-ret));
5899         return ret;
5900 }
5901
5902
5903 static int i802_flush(void *priv)
5904 {
5905         struct i802_bss *bss = priv;
5906         struct wpa_driver_nl80211_data *drv = bss->drv;
5907         struct nl_msg *msg;
5908         int res;
5909
5910         msg = nlmsg_alloc();
5911         if (!msg)
5912                 return -1;
5913
5914         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
5915                    bss->ifname);
5916         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
5917
5918         /*
5919          * XXX: FIX! this needs to flush all VLANs too
5920          */
5921         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
5922                     if_nametoindex(bss->ifname));
5923
5924         res = send_and_recv_msgs(drv, msg, NULL, NULL);
5925         if (res) {
5926                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
5927                            "(%s)", res, strerror(-res));
5928         }
5929         return res;
5930  nla_put_failure:
5931         nlmsg_free(msg);
5932         return -ENOBUFS;
5933 }
5934
5935
5936 static int get_sta_handler(struct nl_msg *msg, void *arg)
5937 {
5938         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5939         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5940         struct hostap_sta_driver_data *data = arg;
5941         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
5942         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
5943                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
5944                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
5945                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
5946                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
5947                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
5948                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
5949         };
5950
5951         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5952                   genlmsg_attrlen(gnlh, 0), NULL);
5953
5954         /*
5955          * TODO: validate the interface and mac address!
5956          * Otherwise, there's a race condition as soon as
5957          * the kernel starts sending station notifications.
5958          */
5959
5960         if (!tb[NL80211_ATTR_STA_INFO]) {
5961                 wpa_printf(MSG_DEBUG, "sta stats missing!");
5962                 return NL_SKIP;
5963         }
5964         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
5965                              tb[NL80211_ATTR_STA_INFO],
5966                              stats_policy)) {
5967                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
5968                 return NL_SKIP;
5969         }
5970
5971         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
5972                 data->inactive_msec =
5973                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
5974         if (stats[NL80211_STA_INFO_RX_BYTES])
5975                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
5976         if (stats[NL80211_STA_INFO_TX_BYTES])
5977                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
5978         if (stats[NL80211_STA_INFO_RX_PACKETS])
5979                 data->rx_packets =
5980                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
5981         if (stats[NL80211_STA_INFO_TX_PACKETS])
5982                 data->tx_packets =
5983                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
5984         if (stats[NL80211_STA_INFO_TX_FAILED])
5985                 data->tx_retry_failed =
5986                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
5987
5988         return NL_SKIP;
5989 }
5990
5991 static int i802_read_sta_data(struct i802_bss *bss,
5992                               struct hostap_sta_driver_data *data,
5993                               const u8 *addr)
5994 {
5995         struct wpa_driver_nl80211_data *drv = bss->drv;
5996         struct nl_msg *msg;
5997
5998         os_memset(data, 0, sizeof(*data));
5999         msg = nlmsg_alloc();
6000         if (!msg)
6001                 return -ENOMEM;
6002
6003         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
6004
6005         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6006         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
6007
6008         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
6009  nla_put_failure:
6010         nlmsg_free(msg);
6011         return -ENOBUFS;
6012 }
6013
6014
6015 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
6016                                     int cw_min, int cw_max, int burst_time)
6017 {
6018         struct i802_bss *bss = priv;
6019         struct wpa_driver_nl80211_data *drv = bss->drv;
6020         struct nl_msg *msg;
6021         struct nlattr *txq, *params;
6022
6023         msg = nlmsg_alloc();
6024         if (!msg)
6025                 return -1;
6026
6027         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
6028
6029         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
6030
6031         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
6032         if (!txq)
6033                 goto nla_put_failure;
6034
6035         /* We are only sending parameters for a single TXQ at a time */
6036         params = nla_nest_start(msg, 1);
6037         if (!params)
6038                 goto nla_put_failure;
6039
6040         switch (queue) {
6041         case 0:
6042                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
6043                 break;
6044         case 1:
6045                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
6046                 break;
6047         case 2:
6048                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
6049                 break;
6050         case 3:
6051                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
6052                 break;
6053         }
6054         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
6055          * 32 usec, so need to convert the value here. */
6056         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
6057         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
6058         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
6059         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
6060
6061         nla_nest_end(msg, params);
6062
6063         nla_nest_end(msg, txq);
6064
6065         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
6066                 return 0;
6067         msg = NULL;
6068  nla_put_failure:
6069         nlmsg_free(msg);
6070         return -1;
6071 }
6072
6073
6074 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
6075                              const char *ifname, int vlan_id)
6076 {
6077         struct wpa_driver_nl80211_data *drv = bss->drv;
6078         struct nl_msg *msg;
6079         int ret = -ENOBUFS;
6080
6081         msg = nlmsg_alloc();
6082         if (!msg)
6083                 return -ENOMEM;
6084
6085         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
6086                    ", ifname=%s[%d], vlan_id=%d)",
6087                    bss->ifname, if_nametoindex(bss->ifname),
6088                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
6089         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
6090
6091         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
6092                     if_nametoindex(bss->ifname));
6093         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6094         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
6095                     if_nametoindex(ifname));
6096
6097         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6098         msg = NULL;
6099         if (ret < 0) {
6100                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
6101                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
6102                            MAC2STR(addr), ifname, vlan_id, ret,
6103                            strerror(-ret));
6104         }
6105  nla_put_failure:
6106         nlmsg_free(msg);
6107         return ret;
6108 }
6109
6110
6111 static int i802_get_inact_sec(void *priv, const u8 *addr)
6112 {
6113         struct hostap_sta_driver_data data;
6114         int ret;
6115
6116         data.inactive_msec = (unsigned long) -1;
6117         ret = i802_read_sta_data(priv, &data, addr);
6118         if (ret || data.inactive_msec == (unsigned long) -1)
6119                 return -1;
6120         return data.inactive_msec / 1000;
6121 }
6122
6123
6124 static int i802_sta_clear_stats(void *priv, const u8 *addr)
6125 {
6126 #if 0
6127         /* TODO */
6128 #endif
6129         return 0;
6130 }
6131
6132
6133 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
6134                            int reason)
6135 {
6136         struct i802_bss *bss = priv;
6137         struct wpa_driver_nl80211_data *drv = bss->drv;
6138         struct ieee80211_mgmt mgmt;
6139
6140         if (is_mesh_interface(drv->nlmode))
6141                 return -1;
6142
6143         if (drv->device_ap_sme)
6144                 return wpa_driver_nl80211_sta_remove(bss, addr, 1, reason);
6145
6146         memset(&mgmt, 0, sizeof(mgmt));
6147         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
6148                                           WLAN_FC_STYPE_DEAUTH);
6149         memcpy(mgmt.da, addr, ETH_ALEN);
6150         memcpy(mgmt.sa, own_addr, ETH_ALEN);
6151         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
6152         mgmt.u.deauth.reason_code = host_to_le16(reason);
6153         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
6154                                             IEEE80211_HDRLEN +
6155                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
6156                                             0);
6157 }
6158
6159
6160 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
6161                              int reason)
6162 {
6163         struct i802_bss *bss = priv;
6164         struct wpa_driver_nl80211_data *drv = bss->drv;
6165         struct ieee80211_mgmt mgmt;
6166
6167         if (is_mesh_interface(drv->nlmode))
6168                 return -1;
6169
6170         if (drv->device_ap_sme)
6171                 return wpa_driver_nl80211_sta_remove(bss, addr, 0, reason);
6172
6173         memset(&mgmt, 0, sizeof(mgmt));
6174         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
6175                                           WLAN_FC_STYPE_DISASSOC);
6176         memcpy(mgmt.da, addr, ETH_ALEN);
6177         memcpy(mgmt.sa, own_addr, ETH_ALEN);
6178         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
6179         mgmt.u.disassoc.reason_code = host_to_le16(reason);
6180         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
6181                                             IEEE80211_HDRLEN +
6182                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
6183                                             0);
6184 }
6185
6186
6187 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
6188 {
6189         char buf[200], *pos, *end;
6190         int i, res;
6191
6192         pos = buf;
6193         end = pos + sizeof(buf);
6194
6195         for (i = 0; i < drv->num_if_indices; i++) {
6196                 if (!drv->if_indices[i])
6197                         continue;
6198                 res = os_snprintf(pos, end - pos, " %d", drv->if_indices[i]);
6199                 if (res < 0 || res >= end - pos)
6200                         break;
6201                 pos += res;
6202         }
6203         *pos = '\0';
6204
6205         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
6206                    drv->num_if_indices, buf);
6207 }
6208
6209
6210 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6211 {
6212         int i;
6213         int *old;
6214
6215         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
6216                    ifidx);
6217         if (have_ifidx(drv, ifidx)) {
6218                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
6219                            ifidx);
6220                 return;
6221         }
6222         for (i = 0; i < drv->num_if_indices; i++) {
6223                 if (drv->if_indices[i] == 0) {
6224                         drv->if_indices[i] = ifidx;
6225                         dump_ifidx(drv);
6226                         return;
6227                 }
6228         }
6229
6230         if (drv->if_indices != drv->default_if_indices)
6231                 old = drv->if_indices;
6232         else
6233                 old = NULL;
6234
6235         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
6236                                            sizeof(int));
6237         if (!drv->if_indices) {
6238                 if (!old)
6239                         drv->if_indices = drv->default_if_indices;
6240                 else
6241                         drv->if_indices = old;
6242                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
6243                            "interfaces");
6244                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
6245                 return;
6246         } else if (!old)
6247                 os_memcpy(drv->if_indices, drv->default_if_indices,
6248                           sizeof(drv->default_if_indices));
6249         drv->if_indices[drv->num_if_indices] = ifidx;
6250         drv->num_if_indices++;
6251         dump_ifidx(drv);
6252 }
6253
6254
6255 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6256 {
6257         int i;
6258
6259         for (i = 0; i < drv->num_if_indices; i++) {
6260                 if (drv->if_indices[i] == ifidx) {
6261                         drv->if_indices[i] = 0;
6262                         break;
6263                 }
6264         }
6265         dump_ifidx(drv);
6266 }
6267
6268
6269 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6270 {
6271         int i;
6272
6273         for (i = 0; i < drv->num_if_indices; i++)
6274                 if (drv->if_indices[i] == ifidx)
6275                         return 1;
6276
6277         return 0;
6278 }
6279
6280
6281 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
6282                             const char *bridge_ifname, char *ifname_wds)
6283 {
6284         struct i802_bss *bss = priv;
6285         struct wpa_driver_nl80211_data *drv = bss->drv;
6286         char name[IFNAMSIZ + 1];
6287
6288         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
6289         if (ifname_wds)
6290                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
6291
6292         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
6293                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
6294         if (val) {
6295                 if (!if_nametoindex(name)) {
6296                         if (nl80211_create_iface(drv, name,
6297                                                  NL80211_IFTYPE_AP_VLAN,
6298                                                  bss->addr, 1, NULL, NULL, 0) <
6299                             0)
6300                                 return -1;
6301                         if (bridge_ifname &&
6302                             linux_br_add_if(drv->global->ioctl_sock,
6303                                             bridge_ifname, name) < 0)
6304                                 return -1;
6305                 }
6306                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
6307                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
6308                                    "interface %s up", name);
6309                 }
6310                 return i802_set_sta_vlan(priv, addr, name, 0);
6311         } else {
6312                 if (bridge_ifname)
6313                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
6314                                         name);
6315
6316                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
6317                 nl80211_remove_iface(drv, if_nametoindex(name));
6318                 return 0;
6319         }
6320 }
6321
6322
6323 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
6324 {
6325         struct wpa_driver_nl80211_data *drv = eloop_ctx;
6326         struct sockaddr_ll lladdr;
6327         unsigned char buf[3000];
6328         int len;
6329         socklen_t fromlen = sizeof(lladdr);
6330
6331         len = recvfrom(sock, buf, sizeof(buf), 0,
6332                        (struct sockaddr *)&lladdr, &fromlen);
6333         if (len < 0) {
6334                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
6335                            strerror(errno));
6336                 return;
6337         }
6338
6339         if (have_ifidx(drv, lladdr.sll_ifindex))
6340                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
6341 }
6342
6343
6344 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
6345                              struct i802_bss *bss,
6346                              const char *brname, const char *ifname)
6347 {
6348         int br_ifindex;
6349         char in_br[IFNAMSIZ];
6350
6351         os_strlcpy(bss->brname, brname, IFNAMSIZ);
6352         br_ifindex = if_nametoindex(brname);
6353         if (br_ifindex == 0) {
6354                 /*
6355                  * Bridge was configured, but the bridge device does
6356                  * not exist. Try to add it now.
6357                  */
6358                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
6359                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
6360                                    "bridge interface %s: %s",
6361                                    brname, strerror(errno));
6362                         return -1;
6363                 }
6364                 bss->added_bridge = 1;
6365                 br_ifindex = if_nametoindex(brname);
6366                 add_ifidx(drv, br_ifindex);
6367         }
6368         bss->br_ifindex = br_ifindex;
6369
6370         if (linux_br_get(in_br, ifname) == 0) {
6371                 if (os_strcmp(in_br, brname) == 0)
6372                         return 0; /* already in the bridge */
6373
6374                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
6375                            "bridge %s", ifname, in_br);
6376                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
6377                     0) {
6378                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
6379                                    "remove interface %s from bridge "
6380                                    "%s: %s",
6381                                    ifname, brname, strerror(errno));
6382                         return -1;
6383                 }
6384         }
6385
6386         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
6387                    ifname, brname);
6388         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
6389                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
6390                            "into bridge %s: %s",
6391                            ifname, brname, strerror(errno));
6392                 return -1;
6393         }
6394         bss->added_if_into_bridge = 1;
6395
6396         return 0;
6397 }
6398
6399
6400 static void *i802_init(struct hostapd_data *hapd,
6401                        struct wpa_init_params *params)
6402 {
6403         struct wpa_driver_nl80211_data *drv;
6404         struct i802_bss *bss;
6405         size_t i;
6406         char brname[IFNAMSIZ];
6407         int ifindex, br_ifindex;
6408         int br_added = 0;
6409
6410         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
6411                                           params->global_priv, 1,
6412                                           params->bssid, params->driver_params);
6413         if (bss == NULL)
6414                 return NULL;
6415
6416         drv = bss->drv;
6417
6418         if (linux_br_get(brname, params->ifname) == 0) {
6419                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
6420                            params->ifname, brname);
6421                 br_ifindex = if_nametoindex(brname);
6422                 os_strlcpy(bss->brname, brname, IFNAMSIZ);
6423         } else {
6424                 brname[0] = '\0';
6425                 br_ifindex = 0;
6426         }
6427         bss->br_ifindex = br_ifindex;
6428
6429         for (i = 0; i < params->num_bridge; i++) {
6430                 if (params->bridge[i]) {
6431                         ifindex = if_nametoindex(params->bridge[i]);
6432                         if (ifindex)
6433                                 add_ifidx(drv, ifindex);
6434                         if (ifindex == br_ifindex)
6435                                 br_added = 1;
6436                 }
6437         }
6438         if (!br_added && br_ifindex &&
6439             (params->num_bridge == 0 || !params->bridge[0]))
6440                 add_ifidx(drv, br_ifindex);
6441
6442         /* start listening for EAPOL on the default AP interface */
6443         add_ifidx(drv, drv->ifindex);
6444
6445         if (params->num_bridge && params->bridge[0] &&
6446             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
6447                 goto failed;
6448
6449 #ifdef CONFIG_LIBNL3_ROUTE
6450         if (bss->added_if_into_bridge) {
6451                 drv->rtnl_sk = nl_socket_alloc();
6452                 if (drv->rtnl_sk == NULL) {
6453                         wpa_printf(MSG_ERROR, "nl80211: Failed to allocate nl_sock");
6454                         goto failed;
6455                 }
6456
6457                 if (nl_connect(drv->rtnl_sk, NETLINK_ROUTE)) {
6458                         wpa_printf(MSG_ERROR, "nl80211: Failed to connect nl_sock to NETLINK_ROUTE: %s",
6459                                    strerror(errno));
6460                         goto failed;
6461                 }
6462         }
6463 #endif /* CONFIG_LIBNL3_ROUTE */
6464
6465         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
6466         if (drv->eapol_sock < 0) {
6467                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
6468                            strerror(errno));
6469                 goto failed;
6470         }
6471
6472         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
6473         {
6474                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
6475                 goto failed;
6476         }
6477
6478         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
6479                                params->own_addr))
6480                 goto failed;
6481         os_memcpy(drv->perm_addr, params->own_addr, ETH_ALEN);
6482
6483         memcpy(bss->addr, params->own_addr, ETH_ALEN);
6484
6485         return bss;
6486
6487 failed:
6488         wpa_driver_nl80211_deinit(bss);
6489         return NULL;
6490 }
6491
6492
6493 static void i802_deinit(void *priv)
6494 {
6495         struct i802_bss *bss = priv;
6496         wpa_driver_nl80211_deinit(bss);
6497 }
6498
6499
6500 static enum nl80211_iftype wpa_driver_nl80211_if_type(
6501         enum wpa_driver_if_type type)
6502 {
6503         switch (type) {
6504         case WPA_IF_STATION:
6505                 return NL80211_IFTYPE_STATION;
6506         case WPA_IF_P2P_CLIENT:
6507         case WPA_IF_P2P_GROUP:
6508                 return NL80211_IFTYPE_P2P_CLIENT;
6509         case WPA_IF_AP_VLAN:
6510                 return NL80211_IFTYPE_AP_VLAN;
6511         case WPA_IF_AP_BSS:
6512                 return NL80211_IFTYPE_AP;
6513         case WPA_IF_P2P_GO:
6514                 return NL80211_IFTYPE_P2P_GO;
6515         case WPA_IF_P2P_DEVICE:
6516                 return NL80211_IFTYPE_P2P_DEVICE;
6517         }
6518         return -1;
6519 }
6520
6521
6522 #ifdef CONFIG_P2P
6523
6524 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
6525 {
6526         struct wpa_driver_nl80211_data *drv;
6527         dl_list_for_each(drv, &global->interfaces,
6528                          struct wpa_driver_nl80211_data, list) {
6529                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
6530                         return 1;
6531         }
6532         return 0;
6533 }
6534
6535
6536 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
6537                                       u8 *new_addr)
6538 {
6539         unsigned int idx;
6540
6541         if (!drv->global)
6542                 return -1;
6543
6544         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
6545         for (idx = 0; idx < 64; idx++) {
6546                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
6547                 new_addr[0] ^= idx << 2;
6548                 if (!nl80211_addr_in_use(drv->global, new_addr))
6549                         break;
6550         }
6551         if (idx == 64)
6552                 return -1;
6553
6554         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
6555                    MACSTR, MAC2STR(new_addr));
6556
6557         return 0;
6558 }
6559
6560 #endif /* CONFIG_P2P */
6561
6562
6563 struct wdev_info {
6564         u64 wdev_id;
6565         int wdev_id_set;
6566         u8 macaddr[ETH_ALEN];
6567 };
6568
6569 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
6570 {
6571         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6572         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6573         struct wdev_info *wi = arg;
6574
6575         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6576                   genlmsg_attrlen(gnlh, 0), NULL);
6577         if (tb[NL80211_ATTR_WDEV]) {
6578                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
6579                 wi->wdev_id_set = 1;
6580         }
6581
6582         if (tb[NL80211_ATTR_MAC])
6583                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
6584                           ETH_ALEN);
6585
6586         return NL_SKIP;
6587 }
6588
6589
6590 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
6591                                      const char *ifname, const u8 *addr,
6592                                      void *bss_ctx, void **drv_priv,
6593                                      char *force_ifname, u8 *if_addr,
6594                                      const char *bridge, int use_existing)
6595 {
6596         enum nl80211_iftype nlmode;
6597         struct i802_bss *bss = priv;
6598         struct wpa_driver_nl80211_data *drv = bss->drv;
6599         int ifidx;
6600         int added = 1;
6601
6602         if (addr)
6603                 os_memcpy(if_addr, addr, ETH_ALEN);
6604         nlmode = wpa_driver_nl80211_if_type(type);
6605         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
6606                 struct wdev_info p2pdev_info;
6607
6608                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
6609                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6610                                              0, nl80211_wdev_handler,
6611                                              &p2pdev_info, use_existing);
6612                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
6613                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
6614                                    ifname);
6615                         return -1;
6616                 }
6617
6618                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
6619                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
6620                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
6621                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
6622                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
6623                            ifname,
6624                            (long long unsigned int) p2pdev_info.wdev_id);
6625         } else {
6626                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6627                                              0, NULL, NULL, use_existing);
6628                 if (use_existing && ifidx == -ENFILE) {
6629                         added = 0;
6630                         ifidx = if_nametoindex(ifname);
6631                 } else if (ifidx < 0) {
6632                         return -1;
6633                 }
6634         }
6635
6636         if (!addr) {
6637                 if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
6638                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
6639                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
6640                                             bss->ifname, if_addr) < 0) {
6641                         if (added)
6642                                 nl80211_remove_iface(drv, ifidx);
6643                         return -1;
6644                 }
6645         }
6646
6647 #ifdef CONFIG_P2P
6648         if (!addr &&
6649             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
6650              type == WPA_IF_P2P_GO)) {
6651                 /* Enforce unique P2P Interface Address */
6652                 u8 new_addr[ETH_ALEN];
6653
6654                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
6655                                        new_addr) < 0) {
6656                         if (added)
6657                                 nl80211_remove_iface(drv, ifidx);
6658                         return -1;
6659                 }
6660                 if (nl80211_addr_in_use(drv->global, new_addr)) {
6661                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
6662                                    "for P2P group interface");
6663                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
6664                                 if (added)
6665                                         nl80211_remove_iface(drv, ifidx);
6666                                 return -1;
6667                         }
6668                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
6669                                                new_addr) < 0) {
6670                                 if (added)
6671                                         nl80211_remove_iface(drv, ifidx);
6672                                 return -1;
6673                         }
6674                 }
6675                 os_memcpy(if_addr, new_addr, ETH_ALEN);
6676         }
6677 #endif /* CONFIG_P2P */
6678
6679         if (type == WPA_IF_AP_BSS) {
6680                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
6681                 if (new_bss == NULL) {
6682                         if (added)
6683                                 nl80211_remove_iface(drv, ifidx);
6684                         return -1;
6685                 }
6686
6687                 if (bridge &&
6688                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
6689                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
6690                                    "interface %s to a bridge %s",
6691                                    ifname, bridge);
6692                         if (added)
6693                                 nl80211_remove_iface(drv, ifidx);
6694                         os_free(new_bss);
6695                         return -1;
6696                 }
6697
6698                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
6699                 {
6700                         if (added)
6701                                 nl80211_remove_iface(drv, ifidx);
6702                         os_free(new_bss);
6703                         return -1;
6704                 }
6705                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
6706                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
6707                 new_bss->ifindex = ifidx;
6708                 new_bss->drv = drv;
6709                 new_bss->next = drv->first_bss->next;
6710                 new_bss->freq = drv->first_bss->freq;
6711                 new_bss->ctx = bss_ctx;
6712                 new_bss->added_if = added;
6713                 drv->first_bss->next = new_bss;
6714                 if (drv_priv)
6715                         *drv_priv = new_bss;
6716                 nl80211_init_bss(new_bss);
6717
6718                 /* Subscribe management frames for this WPA_IF_AP_BSS */
6719                 if (nl80211_setup_ap(new_bss))
6720                         return -1;
6721         }
6722
6723         if (drv->global)
6724                 drv->global->if_add_ifindex = ifidx;
6725
6726         /*
6727          * Some virtual interfaces need to process EAPOL packets and events on
6728          * the parent interface. This is used mainly with hostapd.
6729          */
6730         if (ifidx > 0 &&
6731             (drv->hostapd ||
6732              nlmode == NL80211_IFTYPE_AP_VLAN ||
6733              nlmode == NL80211_IFTYPE_WDS ||
6734              nlmode == NL80211_IFTYPE_MONITOR))
6735                 add_ifidx(drv, ifidx);
6736
6737         return 0;
6738 }
6739
6740
6741 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
6742                                         enum wpa_driver_if_type type,
6743                                         const char *ifname)
6744 {
6745         struct wpa_driver_nl80211_data *drv = bss->drv;
6746         int ifindex = if_nametoindex(ifname);
6747
6748         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
6749                    __func__, type, ifname, ifindex, bss->added_if);
6750         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
6751                 nl80211_remove_iface(drv, ifindex);
6752         else if (ifindex > 0 && !bss->added_if) {
6753                 struct wpa_driver_nl80211_data *drv2;
6754                 dl_list_for_each(drv2, &drv->global->interfaces,
6755                                  struct wpa_driver_nl80211_data, list)
6756                         del_ifidx(drv2, ifindex);
6757         }
6758
6759         if (type != WPA_IF_AP_BSS)
6760                 return 0;
6761
6762         if (bss->added_if_into_bridge) {
6763                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
6764                                     bss->ifname) < 0)
6765                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6766                                    "interface %s from bridge %s: %s",
6767                                    bss->ifname, bss->brname, strerror(errno));
6768         }
6769         if (bss->added_bridge) {
6770                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
6771                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6772                                    "bridge %s: %s",
6773                                    bss->brname, strerror(errno));
6774         }
6775
6776         if (bss != drv->first_bss) {
6777                 struct i802_bss *tbss;
6778
6779                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
6780                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
6781                         if (tbss->next == bss) {
6782                                 tbss->next = bss->next;
6783                                 /* Unsubscribe management frames */
6784                                 nl80211_teardown_ap(bss);
6785                                 nl80211_destroy_bss(bss);
6786                                 if (!bss->added_if)
6787                                         i802_set_iface_flags(bss, 0);
6788                                 os_free(bss);
6789                                 bss = NULL;
6790                                 break;
6791                         }
6792                 }
6793                 if (bss)
6794                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
6795                                    "BSS %p in the list", __func__, bss);
6796         } else {
6797                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
6798                 nl80211_teardown_ap(bss);
6799                 if (!bss->added_if && !drv->first_bss->next)
6800                         wpa_driver_nl80211_del_beacon(drv);
6801                 nl80211_destroy_bss(bss);
6802                 if (!bss->added_if)
6803                         i802_set_iface_flags(bss, 0);
6804                 if (drv->first_bss->next) {
6805                         drv->first_bss = drv->first_bss->next;
6806                         drv->ctx = drv->first_bss->ctx;
6807                         os_free(bss);
6808                 } else {
6809                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
6810                 }
6811         }
6812
6813         return 0;
6814 }
6815
6816
6817 static int cookie_handler(struct nl_msg *msg, void *arg)
6818 {
6819         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6820         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6821         u64 *cookie = arg;
6822         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6823                   genlmsg_attrlen(gnlh, 0), NULL);
6824         if (tb[NL80211_ATTR_COOKIE])
6825                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
6826         return NL_SKIP;
6827 }
6828
6829
6830 static int nl80211_send_frame_cmd(struct i802_bss *bss,
6831                                   unsigned int freq, unsigned int wait,
6832                                   const u8 *buf, size_t buf_len,
6833                                   u64 *cookie_out, int no_cck, int no_ack,
6834                                   int offchanok)
6835 {
6836         struct wpa_driver_nl80211_data *drv = bss->drv;
6837         struct nl_msg *msg;
6838         u64 cookie;
6839         int ret = -1;
6840
6841         msg = nlmsg_alloc();
6842         if (!msg)
6843                 return -1;
6844
6845         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
6846                    "no_ack=%d offchanok=%d",
6847                    freq, wait, no_cck, no_ack, offchanok);
6848         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
6849         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
6850
6851         if (nl80211_set_iface_id(msg, bss) < 0)
6852                 goto nla_put_failure;
6853         if (freq)
6854                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
6855         if (wait)
6856                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
6857         if (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6858                           drv->test_use_roc_tx))
6859                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
6860         if (no_cck)
6861                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
6862         if (no_ack)
6863                 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
6864
6865         NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
6866
6867         cookie = 0;
6868         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6869         msg = NULL;
6870         if (ret) {
6871                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
6872                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
6873                            freq, wait);
6874                 goto nla_put_failure;
6875         }
6876         wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
6877                    "cookie 0x%llx", no_ack ? " (no ACK)" : "",
6878                    (long long unsigned int) cookie);
6879
6880         if (cookie_out)
6881                 *cookie_out = no_ack ? (u64) -1 : cookie;
6882
6883 nla_put_failure:
6884         nlmsg_free(msg);
6885         return ret;
6886 }
6887
6888
6889 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
6890                                           unsigned int freq,
6891                                           unsigned int wait_time,
6892                                           const u8 *dst, const u8 *src,
6893                                           const u8 *bssid,
6894                                           const u8 *data, size_t data_len,
6895                                           int no_cck)
6896 {
6897         struct wpa_driver_nl80211_data *drv = bss->drv;
6898         int ret = -1;
6899         u8 *buf;
6900         struct ieee80211_hdr *hdr;
6901
6902         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
6903                    "freq=%u MHz wait=%d ms no_cck=%d)",
6904                    drv->ifindex, freq, wait_time, no_cck);
6905
6906         buf = os_zalloc(24 + data_len);
6907         if (buf == NULL)
6908                 return ret;
6909         os_memcpy(buf + 24, data, data_len);
6910         hdr = (struct ieee80211_hdr *) buf;
6911         hdr->frame_control =
6912                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
6913         os_memcpy(hdr->addr1, dst, ETH_ALEN);
6914         os_memcpy(hdr->addr2, src, ETH_ALEN);
6915         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
6916
6917         if (is_ap_interface(drv->nlmode) &&
6918             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6919              (int) freq == bss->freq || drv->device_ap_sme ||
6920              !drv->use_monitor))
6921                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
6922                                                    0, freq, no_cck, 1,
6923                                                    wait_time);
6924         else
6925                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
6926                                              24 + data_len,
6927                                              &drv->send_action_cookie,
6928                                              no_cck, 0, 1);
6929
6930         os_free(buf);
6931         return ret;
6932 }
6933
6934
6935 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
6936 {
6937         struct i802_bss *bss = priv;
6938         struct wpa_driver_nl80211_data *drv = bss->drv;
6939         struct nl_msg *msg;
6940         int ret;
6941
6942         msg = nlmsg_alloc();
6943         if (!msg)
6944                 return;
6945
6946         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
6947                    (long long unsigned int) drv->send_action_cookie);
6948         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
6949
6950         if (nl80211_set_iface_id(msg, bss) < 0)
6951                 goto nla_put_failure;
6952         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
6953
6954         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6955         msg = NULL;
6956         if (ret)
6957                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
6958                            "(%s)", ret, strerror(-ret));
6959
6960  nla_put_failure:
6961         nlmsg_free(msg);
6962 }
6963
6964
6965 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
6966                                                 unsigned int duration)
6967 {
6968         struct i802_bss *bss = priv;
6969         struct wpa_driver_nl80211_data *drv = bss->drv;
6970         struct nl_msg *msg;
6971         int ret;
6972         u64 cookie;
6973
6974         msg = nlmsg_alloc();
6975         if (!msg)
6976                 return -1;
6977
6978         nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
6979
6980         if (nl80211_set_iface_id(msg, bss) < 0)
6981                 goto nla_put_failure;
6982
6983         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
6984         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
6985
6986         cookie = 0;
6987         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6988         msg = NULL;
6989         if (ret == 0) {
6990                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
6991                            "0x%llx for freq=%u MHz duration=%u",
6992                            (long long unsigned int) cookie, freq, duration);
6993                 drv->remain_on_chan_cookie = cookie;
6994                 drv->pending_remain_on_chan = 1;
6995                 return 0;
6996         }
6997         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
6998                    "(freq=%d duration=%u): %d (%s)",
6999                    freq, duration, ret, strerror(-ret));
7000 nla_put_failure:
7001         nlmsg_free(msg);
7002         return -1;
7003 }
7004
7005
7006 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
7007 {
7008         struct i802_bss *bss = priv;
7009         struct wpa_driver_nl80211_data *drv = bss->drv;
7010         struct nl_msg *msg;
7011         int ret;
7012
7013         if (!drv->pending_remain_on_chan) {
7014                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
7015                            "to cancel");
7016                 return -1;
7017         }
7018
7019         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
7020                    "0x%llx",
7021                    (long long unsigned int) drv->remain_on_chan_cookie);
7022
7023         msg = nlmsg_alloc();
7024         if (!msg)
7025                 return -1;
7026
7027         nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
7028
7029         if (nl80211_set_iface_id(msg, bss) < 0)
7030                 goto nla_put_failure;
7031
7032         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
7033
7034         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7035         msg = NULL;
7036         if (ret == 0)
7037                 return 0;
7038         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
7039                    "%d (%s)", ret, strerror(-ret));
7040 nla_put_failure:
7041         nlmsg_free(msg);
7042         return -1;
7043 }
7044
7045
7046 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
7047 {
7048         struct wpa_driver_nl80211_data *drv = bss->drv;
7049
7050         if (!report) {
7051                 if (bss->nl_preq && drv->device_ap_sme &&
7052                     is_ap_interface(drv->nlmode) && !bss->in_deinit &&
7053                     !bss->static_ap) {
7054                         /*
7055                          * Do not disable Probe Request reporting that was
7056                          * enabled in nl80211_setup_ap().
7057                          */
7058                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
7059                                    "Probe Request reporting nl_preq=%p while "
7060                                    "in AP mode", bss->nl_preq);
7061                 } else if (bss->nl_preq) {
7062                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
7063                                    "reporting nl_preq=%p", bss->nl_preq);
7064                         nl80211_destroy_eloop_handle(&bss->nl_preq);
7065                 }
7066                 return 0;
7067         }
7068
7069         if (bss->nl_preq) {
7070                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
7071                            "already on! nl_preq=%p", bss->nl_preq);
7072                 return 0;
7073         }
7074
7075         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
7076         if (bss->nl_preq == NULL)
7077                 return -1;
7078         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
7079                    "reporting nl_preq=%p", bss->nl_preq);
7080
7081         if (nl80211_register_frame(bss, bss->nl_preq,
7082                                    (WLAN_FC_TYPE_MGMT << 2) |
7083                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
7084                                    NULL, 0) < 0)
7085                 goto out_err;
7086
7087         nl80211_register_eloop_read(&bss->nl_preq,
7088                                     wpa_driver_nl80211_event_receive,
7089                                     bss->nl_cb);
7090
7091         return 0;
7092
7093  out_err:
7094         nl_destroy_handles(&bss->nl_preq);
7095         return -1;
7096 }
7097
7098
7099 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
7100                                      int ifindex, int disabled)
7101 {
7102         struct nl_msg *msg;
7103         struct nlattr *bands, *band;
7104         int ret;
7105
7106         msg = nlmsg_alloc();
7107         if (!msg)
7108                 return -1;
7109
7110         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
7111         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
7112
7113         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
7114         if (!bands)
7115                 goto nla_put_failure;
7116
7117         /*
7118          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
7119          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
7120          * rates. All 5 GHz rates are left enabled.
7121          */
7122         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
7123         if (!band)
7124                 goto nla_put_failure;
7125         if (disabled) {
7126                 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
7127                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
7128         }
7129         nla_nest_end(msg, band);
7130
7131         nla_nest_end(msg, bands);
7132
7133         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7134         msg = NULL;
7135         if (ret) {
7136                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
7137                            "(%s)", ret, strerror(-ret));
7138         } else
7139                 drv->disabled_11b_rates = disabled;
7140
7141         return ret;
7142
7143 nla_put_failure:
7144         nlmsg_free(msg);
7145         return -1;
7146 }
7147
7148
7149 static int wpa_driver_nl80211_deinit_ap(void *priv)
7150 {
7151         struct i802_bss *bss = priv;
7152         struct wpa_driver_nl80211_data *drv = bss->drv;
7153         if (!is_ap_interface(drv->nlmode))
7154                 return -1;
7155         wpa_driver_nl80211_del_beacon(drv);
7156         bss->beacon_set = 0;
7157
7158         /*
7159          * If the P2P GO interface was dynamically added, then it is
7160          * possible that the interface change to station is not possible.
7161          */
7162         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
7163                 return 0;
7164
7165         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
7166 }
7167
7168
7169 static int wpa_driver_nl80211_stop_ap(void *priv)
7170 {
7171         struct i802_bss *bss = priv;
7172         struct wpa_driver_nl80211_data *drv = bss->drv;
7173         if (!is_ap_interface(drv->nlmode))
7174                 return -1;
7175         wpa_driver_nl80211_del_beacon(drv);
7176         bss->beacon_set = 0;
7177         return 0;
7178 }
7179
7180
7181 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
7182 {
7183         struct i802_bss *bss = priv;
7184         struct wpa_driver_nl80211_data *drv = bss->drv;
7185         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
7186                 return -1;
7187
7188         /*
7189          * If the P2P Client interface was dynamically added, then it is
7190          * possible that the interface change to station is not possible.
7191          */
7192         if (bss->if_dynamic)
7193                 return 0;
7194
7195         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
7196 }
7197
7198
7199 static void wpa_driver_nl80211_resume(void *priv)
7200 {
7201         struct i802_bss *bss = priv;
7202
7203         if (i802_set_iface_flags(bss, 1))
7204                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
7205 }
7206
7207
7208 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
7209                                   const u8 *ies, size_t ies_len)
7210 {
7211         struct i802_bss *bss = priv;
7212         struct wpa_driver_nl80211_data *drv = bss->drv;
7213         int ret;
7214         u8 *data, *pos;
7215         size_t data_len;
7216         const u8 *own_addr = bss->addr;
7217
7218         if (action != 1) {
7219                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
7220                            "action %d", action);
7221                 return -1;
7222         }
7223
7224         /*
7225          * Action frame payload:
7226          * Category[1] = 6 (Fast BSS Transition)
7227          * Action[1] = 1 (Fast BSS Transition Request)
7228          * STA Address
7229          * Target AP Address
7230          * FT IEs
7231          */
7232
7233         data_len = 2 + 2 * ETH_ALEN + ies_len;
7234         data = os_malloc(data_len);
7235         if (data == NULL)
7236                 return -1;
7237         pos = data;
7238         *pos++ = 0x06; /* FT Action category */
7239         *pos++ = action;
7240         os_memcpy(pos, own_addr, ETH_ALEN);
7241         pos += ETH_ALEN;
7242         os_memcpy(pos, target_ap, ETH_ALEN);
7243         pos += ETH_ALEN;
7244         os_memcpy(pos, ies, ies_len);
7245
7246         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
7247                                              drv->bssid, own_addr, drv->bssid,
7248                                              data, data_len, 0);
7249         os_free(data);
7250
7251         return ret;
7252 }
7253
7254
7255 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
7256 {
7257         struct i802_bss *bss = priv;
7258         struct wpa_driver_nl80211_data *drv = bss->drv;
7259         struct nl_msg *msg;
7260         struct nlattr *cqm;
7261         int ret = -1;
7262
7263         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
7264                    "hysteresis=%d", threshold, hysteresis);
7265
7266         msg = nlmsg_alloc();
7267         if (!msg)
7268                 return -1;
7269
7270         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
7271
7272         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7273
7274         cqm = nla_nest_start(msg, NL80211_ATTR_CQM);
7275         if (cqm == NULL)
7276                 goto nla_put_failure;
7277
7278         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
7279         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
7280         nla_nest_end(msg, cqm);
7281
7282         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7283         msg = NULL;
7284
7285 nla_put_failure:
7286         nlmsg_free(msg);
7287         return ret;
7288 }
7289
7290
7291 static int get_channel_width(struct nl_msg *msg, void *arg)
7292 {
7293         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7294         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7295         struct wpa_signal_info *sig_change = arg;
7296
7297         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7298                   genlmsg_attrlen(gnlh, 0), NULL);
7299
7300         sig_change->center_frq1 = -1;
7301         sig_change->center_frq2 = -1;
7302         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
7303
7304         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
7305                 sig_change->chanwidth = convert2width(
7306                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
7307                 if (tb[NL80211_ATTR_CENTER_FREQ1])
7308                         sig_change->center_frq1 =
7309                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
7310                 if (tb[NL80211_ATTR_CENTER_FREQ2])
7311                         sig_change->center_frq2 =
7312                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
7313         }
7314
7315         return NL_SKIP;
7316 }
7317
7318
7319 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
7320                                      struct wpa_signal_info *sig)
7321 {
7322         struct nl_msg *msg;
7323
7324         msg = nlmsg_alloc();
7325         if (!msg)
7326                 return -ENOMEM;
7327
7328         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_INTERFACE);
7329         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7330
7331         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
7332
7333 nla_put_failure:
7334         nlmsg_free(msg);
7335         return -ENOBUFS;
7336 }
7337
7338
7339 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
7340 {
7341         struct i802_bss *bss = priv;
7342         struct wpa_driver_nl80211_data *drv = bss->drv;
7343         int res;
7344
7345         os_memset(si, 0, sizeof(*si));
7346         res = nl80211_get_link_signal(drv, si);
7347         if (res != 0)
7348                 return res;
7349
7350         res = nl80211_get_channel_width(drv, si);
7351         if (res != 0)
7352                 return res;
7353
7354         return nl80211_get_link_noise(drv, si);
7355 }
7356
7357
7358 static int wpa_driver_nl80211_shared_freq(void *priv)
7359 {
7360         struct i802_bss *bss = priv;
7361         struct wpa_driver_nl80211_data *drv = bss->drv;
7362         struct wpa_driver_nl80211_data *driver;
7363         int freq = 0;
7364
7365         /*
7366          * If the same PHY is in connected state with some other interface,
7367          * then retrieve the assoc freq.
7368          */
7369         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
7370                    drv->phyname);
7371
7372         dl_list_for_each(driver, &drv->global->interfaces,
7373                          struct wpa_driver_nl80211_data, list) {
7374                 if (drv == driver ||
7375                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
7376                     !driver->associated)
7377                         continue;
7378
7379                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
7380                            MACSTR,
7381                            driver->phyname, driver->first_bss->ifname,
7382                            MAC2STR(driver->first_bss->addr));
7383                 if (is_ap_interface(driver->nlmode))
7384                         freq = driver->first_bss->freq;
7385                 else
7386                         freq = nl80211_get_assoc_freq(driver);
7387                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
7388                            drv->phyname, freq);
7389         }
7390
7391         if (!freq)
7392                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
7393                            "PHY (%s) in associated state", drv->phyname);
7394
7395         return freq;
7396 }
7397
7398
7399 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
7400                               int encrypt)
7401 {
7402         struct i802_bss *bss = priv;
7403         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
7404                                              0, 0, 0, 0);
7405 }
7406
7407
7408 static int nl80211_set_param(void *priv, const char *param)
7409 {
7410         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
7411         if (param == NULL)
7412                 return 0;
7413
7414 #ifdef CONFIG_P2P
7415         if (os_strstr(param, "use_p2p_group_interface=1")) {
7416                 struct i802_bss *bss = priv;
7417                 struct wpa_driver_nl80211_data *drv = bss->drv;
7418
7419                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
7420                            "interface");
7421                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
7422                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
7423         }
7424 #endif /* CONFIG_P2P */
7425
7426         if (os_strstr(param, "use_monitor=1")) {
7427                 struct i802_bss *bss = priv;
7428                 struct wpa_driver_nl80211_data *drv = bss->drv;
7429                 drv->use_monitor = 1;
7430         }
7431
7432         if (os_strstr(param, "force_connect_cmd=1")) {
7433                 struct i802_bss *bss = priv;
7434                 struct wpa_driver_nl80211_data *drv = bss->drv;
7435                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
7436                 drv->force_connect_cmd = 1;
7437         }
7438
7439         if (os_strstr(param, "no_offchannel_tx=1")) {
7440                 struct i802_bss *bss = priv;
7441                 struct wpa_driver_nl80211_data *drv = bss->drv;
7442                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
7443                 drv->test_use_roc_tx = 1;
7444         }
7445
7446         return 0;
7447 }
7448
7449
7450 static void * nl80211_global_init(void)
7451 {
7452         struct nl80211_global *global;
7453         struct netlink_config *cfg;
7454
7455         global = os_zalloc(sizeof(*global));
7456         if (global == NULL)
7457                 return NULL;
7458         global->ioctl_sock = -1;
7459         dl_list_init(&global->interfaces);
7460         global->if_add_ifindex = -1;
7461
7462         cfg = os_zalloc(sizeof(*cfg));
7463         if (cfg == NULL)
7464                 goto err;
7465
7466         cfg->ctx = global;
7467         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
7468         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
7469         global->netlink = netlink_init(cfg);
7470         if (global->netlink == NULL) {
7471                 os_free(cfg);
7472                 goto err;
7473         }
7474
7475         if (wpa_driver_nl80211_init_nl_global(global) < 0)
7476                 goto err;
7477
7478         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
7479         if (global->ioctl_sock < 0) {
7480                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
7481                            strerror(errno));
7482                 goto err;
7483         }
7484
7485         return global;
7486
7487 err:
7488         nl80211_global_deinit(global);
7489         return NULL;
7490 }
7491
7492
7493 static void nl80211_global_deinit(void *priv)
7494 {
7495         struct nl80211_global *global = priv;
7496         if (global == NULL)
7497                 return;
7498         if (!dl_list_empty(&global->interfaces)) {
7499                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
7500                            "nl80211_global_deinit",
7501                            dl_list_len(&global->interfaces));
7502         }
7503
7504         if (global->netlink)
7505                 netlink_deinit(global->netlink);
7506
7507         nl_destroy_handles(&global->nl);
7508
7509         if (global->nl_event)
7510                 nl80211_destroy_eloop_handle(&global->nl_event);
7511
7512         nl_cb_put(global->nl_cb);
7513
7514         if (global->ioctl_sock >= 0)
7515                 close(global->ioctl_sock);
7516
7517         os_free(global);
7518 }
7519
7520
7521 static const char * nl80211_get_radio_name(void *priv)
7522 {
7523         struct i802_bss *bss = priv;
7524         struct wpa_driver_nl80211_data *drv = bss->drv;
7525         return drv->phyname;
7526 }
7527
7528
7529 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
7530                          const u8 *pmkid)
7531 {
7532         struct nl_msg *msg;
7533
7534         msg = nlmsg_alloc();
7535         if (!msg)
7536                 return -ENOMEM;
7537
7538         nl80211_cmd(bss->drv, msg, 0, cmd);
7539
7540         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7541         if (pmkid)
7542                 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
7543         if (bssid)
7544                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7545
7546         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7547  nla_put_failure:
7548         nlmsg_free(msg);
7549         return -ENOBUFS;
7550 }
7551
7552
7553 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7554 {
7555         struct i802_bss *bss = priv;
7556         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
7557         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
7558 }
7559
7560
7561 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7562 {
7563         struct i802_bss *bss = priv;
7564         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
7565                    MAC2STR(bssid));
7566         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
7567 }
7568
7569
7570 static int nl80211_flush_pmkid(void *priv)
7571 {
7572         struct i802_bss *bss = priv;
7573         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
7574         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
7575 }
7576
7577
7578 static void clean_survey_results(struct survey_results *survey_results)
7579 {
7580         struct freq_survey *survey, *tmp;
7581
7582         if (dl_list_empty(&survey_results->survey_list))
7583                 return;
7584
7585         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
7586                               struct freq_survey, list) {
7587                 dl_list_del(&survey->list);
7588                 os_free(survey);
7589         }
7590 }
7591
7592
7593 static void add_survey(struct nlattr **sinfo, u32 ifidx,
7594                        struct dl_list *survey_list)
7595 {
7596         struct freq_survey *survey;
7597
7598         survey = os_zalloc(sizeof(struct freq_survey));
7599         if  (!survey)
7600                 return;
7601
7602         survey->ifidx = ifidx;
7603         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7604         survey->filled = 0;
7605
7606         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
7607                 survey->nf = (int8_t)
7608                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
7609                 survey->filled |= SURVEY_HAS_NF;
7610         }
7611
7612         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
7613                 survey->channel_time =
7614                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
7615                 survey->filled |= SURVEY_HAS_CHAN_TIME;
7616         }
7617
7618         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
7619                 survey->channel_time_busy =
7620                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
7621                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
7622         }
7623
7624         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
7625                 survey->channel_time_rx =
7626                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
7627                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
7628         }
7629
7630         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
7631                 survey->channel_time_tx =
7632                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
7633                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
7634         }
7635
7636         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
7637                    survey->freq,
7638                    survey->nf,
7639                    (unsigned long int) survey->channel_time,
7640                    (unsigned long int) survey->channel_time_busy,
7641                    (unsigned long int) survey->channel_time_tx,
7642                    (unsigned long int) survey->channel_time_rx,
7643                    survey->filled);
7644
7645         dl_list_add_tail(survey_list, &survey->list);
7646 }
7647
7648
7649 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
7650                            unsigned int freq_filter)
7651 {
7652         if (!freq_filter)
7653                 return 1;
7654
7655         return freq_filter == surveyed_freq;
7656 }
7657
7658
7659 static int survey_handler(struct nl_msg *msg, void *arg)
7660 {
7661         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7662         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7663         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
7664         struct survey_results *survey_results;
7665         u32 surveyed_freq = 0;
7666         u32 ifidx;
7667
7668         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
7669                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
7670                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
7671         };
7672
7673         survey_results = (struct survey_results *) arg;
7674
7675         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7676                   genlmsg_attrlen(gnlh, 0), NULL);
7677
7678         if (!tb[NL80211_ATTR_IFINDEX])
7679                 return NL_SKIP;
7680
7681         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
7682
7683         if (!tb[NL80211_ATTR_SURVEY_INFO])
7684                 return NL_SKIP;
7685
7686         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
7687                              tb[NL80211_ATTR_SURVEY_INFO],
7688                              survey_policy))
7689                 return NL_SKIP;
7690
7691         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
7692                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
7693                 return NL_SKIP;
7694         }
7695
7696         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7697
7698         if (!check_survey_ok(sinfo, surveyed_freq,
7699                              survey_results->freq_filter))
7700                 return NL_SKIP;
7701
7702         if (survey_results->freq_filter &&
7703             survey_results->freq_filter != surveyed_freq) {
7704                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
7705                            surveyed_freq);
7706                 return NL_SKIP;
7707         }
7708
7709         add_survey(sinfo, ifidx, &survey_results->survey_list);
7710
7711         return NL_SKIP;
7712 }
7713
7714
7715 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
7716 {
7717         struct i802_bss *bss = priv;
7718         struct wpa_driver_nl80211_data *drv = bss->drv;
7719         struct nl_msg *msg;
7720         int err = -ENOBUFS;
7721         union wpa_event_data data;
7722         struct survey_results *survey_results;
7723
7724         os_memset(&data, 0, sizeof(data));
7725         survey_results = &data.survey_results;
7726
7727         dl_list_init(&survey_results->survey_list);
7728
7729         msg = nlmsg_alloc();
7730         if (!msg)
7731                 goto nla_put_failure;
7732
7733         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
7734
7735         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7736
7737         if (freq)
7738                 data.survey_results.freq_filter = freq;
7739
7740         do {
7741                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
7742                 err = send_and_recv_msgs(drv, msg, survey_handler,
7743                                          survey_results);
7744         } while (err > 0);
7745
7746         if (err) {
7747                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
7748                 goto out_clean;
7749         }
7750
7751         wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
7752
7753 out_clean:
7754         clean_survey_results(survey_results);
7755 nla_put_failure:
7756         return err;
7757 }
7758
7759
7760 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
7761                                    const u8 *replay_ctr)
7762 {
7763         struct i802_bss *bss = priv;
7764         struct wpa_driver_nl80211_data *drv = bss->drv;
7765         struct nlattr *replay_nested;
7766         struct nl_msg *msg;
7767
7768         msg = nlmsg_alloc();
7769         if (!msg)
7770                 return;
7771
7772         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7773
7774         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7775
7776         replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7777         if (!replay_nested)
7778                 goto nla_put_failure;
7779
7780         NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
7781         NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
7782         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
7783                 replay_ctr);
7784
7785         nla_nest_end(msg, replay_nested);
7786
7787         send_and_recv_msgs(drv, msg, NULL, NULL);
7788         return;
7789  nla_put_failure:
7790         nlmsg_free(msg);
7791 }
7792
7793
7794 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
7795                                     const u8 *addr, int qos)
7796 {
7797         /* send data frame to poll STA and check whether
7798          * this frame is ACKed */
7799         struct {
7800                 struct ieee80211_hdr hdr;
7801                 u16 qos_ctl;
7802         } STRUCT_PACKED nulldata;
7803         size_t size;
7804
7805         /* Send data frame to poll STA and check whether this frame is ACKed */
7806
7807         os_memset(&nulldata, 0, sizeof(nulldata));
7808
7809         if (qos) {
7810                 nulldata.hdr.frame_control =
7811                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7812                                      WLAN_FC_STYPE_QOS_NULL);
7813                 size = sizeof(nulldata);
7814         } else {
7815                 nulldata.hdr.frame_control =
7816                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7817                                      WLAN_FC_STYPE_NULLFUNC);
7818                 size = sizeof(struct ieee80211_hdr);
7819         }
7820
7821         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
7822         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
7823         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
7824         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
7825
7826         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
7827                                          0, 0) < 0)
7828                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
7829                            "send poll frame");
7830 }
7831
7832 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
7833                                 int qos)
7834 {
7835         struct i802_bss *bss = priv;
7836         struct wpa_driver_nl80211_data *drv = bss->drv;
7837         struct nl_msg *msg;
7838
7839         if (!drv->poll_command_supported) {
7840                 nl80211_send_null_frame(bss, own_addr, addr, qos);
7841                 return;
7842         }
7843
7844         msg = nlmsg_alloc();
7845         if (!msg)
7846                 return;
7847
7848         nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
7849
7850         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7851         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7852
7853         send_and_recv_msgs(drv, msg, NULL, NULL);
7854         return;
7855  nla_put_failure:
7856         nlmsg_free(msg);
7857 }
7858
7859
7860 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
7861 {
7862         struct nl_msg *msg;
7863
7864         msg = nlmsg_alloc();
7865         if (!msg)
7866                 return -ENOMEM;
7867
7868         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
7869         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
7870         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
7871                     enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
7872         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7873 nla_put_failure:
7874         nlmsg_free(msg);
7875         return -ENOBUFS;
7876 }
7877
7878
7879 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
7880                                      int ctwindow)
7881 {
7882         struct i802_bss *bss = priv;
7883
7884         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
7885                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
7886
7887         if (opp_ps != -1 || ctwindow != -1) {
7888 #ifdef ANDROID_P2P
7889                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
7890 #else /* ANDROID_P2P */
7891                 return -1; /* Not yet supported */
7892 #endif /* ANDROID_P2P */
7893         }
7894
7895         if (legacy_ps == -1)
7896                 return 0;
7897         if (legacy_ps != 0 && legacy_ps != 1)
7898                 return -1; /* Not yet supported */
7899
7900         return nl80211_set_power_save(bss, legacy_ps);
7901 }
7902
7903
7904 static int nl80211_start_radar_detection(void *priv,
7905                                          struct hostapd_freq_params *freq)
7906 {
7907         struct i802_bss *bss = priv;
7908         struct wpa_driver_nl80211_data *drv = bss->drv;
7909         struct nl_msg *msg;
7910         int ret;
7911
7912         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7913                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7914                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7915
7916         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
7917                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
7918                            "detection");
7919                 return -1;
7920         }
7921
7922         msg = nlmsg_alloc();
7923         if (!msg)
7924                 return -1;
7925
7926         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_RADAR_DETECT);
7927         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7928
7929         if (nl80211_put_freq_params(msg, freq) < 0)
7930                 goto nla_put_failure;
7931
7932         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7933         msg = NULL;
7934         if (ret == 0)
7935                 return 0;
7936         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
7937                    "%d (%s)", ret, strerror(-ret));
7938 nla_put_failure:
7939         nlmsg_free(msg);
7940         return -1;
7941 }
7942
7943 #ifdef CONFIG_TDLS
7944
7945 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
7946                                   u8 dialog_token, u16 status_code,
7947                                   u32 peer_capab, int initiator, const u8 *buf,
7948                                   size_t len)
7949 {
7950         struct i802_bss *bss = priv;
7951         struct wpa_driver_nl80211_data *drv = bss->drv;
7952         struct nl_msg *msg;
7953
7954         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7955                 return -EOPNOTSUPP;
7956
7957         if (!dst)
7958                 return -EINVAL;
7959
7960         msg = nlmsg_alloc();
7961         if (!msg)
7962                 return -ENOMEM;
7963
7964         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
7965         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7966         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
7967         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
7968         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
7969         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
7970         if (peer_capab) {
7971                 /*
7972                  * The internal enum tdls_peer_capability definition is
7973                  * currently identical with the nl80211 enum
7974                  * nl80211_tdls_peer_capability, so no conversion is needed
7975                  * here.
7976                  */
7977                 NLA_PUT_U32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY, peer_capab);
7978         }
7979         if (initiator)
7980                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_INITIATOR);
7981         NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
7982
7983         return send_and_recv_msgs(drv, msg, NULL, NULL);
7984
7985 nla_put_failure:
7986         nlmsg_free(msg);
7987         return -ENOBUFS;
7988 }
7989
7990
7991 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
7992 {
7993         struct i802_bss *bss = priv;
7994         struct wpa_driver_nl80211_data *drv = bss->drv;
7995         struct nl_msg *msg;
7996         enum nl80211_tdls_operation nl80211_oper;
7997
7998         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7999                 return -EOPNOTSUPP;
8000
8001         switch (oper) {
8002         case TDLS_DISCOVERY_REQ:
8003                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
8004                 break;
8005         case TDLS_SETUP:
8006                 nl80211_oper = NL80211_TDLS_SETUP;
8007                 break;
8008         case TDLS_TEARDOWN:
8009                 nl80211_oper = NL80211_TDLS_TEARDOWN;
8010                 break;
8011         case TDLS_ENABLE_LINK:
8012                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
8013                 break;
8014         case TDLS_DISABLE_LINK:
8015                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
8016                 break;
8017         case TDLS_ENABLE:
8018                 return 0;
8019         case TDLS_DISABLE:
8020                 return 0;
8021         default:
8022                 return -EINVAL;
8023         }
8024
8025         msg = nlmsg_alloc();
8026         if (!msg)
8027                 return -ENOMEM;
8028
8029         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
8030         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
8031         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8032         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
8033
8034         return send_and_recv_msgs(drv, msg, NULL, NULL);
8035
8036 nla_put_failure:
8037         nlmsg_free(msg);
8038         return -ENOBUFS;
8039 }
8040
8041 #endif /* CONFIG TDLS */
8042
8043
8044 static int driver_nl80211_set_key(const char *ifname, void *priv,
8045                                   enum wpa_alg alg, const u8 *addr,
8046                                   int key_idx, int set_tx,
8047                                   const u8 *seq, size_t seq_len,
8048                                   const u8 *key, size_t key_len)
8049 {
8050         struct i802_bss *bss = priv;
8051         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
8052                                           set_tx, seq, seq_len, key, key_len);
8053 }
8054
8055
8056 static int driver_nl80211_scan2(void *priv,
8057                                 struct wpa_driver_scan_params *params)
8058 {
8059         struct i802_bss *bss = priv;
8060         return wpa_driver_nl80211_scan(bss, params);
8061 }
8062
8063
8064 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
8065                                          int reason_code)
8066 {
8067         struct i802_bss *bss = priv;
8068         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
8069 }
8070
8071
8072 static int driver_nl80211_authenticate(void *priv,
8073                                        struct wpa_driver_auth_params *params)
8074 {
8075         struct i802_bss *bss = priv;
8076         return wpa_driver_nl80211_authenticate(bss, params);
8077 }
8078
8079
8080 static void driver_nl80211_deinit(void *priv)
8081 {
8082         struct i802_bss *bss = priv;
8083         wpa_driver_nl80211_deinit(bss);
8084 }
8085
8086
8087 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
8088                                     const char *ifname)
8089 {
8090         struct i802_bss *bss = priv;
8091         return wpa_driver_nl80211_if_remove(bss, type, ifname);
8092 }
8093
8094
8095 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
8096                                     size_t data_len, int noack)
8097 {
8098         struct i802_bss *bss = priv;
8099         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
8100                                             0, 0, 0, 0);
8101 }
8102
8103
8104 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
8105 {
8106         struct i802_bss *bss = priv;
8107         return wpa_driver_nl80211_sta_remove(bss, addr, -1, 0);
8108 }
8109
8110
8111 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
8112                                        const char *ifname, int vlan_id)
8113 {
8114         struct i802_bss *bss = priv;
8115         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
8116 }
8117
8118
8119 static int driver_nl80211_read_sta_data(void *priv,
8120                                         struct hostap_sta_driver_data *data,
8121                                         const u8 *addr)
8122 {
8123         struct i802_bss *bss = priv;
8124         return i802_read_sta_data(bss, data, addr);
8125 }
8126
8127
8128 static int driver_nl80211_send_action(void *priv, unsigned int freq,
8129                                       unsigned int wait_time,
8130                                       const u8 *dst, const u8 *src,
8131                                       const u8 *bssid,
8132                                       const u8 *data, size_t data_len,
8133                                       int no_cck)
8134 {
8135         struct i802_bss *bss = priv;
8136         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
8137                                               bssid, data, data_len, no_cck);
8138 }
8139
8140
8141 static int driver_nl80211_probe_req_report(void *priv, int report)
8142 {
8143         struct i802_bss *bss = priv;
8144         return wpa_driver_nl80211_probe_req_report(bss, report);
8145 }
8146
8147
8148 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
8149                                             const u8 *ies, size_t ies_len)
8150 {
8151         int ret;
8152         struct nl_msg *msg;
8153         struct i802_bss *bss = priv;
8154         struct wpa_driver_nl80211_data *drv = bss->drv;
8155         u16 mdid = WPA_GET_LE16(md);
8156
8157         msg = nlmsg_alloc();
8158         if (!msg)
8159                 return -ENOMEM;
8160
8161         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
8162         nl80211_cmd(drv, msg, 0, NL80211_CMD_UPDATE_FT_IES);
8163         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8164         NLA_PUT(msg, NL80211_ATTR_IE, ies_len, ies);
8165         NLA_PUT_U16(msg, NL80211_ATTR_MDID, mdid);
8166
8167         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8168         if (ret) {
8169                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
8170                            "err=%d (%s)", ret, strerror(-ret));
8171         }
8172
8173         return ret;
8174
8175 nla_put_failure:
8176         nlmsg_free(msg);
8177         return -ENOBUFS;
8178 }
8179
8180
8181 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
8182 {
8183         struct i802_bss *bss = priv;
8184         struct wpa_driver_nl80211_data *drv = bss->drv;
8185
8186         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
8187                 return NULL;
8188
8189         return bss->addr;
8190 }
8191
8192
8193 static const char * scan_state_str(enum scan_states scan_state)
8194 {
8195         switch (scan_state) {
8196         case NO_SCAN:
8197                 return "NO_SCAN";
8198         case SCAN_REQUESTED:
8199                 return "SCAN_REQUESTED";
8200         case SCAN_STARTED:
8201                 return "SCAN_STARTED";
8202         case SCAN_COMPLETED:
8203                 return "SCAN_COMPLETED";
8204         case SCAN_ABORTED:
8205                 return "SCAN_ABORTED";
8206         case SCHED_SCAN_STARTED:
8207                 return "SCHED_SCAN_STARTED";
8208         case SCHED_SCAN_STOPPED:
8209                 return "SCHED_SCAN_STOPPED";
8210         case SCHED_SCAN_RESULTS:
8211                 return "SCHED_SCAN_RESULTS";
8212         }
8213
8214         return "??";
8215 }
8216
8217
8218 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
8219 {
8220         struct i802_bss *bss = priv;
8221         struct wpa_driver_nl80211_data *drv = bss->drv;
8222         int res;
8223         char *pos, *end;
8224
8225         pos = buf;
8226         end = buf + buflen;
8227
8228         res = os_snprintf(pos, end - pos,
8229                           "ifindex=%d\n"
8230                           "ifname=%s\n"
8231                           "brname=%s\n"
8232                           "addr=" MACSTR "\n"
8233                           "freq=%d\n"
8234                           "%s%s%s%s%s",
8235                           bss->ifindex,
8236                           bss->ifname,
8237                           bss->brname,
8238                           MAC2STR(bss->addr),
8239                           bss->freq,
8240                           bss->beacon_set ? "beacon_set=1\n" : "",
8241                           bss->added_if_into_bridge ?
8242                           "added_if_into_bridge=1\n" : "",
8243                           bss->added_bridge ? "added_bridge=1\n" : "",
8244                           bss->in_deinit ? "in_deinit=1\n" : "",
8245                           bss->if_dynamic ? "if_dynamic=1\n" : "");
8246         if (res < 0 || res >= end - pos)
8247                 return pos - buf;
8248         pos += res;
8249
8250         if (bss->wdev_id_set) {
8251                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
8252                                   (unsigned long long) bss->wdev_id);
8253                 if (res < 0 || res >= end - pos)
8254                         return pos - buf;
8255                 pos += res;
8256         }
8257
8258         res = os_snprintf(pos, end - pos,
8259                           "phyname=%s\n"
8260                           "perm_addr=" MACSTR "\n"
8261                           "drv_ifindex=%d\n"
8262                           "operstate=%d\n"
8263                           "scan_state=%s\n"
8264                           "auth_bssid=" MACSTR "\n"
8265                           "auth_attempt_bssid=" MACSTR "\n"
8266                           "bssid=" MACSTR "\n"
8267                           "prev_bssid=" MACSTR "\n"
8268                           "associated=%d\n"
8269                           "assoc_freq=%u\n"
8270                           "monitor_sock=%d\n"
8271                           "monitor_ifidx=%d\n"
8272                           "monitor_refcount=%d\n"
8273                           "last_mgmt_freq=%u\n"
8274                           "eapol_tx_sock=%d\n"
8275                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
8276                           drv->phyname,
8277                           MAC2STR(drv->perm_addr),
8278                           drv->ifindex,
8279                           drv->operstate,
8280                           scan_state_str(drv->scan_state),
8281                           MAC2STR(drv->auth_bssid),
8282                           MAC2STR(drv->auth_attempt_bssid),
8283                           MAC2STR(drv->bssid),
8284                           MAC2STR(drv->prev_bssid),
8285                           drv->associated,
8286                           drv->assoc_freq,
8287                           drv->monitor_sock,
8288                           drv->monitor_ifidx,
8289                           drv->monitor_refcount,
8290                           drv->last_mgmt_freq,
8291                           drv->eapol_tx_sock,
8292                           drv->ignore_if_down_event ?
8293                           "ignore_if_down_event=1\n" : "",
8294                           drv->scan_complete_events ?
8295                           "scan_complete_events=1\n" : "",
8296                           drv->disabled_11b_rates ?
8297                           "disabled_11b_rates=1\n" : "",
8298                           drv->pending_remain_on_chan ?
8299                           "pending_remain_on_chan=1\n" : "",
8300                           drv->in_interface_list ? "in_interface_list=1\n" : "",
8301                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
8302                           drv->poll_command_supported ?
8303                           "poll_command_supported=1\n" : "",
8304                           drv->data_tx_status ? "data_tx_status=1\n" : "",
8305                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
8306                           drv->retry_auth ? "retry_auth=1\n" : "",
8307                           drv->use_monitor ? "use_monitor=1\n" : "",
8308                           drv->ignore_next_local_disconnect ?
8309                           "ignore_next_local_disconnect=1\n" : "",
8310                           drv->ignore_next_local_deauth ?
8311                           "ignore_next_local_deauth=1\n" : "");
8312         if (res < 0 || res >= end - pos)
8313                 return pos - buf;
8314         pos += res;
8315
8316         if (drv->has_capability) {
8317                 res = os_snprintf(pos, end - pos,
8318                                   "capa.key_mgmt=0x%x\n"
8319                                   "capa.enc=0x%x\n"
8320                                   "capa.auth=0x%x\n"
8321                                   "capa.flags=0x%llx\n"
8322                                   "capa.max_scan_ssids=%d\n"
8323                                   "capa.max_sched_scan_ssids=%d\n"
8324                                   "capa.sched_scan_supported=%d\n"
8325                                   "capa.max_match_sets=%d\n"
8326                                   "capa.max_remain_on_chan=%u\n"
8327                                   "capa.max_stations=%u\n"
8328                                   "capa.probe_resp_offloads=0x%x\n"
8329                                   "capa.max_acl_mac_addrs=%u\n"
8330                                   "capa.num_multichan_concurrent=%u\n",
8331                                   drv->capa.key_mgmt,
8332                                   drv->capa.enc,
8333                                   drv->capa.auth,
8334                                   (unsigned long long) drv->capa.flags,
8335                                   drv->capa.max_scan_ssids,
8336                                   drv->capa.max_sched_scan_ssids,
8337                                   drv->capa.sched_scan_supported,
8338                                   drv->capa.max_match_sets,
8339                                   drv->capa.max_remain_on_chan,
8340                                   drv->capa.max_stations,
8341                                   drv->capa.probe_resp_offloads,
8342                                   drv->capa.max_acl_mac_addrs,
8343                                   drv->capa.num_multichan_concurrent);
8344                 if (res < 0 || res >= end - pos)
8345                         return pos - buf;
8346                 pos += res;
8347         }
8348
8349         return pos - buf;
8350 }
8351
8352
8353 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
8354 {
8355         if (settings->head)
8356                 NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD,
8357                         settings->head_len, settings->head);
8358
8359         if (settings->tail)
8360                 NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL,
8361                         settings->tail_len, settings->tail);
8362
8363         if (settings->beacon_ies)
8364                 NLA_PUT(msg, NL80211_ATTR_IE,
8365                         settings->beacon_ies_len, settings->beacon_ies);
8366
8367         if (settings->proberesp_ies)
8368                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
8369                         settings->proberesp_ies_len, settings->proberesp_ies);
8370
8371         if (settings->assocresp_ies)
8372                 NLA_PUT(msg,
8373                         NL80211_ATTR_IE_ASSOC_RESP,
8374                         settings->assocresp_ies_len, settings->assocresp_ies);
8375
8376         if (settings->probe_resp)
8377                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP,
8378                         settings->probe_resp_len, settings->probe_resp);
8379
8380         return 0;
8381
8382 nla_put_failure:
8383         return -ENOBUFS;
8384 }
8385
8386
8387 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
8388 {
8389         struct nl_msg *msg;
8390         struct i802_bss *bss = priv;
8391         struct wpa_driver_nl80211_data *drv = bss->drv;
8392         struct nlattr *beacon_csa;
8393         int ret = -ENOBUFS;
8394
8395         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
8396                    settings->cs_count, settings->block_tx,
8397                    settings->freq_params.freq, settings->freq_params.bandwidth,
8398                    settings->freq_params.center_freq1,
8399                    settings->freq_params.center_freq2);
8400
8401         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
8402                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
8403                 return -EOPNOTSUPP;
8404         }
8405
8406         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
8407             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
8408                 return -EOPNOTSUPP;
8409
8410         /* check settings validity */
8411         if (!settings->beacon_csa.tail ||
8412             ((settings->beacon_csa.tail_len <=
8413               settings->counter_offset_beacon) ||
8414              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
8415               settings->cs_count)))
8416                 return -EINVAL;
8417
8418         if (settings->beacon_csa.probe_resp &&
8419             ((settings->beacon_csa.probe_resp_len <=
8420               settings->counter_offset_presp) ||
8421              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
8422               settings->cs_count)))
8423                 return -EINVAL;
8424
8425         msg = nlmsg_alloc();
8426         if (!msg)
8427                 return -ENOMEM;
8428
8429         nl80211_cmd(drv, msg, 0, NL80211_CMD_CHANNEL_SWITCH);
8430         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8431         NLA_PUT_U32(msg, NL80211_ATTR_CH_SWITCH_COUNT, settings->cs_count);
8432         ret = nl80211_put_freq_params(msg, &settings->freq_params);
8433         if (ret)
8434                 goto error;
8435
8436         if (settings->block_tx)
8437                 NLA_PUT_FLAG(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX);
8438
8439         /* beacon_after params */
8440         ret = set_beacon_data(msg, &settings->beacon_after);
8441         if (ret)
8442                 goto error;
8443
8444         /* beacon_csa params */
8445         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
8446         if (!beacon_csa)
8447                 goto nla_put_failure;
8448
8449         ret = set_beacon_data(msg, &settings->beacon_csa);
8450         if (ret)
8451                 goto error;
8452
8453         NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
8454                     settings->counter_offset_beacon);
8455
8456         if (settings->beacon_csa.probe_resp)
8457                 NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
8458                             settings->counter_offset_presp);
8459
8460         nla_nest_end(msg, beacon_csa);
8461         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8462         if (ret) {
8463                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
8464                            ret, strerror(-ret));
8465         }
8466         return ret;
8467
8468 nla_put_failure:
8469         ret = -ENOBUFS;
8470 error:
8471         nlmsg_free(msg);
8472         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
8473         return ret;
8474 }
8475
8476
8477 static int nl80211_add_ts(void *priv, u8 tsid, const u8 *addr,
8478                           u8 user_priority, u16 admitted_time)
8479 {
8480         struct i802_bss *bss = priv;
8481         struct wpa_driver_nl80211_data *drv = bss->drv;
8482         struct nl_msg *msg;
8483         int ret;
8484
8485         wpa_printf(MSG_DEBUG,
8486                    "nl80211: add_ts request: tsid=%u admitted_time=%u up=%d",
8487                    tsid, admitted_time, user_priority);
8488
8489         if (!is_sta_interface(drv->nlmode))
8490                 return -ENOTSUP;
8491
8492         msg = nlmsg_alloc();
8493         if (!msg)
8494                 return -ENOMEM;
8495
8496         nl80211_cmd(drv, msg, 0, NL80211_CMD_ADD_TX_TS);
8497         if (nl80211_set_iface_id(msg, bss) < 0)
8498                 goto nla_put_failure;
8499
8500         NLA_PUT_U8(msg, NL80211_ATTR_TSID, tsid);
8501         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8502         NLA_PUT_U8(msg, NL80211_ATTR_USER_PRIO, user_priority);
8503         NLA_PUT_U16(msg, NL80211_ATTR_ADMITTED_TIME, admitted_time);
8504
8505         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8506         if (ret)
8507                 wpa_printf(MSG_DEBUG, "nl80211: add_ts failed err=%d (%s)",
8508                            ret, strerror(-ret));
8509         return ret;
8510
8511 nla_put_failure:
8512         nlmsg_free(msg);
8513         return -ENOBUFS;
8514 }
8515
8516
8517 static int nl80211_del_ts(void *priv, u8 tsid, const u8 *addr)
8518 {
8519         struct i802_bss *bss = priv;
8520         struct wpa_driver_nl80211_data *drv = bss->drv;
8521         struct nl_msg *msg;
8522         int ret;
8523
8524         wpa_printf(MSG_DEBUG, "nl80211: del_ts request: tsid=%u", tsid);
8525
8526         if (!is_sta_interface(drv->nlmode))
8527                 return -ENOTSUP;
8528
8529         msg = nlmsg_alloc();
8530         if (!msg)
8531                 return -ENOMEM;
8532
8533         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_TX_TS);
8534         if (nl80211_set_iface_id(msg, bss) < 0)
8535                 goto nla_put_failure;
8536
8537         NLA_PUT_U8(msg, NL80211_ATTR_TSID, tsid);
8538         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8539
8540         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8541         if (ret)
8542                 wpa_printf(MSG_DEBUG, "nl80211: del_ts failed err=%d (%s)",
8543                            ret, strerror(-ret));
8544         return ret;
8545
8546 nla_put_failure:
8547         nlmsg_free(msg);
8548         return -ENOBUFS;
8549 }
8550
8551
8552 #ifdef CONFIG_TESTING_OPTIONS
8553 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
8554 {
8555         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8556         struct wpabuf *buf = arg;
8557
8558         if (!buf)
8559                 return NL_SKIP;
8560
8561         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
8562                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
8563                 return NL_SKIP;
8564         }
8565
8566         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
8567                         genlmsg_attrlen(gnlh, 0));
8568
8569         return NL_SKIP;
8570 }
8571 #endif /* CONFIG_TESTING_OPTIONS */
8572
8573
8574 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
8575 {
8576         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8577         struct nlattr *nl_vendor_reply, *nl;
8578         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8579         struct wpabuf *buf = arg;
8580         int rem;
8581
8582         if (!buf)
8583                 return NL_SKIP;
8584
8585         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8586                   genlmsg_attrlen(gnlh, 0), NULL);
8587         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
8588
8589         if (!nl_vendor_reply)
8590                 return NL_SKIP;
8591
8592         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
8593                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
8594                 return NL_SKIP;
8595         }
8596
8597         nla_for_each_nested(nl, nl_vendor_reply, rem) {
8598                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
8599         }
8600
8601         return NL_SKIP;
8602 }
8603
8604
8605 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
8606                               unsigned int subcmd, const u8 *data,
8607                               size_t data_len, struct wpabuf *buf)
8608 {
8609         struct i802_bss *bss = priv;
8610         struct wpa_driver_nl80211_data *drv = bss->drv;
8611         struct nl_msg *msg;
8612         int ret;
8613
8614         msg = nlmsg_alloc();
8615         if (!msg)
8616                 return -ENOMEM;
8617
8618 #ifdef CONFIG_TESTING_OPTIONS
8619         if (vendor_id == 0xffffffff) {
8620                 nl80211_cmd(drv, msg, 0, subcmd);
8621                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
8622                     0)
8623                         goto nla_put_failure;
8624                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
8625                 if (ret)
8626                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
8627                                    ret);
8628                 return ret;
8629         }
8630 #endif /* CONFIG_TESTING_OPTIONS */
8631
8632         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
8633         if (nl80211_set_iface_id(msg, bss) < 0)
8634                 goto nla_put_failure;
8635         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, vendor_id);
8636         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd);
8637         if (data)
8638                 NLA_PUT(msg, NL80211_ATTR_VENDOR_DATA, data_len, data);
8639
8640         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
8641         if (ret)
8642                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
8643                            ret);
8644         return ret;
8645
8646 nla_put_failure:
8647         nlmsg_free(msg);
8648         return -ENOBUFS;
8649 }
8650
8651
8652 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
8653                                u8 qos_map_set_len)
8654 {
8655         struct i802_bss *bss = priv;
8656         struct wpa_driver_nl80211_data *drv = bss->drv;
8657         struct nl_msg *msg;
8658         int ret;
8659
8660         msg = nlmsg_alloc();
8661         if (!msg)
8662                 return -ENOMEM;
8663
8664         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
8665                     qos_map_set, qos_map_set_len);
8666
8667         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_QOS_MAP);
8668         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8669         NLA_PUT(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set);
8670
8671         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8672         if (ret)
8673                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
8674
8675         return ret;
8676
8677 nla_put_failure:
8678         nlmsg_free(msg);
8679         return -ENOBUFS;
8680 }
8681
8682
8683 static int nl80211_set_wowlan(void *priv,
8684                               const struct wowlan_triggers *triggers)
8685 {
8686         struct i802_bss *bss = priv;
8687         struct wpa_driver_nl80211_data *drv = bss->drv;
8688         struct nl_msg *msg;
8689         struct nlattr *wowlan_triggers;
8690         int ret;
8691
8692         msg = nlmsg_alloc();
8693         if (!msg)
8694                 return -ENOMEM;
8695
8696         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
8697
8698         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WOWLAN);
8699         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8700
8701         wowlan_triggers = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8702         if (!wowlan_triggers)
8703                 goto nla_put_failure;
8704
8705         if (triggers->any)
8706                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
8707         if (triggers->disconnect)
8708                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
8709         if (triggers->magic_pkt)
8710                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
8711         if (triggers->gtk_rekey_failure)
8712                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
8713         if (triggers->eap_identity_req)
8714                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
8715         if (triggers->four_way_handshake)
8716                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
8717         if (triggers->rfkill_release)
8718                 NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
8719
8720         nla_nest_end(msg, wowlan_triggers);
8721
8722         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8723         if (ret)
8724                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
8725
8726         return ret;
8727
8728 nla_put_failure:
8729         nlmsg_free(msg);
8730         return -ENOBUFS;
8731 }
8732
8733
8734 static int nl80211_roaming(void *priv, int allowed, const u8 *bssid)
8735 {
8736         struct i802_bss *bss = priv;
8737         struct wpa_driver_nl80211_data *drv = bss->drv;
8738         struct nl_msg *msg;
8739         struct nlattr *params;
8740
8741         wpa_printf(MSG_DEBUG, "nl80211: Roaming policy: allowed=%d", allowed);
8742
8743         if (!drv->roaming_vendor_cmd_avail) {
8744                 wpa_printf(MSG_DEBUG,
8745                            "nl80211: Ignore roaming policy change since driver does not provide command for setting it");
8746                 return -1;
8747         }
8748
8749         msg = nlmsg_alloc();
8750         if (!msg)
8751                 return -ENOMEM;
8752
8753         nl80211_cmd(drv, msg, 0, NL80211_CMD_VENDOR);
8754
8755         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8756         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA);
8757         NLA_PUT_U32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8758                     QCA_NL80211_VENDOR_SUBCMD_ROAMING);
8759
8760         params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
8761         if (!params)
8762                 goto nla_put_failure;
8763         NLA_PUT_U32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY,
8764                     allowed ? QCA_ROAMING_ALLOWED_WITHIN_ESS :
8765                     QCA_ROAMING_NOT_ALLOWED);
8766         if (bssid)
8767                 NLA_PUT(msg, QCA_WLAN_VENDOR_ATTR_MAC_ADDR, ETH_ALEN, bssid);
8768         nla_nest_end(msg, params);
8769
8770         return send_and_recv_msgs(drv, msg, NULL, NULL);
8771
8772  nla_put_failure:
8773         nlmsg_free(msg);
8774         return -1;
8775 }
8776
8777
8778 static int nl80211_set_mac_addr(void *priv, const u8 *addr)
8779 {
8780         struct i802_bss *bss = priv;
8781         struct wpa_driver_nl80211_data *drv = bss->drv;
8782         int new_addr = addr != NULL;
8783
8784         if (!addr)
8785                 addr = drv->perm_addr;
8786
8787         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) < 0)
8788                 return -1;
8789
8790         if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname, addr) < 0)
8791         {
8792                 wpa_printf(MSG_DEBUG,
8793                            "nl80211: failed to set_mac_addr for %s to " MACSTR,
8794                            bss->ifname, MAC2STR(addr));
8795                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
8796                                           1) < 0) {
8797                         wpa_printf(MSG_DEBUG,
8798                                    "nl80211: Could not restore interface UP after failed set_mac_addr");
8799                 }
8800                 return -1;
8801         }
8802
8803         wpa_printf(MSG_DEBUG, "nl80211: set_mac_addr for %s to " MACSTR,
8804                    bss->ifname, MAC2STR(addr));
8805         drv->addr_changed = new_addr;
8806         os_memcpy(bss->addr, addr, ETH_ALEN);
8807
8808         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1) < 0)
8809         {
8810                 wpa_printf(MSG_DEBUG,
8811                            "nl80211: Could not restore interface UP after set_mac_addr");
8812         }
8813
8814         return 0;
8815 }
8816
8817
8818 #ifdef CONFIG_MESH
8819
8820 static int wpa_driver_nl80211_init_mesh(void *priv)
8821 {
8822         if (wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_MESH_POINT)) {
8823                 wpa_printf(MSG_INFO,
8824                            "nl80211: Failed to set interface into mesh mode");
8825                 return -1;
8826         }
8827         return 0;
8828 }
8829
8830
8831 static int
8832 wpa_driver_nl80211_join_mesh(void *priv,
8833                              struct wpa_driver_mesh_join_params *params)
8834 {
8835         struct i802_bss *bss = priv;
8836         struct wpa_driver_nl80211_data *drv = bss->drv;
8837         struct nl_msg *msg;
8838         struct nlattr *container;
8839         int ret = 0;
8840
8841         msg = nlmsg_alloc();
8842         if (!msg)
8843                 return -1;
8844
8845         wpa_printf(MSG_DEBUG, "nl80211: mesh join (ifindex=%d)", drv->ifindex);
8846         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_MESH);
8847
8848         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8849         if (params->freq) {
8850                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8851                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
8852         }
8853
8854         if (params->ht_mode) {
8855                 unsigned int ht_value;
8856                 char *ht_mode = "";
8857
8858                 switch (params->ht_mode) {
8859                 default:
8860                 case CHAN_NO_HT:
8861                         ht_value = NL80211_CHAN_NO_HT;
8862                         ht_mode = "NOHT";
8863                         break;
8864                 case CHAN_HT20:
8865                         ht_value = NL80211_CHAN_HT20;
8866                         ht_mode = "HT20";
8867                         break;
8868                 case CHAN_HT40PLUS:
8869                         ht_value = NL80211_CHAN_HT40PLUS;
8870                         ht_mode = "HT40+";
8871                         break;
8872                 case CHAN_HT40MINUS:
8873                         ht_value = NL80211_CHAN_HT40MINUS;
8874                         ht_mode = "HT40-";
8875                         break;
8876                 }
8877                 wpa_printf(MSG_DEBUG, "  * ht_mode=%s", ht_mode);
8878                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ht_value);
8879         }
8880
8881         if (params->basic_rates) {
8882                 u8 rates[NL80211_MAX_SUPP_RATES];
8883                 u8 rates_len = 0;
8884                 int i;
8885
8886                 for (i = 0; i < NL80211_MAX_SUPP_RATES; i++) {
8887                         if (params->basic_rates[i] < 0)
8888                                 break;
8889                         rates[rates_len++] = params->basic_rates[i] / 5;
8890                 }
8891
8892                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
8893         }
8894
8895         if (params->meshid) {
8896                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8897                                   params->meshid, params->meshid_len);
8898                 NLA_PUT(msg, NL80211_ATTR_MESH_ID, params->meshid_len,
8899                         params->meshid);
8900         }
8901
8902         wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
8903
8904         container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
8905         if (!container)
8906                 goto nla_put_failure;
8907
8908         if (params->ies) {
8909                 wpa_hexdump(MSG_DEBUG, "  * IEs", params->ies, params->ie_len);
8910                 NLA_PUT(msg, NL80211_MESH_SETUP_IE, params->ie_len,
8911                         params->ies);
8912         }
8913         /* WPA_DRIVER_MESH_FLAG_OPEN_AUTH is treated as default by nl80211 */
8914         if (params->flags & WPA_DRIVER_MESH_FLAG_SAE_AUTH) {
8915                 NLA_PUT_U8(msg, NL80211_MESH_SETUP_AUTH_PROTOCOL, 0x1);
8916                 NLA_PUT_FLAG(msg, NL80211_MESH_SETUP_USERSPACE_AUTH);
8917         }
8918         if (params->flags & WPA_DRIVER_MESH_FLAG_AMPE)
8919                 NLA_PUT_FLAG(msg, NL80211_MESH_SETUP_USERSPACE_AMPE);
8920         if (params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM)
8921                 NLA_PUT_FLAG(msg, NL80211_MESH_SETUP_USERSPACE_MPM);
8922         nla_nest_end(msg, container);
8923
8924         container = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
8925         if (!container)
8926                 goto nla_put_failure;
8927
8928         if (!(params->conf.flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS))
8929                 NLA_PUT_U32(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 0);
8930         nla_nest_end(msg, container);
8931
8932         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8933         msg = NULL;
8934         if (ret) {
8935                 wpa_printf(MSG_DEBUG, "nl80211: mesh join failed: ret=%d (%s)",
8936                            ret, strerror(-ret));
8937                 goto nla_put_failure;
8938         }
8939         ret = 0;
8940         bss->freq = params->freq;
8941         wpa_printf(MSG_DEBUG, "nl80211: mesh join request send successfully");
8942
8943
8944 nla_put_failure:
8945         nlmsg_free(msg);
8946         return ret;
8947 }
8948
8949
8950 static int wpa_driver_nl80211_leave_mesh(void *priv)
8951 {
8952         struct i802_bss *bss = priv;
8953         struct wpa_driver_nl80211_data *drv = bss->drv;
8954         struct nl_msg *msg;
8955         int ret = 0;
8956
8957         msg = nlmsg_alloc();
8958         if (!msg)
8959                 return -1;
8960
8961         wpa_printf(MSG_DEBUG, "nl80211: mesh leave (ifindex=%d)", drv->ifindex);
8962         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_MESH);
8963         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8964
8965         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8966         msg = NULL;
8967         if (ret) {
8968                 wpa_printf(MSG_DEBUG, "nl80211: mesh leave failed: ret=%d (%s)",
8969                            ret, strerror(-ret));
8970                 goto nla_put_failure;
8971         }
8972         ret = 0;
8973         wpa_printf(MSG_DEBUG, "nl80211: mesh leave request send successfully");
8974
8975 nla_put_failure:
8976         nlmsg_free(msg);
8977         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8978                                         NL80211_IFTYPE_STATION)) {
8979                 wpa_printf(MSG_INFO,
8980                            "nl80211: Failed to set interface into station mode");
8981         }
8982         return ret;
8983 }
8984
8985 #endif /* CONFIG_MESH */
8986
8987
8988 static int wpa_driver_br_add_ip_neigh(void *priv, u8 version,
8989                                       const u8 *ipaddr, int prefixlen,
8990                                       const u8 *addr)
8991 {
8992 #ifdef CONFIG_LIBNL3_ROUTE
8993         struct i802_bss *bss = priv;
8994         struct wpa_driver_nl80211_data *drv = bss->drv;
8995         struct rtnl_neigh *rn;
8996         struct nl_addr *nl_ipaddr = NULL;
8997         struct nl_addr *nl_lladdr = NULL;
8998         int family, addrsize;
8999         int res;
9000
9001         if (!ipaddr || prefixlen == 0 || !addr)
9002                 return -EINVAL;
9003
9004         if (bss->br_ifindex == 0) {
9005                 wpa_printf(MSG_DEBUG,
9006                            "nl80211: bridge must be set before adding an ip neigh to it");
9007                 return -1;
9008         }
9009
9010         if (!drv->rtnl_sk) {
9011                 wpa_printf(MSG_DEBUG,
9012                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
9013                 return -1;
9014         }
9015
9016         if (version == 4) {
9017                 family = AF_INET;
9018                 addrsize = 4;
9019         } else if (version == 6) {
9020                 family = AF_INET6;
9021                 addrsize = 16;
9022         } else {
9023                 return -EINVAL;
9024         }
9025
9026         rn = rtnl_neigh_alloc();
9027         if (rn == NULL)
9028                 return -ENOMEM;
9029
9030         /* set the destination ip address for neigh */
9031         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
9032         if (nl_ipaddr == NULL) {
9033                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
9034                 res = -ENOMEM;
9035                 goto errout;
9036         }
9037         nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
9038         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
9039         if (res) {
9040                 wpa_printf(MSG_DEBUG,
9041                            "nl80211: neigh set destination addr failed");
9042                 goto errout;
9043         }
9044
9045         /* set the corresponding lladdr for neigh */
9046         nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
9047         if (nl_lladdr == NULL) {
9048                 wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
9049                 res = -ENOMEM;
9050                 goto errout;
9051         }
9052         rtnl_neigh_set_lladdr(rn, nl_lladdr);
9053
9054         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
9055         rtnl_neigh_set_state(rn, NUD_PERMANENT);
9056
9057         res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
9058         if (res) {
9059                 wpa_printf(MSG_DEBUG,
9060                            "nl80211: Adding bridge ip neigh failed: %s",
9061                            strerror(errno));
9062         }
9063 errout:
9064         if (nl_lladdr)
9065                 nl_addr_put(nl_lladdr);
9066         if (nl_ipaddr)
9067                 nl_addr_put(nl_ipaddr);
9068         if (rn)
9069                 rtnl_neigh_put(rn);
9070         return res;
9071 #else /* CONFIG_LIBNL3_ROUTE */
9072         return -1;
9073 #endif /* CONFIG_LIBNL3_ROUTE */
9074 }
9075
9076
9077 static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
9078                                          const u8 *ipaddr)
9079 {
9080 #ifdef CONFIG_LIBNL3_ROUTE
9081         struct i802_bss *bss = priv;
9082         struct wpa_driver_nl80211_data *drv = bss->drv;
9083         struct rtnl_neigh *rn;
9084         struct nl_addr *nl_ipaddr;
9085         int family, addrsize;
9086         int res;
9087
9088         if (!ipaddr)
9089                 return -EINVAL;
9090
9091         if (version == 4) {
9092                 family = AF_INET;
9093                 addrsize = 4;
9094         } else if (version == 6) {
9095                 family = AF_INET6;
9096                 addrsize = 16;
9097         } else {
9098                 return -EINVAL;
9099         }
9100
9101         if (bss->br_ifindex == 0) {
9102                 wpa_printf(MSG_DEBUG,
9103                            "nl80211: bridge must be set to delete an ip neigh");
9104                 return -1;
9105         }
9106
9107         if (!drv->rtnl_sk) {
9108                 wpa_printf(MSG_DEBUG,
9109                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
9110                 return -1;
9111         }
9112
9113         rn = rtnl_neigh_alloc();
9114         if (rn == NULL)
9115                 return -ENOMEM;
9116
9117         /* set the destination ip address for neigh */
9118         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
9119         if (nl_ipaddr == NULL) {
9120                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
9121                 res = -ENOMEM;
9122                 goto errout;
9123         }
9124         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
9125         if (res) {
9126                 wpa_printf(MSG_DEBUG,
9127                            "nl80211: neigh set destination addr failed");
9128                 goto errout;
9129         }
9130
9131         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
9132
9133         res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
9134         if (res) {
9135                 wpa_printf(MSG_DEBUG,
9136                            "nl80211: Deleting bridge ip neigh failed: %s",
9137                            strerror(errno));
9138         }
9139 errout:
9140         if (nl_ipaddr)
9141                 nl_addr_put(nl_ipaddr);
9142         if (rn)
9143                 rtnl_neigh_put(rn);
9144         return res;
9145 #else /* CONFIG_LIBNL3_ROUTE */
9146         return -1;
9147 #endif /* CONFIG_LIBNL3_ROUTE */
9148 }
9149
9150
9151 static int linux_write_system_file(const char *path, unsigned int val)
9152 {
9153         char buf[50];
9154         int fd, len;
9155
9156         len = os_snprintf(buf, sizeof(buf), "%u\n", val);
9157         if (len < 0)
9158                 return -1;
9159
9160         fd = open(path, O_WRONLY);
9161         if (fd < 0)
9162                 return -1;
9163
9164         if (write(fd, buf, len) < 0) {
9165                 wpa_printf(MSG_DEBUG,
9166                            "nl80211: Failed to write Linux system file: %s with the value of %d",
9167                            path, val);
9168                 close(fd);
9169                 return -1;
9170         }
9171         close(fd);
9172
9173         return 0;
9174 }
9175
9176
9177 static const char * drv_br_port_attr_str(enum drv_br_port_attr attr)
9178 {
9179         switch (attr) {
9180         case DRV_BR_PORT_ATTR_PROXYARP:
9181                 return "proxyarp";
9182         case DRV_BR_PORT_ATTR_HAIRPIN_MODE:
9183                 return "hairpin_mode";
9184         }
9185
9186         return NULL;
9187 }
9188
9189
9190 static int wpa_driver_br_port_set_attr(void *priv, enum drv_br_port_attr attr,
9191                                        unsigned int val)
9192 {
9193         struct i802_bss *bss = priv;
9194         char path[128];
9195         const char *attr_txt;
9196
9197         attr_txt = drv_br_port_attr_str(attr);
9198         if (attr_txt == NULL)
9199                 return -EINVAL;
9200
9201         os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/%s",
9202                     bss->ifname, attr_txt);
9203
9204         if (linux_write_system_file(path, val))
9205                 return -1;
9206
9207         return 0;
9208 }
9209
9210
9211 static const char * drv_br_net_param_str(enum drv_br_net_param param)
9212 {
9213         switch (param) {
9214         case DRV_BR_NET_PARAM_GARP_ACCEPT:
9215                 return "arp_accept";
9216         }
9217
9218         return NULL;
9219 }
9220
9221
9222 static int wpa_driver_br_set_net_param(void *priv, enum drv_br_net_param param,
9223                                        unsigned int val)
9224 {
9225         struct i802_bss *bss = priv;
9226         char path[128];
9227         const char *param_txt;
9228         int ip_version = 4;
9229
9230         param_txt = drv_br_net_param_str(param);
9231         if (param_txt == NULL)
9232                 return -EINVAL;
9233
9234         switch (param) {
9235                 case DRV_BR_NET_PARAM_GARP_ACCEPT:
9236                         ip_version = 4;
9237                         break;
9238                 default:
9239                         return -EINVAL;
9240         }
9241
9242         os_snprintf(path, sizeof(path), "/proc/sys/net/ipv%d/conf/%s/%s",
9243                     ip_version, bss->brname, param_txt);
9244
9245         if (linux_write_system_file(path, val))
9246                 return -1;
9247
9248         return 0;
9249 }
9250
9251
9252 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
9253         .name = "nl80211",
9254         .desc = "Linux nl80211/cfg80211",
9255         .get_bssid = wpa_driver_nl80211_get_bssid,
9256         .get_ssid = wpa_driver_nl80211_get_ssid,
9257         .set_key = driver_nl80211_set_key,
9258         .scan2 = driver_nl80211_scan2,
9259         .sched_scan = wpa_driver_nl80211_sched_scan,
9260         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
9261         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
9262         .deauthenticate = driver_nl80211_deauthenticate,
9263         .authenticate = driver_nl80211_authenticate,
9264         .associate = wpa_driver_nl80211_associate,
9265         .global_init = nl80211_global_init,
9266         .global_deinit = nl80211_global_deinit,
9267         .init2 = wpa_driver_nl80211_init,
9268         .deinit = driver_nl80211_deinit,
9269         .get_capa = wpa_driver_nl80211_get_capa,
9270         .set_operstate = wpa_driver_nl80211_set_operstate,
9271         .set_supp_port = wpa_driver_nl80211_set_supp_port,
9272         .set_country = wpa_driver_nl80211_set_country,
9273         .get_country = wpa_driver_nl80211_get_country,
9274         .set_ap = wpa_driver_nl80211_set_ap,
9275         .set_acl = wpa_driver_nl80211_set_acl,
9276         .if_add = wpa_driver_nl80211_if_add,
9277         .if_remove = driver_nl80211_if_remove,
9278         .send_mlme = driver_nl80211_send_mlme,
9279         .get_hw_feature_data = nl80211_get_hw_feature_data,
9280         .sta_add = wpa_driver_nl80211_sta_add,
9281         .sta_remove = driver_nl80211_sta_remove,
9282         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
9283         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
9284         .hapd_init = i802_init,
9285         .hapd_deinit = i802_deinit,
9286         .set_wds_sta = i802_set_wds_sta,
9287         .get_seqnum = i802_get_seqnum,
9288         .flush = i802_flush,
9289         .get_inact_sec = i802_get_inact_sec,
9290         .sta_clear_stats = i802_sta_clear_stats,
9291         .set_rts = i802_set_rts,
9292         .set_frag = i802_set_frag,
9293         .set_tx_queue_params = i802_set_tx_queue_params,
9294         .set_sta_vlan = driver_nl80211_set_sta_vlan,
9295         .sta_deauth = i802_sta_deauth,
9296         .sta_disassoc = i802_sta_disassoc,
9297         .read_sta_data = driver_nl80211_read_sta_data,
9298         .set_freq = i802_set_freq,
9299         .send_action = driver_nl80211_send_action,
9300         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
9301         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
9302         .cancel_remain_on_channel =
9303         wpa_driver_nl80211_cancel_remain_on_channel,
9304         .probe_req_report = driver_nl80211_probe_req_report,
9305         .deinit_ap = wpa_driver_nl80211_deinit_ap,
9306         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
9307         .resume = wpa_driver_nl80211_resume,
9308         .send_ft_action = nl80211_send_ft_action,
9309         .signal_monitor = nl80211_signal_monitor,
9310         .signal_poll = nl80211_signal_poll,
9311         .send_frame = nl80211_send_frame,
9312         .shared_freq = wpa_driver_nl80211_shared_freq,
9313         .set_param = nl80211_set_param,
9314         .get_radio_name = nl80211_get_radio_name,
9315         .add_pmkid = nl80211_add_pmkid,
9316         .remove_pmkid = nl80211_remove_pmkid,
9317         .flush_pmkid = nl80211_flush_pmkid,
9318         .set_rekey_info = nl80211_set_rekey_info,
9319         .poll_client = nl80211_poll_client,
9320         .set_p2p_powersave = nl80211_set_p2p_powersave,
9321         .start_dfs_cac = nl80211_start_radar_detection,
9322         .stop_ap = wpa_driver_nl80211_stop_ap,
9323 #ifdef CONFIG_TDLS
9324         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
9325         .tdls_oper = nl80211_tdls_oper,
9326 #endif /* CONFIG_TDLS */
9327         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
9328         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
9329         .get_survey = wpa_driver_nl80211_get_survey,
9330         .status = wpa_driver_nl80211_status,
9331         .switch_channel = nl80211_switch_channel,
9332 #ifdef ANDROID_P2P
9333         .set_noa = wpa_driver_set_p2p_noa,
9334         .get_noa = wpa_driver_get_p2p_noa,
9335         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
9336 #endif /* ANDROID_P2P */
9337 #ifdef ANDROID
9338         .driver_cmd = wpa_driver_nl80211_driver_cmd,
9339 #endif /* ANDROID */
9340         .vendor_cmd = nl80211_vendor_cmd,
9341         .set_qos_map = nl80211_set_qos_map,
9342         .set_wowlan = nl80211_set_wowlan,
9343         .roaming = nl80211_roaming,
9344         .set_mac_addr = nl80211_set_mac_addr,
9345 #ifdef CONFIG_MESH
9346         .init_mesh = wpa_driver_nl80211_init_mesh,
9347         .join_mesh = wpa_driver_nl80211_join_mesh,
9348         .leave_mesh = wpa_driver_nl80211_leave_mesh,
9349 #endif /* CONFIG_MESH */
9350         .br_add_ip_neigh = wpa_driver_br_add_ip_neigh,
9351         .br_delete_ip_neigh = wpa_driver_br_delete_ip_neigh,
9352         .br_port_set_attr = wpa_driver_br_port_set_attr,
9353         .br_set_net_param = wpa_driver_br_set_net_param,
9354         .add_tx_ts = nl80211_add_ts,
9355         .del_tx_ts = nl80211_del_ts,
9356 };