src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/ioctl.h>
  15 #include <sys/types.h>
  16 #include <sys/stat.h>
  17 #include <fcntl.h>
  18 #include <net/if.h>
  19 #include <netlink/genl/genl.h>
  20 #include <netlink/genl/family.h>
  21 #include <netlink/genl/ctrl.h>
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/filter.h>
  25 #include <linux/errqueue.h>
  26 #include "nl80211_copy.h"
  27
  28 #include "common.h"
  29 #include "eloop.h"
  30 #include "utils/list.h"
  31 #include "common/ieee802_11_defs.h"
  32 #include "common/ieee802_11_common.h"
  33 #include "l2_packet/l2_packet.h"
  34 #include "netlink.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver.h"
  40
  41 #ifndef SO_WIFI_STATUS
  42 # if defined(__sparc__)
  43 #  define SO_WIFI_STATUS        0x0025
  44 # elif defined(__parisc__)
  45 #  define SO_WIFI_STATUS        0x4022
  46 # else
  47 #  define SO_WIFI_STATUS        41
  48 # endif
  49
  50 # define SCM_WIFI_STATUS        SO_WIFI_STATUS
  51 #endif
  52
  53 #ifndef SO_EE_ORIGIN_TXSTATUS
  54 #define SO_EE_ORIGIN_TXSTATUS   4
  55 #endif
  56
  57 #ifndef PACKET_TX_TIMESTAMP
  58 #define PACKET_TX_TIMESTAMP     16
  59 #endif
  60
  61 #ifdef ANDROID
  62 #include "android_drv.h"
  63 #endif /* ANDROID */
  64 #ifdef CONFIG_LIBNL20
  65 /* libnl 2.0 compatibility code */
  66 #define nl_handle nl_sock
  67 #define nl80211_handle_alloc nl_socket_alloc_cb
  68 #define nl80211_handle_destroy nl_socket_free
  69 #else
  70 /*
  71  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  72  * but when you free a socket again it will mess up its bitmap and
  73  * and use the wrong number the next time it needs a socket ID.
  74  * Therefore, we wrap the handle alloc/destroy and add our own pid
  75  * accounting.
  76  */
  77 static uint32_t port_bitmap[32] = { 0 };
  78
  79 static struct nl_handle *nl80211_handle_alloc(void *cb)
  80 {
  81         struct nl_handle *handle;
  82         uint32_t pid = getpid() & 0x3FFFFF;
  83         int i;
  84
  85         handle = nl_handle_alloc_cb(cb);
  86
  87         for (i = 0; i < 1024; i++) {
  88                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  89                         continue;
  90                 port_bitmap[i / 32] |= 1 << (i % 32);
  91                 pid += i << 22;
  92                 break;
  93         }
  94
  95         nl_socket_set_local_port(handle, pid);
  96
  97         return handle;
  98 }
  99
 100 static void nl80211_handle_destroy(struct nl_handle *handle)
 101 {
 102         uint32_t port = nl_socket_get_local_port(handle);
 103
 104         port >>= 22;
 105         port_bitmap[port / 32] &= ~(1 << (port % 32));
 106
 107         nl_handle_destroy(handle);
 108 }
 109 #endif /* CONFIG_LIBNL20 */
 110
 111
 112 #ifdef ANDROID
 113 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
 114 static int android_nl_socket_set_nonblocking(struct nl_handle *handle)
 115 {
 116         return fcntl(nl_socket_get_fd(handle), F_SETFL, O_NONBLOCK);
 117 }
 118 #undef nl_socket_set_nonblocking
 119 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
 120 #endif /* ANDROID */
 121
 122
 123 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
 124 {
 125         struct nl_handle *handle;
 126
 127         handle = nl80211_handle_alloc(cb);
 128         if (handle == NULL) {
 129                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 130                            "callbacks (%s)", dbg);
 131                 return NULL;
 132         }
 133
 134         if (genl_connect(handle)) {
 135                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 136                            "netlink (%s)", dbg);
 137                 nl80211_handle_destroy(handle);
 138                 return NULL;
 139         }
 140
 141         return handle;
 142 }
 143
 144
 145 static void nl_destroy_handles(struct nl_handle **handle)
 146 {
 147         if (*handle == NULL)
 148                 return;
 149         nl80211_handle_destroy(*handle);
 150         *handle = NULL;
 151 }
 152
 153
 154 #if __WORDSIZE == 64
 155 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 156 #else
 157 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 158 #endif
 159
 160 static void nl80211_register_eloop_read(struct nl_handle **handle,
 161                                         eloop_sock_handler handler,
 162                                         void *eloop_data)
 163 {
 164         nl_socket_set_nonblocking(*handle);
 165         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 166                                  eloop_data, *handle);
 167         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 168 }
 169
 170
 171 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 172 {
 173         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 174         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 175         nl_destroy_handles(handle);
 176 }
 177
 178
 179 #ifndef IFF_LOWER_UP
 180 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
 181 #endif
 182 #ifndef IFF_DORMANT
 183 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
 184 #endif
 185
 186 #ifndef IF_OPER_DORMANT
 187 #define IF_OPER_DORMANT 5
 188 #endif
 189 #ifndef IF_OPER_UP
 190 #define IF_OPER_UP 6
 191 #endif
 192
 193 struct nl80211_global {
 194         struct dl_list interfaces;
 195         int if_add_ifindex;
 196         u64 if_add_wdevid;
 197         int if_add_wdevid_set;
 198         struct netlink_data *netlink;
 199         struct nl_cb *nl_cb;
 200         struct nl_handle *nl;
 201         int nl80211_id;
 202         int ioctl_sock; /* socket for ioctl() use */
 203
 204         struct nl_handle *nl_event;
 205 };
 206
 207 struct nl80211_wiphy_data {
 208         struct dl_list list;
 209         struct dl_list bsss;
 210         struct dl_list drvs;
 211
 212         struct nl_handle *nl_beacons;
 213         struct nl_cb *nl_cb;
 214
 215         int wiphy_idx;
 216 };
 217
 218 static void nl80211_global_deinit(void *priv);
 219
 220 struct i802_bss {
 221         struct wpa_driver_nl80211_data *drv;
 222         struct i802_bss *next;
 223         int ifindex;
 224         u64 wdev_id;
 225         char ifname[IFNAMSIZ + 1];
 226         char brname[IFNAMSIZ];
 227         unsigned int beacon_set:1;
 228         unsigned int added_if_into_bridge:1;
 229         unsigned int added_bridge:1;
 230         unsigned int in_deinit:1;
 231         unsigned int wdev_id_set:1;
 232         unsigned int added_if:1;
 233
 234         u8 addr[ETH_ALEN];
 235
 236         int freq;
 237         int if_dynamic;
 238
 239         void *ctx;
 240         struct nl_handle *nl_preq, *nl_mgmt;
 241         struct nl_cb *nl_cb;
 242
 243         struct nl80211_wiphy_data *wiphy_data;
 244         struct dl_list wiphy_list;
 245 };
 246
 247 struct wpa_driver_nl80211_data {
 248         struct nl80211_global *global;
 249         struct dl_list list;
 250         struct dl_list wiphy_list;
 251         char phyname[32];
 252         void *ctx;
 253         int ifindex;
 254         int if_removed;
 255         int if_disabled;
 256         int ignore_if_down_event;
 257         struct rfkill_data *rfkill;
 258         struct wpa_driver_capa capa;
 259         u8 *extended_capa, *extended_capa_mask;
 260         unsigned int extended_capa_len;
 261         int has_capability;
 262
 263         int operstate;
 264
 265         int scan_complete_events;
 266         enum scan_states {
 267                 NO_SCAN, SCAN_REQUESTED, SCAN_STARTED, SCAN_COMPLETED,
 268                 SCAN_ABORTED, SCHED_SCAN_STARTED, SCHED_SCAN_STOPPED,
 269                 SCHED_SCAN_RESULTS
 270         } scan_state;
 271
 272         struct nl_cb *nl_cb;
 273
 274         u8 auth_bssid[ETH_ALEN];
 275         u8 auth_attempt_bssid[ETH_ALEN];
 276         u8 bssid[ETH_ALEN];
 277         u8 prev_bssid[ETH_ALEN];
 278         int associated;
 279         u8 ssid[32];
 280         size_t ssid_len;
 281         enum nl80211_iftype nlmode;
 282         enum nl80211_iftype ap_scan_as_station;
 283         unsigned int assoc_freq;
 284
 285         int monitor_sock;
 286         int monitor_ifidx;
 287         int monitor_refcount;
 288
 289         unsigned int disabled_11b_rates:1;
 290         unsigned int pending_remain_on_chan:1;
 291         unsigned int in_interface_list:1;
 292         unsigned int device_ap_sme:1;
 293         unsigned int poll_command_supported:1;
 294         unsigned int data_tx_status:1;
 295         unsigned int scan_for_auth:1;
 296         unsigned int retry_auth:1;
 297         unsigned int use_monitor:1;
 298         unsigned int ignore_next_local_disconnect:1;
 299         unsigned int allow_p2p_device:1;
 300         unsigned int hostapd:1;
 301         unsigned int start_mode_ap:1;
 302         unsigned int start_iface_up:1;
 303         unsigned int channel_switch_supported:1;
 304
 305         u64 remain_on_chan_cookie;
 306         u64 send_action_cookie;
 307
 308         unsigned int last_mgmt_freq;
 309
 310         struct wpa_driver_scan_filter *filter_ssids;
 311         size_t num_filter_ssids;
 312
 313         struct i802_bss *first_bss;
 314
 315         int eapol_tx_sock;
 316
 317         int eapol_sock; /* socket for EAPOL frames */
 318
 319         int default_if_indices[16];
 320         int *if_indices;
 321         int num_if_indices;
 322
 323         /* From failed authentication command */
 324         int auth_freq;
 325         u8 auth_bssid_[ETH_ALEN];
 326         u8 auth_ssid[32];
 327         size_t auth_ssid_len;
 328         int auth_alg;
 329         u8 *auth_ie;
 330         size_t auth_ie_len;
 331         u8 auth_wep_key[4][16];
 332         size_t auth_wep_key_len[4];
 333         int auth_wep_tx_keyidx;
 334         int auth_local_state_change;
 335         int auth_p2p;
 336 };
 337
 338
 339 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 340 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 341                                             void *timeout_ctx);
 342 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
 343                                        enum nl80211_iftype nlmode);
 344 static int
 345 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 346                                    const u8 *set_addr, int first);
 347 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 348                                    const u8 *addr, int cmd, u16 reason_code,
 349                                    int local_state_change);
 350 static void nl80211_remove_monitor_interface(
 351         struct wpa_driver_nl80211_data *drv);
 352 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 353                                   unsigned int freq, unsigned int wait,
 354                                   const u8 *buf, size_t buf_len, u64 *cookie,
 355                                   int no_cck, int no_ack, int offchanok);
 356 static int nl80211_register_frame(struct i802_bss *bss,
 357                                   struct nl_handle *hl_handle,
 358                                   u16 type, const u8 *match, size_t match_len);
 359 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 360                                                int report);
 361 #ifdef ANDROID
 362 static int android_pno_start(struct i802_bss *bss,
 363                              struct wpa_driver_scan_params *params);
 364 static int android_pno_stop(struct i802_bss *bss);
 365 #endif /* ANDROID */
 366
 367 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 368 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 369 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 370 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
 371                                         enum wpa_driver_if_type type,
 372                                         const char *ifname);
 373
 374 static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
 375                                        struct hostapd_freq_params *freq);
 376 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 377                                      int ifindex, int disabled);
 378
 379 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 380 static int wpa_driver_nl80211_authenticate_retry(
 381         struct wpa_driver_nl80211_data *drv);
 382
 383 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 384
 385
 386 static const char * nl80211_command_to_string(enum nl80211_commands cmd)
 387 {
 388 #define C2S(x) case x: return #x;
 389         switch (cmd) {
 390         C2S(NL80211_CMD_UNSPEC)
 391         C2S(NL80211_CMD_GET_WIPHY)
 392         C2S(NL80211_CMD_SET_WIPHY)
 393         C2S(NL80211_CMD_NEW_WIPHY)
 394         C2S(NL80211_CMD_DEL_WIPHY)
 395         C2S(NL80211_CMD_GET_INTERFACE)
 396         C2S(NL80211_CMD_SET_INTERFACE)
 397         C2S(NL80211_CMD_NEW_INTERFACE)
 398         C2S(NL80211_CMD_DEL_INTERFACE)
 399         C2S(NL80211_CMD_GET_KEY)
 400         C2S(NL80211_CMD_SET_KEY)
 401         C2S(NL80211_CMD_NEW_KEY)
 402         C2S(NL80211_CMD_DEL_KEY)
 403         C2S(NL80211_CMD_GET_BEACON)
 404         C2S(NL80211_CMD_SET_BEACON)
 405         C2S(NL80211_CMD_START_AP)
 406         C2S(NL80211_CMD_STOP_AP)
 407         C2S(NL80211_CMD_GET_STATION)
 408         C2S(NL80211_CMD_SET_STATION)
 409         C2S(NL80211_CMD_NEW_STATION)
 410         C2S(NL80211_CMD_DEL_STATION)
 411         C2S(NL80211_CMD_GET_MPATH)
 412         C2S(NL80211_CMD_SET_MPATH)
 413         C2S(NL80211_CMD_NEW_MPATH)
 414         C2S(NL80211_CMD_DEL_MPATH)
 415         C2S(NL80211_CMD_SET_BSS)
 416         C2S(NL80211_CMD_SET_REG)
 417         C2S(NL80211_CMD_REQ_SET_REG)
 418         C2S(NL80211_CMD_GET_MESH_CONFIG)
 419         C2S(NL80211_CMD_SET_MESH_CONFIG)
 420         C2S(NL80211_CMD_SET_MGMT_EXTRA_IE)
 421         C2S(NL80211_CMD_GET_REG)
 422         C2S(NL80211_CMD_GET_SCAN)
 423         C2S(NL80211_CMD_TRIGGER_SCAN)
 424         C2S(NL80211_CMD_NEW_SCAN_RESULTS)
 425         C2S(NL80211_CMD_SCAN_ABORTED)
 426         C2S(NL80211_CMD_REG_CHANGE)
 427         C2S(NL80211_CMD_AUTHENTICATE)
 428         C2S(NL80211_CMD_ASSOCIATE)
 429         C2S(NL80211_CMD_DEAUTHENTICATE)
 430         C2S(NL80211_CMD_DISASSOCIATE)
 431         C2S(NL80211_CMD_MICHAEL_MIC_FAILURE)
 432         C2S(NL80211_CMD_REG_BEACON_HINT)
 433         C2S(NL80211_CMD_JOIN_IBSS)
 434         C2S(NL80211_CMD_LEAVE_IBSS)
 435         C2S(NL80211_CMD_TESTMODE)
 436         C2S(NL80211_CMD_CONNECT)
 437         C2S(NL80211_CMD_ROAM)
 438         C2S(NL80211_CMD_DISCONNECT)
 439         C2S(NL80211_CMD_SET_WIPHY_NETNS)
 440         C2S(NL80211_CMD_GET_SURVEY)
 441         C2S(NL80211_CMD_NEW_SURVEY_RESULTS)
 442         C2S(NL80211_CMD_SET_PMKSA)
 443         C2S(NL80211_CMD_DEL_PMKSA)
 444         C2S(NL80211_CMD_FLUSH_PMKSA)
 445         C2S(NL80211_CMD_REMAIN_ON_CHANNEL)
 446         C2S(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL)
 447         C2S(NL80211_CMD_SET_TX_BITRATE_MASK)
 448         C2S(NL80211_CMD_REGISTER_FRAME)
 449         C2S(NL80211_CMD_FRAME)
 450         C2S(NL80211_CMD_FRAME_TX_STATUS)
 451         C2S(NL80211_CMD_SET_POWER_SAVE)
 452         C2S(NL80211_CMD_GET_POWER_SAVE)
 453         C2S(NL80211_CMD_SET_CQM)
 454         C2S(NL80211_CMD_NOTIFY_CQM)
 455         C2S(NL80211_CMD_SET_CHANNEL)
 456         C2S(NL80211_CMD_SET_WDS_PEER)
 457         C2S(NL80211_CMD_FRAME_WAIT_CANCEL)
 458         C2S(NL80211_CMD_JOIN_MESH)
 459         C2S(NL80211_CMD_LEAVE_MESH)
 460         C2S(NL80211_CMD_UNPROT_DEAUTHENTICATE)
 461         C2S(NL80211_CMD_UNPROT_DISASSOCIATE)
 462         C2S(NL80211_CMD_NEW_PEER_CANDIDATE)
 463         C2S(NL80211_CMD_GET_WOWLAN)
 464         C2S(NL80211_CMD_SET_WOWLAN)
 465         C2S(NL80211_CMD_START_SCHED_SCAN)
 466         C2S(NL80211_CMD_STOP_SCHED_SCAN)
 467         C2S(NL80211_CMD_SCHED_SCAN_RESULTS)
 468         C2S(NL80211_CMD_SCHED_SCAN_STOPPED)
 469         C2S(NL80211_CMD_SET_REKEY_OFFLOAD)
 470         C2S(NL80211_CMD_PMKSA_CANDIDATE)
 471         C2S(NL80211_CMD_TDLS_OPER)
 472         C2S(NL80211_CMD_TDLS_MGMT)
 473         C2S(NL80211_CMD_UNEXPECTED_FRAME)
 474         C2S(NL80211_CMD_PROBE_CLIENT)
 475         C2S(NL80211_CMD_REGISTER_BEACONS)
 476         C2S(NL80211_CMD_UNEXPECTED_4ADDR_FRAME)
 477         C2S(NL80211_CMD_SET_NOACK_MAP)
 478         C2S(NL80211_CMD_CH_SWITCH_NOTIFY)
 479         C2S(NL80211_CMD_START_P2P_DEVICE)
 480         C2S(NL80211_CMD_STOP_P2P_DEVICE)
 481         C2S(NL80211_CMD_CONN_FAILED)
 482         C2S(NL80211_CMD_SET_MCAST_RATE)
 483         C2S(NL80211_CMD_SET_MAC_ACL)
 484         C2S(NL80211_CMD_RADAR_DETECT)
 485         C2S(NL80211_CMD_GET_PROTOCOL_FEATURES)
 486         C2S(NL80211_CMD_UPDATE_FT_IES)
 487         C2S(NL80211_CMD_FT_EVENT)
 488         C2S(NL80211_CMD_CRIT_PROTOCOL_START)
 489         C2S(NL80211_CMD_CRIT_PROTOCOL_STOP)
 490         default:
 491                 return "NL80211_CMD_UNKNOWN";
 492         }
 493 #undef C2S
 494 }
 495
 496
 497 static int is_ap_interface(enum nl80211_iftype nlmode)
 498 {
 499         return (nlmode == NL80211_IFTYPE_AP ||
 500                 nlmode == NL80211_IFTYPE_P2P_GO);
 501 }
 502
 503
 504 static int is_sta_interface(enum nl80211_iftype nlmode)
 505 {
 506         return (nlmode == NL80211_IFTYPE_STATION ||
 507                 nlmode == NL80211_IFTYPE_P2P_CLIENT);
 508 }
 509
 510
 511 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 512 {
 513         return (nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 514                 nlmode == NL80211_IFTYPE_P2P_GO);
 515 }
 516
 517
 518 static void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 519 {
 520         if (drv->associated)
 521                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 522         drv->associated = 0;
 523         os_memset(drv->bssid, 0, ETH_ALEN);
 524 }
 525
 526
 527 struct nl80211_bss_info_arg {
 528         struct wpa_driver_nl80211_data *drv;
 529         struct wpa_scan_results *res;
 530         unsigned int assoc_freq;
 531         u8 assoc_bssid[ETH_ALEN];
 532 };
 533
 534 static int bss_info_handler(struct nl_msg *msg, void *arg);
 535
 536
 537 /* nl80211 code */
 538 static int ack_handler(struct nl_msg *msg, void *arg)
 539 {
 540         int *err = arg;
 541         *err = 0;
 542         return NL_STOP;
 543 }
 544
 545 static int finish_handler(struct nl_msg *msg, void *arg)
 546 {
 547         int *ret = arg;
 548         *ret = 0;
 549         return NL_SKIP;
 550 }
 551
 552 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 553                          void *arg)
 554 {
 555         int *ret = arg;
 556         *ret = err->error;
 557         return NL_SKIP;
 558 }
 559
 560
 561 static int no_seq_check(struct nl_msg *msg, void *arg)
 562 {
 563         return NL_OK;
 564 }
 565
 566
 567 static int send_and_recv(struct nl80211_global *global,
 568                          struct nl_handle *nl_handle, struct nl_msg *msg,
 569                          int (*valid_handler)(struct nl_msg *, void *),
 570                          void *valid_data)
 571 {
 572         struct nl_cb *cb;
 573         int err = -ENOMEM;
 574
 575         cb = nl_cb_clone(global->nl_cb);
 576         if (!cb)
 577                 goto out;
 578
 579         err = nl_send_auto_complete(nl_handle, msg);
 580         if (err < 0)
 581                 goto out;
 582
 583         err = 1;
 584
 585         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 586         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 587         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 588
 589         if (valid_handler)
 590                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 591                           valid_handler, valid_data);
 592
 593         while (err > 0) {
 594                 int res = nl_recvmsgs(nl_handle, cb);
 595                 if (res) {
 596                         wpa_printf(MSG_INFO,
 597                                    "nl80211: %s->nl_recvmsgs failed: %d",
 598                                    __func__, res);
 599                 }
 600         }
 601  out:
 602         nl_cb_put(cb);
 603         nlmsg_free(msg);
 604         return err;
 605 }
 606
 607
 608 static int send_and_recv_msgs_global(struct nl80211_global *global,
 609                                      struct nl_msg *msg,
 610                                      int (*valid_handler)(struct nl_msg *, void *),
 611                                      void *valid_data)
 612 {
 613         return send_and_recv(global, global->nl, msg, valid_handler,
 614                              valid_data);
 615 }
 616
 617
 618 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 619                               struct nl_msg *msg,
 620                               int (*valid_handler)(struct nl_msg *, void *),
 621                               void *valid_data)
 622 {
 623         return send_and_recv(drv->global, drv->global->nl, msg,
 624                              valid_handler, valid_data);
 625 }
 626
 627
 628 struct family_data {
 629         const char *group;
 630         int id;
 631 };
 632
 633
 634 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 635 {
 636         if (bss->wdev_id_set)
 637                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 638         else
 639                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 640         return 0;
 641
 642 nla_put_failure:
 643         return -1;
 644 }
 645
 646
 647 static int family_handler(struct nl_msg *msg, void *arg)
 648 {
 649         struct family_data *res = arg;
 650         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 651         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 652         struct nlattr *mcgrp;
 653         int i;
 654
 655         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 656                   genlmsg_attrlen(gnlh, 0), NULL);
 657         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 658                 return NL_SKIP;
 659
 660         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 661                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 662                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 663                           nla_len(mcgrp), NULL);
 664                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 665                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 666                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 667                                res->group,
 668                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 669                         continue;
 670                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 671                 break;
 672         };
 673
 674         return NL_SKIP;
 675 }
 676
 677
 678 static int nl_get_multicast_id(struct nl80211_global *global,
 679                                const char *family, const char *group)
 680 {
 681         struct nl_msg *msg;
 682         int ret = -1;
 683         struct family_data res = { group, -ENOENT };
 684
 685         msg = nlmsg_alloc();
 686         if (!msg)
 687                 return -ENOMEM;
 688         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 689                     0, 0, CTRL_CMD_GETFAMILY, 0);
 690         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 691
 692         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 693         msg = NULL;
 694         if (ret == 0)
 695                 ret = res.id;
 696
 697 nla_put_failure:
 698         nlmsg_free(msg);
 699         return ret;
 700 }
 701
 702
 703 static void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 704                           struct nl_msg *msg, int flags, uint8_t cmd)
 705 {
 706         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 707                            0, flags, cmd, 0);
 708 }
 709
 710
 711 struct wiphy_idx_data {
 712         int wiphy_idx;
 713         enum nl80211_iftype nlmode;
 714         u8 *macaddr;
 715 };
 716
 717
 718 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 719 {
 720         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 721         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 722         struct wiphy_idx_data *info = arg;
 723
 724         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 725                   genlmsg_attrlen(gnlh, 0), NULL);
 726
 727         if (tb[NL80211_ATTR_WIPHY])
 728                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 729
 730         if (tb[NL80211_ATTR_IFTYPE])
 731                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 732
 733         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 734                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 735                           ETH_ALEN);
 736
 737         return NL_SKIP;
 738 }
 739
 740
 741 static int nl80211_get_wiphy_index(struct i802_bss *bss)
 742 {
 743         struct nl_msg *msg;
 744         struct wiphy_idx_data data = {
 745                 .wiphy_idx = -1,
 746                 .macaddr = NULL,
 747         };
 748
 749         msg = nlmsg_alloc();
 750         if (!msg)
 751                 return NL80211_IFTYPE_UNSPECIFIED;
 752
 753         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 754
 755         if (nl80211_set_iface_id(msg, bss) < 0)
 756                 goto nla_put_failure;
 757
 758         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 759                 return data.wiphy_idx;
 760         msg = NULL;
 761 nla_put_failure:
 762         nlmsg_free(msg);
 763         return -1;
 764 }
 765
 766
 767 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 768 {
 769         struct nl_msg *msg;
 770         struct wiphy_idx_data data = {
 771                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 772                 .macaddr = NULL,
 773         };
 774
 775         msg = nlmsg_alloc();
 776         if (!msg)
 777                 return -1;
 778
 779         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 780
 781         if (nl80211_set_iface_id(msg, bss) < 0)
 782                 goto nla_put_failure;
 783
 784         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 785                 return data.nlmode;
 786         msg = NULL;
 787 nla_put_failure:
 788         nlmsg_free(msg);
 789         return NL80211_IFTYPE_UNSPECIFIED;
 790 }
 791
 792
 793 static int nl80211_get_macaddr(struct i802_bss *bss)
 794 {
 795         struct nl_msg *msg;
 796         struct wiphy_idx_data data = {
 797                 .macaddr = bss->addr,
 798         };
 799
 800         msg = nlmsg_alloc();
 801         if (!msg)
 802                 return NL80211_IFTYPE_UNSPECIFIED;
 803
 804         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 805         if (nl80211_set_iface_id(msg, bss) < 0)
 806                 goto nla_put_failure;
 807
 808         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 809
 810 nla_put_failure:
 811         nlmsg_free(msg);
 812         return NL80211_IFTYPE_UNSPECIFIED;
 813 }
 814
 815
 816 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 817                                     struct nl80211_wiphy_data *w)
 818 {
 819         struct nl_msg *msg;
 820         int ret = -1;
 821
 822         msg = nlmsg_alloc();
 823         if (!msg)
 824                 return -1;
 825
 826         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
 827
 828         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
 829
 830         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 831         msg = NULL;
 832         if (ret) {
 833                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 834                            "failed: ret=%d (%s)",
 835                            ret, strerror(-ret));
 836                 goto nla_put_failure;
 837         }
 838         ret = 0;
 839 nla_put_failure:
 840         nlmsg_free(msg);
 841         return ret;
 842 }
 843
 844
 845 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 846 {
 847         struct nl80211_wiphy_data *w = eloop_ctx;
 848         int res;
 849
 850         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 851
 852         res = nl_recvmsgs(handle, w->nl_cb);
 853         if (res) {
 854                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 855                            __func__, res);
 856         }
 857 }
 858
 859
 860 static int process_beacon_event(struct nl_msg *msg, void *arg)
 861 {
 862         struct nl80211_wiphy_data *w = arg;
 863         struct wpa_driver_nl80211_data *drv;
 864         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 865         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 866         union wpa_event_data event;
 867
 868         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 869                   genlmsg_attrlen(gnlh, 0), NULL);
 870
 871         if (gnlh->cmd != NL80211_CMD_FRAME) {
 872                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 873                            gnlh->cmd);
 874                 return NL_SKIP;
 875         }
 876
 877         if (!tb[NL80211_ATTR_FRAME])
 878                 return NL_SKIP;
 879
 880         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 881                          wiphy_list) {
 882                 os_memset(&event, 0, sizeof(event));
 883                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 884                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 885                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 886         }
 887
 888         return NL_SKIP;
 889 }
 890
 891
 892 static struct nl80211_wiphy_data *
 893 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 894 {
 895         static DEFINE_DL_LIST(nl80211_wiphys);
 896         struct nl80211_wiphy_data *w;
 897         int wiphy_idx, found = 0;
 898         struct i802_bss *tmp_bss;
 899
 900         if (bss->wiphy_data != NULL)
 901                 return bss->wiphy_data;
 902
 903         wiphy_idx = nl80211_get_wiphy_index(bss);
 904
 905         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 906                 if (w->wiphy_idx == wiphy_idx)
 907                         goto add;
 908         }
 909
 910         /* alloc new one */
 911         w = os_zalloc(sizeof(*w));
 912         if (w == NULL)
 913                 return NULL;
 914         w->wiphy_idx = wiphy_idx;
 915         dl_list_init(&w->bsss);
 916         dl_list_init(&w->drvs);
 917
 918         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 919         if (!w->nl_cb) {
 920                 os_free(w);
 921                 return NULL;
 922         }
 923         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 924         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 925                   w);
 926
 927         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 928                                          "wiphy beacons");
 929         if (w->nl_beacons == NULL) {
 930                 os_free(w);
 931                 return NULL;
 932         }
 933
 934         if (nl80211_register_beacons(bss->drv, w)) {
 935                 nl_destroy_handles(&w->nl_beacons);
 936                 os_free(w);
 937                 return NULL;
 938         }
 939
 940         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 941
 942         dl_list_add(&nl80211_wiphys, &w->list);
 943
 944 add:
 945         /* drv entry for this bss already there? */
 946         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 947                 if (tmp_bss->drv == bss->drv) {
 948                         found = 1;
 949                         break;
 950                 }
 951         }
 952         /* if not add it */
 953         if (!found)
 954                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 955
 956         dl_list_add(&w->bsss, &bss->wiphy_list);
 957         bss->wiphy_data = w;
 958         return w;
 959 }
 960
 961
 962 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 963 {
 964         struct nl80211_wiphy_data *w = bss->wiphy_data;
 965         struct i802_bss *tmp_bss;
 966         int found = 0;
 967
 968         if (w == NULL)
 969                 return;
 970         bss->wiphy_data = NULL;
 971         dl_list_del(&bss->wiphy_list);
 972
 973         /* still any for this drv present? */
 974         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 975                 if (tmp_bss->drv == bss->drv) {
 976                         found = 1;
 977                         break;
 978                 }
 979         }
 980         /* if not remove it */
 981         if (!found)
 982                 dl_list_del(&bss->drv->wiphy_list);
 983
 984         if (!dl_list_empty(&w->bsss))
 985                 return;
 986
 987         nl80211_destroy_eloop_handle(&w->nl_beacons);
 988
 989         nl_cb_put(w->nl_cb);
 990         dl_list_del(&w->list);
 991         os_free(w);
 992 }
 993
 994
 995 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 996 {
 997         struct i802_bss *bss = priv;
 998         struct wpa_driver_nl80211_data *drv = bss->drv;
 999         if (!drv->associated)
1000                 return -1;
1001         os_memcpy(bssid, drv->bssid, ETH_ALEN);
1002         return 0;
1003 }
1004
1005
1006 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
1007 {
1008         struct i802_bss *bss = priv;
1009         struct wpa_driver_nl80211_data *drv = bss->drv;
1010         if (!drv->associated)
1011                 return -1;
1012         os_memcpy(ssid, drv->ssid, drv->ssid_len);
1013         return drv->ssid_len;
1014 }
1015
1016
1017 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
1018                                           char *buf, size_t len, int del)
1019 {
1020         union wpa_event_data event;
1021
1022         os_memset(&event, 0, sizeof(event));
1023         if (len > sizeof(event.interface_status.ifname))
1024                 len = sizeof(event.interface_status.ifname) - 1;
1025         os_memcpy(event.interface_status.ifname, buf, len);
1026         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
1027                 EVENT_INTERFACE_ADDED;
1028
1029         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
1030                    del ? "DEL" : "NEW",
1031                    event.interface_status.ifname,
1032                    del ? "removed" : "added");
1033
1034         if (os_strcmp(drv->first_bss->ifname, event.interface_status.ifname) ==
1035             0) {
1036                 if (del) {
1037                         if (drv->if_removed) {
1038                                 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
1039                                            "already set - ignore event");
1040                                 return;
1041                         }
1042                         drv->if_removed = 1;
1043                 } else {
1044                         if (if_nametoindex(drv->first_bss->ifname) == 0) {
1045                                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s "
1046                                            "does not exist - ignore "
1047                                            "RTM_NEWLINK",
1048                                            drv->first_bss->ifname);
1049                                 return;
1050                         }
1051                         if (!drv->if_removed) {
1052                                 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
1053                                            "already cleared - ignore event");
1054                                 return;
1055                         }
1056                         drv->if_removed = 0;
1057                 }
1058         }
1059
1060         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1061 }
1062
1063
1064 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
1065                                          u8 *buf, size_t len)
1066 {
1067         int attrlen, rta_len;
1068         struct rtattr *attr;
1069
1070         attrlen = len;
1071         attr = (struct rtattr *) buf;
1072
1073         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1074         while (RTA_OK(attr, attrlen)) {
1075                 if (attr->rta_type == IFLA_IFNAME) {
1076                         if (os_strcmp(((char *) attr) + rta_len,
1077                                       drv->first_bss->ifname) == 0)
1078                                 return 1;
1079                         else
1080                                 break;
1081                 }
1082                 attr = RTA_NEXT(attr, attrlen);
1083         }
1084
1085         return 0;
1086 }
1087
1088
1089 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
1090                                           int ifindex, u8 *buf, size_t len)
1091 {
1092         if (drv->ifindex == ifindex)
1093                 return 1;
1094
1095         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
1096                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
1097                            "interface");
1098                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0);
1099                 return 1;
1100         }
1101
1102         return 0;
1103 }
1104
1105
1106 static struct wpa_driver_nl80211_data *
1107 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
1108 {
1109         struct wpa_driver_nl80211_data *drv;
1110         dl_list_for_each(drv, &global->interfaces,
1111                          struct wpa_driver_nl80211_data, list) {
1112                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
1113                     have_ifidx(drv, idx))
1114                         return drv;
1115         }
1116         return NULL;
1117 }
1118
1119
1120 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
1121                                                  struct ifinfomsg *ifi,
1122                                                  u8 *buf, size_t len)
1123 {
1124         struct nl80211_global *global = ctx;
1125         struct wpa_driver_nl80211_data *drv;
1126         int attrlen, rta_len;
1127         struct rtattr *attr;
1128         u32 brid = 0;
1129         char namebuf[IFNAMSIZ];
1130
1131         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1132         if (!drv) {
1133                 wpa_printf(MSG_DEBUG, "nl80211: Ignore event for foreign "
1134                            "ifindex %d", ifi->ifi_index);
1135                 return;
1136         }
1137
1138         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
1139                    "(%s%s%s%s)",
1140                    drv->operstate, ifi->ifi_flags,
1141                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1142                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1143                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1144                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1145
1146         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
1147                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1148                     linux_iface_up(drv->global->ioctl_sock,
1149                                    drv->first_bss->ifname) > 0) {
1150                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
1151                                    "event since interface %s is up", namebuf);
1152                         return;
1153                 }
1154                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
1155                 if (drv->ignore_if_down_event) {
1156                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
1157                                    "event generated by mode change");
1158                         drv->ignore_if_down_event = 0;
1159                 } else {
1160                         drv->if_disabled = 1;
1161                         wpa_supplicant_event(drv->ctx,
1162                                              EVENT_INTERFACE_DISABLED, NULL);
1163                 }
1164         }
1165
1166         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
1167                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1168                     linux_iface_up(drv->global->ioctl_sock,
1169                                    drv->first_bss->ifname) == 0) {
1170                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1171                                    "event since interface %s is down",
1172                                    namebuf);
1173                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
1174                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1175                                    "event since interface %s does not exist",
1176                                    drv->first_bss->ifname);
1177                 } else if (drv->if_removed) {
1178                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1179                                    "event since interface %s is marked "
1180                                    "removed", drv->first_bss->ifname);
1181                 } else {
1182                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1183                         drv->if_disabled = 0;
1184                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1185                                              NULL);
1186                 }
1187         }
1188
1189         /*
1190          * Some drivers send the association event before the operup event--in
1191          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1192          * fails. This will hit us when wpa_supplicant does not need to do
1193          * IEEE 802.1X authentication
1194          */
1195         if (drv->operstate == 1 &&
1196             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1197             !(ifi->ifi_flags & IFF_RUNNING))
1198                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1199                                        -1, IF_OPER_UP);
1200
1201         attrlen = len;
1202         attr = (struct rtattr *) buf;
1203         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1204         while (RTA_OK(attr, attrlen)) {
1205                 if (attr->rta_type == IFLA_IFNAME) {
1206                         wpa_driver_nl80211_event_link(
1207                                 drv,
1208                                 ((char *) attr) + rta_len,
1209                                 attr->rta_len - rta_len, 0);
1210                 } else if (attr->rta_type == IFLA_MASTER)
1211                         brid = nla_get_u32((struct nlattr *) attr);
1212                 attr = RTA_NEXT(attr, attrlen);
1213         }
1214
1215         if (ifi->ifi_family == AF_BRIDGE && brid) {
1216                 /* device has been added to bridge */
1217                 if_indextoname(brid, namebuf);
1218                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1219                            brid, namebuf);
1220                 add_ifidx(drv, brid);
1221         }
1222 }
1223
1224
1225 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1226                                                  struct ifinfomsg *ifi,
1227                                                  u8 *buf, size_t len)
1228 {
1229         struct nl80211_global *global = ctx;
1230         struct wpa_driver_nl80211_data *drv;
1231         int attrlen, rta_len;
1232         struct rtattr *attr;
1233         u32 brid = 0;
1234
1235         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1236         if (!drv) {
1237                 wpa_printf(MSG_DEBUG, "nl80211: Ignore dellink event for "
1238                            "foreign ifindex %d", ifi->ifi_index);
1239                 return;
1240         }
1241
1242         attrlen = len;
1243         attr = (struct rtattr *) buf;
1244
1245         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1246         while (RTA_OK(attr, attrlen)) {
1247                 if (attr->rta_type == IFLA_IFNAME) {
1248                         wpa_driver_nl80211_event_link(
1249                                 drv,
1250                                 ((char *) attr) + rta_len,
1251                                 attr->rta_len - rta_len, 1);
1252                 } else if (attr->rta_type == IFLA_MASTER)
1253                         brid = nla_get_u32((struct nlattr *) attr);
1254                 attr = RTA_NEXT(attr, attrlen);
1255         }
1256
1257         if (ifi->ifi_family == AF_BRIDGE && brid) {
1258                 /* device has been removed from bridge */
1259                 char namebuf[IFNAMSIZ];
1260                 if_indextoname(brid, namebuf);
1261                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1262                            "%s", brid, namebuf);
1263                 del_ifidx(drv, brid);
1264         }
1265 }
1266
1267
1268 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
1269                             const u8 *frame, size_t len)
1270 {
1271         const struct ieee80211_mgmt *mgmt;
1272         union wpa_event_data event;
1273
1274         wpa_printf(MSG_DEBUG, "nl80211: Authenticate event");
1275         mgmt = (const struct ieee80211_mgmt *) frame;
1276         if (len < 24 + sizeof(mgmt->u.auth)) {
1277                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1278                            "frame");
1279                 return;
1280         }
1281
1282         os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
1283         os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
1284         os_memset(&event, 0, sizeof(event));
1285         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
1286         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1287         event.auth.auth_transaction =
1288                 le_to_host16(mgmt->u.auth.auth_transaction);
1289         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
1290         if (len > 24 + sizeof(mgmt->u.auth)) {
1291                 event.auth.ies = mgmt->u.auth.variable;
1292                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
1293         }
1294
1295         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
1296 }
1297
1298
1299 static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1300 {
1301         struct nl_msg *msg;
1302         int ret;
1303         struct nl80211_bss_info_arg arg;
1304
1305         os_memset(&arg, 0, sizeof(arg));
1306         msg = nlmsg_alloc();
1307         if (!msg)
1308                 goto nla_put_failure;
1309
1310         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1311         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1312
1313         arg.drv = drv;
1314         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1315         msg = NULL;
1316         if (ret == 0) {
1317                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1318                            "associated BSS from scan results: %u MHz",
1319                            arg.assoc_freq);
1320                 if (arg.assoc_freq)
1321                         drv->assoc_freq = arg.assoc_freq;
1322                 return drv->assoc_freq;
1323         }
1324         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1325                    "(%s)", ret, strerror(-ret));
1326 nla_put_failure:
1327         nlmsg_free(msg);
1328         return drv->assoc_freq;
1329 }
1330
1331
1332 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
1333                             const u8 *frame, size_t len)
1334 {
1335         const struct ieee80211_mgmt *mgmt;
1336         union wpa_event_data event;
1337         u16 status;
1338
1339         wpa_printf(MSG_DEBUG, "nl80211: Associate event");
1340         mgmt = (const struct ieee80211_mgmt *) frame;
1341         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
1342                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1343                            "frame");
1344                 return;
1345         }
1346
1347         status = le_to_host16(mgmt->u.assoc_resp.status_code);
1348         if (status != WLAN_STATUS_SUCCESS) {
1349                 os_memset(&event, 0, sizeof(event));
1350                 event.assoc_reject.bssid = mgmt->bssid;
1351                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1352                         event.assoc_reject.resp_ies =
1353                                 (u8 *) mgmt->u.assoc_resp.variable;
1354                         event.assoc_reject.resp_ies_len =
1355                                 len - 24 - sizeof(mgmt->u.assoc_resp);
1356                 }
1357                 event.assoc_reject.status_code = status;
1358
1359                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1360                 return;
1361         }
1362
1363         drv->associated = 1;
1364         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
1365         os_memcpy(drv->prev_bssid, mgmt->sa, ETH_ALEN);
1366
1367         os_memset(&event, 0, sizeof(event));
1368         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1369                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
1370                 event.assoc_info.resp_ies_len =
1371                         len - 24 - sizeof(mgmt->u.assoc_resp);
1372         }
1373
1374         event.assoc_info.freq = drv->assoc_freq;
1375
1376         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1377 }
1378
1379
1380 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
1381                                enum nl80211_commands cmd, struct nlattr *status,
1382                                struct nlattr *addr, struct nlattr *req_ie,
1383                                struct nlattr *resp_ie)
1384 {
1385         union wpa_event_data event;
1386
1387         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1388                 /*
1389                  * Avoid reporting two association events that would confuse
1390                  * the core code.
1391                  */
1392                 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
1393                            "when using userspace SME", cmd);
1394                 return;
1395         }
1396
1397         if (cmd == NL80211_CMD_CONNECT)
1398                 wpa_printf(MSG_DEBUG, "nl80211: Connect event");
1399         else if (cmd == NL80211_CMD_ROAM)
1400                 wpa_printf(MSG_DEBUG, "nl80211: Roam event");
1401
1402         os_memset(&event, 0, sizeof(event));
1403         if (cmd == NL80211_CMD_CONNECT &&
1404             nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
1405                 if (addr)
1406                         event.assoc_reject.bssid = nla_data(addr);
1407                 if (resp_ie) {
1408                         event.assoc_reject.resp_ies = nla_data(resp_ie);
1409                         event.assoc_reject.resp_ies_len = nla_len(resp_ie);
1410                 }
1411                 event.assoc_reject.status_code = nla_get_u16(status);
1412                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1413                 return;
1414         }
1415
1416         drv->associated = 1;
1417         if (addr) {
1418                 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1419                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
1420         }
1421
1422         if (req_ie) {
1423                 event.assoc_info.req_ies = nla_data(req_ie);
1424                 event.assoc_info.req_ies_len = nla_len(req_ie);
1425         }
1426         if (resp_ie) {
1427                 event.assoc_info.resp_ies = nla_data(resp_ie);
1428                 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1429         }
1430
1431         event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1432
1433         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1434 }
1435
1436
1437 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1438                                   struct nlattr *reason, struct nlattr *addr,
1439                                   struct nlattr *by_ap)
1440 {
1441         union wpa_event_data data;
1442         unsigned int locally_generated = by_ap == NULL;
1443
1444         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1445                 /*
1446                  * Avoid reporting two disassociation events that could
1447                  * confuse the core code.
1448                  */
1449                 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1450                            "event when using userspace SME");
1451                 return;
1452         }
1453
1454         if (drv->ignore_next_local_disconnect) {
1455                 drv->ignore_next_local_disconnect = 0;
1456                 if (locally_generated) {
1457                         wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1458                                    "event triggered during reassociation");
1459                         return;
1460                 }
1461                 wpa_printf(MSG_WARNING, "nl80211: Was expecting local "
1462                            "disconnect but got another disconnect "
1463                            "event first");
1464         }
1465
1466         wpa_printf(MSG_DEBUG, "nl80211: Disconnect event");
1467         nl80211_mark_disconnected(drv);
1468         os_memset(&data, 0, sizeof(data));
1469         if (reason)
1470                 data.deauth_info.reason_code = nla_get_u16(reason);
1471         data.deauth_info.locally_generated = by_ap == NULL;
1472         wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1473 }
1474
1475
1476 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1477                                  struct nlattr *freq, struct nlattr *type)
1478 {
1479         union wpa_event_data data;
1480         int ht_enabled = 1;
1481         int chan_offset = 0;
1482
1483         wpa_printf(MSG_DEBUG, "nl80211: Channel switch event");
1484
1485         if (!freq || !type)
1486                 return;
1487
1488         switch (nla_get_u32(type)) {
1489         case NL80211_CHAN_NO_HT:
1490                 ht_enabled = 0;
1491                 break;
1492         case NL80211_CHAN_HT20:
1493                 break;
1494         case NL80211_CHAN_HT40PLUS:
1495                 chan_offset = 1;
1496                 break;
1497         case NL80211_CHAN_HT40MINUS:
1498                 chan_offset = -1;
1499                 break;
1500         }
1501
1502         data.ch_switch.freq = nla_get_u32(freq);
1503         data.ch_switch.ht_enabled = ht_enabled;
1504         data.ch_switch.ch_offset = chan_offset;
1505
1506         drv->first_bss->freq = data.ch_switch.freq;
1507
1508         wpa_supplicant_event(drv->ctx, EVENT_CH_SWITCH, &data);
1509 }
1510
1511
1512 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1513                                enum nl80211_commands cmd, struct nlattr *addr)
1514 {
1515         union wpa_event_data event;
1516         enum wpa_event_type ev;
1517
1518         if (nla_len(addr) != ETH_ALEN)
1519                 return;
1520
1521         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1522                    cmd, MAC2STR((u8 *) nla_data(addr)));
1523
1524         if (cmd == NL80211_CMD_AUTHENTICATE)
1525                 ev = EVENT_AUTH_TIMED_OUT;
1526         else if (cmd == NL80211_CMD_ASSOCIATE)
1527                 ev = EVENT_ASSOC_TIMED_OUT;
1528         else
1529                 return;
1530
1531         os_memset(&event, 0, sizeof(event));
1532         os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1533         wpa_supplicant_event(drv->ctx, ev, &event);
1534 }
1535
1536
1537 static void mlme_event_mgmt(struct wpa_driver_nl80211_data *drv,
1538                             struct nlattr *freq, struct nlattr *sig,
1539                             const u8 *frame, size_t len)
1540 {
1541         const struct ieee80211_mgmt *mgmt;
1542         union wpa_event_data event;
1543         u16 fc, stype;
1544         int ssi_signal = 0;
1545         int rx_freq = 0;
1546
1547         wpa_printf(MSG_MSGDUMP, "nl80211: Frame event");
1548         mgmt = (const struct ieee80211_mgmt *) frame;
1549         if (len < 24) {
1550                 wpa_printf(MSG_DEBUG, "nl80211: Too short action frame");
1551                 return;
1552         }
1553
1554         fc = le_to_host16(mgmt->frame_control);
1555         stype = WLAN_FC_GET_STYPE(fc);
1556
1557         if (sig)
1558                 ssi_signal = (s32) nla_get_u32(sig);
1559
1560         os_memset(&event, 0, sizeof(event));
1561         if (freq) {
1562                 event.rx_action.freq = nla_get_u32(freq);
1563                 rx_freq = drv->last_mgmt_freq = event.rx_action.freq;
1564         }
1565         wpa_printf(MSG_DEBUG,
1566                    "nl80211: RX frame freq=%d ssi_signal=%d stype=%u len=%u",
1567                    rx_freq, ssi_signal, stype, (unsigned int) len);
1568         if (stype == WLAN_FC_STYPE_ACTION) {
1569                 event.rx_action.da = mgmt->da;
1570                 event.rx_action.sa = mgmt->sa;
1571                 event.rx_action.bssid = mgmt->bssid;
1572                 event.rx_action.category = mgmt->u.action.category;
1573                 event.rx_action.data = &mgmt->u.action.category + 1;
1574                 event.rx_action.len = frame + len - event.rx_action.data;
1575                 wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event);
1576         } else {
1577                 event.rx_mgmt.frame = frame;
1578                 event.rx_mgmt.frame_len = len;
1579                 event.rx_mgmt.ssi_signal = ssi_signal;
1580                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1581         }
1582 }
1583
1584
1585 static void mlme_event_mgmt_tx_status(struct wpa_driver_nl80211_data *drv,
1586                                       struct nlattr *cookie, const u8 *frame,
1587                                       size_t len, struct nlattr *ack)
1588 {
1589         union wpa_event_data event;
1590         const struct ieee80211_hdr *hdr;
1591         u16 fc;
1592
1593         wpa_printf(MSG_DEBUG, "nl80211: Frame TX status event");
1594         if (!is_ap_interface(drv->nlmode)) {
1595                 u64 cookie_val;
1596
1597                 if (!cookie)
1598                         return;
1599
1600                 cookie_val = nla_get_u64(cookie);
1601                 wpa_printf(MSG_DEBUG, "nl80211: Action TX status:"
1602                            " cookie=0%llx%s (ack=%d)",
1603                            (long long unsigned int) cookie_val,
1604                            cookie_val == drv->send_action_cookie ?
1605                            " (match)" : " (unknown)", ack != NULL);
1606                 if (cookie_val != drv->send_action_cookie)
1607                         return;
1608         }
1609
1610         hdr = (const struct ieee80211_hdr *) frame;
1611         fc = le_to_host16(hdr->frame_control);
1612
1613         os_memset(&event, 0, sizeof(event));
1614         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1615         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1616         event.tx_status.dst = hdr->addr1;
1617         event.tx_status.data = frame;
1618         event.tx_status.data_len = len;
1619         event.tx_status.ack = ack != NULL;
1620         wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event);
1621 }
1622
1623
1624 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1625                                        enum wpa_event_type type,
1626                                        const u8 *frame, size_t len)
1627 {
1628         const struct ieee80211_mgmt *mgmt;
1629         union wpa_event_data event;
1630         const u8 *bssid = NULL;
1631         u16 reason_code = 0;
1632
1633         if (type == EVENT_DEAUTH)
1634                 wpa_printf(MSG_DEBUG, "nl80211: Deauthenticate event");
1635         else
1636                 wpa_printf(MSG_DEBUG, "nl80211: Disassociate event");
1637
1638         mgmt = (const struct ieee80211_mgmt *) frame;
1639         if (len >= 24) {
1640                 bssid = mgmt->bssid;
1641
1642                 if ((drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
1643                     !drv->associated &&
1644                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0 &&
1645                     os_memcmp(bssid, drv->auth_attempt_bssid, ETH_ALEN) != 0 &&
1646                     os_memcmp(bssid, drv->prev_bssid, ETH_ALEN) == 0) {
1647                         /*
1648                          * Avoid issues with some roaming cases where
1649                          * disconnection event for the old AP may show up after
1650                          * we have started connection with the new AP.
1651                          */
1652                         wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth/disassoc event from old AP " MACSTR " when already authenticating with " MACSTR,
1653                                    MAC2STR(bssid),
1654                                    MAC2STR(drv->auth_attempt_bssid));
1655                         return;
1656                 }
1657
1658                 if (drv->associated != 0 &&
1659                     os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
1660                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
1661                         /*
1662                          * We have presumably received this deauth as a
1663                          * response to a clear_state_mismatch() outgoing
1664                          * deauth.  Don't let it take us offline!
1665                          */
1666                         wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1667                                    "from Unknown BSSID " MACSTR " -- ignoring",
1668                                    MAC2STR(bssid));
1669                         return;
1670                 }
1671         }
1672
1673         nl80211_mark_disconnected(drv);
1674         os_memset(&event, 0, sizeof(event));
1675
1676         /* Note: Same offset for Reason Code in both frame subtypes */
1677         if (len >= 24 + sizeof(mgmt->u.deauth))
1678                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1679
1680         if (type == EVENT_DISASSOC) {
1681                 event.disassoc_info.locally_generated =
1682                         !os_memcmp(mgmt->sa, drv->first_bss->addr, ETH_ALEN);
1683                 event.disassoc_info.addr = bssid;
1684                 event.disassoc_info.reason_code = reason_code;
1685                 if (frame + len > mgmt->u.disassoc.variable) {
1686                         event.disassoc_info.ie = mgmt->u.disassoc.variable;
1687                         event.disassoc_info.ie_len = frame + len -
1688                                 mgmt->u.disassoc.variable;
1689                 }
1690         } else {
1691                 event.deauth_info.locally_generated =
1692                         !os_memcmp(mgmt->sa, drv->first_bss->addr, ETH_ALEN);
1693                 event.deauth_info.addr = bssid;
1694                 event.deauth_info.reason_code = reason_code;
1695                 if (frame + len > mgmt->u.deauth.variable) {
1696                         event.deauth_info.ie = mgmt->u.deauth.variable;
1697                         event.deauth_info.ie_len = frame + len -
1698                                 mgmt->u.deauth.variable;
1699                 }
1700         }
1701
1702         wpa_supplicant_event(drv->ctx, type, &event);
1703 }
1704
1705
1706 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1707                                          enum wpa_event_type type,
1708                                          const u8 *frame, size_t len)
1709 {
1710         const struct ieee80211_mgmt *mgmt;
1711         union wpa_event_data event;
1712         u16 reason_code = 0;
1713
1714         if (type == EVENT_UNPROT_DEAUTH)
1715                 wpa_printf(MSG_DEBUG, "nl80211: Unprot Deauthenticate event");
1716         else
1717                 wpa_printf(MSG_DEBUG, "nl80211: Unprot Disassociate event");
1718
1719         if (len < 24)
1720                 return;
1721
1722         mgmt = (const struct ieee80211_mgmt *) frame;
1723
1724         os_memset(&event, 0, sizeof(event));
1725         /* Note: Same offset for Reason Code in both frame subtypes */
1726         if (len >= 24 + sizeof(mgmt->u.deauth))
1727                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1728
1729         if (type == EVENT_UNPROT_DISASSOC) {
1730                 event.unprot_disassoc.sa = mgmt->sa;
1731                 event.unprot_disassoc.da = mgmt->da;
1732                 event.unprot_disassoc.reason_code = reason_code;
1733         } else {
1734                 event.unprot_deauth.sa = mgmt->sa;
1735                 event.unprot_deauth.da = mgmt->da;
1736                 event.unprot_deauth.reason_code = reason_code;
1737         }
1738
1739         wpa_supplicant_event(drv->ctx, type, &event);
1740 }
1741
1742
1743 static void mlme_event(struct i802_bss *bss,
1744                        enum nl80211_commands cmd, struct nlattr *frame,
1745                        struct nlattr *addr, struct nlattr *timed_out,
1746                        struct nlattr *freq, struct nlattr *ack,
1747                        struct nlattr *cookie, struct nlattr *sig)
1748 {
1749         struct wpa_driver_nl80211_data *drv = bss->drv;
1750         const u8 *data;
1751         size_t len;
1752
1753         if (timed_out && addr) {
1754                 mlme_timeout_event(drv, cmd, addr);
1755                 return;
1756         }
1757
1758         if (frame == NULL) {
1759                 wpa_printf(MSG_DEBUG,
1760                            "nl80211: MLME event %d (%s) without frame data",
1761                            cmd, nl80211_command_to_string(cmd));
1762                 return;
1763         }
1764
1765         data = nla_data(frame);
1766         len = nla_len(frame);
1767         if (len < 4 + 2 * ETH_ALEN) {
1768                 wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s("
1769                            MACSTR ") - too short",
1770                            cmd, nl80211_command_to_string(cmd), bss->ifname,
1771                            MAC2STR(bss->addr));
1772                 return;
1773         }
1774         wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s(" MACSTR
1775                    ") A1=" MACSTR " A2=" MACSTR, cmd,
1776                    nl80211_command_to_string(cmd), bss->ifname,
1777                    MAC2STR(bss->addr), MAC2STR(data + 4),
1778                    MAC2STR(data + 4 + ETH_ALEN));
1779         if (cmd != NL80211_CMD_FRAME_TX_STATUS && !(data[4] & 0x01) &&
1780             os_memcmp(bss->addr, data + 4, ETH_ALEN) != 0 &&
1781             os_memcmp(bss->addr, data + 4 + ETH_ALEN, ETH_ALEN) != 0) {
1782                 wpa_printf(MSG_MSGDUMP, "nl80211: %s: Ignore MLME frame event "
1783                            "for foreign address", bss->ifname);
1784                 return;
1785         }
1786         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1787                     nla_data(frame), nla_len(frame));
1788
1789         switch (cmd) {
1790         case NL80211_CMD_AUTHENTICATE:
1791                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1792                 break;
1793         case NL80211_CMD_ASSOCIATE:
1794                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
1795                 break;
1796         case NL80211_CMD_DEAUTHENTICATE:
1797                 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1798                                            nla_data(frame), nla_len(frame));
1799                 break;
1800         case NL80211_CMD_DISASSOCIATE:
1801                 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1802                                            nla_data(frame), nla_len(frame));
1803                 break;
1804         case NL80211_CMD_FRAME:
1805                 mlme_event_mgmt(drv, freq, sig, nla_data(frame),
1806                                 nla_len(frame));
1807                 break;
1808         case NL80211_CMD_FRAME_TX_STATUS:
1809                 mlme_event_mgmt_tx_status(drv, cookie, nla_data(frame),
1810                                           nla_len(frame), ack);
1811                 break;
1812         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1813                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1814                                              nla_data(frame), nla_len(frame));
1815                 break;
1816         case NL80211_CMD_UNPROT_DISASSOCIATE:
1817                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1818                                              nla_data(frame), nla_len(frame));
1819                 break;
1820         default:
1821                 break;
1822         }
1823 }
1824
1825
1826 static void mlme_event_michael_mic_failure(struct i802_bss *bss,
1827                                            struct nlattr *tb[])
1828 {
1829         union wpa_event_data data;
1830
1831         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
1832         os_memset(&data, 0, sizeof(data));
1833         if (tb[NL80211_ATTR_MAC]) {
1834                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
1835                             nla_data(tb[NL80211_ATTR_MAC]),
1836                             nla_len(tb[NL80211_ATTR_MAC]));
1837                 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
1838         }
1839         if (tb[NL80211_ATTR_KEY_SEQ]) {
1840                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
1841                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
1842                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
1843         }
1844         if (tb[NL80211_ATTR_KEY_TYPE]) {
1845                 enum nl80211_key_type key_type =
1846                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
1847                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
1848                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
1849                         data.michael_mic_failure.unicast = 1;
1850         } else
1851                 data.michael_mic_failure.unicast = 1;
1852
1853         if (tb[NL80211_ATTR_KEY_IDX]) {
1854                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
1855                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
1856         }
1857
1858         wpa_supplicant_event(bss->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
1859 }
1860
1861
1862 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
1863                                  struct nlattr *tb[])
1864 {
1865         if (tb[NL80211_ATTR_MAC] == NULL) {
1866                 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
1867                            "event");
1868                 return;
1869         }
1870         os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1871
1872         drv->associated = 1;
1873         wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
1874                    MAC2STR(drv->bssid));
1875
1876         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1877 }
1878
1879
1880 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
1881                                          int cancel_event, struct nlattr *tb[])
1882 {
1883         unsigned int freq, chan_type, duration;
1884         union wpa_event_data data;
1885         u64 cookie;
1886
1887         if (tb[NL80211_ATTR_WIPHY_FREQ])
1888                 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
1889         else
1890                 freq = 0;
1891
1892         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1893                 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1894         else
1895                 chan_type = 0;
1896
1897         if (tb[NL80211_ATTR_DURATION])
1898                 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
1899         else
1900                 duration = 0;
1901
1902         if (tb[NL80211_ATTR_COOKIE])
1903                 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
1904         else
1905                 cookie = 0;
1906
1907         wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
1908                    "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
1909                    cancel_event, freq, chan_type, duration,
1910                    (long long unsigned int) cookie,
1911                    cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
1912
1913         if (cookie != drv->remain_on_chan_cookie)
1914                 return; /* not for us */
1915
1916         if (cancel_event)
1917                 drv->pending_remain_on_chan = 0;
1918
1919         os_memset(&data, 0, sizeof(data));
1920         data.remain_on_channel.freq = freq;
1921         data.remain_on_channel.duration = duration;
1922         wpa_supplicant_event(drv->ctx, cancel_event ?
1923                              EVENT_CANCEL_REMAIN_ON_CHANNEL :
1924                              EVENT_REMAIN_ON_CHANNEL, &data);
1925 }
1926
1927
1928 static void mlme_event_ft_event(struct wpa_driver_nl80211_data *drv,
1929                                 struct nlattr *tb[])
1930 {
1931         union wpa_event_data data;
1932
1933         os_memset(&data, 0, sizeof(data));
1934
1935         if (tb[NL80211_ATTR_IE]) {
1936                 data.ft_ies.ies = nla_data(tb[NL80211_ATTR_IE]);
1937                 data.ft_ies.ies_len = nla_len(tb[NL80211_ATTR_IE]);
1938         }
1939
1940         if (tb[NL80211_ATTR_IE_RIC]) {
1941                 data.ft_ies.ric_ies = nla_data(tb[NL80211_ATTR_IE_RIC]);
1942                 data.ft_ies.ric_ies_len = nla_len(tb[NL80211_ATTR_IE_RIC]);
1943         }
1944
1945         if (tb[NL80211_ATTR_MAC])
1946                 os_memcpy(data.ft_ies.target_ap,
1947                           nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1948
1949         wpa_printf(MSG_DEBUG, "nl80211: FT event target_ap " MACSTR,
1950                    MAC2STR(data.ft_ies.target_ap));
1951
1952         wpa_supplicant_event(drv->ctx, EVENT_FT_RESPONSE, &data);
1953 }
1954
1955
1956 static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
1957                             struct nlattr *tb[])
1958 {
1959         union wpa_event_data event;
1960         struct nlattr *nl;
1961         int rem;
1962         struct scan_info *info;
1963 #define MAX_REPORT_FREQS 50
1964         int freqs[MAX_REPORT_FREQS];
1965         int num_freqs = 0;
1966
1967         if (drv->scan_for_auth) {
1968                 drv->scan_for_auth = 0;
1969                 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
1970                            "cfg80211 BSS entry");
1971                 wpa_driver_nl80211_authenticate_retry(drv);
1972                 return;
1973         }
1974
1975         os_memset(&event, 0, sizeof(event));
1976         info = &event.scan_info;
1977         info->aborted = aborted;
1978
1979         if (tb[NL80211_ATTR_SCAN_SSIDS]) {
1980                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
1981                         struct wpa_driver_scan_ssid *s =
1982                                 &info->ssids[info->num_ssids];
1983                         s->ssid = nla_data(nl);
1984                         s->ssid_len = nla_len(nl);
1985                         info->num_ssids++;
1986                         if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
1987                                 break;
1988                 }
1989         }
1990         if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
1991                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
1992                 {
1993                         freqs[num_freqs] = nla_get_u32(nl);
1994                         num_freqs++;
1995                         if (num_freqs == MAX_REPORT_FREQS - 1)
1996                                 break;
1997                 }
1998                 info->freqs = freqs;
1999                 info->num_freqs = num_freqs;
2000         }
2001         wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
2002 }
2003
2004
2005 static int get_link_signal(struct nl_msg *msg, void *arg)
2006 {
2007         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2008         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2009         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
2010         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
2011                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
2012                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
2013         };
2014         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
2015         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
2016                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
2017                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
2018                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
2019                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
2020         };
2021         struct wpa_signal_info *sig_change = arg;
2022
2023         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2024                   genlmsg_attrlen(gnlh, 0), NULL);
2025         if (!tb[NL80211_ATTR_STA_INFO] ||
2026             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
2027                              tb[NL80211_ATTR_STA_INFO], policy))
2028                 return NL_SKIP;
2029         if (!sinfo[NL80211_STA_INFO_SIGNAL])
2030                 return NL_SKIP;
2031
2032         sig_change->current_signal =
2033                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
2034
2035         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
2036                 sig_change->avg_signal =
2037                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
2038         else
2039                 sig_change->avg_signal = 0;
2040
2041         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
2042                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
2043                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
2044                                      rate_policy)) {
2045                         sig_change->current_txrate = 0;
2046                 } else {
2047                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
2048                                 sig_change->current_txrate =
2049                                         nla_get_u16(rinfo[
2050                                              NL80211_RATE_INFO_BITRATE]) * 100;
2051                         }
2052                 }
2053         }
2054
2055         return NL_SKIP;
2056 }
2057
2058
2059 static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
2060                                    struct wpa_signal_info *sig)
2061 {
2062         struct nl_msg *msg;
2063
2064         sig->current_signal = -9999;
2065         sig->current_txrate = 0;
2066
2067         msg = nlmsg_alloc();
2068         if (!msg)
2069                 return -ENOMEM;
2070
2071         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
2072
2073         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2074         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
2075
2076         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
2077  nla_put_failure:
2078         nlmsg_free(msg);
2079         return -ENOBUFS;
2080 }
2081
2082
2083 static int get_link_noise(struct nl_msg *msg, void *arg)
2084 {
2085         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2086         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2087         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
2088         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
2089                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
2090                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
2091         };
2092         struct wpa_signal_info *sig_change = arg;
2093
2094         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2095                   genlmsg_attrlen(gnlh, 0), NULL);
2096
2097         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
2098                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
2099                 return NL_SKIP;
2100         }
2101
2102         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
2103                              tb[NL80211_ATTR_SURVEY_INFO],
2104                              survey_policy)) {
2105                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
2106                            "attributes!");
2107                 return NL_SKIP;
2108         }
2109
2110         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
2111                 return NL_SKIP;
2112
2113         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
2114             sig_change->frequency)
2115                 return NL_SKIP;
2116
2117         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
2118                 return NL_SKIP;
2119
2120         sig_change->current_noise =
2121                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
2122
2123         return NL_SKIP;
2124 }
2125
2126
2127 static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
2128                                   struct wpa_signal_info *sig_change)
2129 {
2130         struct nl_msg *msg;
2131
2132         sig_change->current_noise = 9999;
2133         sig_change->frequency = drv->assoc_freq;
2134
2135         msg = nlmsg_alloc();
2136         if (!msg)
2137                 return -ENOMEM;
2138
2139         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
2140
2141         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2142
2143         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
2144  nla_put_failure:
2145         nlmsg_free(msg);
2146         return -ENOBUFS;
2147 }
2148
2149
2150 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
2151 {
2152         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2153         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2154         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
2155         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
2156                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
2157                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
2158         };
2159         struct wpa_scan_results *scan_results = arg;
2160         struct wpa_scan_res *scan_res;
2161         size_t i;
2162
2163         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2164                   genlmsg_attrlen(gnlh, 0), NULL);
2165
2166         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
2167                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
2168                 return NL_SKIP;
2169         }
2170
2171         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
2172                              tb[NL80211_ATTR_SURVEY_INFO],
2173                              survey_policy)) {
2174                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
2175                            "attributes");
2176                 return NL_SKIP;
2177         }
2178
2179         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
2180                 return NL_SKIP;
2181
2182         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
2183                 return NL_SKIP;
2184
2185         for (i = 0; i < scan_results->num; ++i) {
2186                 scan_res = scan_results->res[i];
2187                 if (!scan_res)
2188                         continue;
2189                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
2190                     scan_res->freq)
2191                         continue;
2192                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
2193                         continue;
2194                 scan_res->noise = (s8)
2195                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
2196                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
2197         }
2198
2199         return NL_SKIP;
2200 }
2201
2202
2203 static int nl80211_get_noise_for_scan_results(
2204         struct wpa_driver_nl80211_data *drv,
2205         struct wpa_scan_results *scan_res)
2206 {
2207         struct nl_msg *msg;
2208
2209         msg = nlmsg_alloc();
2210         if (!msg)
2211                 return -ENOMEM;
2212
2213         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
2214
2215         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2216
2217         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
2218                                   scan_res);
2219  nla_put_failure:
2220         nlmsg_free(msg);
2221         return -ENOBUFS;
2222 }
2223
2224
2225 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
2226                               struct nlattr *tb[])
2227 {
2228         static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
2229                 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
2230                 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
2231                 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
2232                 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
2233         };
2234         struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
2235         enum nl80211_cqm_rssi_threshold_event event;
2236         union wpa_event_data ed;
2237         struct wpa_signal_info sig;
2238         int res;
2239
2240         if (tb[NL80211_ATTR_CQM] == NULL ||
2241             nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
2242                              cqm_policy)) {
2243                 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
2244                 return;
2245         }
2246
2247         os_memset(&ed, 0, sizeof(ed));
2248
2249         if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
2250                 if (!tb[NL80211_ATTR_MAC])
2251                         return;
2252                 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
2253                           ETH_ALEN);
2254                 wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed);
2255                 return;
2256         }
2257
2258         if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
2259                 return;
2260         event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
2261
2262         if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
2263                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2264                            "event: RSSI high");
2265                 ed.signal_change.above_threshold = 1;
2266         } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
2267                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2268                            "event: RSSI low");
2269                 ed.signal_change.above_threshold = 0;
2270         } else
2271                 return;
2272
2273         res = nl80211_get_link_signal(drv, &sig);
2274         if (res == 0) {
2275                 ed.signal_change.current_signal = sig.current_signal;
2276                 ed.signal_change.current_txrate = sig.current_txrate;
2277                 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm  txrate: %d",
2278                            sig.current_signal, sig.current_txrate);
2279         }
2280
2281         res = nl80211_get_link_noise(drv, &sig);
2282         if (res == 0) {
2283                 ed.signal_change.current_noise = sig.current_noise;
2284                 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
2285                            sig.current_noise);
2286         }
2287
2288         wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
2289 }
2290
2291
2292 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
2293                                       struct nlattr **tb)
2294 {
2295         u8 *addr;
2296         union wpa_event_data data;
2297
2298         if (tb[NL80211_ATTR_MAC] == NULL)
2299                 return;
2300         addr = nla_data(tb[NL80211_ATTR_MAC]);
2301         wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr));
2302
2303         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2304                 u8 *ies = NULL;
2305                 size_t ies_len = 0;
2306                 if (tb[NL80211_ATTR_IE]) {
2307                         ies = nla_data(tb[NL80211_ATTR_IE]);
2308                         ies_len = nla_len(tb[NL80211_ATTR_IE]);
2309                 }
2310                 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len);
2311                 drv_event_assoc(drv->ctx, addr, ies, ies_len, 0);
2312                 return;
2313         }
2314
2315         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2316                 return;
2317
2318         os_memset(&data, 0, sizeof(data));
2319         os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN);
2320         wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data);
2321 }
2322
2323
2324 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
2325                                       struct nlattr **tb)
2326 {
2327         u8 *addr;
2328         union wpa_event_data data;
2329
2330         if (tb[NL80211_ATTR_MAC] == NULL)
2331                 return;
2332         addr = nla_data(tb[NL80211_ATTR_MAC]);
2333         wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
2334                    MAC2STR(addr));
2335
2336         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2337                 drv_event_disassoc(drv->ctx, addr);
2338                 return;
2339         }
2340
2341         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2342                 return;
2343
2344         os_memset(&data, 0, sizeof(data));
2345         os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
2346         wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data);
2347 }
2348
2349
2350 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
2351                                         struct nlattr **tb)
2352 {
2353         struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
2354         static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
2355                 [NL80211_REKEY_DATA_KEK] = {
2356                         .minlen = NL80211_KEK_LEN,
2357                         .maxlen = NL80211_KEK_LEN,
2358                 },
2359                 [NL80211_REKEY_DATA_KCK] = {
2360                         .minlen = NL80211_KCK_LEN,
2361                         .maxlen = NL80211_KCK_LEN,
2362                 },
2363                 [NL80211_REKEY_DATA_REPLAY_CTR] = {
2364                         .minlen = NL80211_REPLAY_CTR_LEN,
2365                         .maxlen = NL80211_REPLAY_CTR_LEN,
2366                 },
2367         };
2368         union wpa_event_data data;
2369
2370         if (!tb[NL80211_ATTR_MAC])
2371                 return;
2372         if (!tb[NL80211_ATTR_REKEY_DATA])
2373                 return;
2374         if (nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2375                              tb[NL80211_ATTR_REKEY_DATA], rekey_policy))
2376                 return;
2377         if (!rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2378                 return;
2379
2380         os_memset(&data, 0, sizeof(data));
2381         data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2382         wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2383                    MAC2STR(data.driver_gtk_rekey.bssid));
2384         data.driver_gtk_rekey.replay_ctr =
2385                 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2386         wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2387                     data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2388         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2389 }
2390
2391
2392 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2393                                           struct nlattr **tb)
2394 {
2395         struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2396         static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2397                 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2398                 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2399                         .minlen = ETH_ALEN,
2400                         .maxlen = ETH_ALEN,
2401                 },
2402                 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2403         };
2404         union wpa_event_data data;
2405
2406         wpa_printf(MSG_DEBUG, "nl80211: PMKSA candidate event");
2407
2408         if (!tb[NL80211_ATTR_PMKSA_CANDIDATE])
2409                 return;
2410         if (nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2411                              tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy))
2412                 return;
2413         if (!cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2414             !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2415                 return;
2416
2417         os_memset(&data, 0, sizeof(data));
2418         os_memcpy(data.pmkid_candidate.bssid,
2419                   nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2420         data.pmkid_candidate.index =
2421                 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2422         data.pmkid_candidate.preauth =
2423                 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2424         wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2425 }
2426
2427
2428 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2429                                        struct nlattr **tb)
2430 {
2431         union wpa_event_data data;
2432
2433         wpa_printf(MSG_DEBUG, "nl80211: Probe client event");
2434
2435         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_ACK])
2436                 return;
2437
2438         os_memset(&data, 0, sizeof(data));
2439         os_memcpy(data.client_poll.addr,
2440                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2441
2442         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2443 }
2444
2445
2446 static void nl80211_tdls_oper_event(struct wpa_driver_nl80211_data *drv,
2447                                     struct nlattr **tb)
2448 {
2449         union wpa_event_data data;
2450
2451         wpa_printf(MSG_DEBUG, "nl80211: TDLS operation event");
2452
2453         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_TDLS_OPERATION])
2454                 return;
2455
2456         os_memset(&data, 0, sizeof(data));
2457         os_memcpy(data.tdls.peer, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2458         switch (nla_get_u8(tb[NL80211_ATTR_TDLS_OPERATION])) {
2459         case NL80211_TDLS_SETUP:
2460                 wpa_printf(MSG_DEBUG, "nl80211: TDLS setup request for peer "
2461                            MACSTR, MAC2STR(data.tdls.peer));
2462                 data.tdls.oper = TDLS_REQUEST_SETUP;
2463                 break;
2464         case NL80211_TDLS_TEARDOWN:
2465                 wpa_printf(MSG_DEBUG, "nl80211: TDLS teardown request for peer "
2466                            MACSTR, MAC2STR(data.tdls.peer));
2467                 data.tdls.oper = TDLS_REQUEST_TEARDOWN;
2468                 break;
2469         default:
2470                 wpa_printf(MSG_DEBUG, "nl80211: Unsupported TDLS operatione "
2471                            "event");
2472                 return;
2473         }
2474         if (tb[NL80211_ATTR_REASON_CODE]) {
2475                 data.tdls.reason_code =
2476                         nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
2477         }
2478
2479         wpa_supplicant_event(drv->ctx, EVENT_TDLS, &data);
2480 }
2481
2482
2483 static void nl80211_stop_ap(struct wpa_driver_nl80211_data *drv,
2484                             struct nlattr **tb)
2485 {
2486         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_UNAVAILABLE, NULL);
2487 }
2488
2489
2490 static void nl80211_connect_failed_event(struct wpa_driver_nl80211_data *drv,
2491                                          struct nlattr **tb)
2492 {
2493         union wpa_event_data data;
2494         u32 reason;
2495
2496         wpa_printf(MSG_DEBUG, "nl80211: Connect failed event");
2497
2498         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_CONN_FAILED_REASON])
2499                 return;
2500
2501         os_memset(&data, 0, sizeof(data));
2502         os_memcpy(data.connect_failed_reason.addr,
2503                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2504
2505         reason = nla_get_u32(tb[NL80211_ATTR_CONN_FAILED_REASON]);
2506         switch (reason) {
2507         case NL80211_CONN_FAIL_MAX_CLIENTS:
2508                 wpa_printf(MSG_DEBUG, "nl80211: Max client reached");
2509                 data.connect_failed_reason.code = MAX_CLIENT_REACHED;
2510                 break;
2511         case NL80211_CONN_FAIL_BLOCKED_CLIENT:
2512                 wpa_printf(MSG_DEBUG, "nl80211: Blocked client " MACSTR
2513                            " tried to connect",
2514                            MAC2STR(data.connect_failed_reason.addr));
2515                 data.connect_failed_reason.code = BLOCKED_CLIENT;
2516                 break;
2517         default:
2518                 wpa_printf(MSG_DEBUG, "nl8021l: Unknown connect failed reason "
2519                            "%u", reason);
2520                 return;
2521         }
2522
2523         wpa_supplicant_event(drv->ctx, EVENT_CONNECT_FAILED_REASON, &data);
2524 }
2525
2526
2527 static enum chan_width convert2width(int width);
2528
2529 static void nl80211_radar_event(struct wpa_driver_nl80211_data *drv,
2530                                 struct nlattr **tb)
2531 {
2532         union wpa_event_data data;
2533         enum nl80211_radar_event event_type;
2534
2535         if (!tb[NL80211_ATTR_WIPHY_FREQ] || !tb[NL80211_ATTR_RADAR_EVENT])
2536                 return;
2537
2538         os_memset(&data, 0, sizeof(data));
2539         data.dfs_event.freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2540         event_type = nla_get_u32(tb[NL80211_ATTR_RADAR_EVENT]);
2541
2542         /* Check HT params */
2543         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2544                 data.dfs_event.ht_enabled = 1;
2545                 data.dfs_event.chan_offset = 0;
2546
2547                 switch (nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
2548                 case NL80211_CHAN_NO_HT:
2549                         data.dfs_event.ht_enabled = 0;
2550                         break;
2551                 case NL80211_CHAN_HT20:
2552                         break;
2553                 case NL80211_CHAN_HT40PLUS:
2554                         data.dfs_event.chan_offset = 1;
2555                         break;
2556                 case NL80211_CHAN_HT40MINUS:
2557                         data.dfs_event.chan_offset = -1;
2558                         break;
2559                 }
2560         }
2561
2562         /* Get VHT params */
2563         if (tb[NL80211_ATTR_CHANNEL_WIDTH])
2564                 data.dfs_event.chan_width =
2565                         convert2width(nla_get_u32(
2566                                               tb[NL80211_ATTR_CHANNEL_WIDTH]));
2567         if (tb[NL80211_ATTR_CENTER_FREQ1])
2568                 data.dfs_event.cf1 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
2569         if (tb[NL80211_ATTR_CENTER_FREQ2])
2570                 data.dfs_event.cf2 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
2571
2572         wpa_printf(MSG_DEBUG, "nl80211: DFS event on freq %d MHz, ht: %d, offset: %d, width: %d, cf1: %dMHz, cf2: %dMHz",
2573                    data.dfs_event.freq, data.dfs_event.ht_enabled,
2574                    data.dfs_event.chan_offset, data.dfs_event.chan_width,
2575                    data.dfs_event.cf1, data.dfs_event.cf2);
2576
2577         switch (event_type) {
2578         case NL80211_RADAR_DETECTED:
2579                 wpa_supplicant_event(drv->ctx, EVENT_DFS_RADAR_DETECTED, &data);
2580                 break;
2581         case NL80211_RADAR_CAC_FINISHED:
2582                 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_FINISHED, &data);
2583                 break;
2584         case NL80211_RADAR_CAC_ABORTED:
2585                 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_ABORTED, &data);
2586                 break;
2587         case NL80211_RADAR_NOP_FINISHED:
2588                 wpa_supplicant_event(drv->ctx, EVENT_DFS_NOP_FINISHED, &data);
2589                 break;
2590         default:
2591                 wpa_printf(MSG_DEBUG, "nl80211: Unknown radar event %d "
2592                            "received", event_type);
2593                 break;
2594         }
2595 }
2596
2597
2598 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2599                                    int wds)
2600 {
2601         struct wpa_driver_nl80211_data *drv = bss->drv;
2602         union wpa_event_data event;
2603
2604         if (!tb[NL80211_ATTR_MAC])
2605                 return;
2606
2607         os_memset(&event, 0, sizeof(event));
2608         event.rx_from_unknown.bssid = bss->addr;
2609         event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2610         event.rx_from_unknown.wds = wds;
2611
2612         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2613 }
2614
2615
2616 static void do_process_drv_event(struct i802_bss *bss, int cmd,
2617                                  struct nlattr **tb)
2618 {
2619         struct wpa_driver_nl80211_data *drv = bss->drv;
2620         union wpa_event_data data;
2621
2622         wpa_printf(MSG_DEBUG, "nl80211: Drv Event %d (%s) received for %s",
2623                    cmd, nl80211_command_to_string(cmd), bss->ifname);
2624
2625         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
2626             (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
2627              cmd == NL80211_CMD_SCAN_ABORTED)) {
2628                 wpa_driver_nl80211_set_mode(drv->first_bss,
2629                                             drv->ap_scan_as_station);
2630                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2631         }
2632
2633         switch (cmd) {
2634         case NL80211_CMD_TRIGGER_SCAN:
2635                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan trigger");
2636                 drv->scan_state = SCAN_STARTED;
2637                 break;
2638         case NL80211_CMD_START_SCHED_SCAN:
2639                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan started");
2640                 drv->scan_state = SCHED_SCAN_STARTED;
2641                 break;
2642         case NL80211_CMD_SCHED_SCAN_STOPPED:
2643                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan stopped");
2644                 drv->scan_state = SCHED_SCAN_STOPPED;
2645                 wpa_supplicant_event(drv->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
2646                 break;
2647         case NL80211_CMD_NEW_SCAN_RESULTS:
2648                 wpa_dbg(drv->ctx, MSG_DEBUG,
2649                         "nl80211: New scan results available");
2650                 drv->scan_state = SCAN_COMPLETED;
2651                 drv->scan_complete_events = 1;
2652                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2653                                      drv->ctx);
2654                 send_scan_event(drv, 0, tb);
2655                 break;
2656         case NL80211_CMD_SCHED_SCAN_RESULTS:
2657                 wpa_dbg(drv->ctx, MSG_DEBUG,
2658                         "nl80211: New sched scan results available");
2659                 drv->scan_state = SCHED_SCAN_RESULTS;
2660                 send_scan_event(drv, 0, tb);
2661                 break;
2662         case NL80211_CMD_SCAN_ABORTED:
2663                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan aborted");
2664                 drv->scan_state = SCAN_ABORTED;
2665                 /*
2666                  * Need to indicate that scan results are available in order
2667                  * not to make wpa_supplicant stop its scanning.
2668                  */
2669                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2670                                      drv->ctx);
2671                 send_scan_event(drv, 1, tb);
2672                 break;
2673         case NL80211_CMD_AUTHENTICATE:
2674         case NL80211_CMD_ASSOCIATE:
2675         case NL80211_CMD_DEAUTHENTICATE:
2676         case NL80211_CMD_DISASSOCIATE:
2677         case NL80211_CMD_FRAME_TX_STATUS:
2678         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
2679         case NL80211_CMD_UNPROT_DISASSOCIATE:
2680                 mlme_event(bss, cmd, tb[NL80211_ATTR_FRAME],
2681                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2682                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2683                            tb[NL80211_ATTR_COOKIE],
2684                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2685                 break;
2686         case NL80211_CMD_CONNECT:
2687         case NL80211_CMD_ROAM:
2688                 mlme_event_connect(drv, cmd,
2689                                    tb[NL80211_ATTR_STATUS_CODE],
2690                                    tb[NL80211_ATTR_MAC],
2691                                    tb[NL80211_ATTR_REQ_IE],
2692                                    tb[NL80211_ATTR_RESP_IE]);
2693                 break;
2694         case NL80211_CMD_CH_SWITCH_NOTIFY:
2695                 mlme_event_ch_switch(drv, tb[NL80211_ATTR_WIPHY_FREQ],
2696                                      tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2697                 break;
2698         case NL80211_CMD_DISCONNECT:
2699                 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
2700                                       tb[NL80211_ATTR_MAC],
2701                                       tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
2702                 break;
2703         case NL80211_CMD_MICHAEL_MIC_FAILURE:
2704                 mlme_event_michael_mic_failure(bss, tb);
2705                 break;
2706         case NL80211_CMD_JOIN_IBSS:
2707                 mlme_event_join_ibss(drv, tb);
2708                 break;
2709         case NL80211_CMD_REMAIN_ON_CHANNEL:
2710                 mlme_event_remain_on_channel(drv, 0, tb);
2711                 break;
2712         case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
2713                 mlme_event_remain_on_channel(drv, 1, tb);
2714                 break;
2715         case NL80211_CMD_NOTIFY_CQM:
2716                 nl80211_cqm_event(drv, tb);
2717                 break;
2718         case NL80211_CMD_REG_CHANGE:
2719                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
2720                 if (tb[NL80211_ATTR_REG_INITIATOR] == NULL)
2721                         break;
2722                 os_memset(&data, 0, sizeof(data));
2723                 switch (nla_get_u8(tb[NL80211_ATTR_REG_INITIATOR])) {
2724                 case NL80211_REGDOM_SET_BY_CORE:
2725                         data.channel_list_changed.initiator =
2726                                 REGDOM_SET_BY_CORE;
2727                         break;
2728                 case NL80211_REGDOM_SET_BY_USER:
2729                         data.channel_list_changed.initiator =
2730                                 REGDOM_SET_BY_USER;
2731                         break;
2732                 case NL80211_REGDOM_SET_BY_DRIVER:
2733                         data.channel_list_changed.initiator =
2734                                 REGDOM_SET_BY_DRIVER;
2735                         break;
2736                 case NL80211_REGDOM_SET_BY_COUNTRY_IE:
2737                         data.channel_list_changed.initiator =
2738                                 REGDOM_SET_BY_COUNTRY_IE;
2739                         break;
2740                 default:
2741                         wpa_printf(MSG_DEBUG, "nl80211: Unknown reg change initiator %d received",
2742                                    nla_get_u8(tb[NL80211_ATTR_REG_INITIATOR]));
2743                         break;
2744                 }
2745                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2746                                      &data);
2747                 break;
2748         case NL80211_CMD_REG_BEACON_HINT:
2749                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
2750                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2751                                      NULL);
2752                 break;
2753         case NL80211_CMD_NEW_STATION:
2754                 nl80211_new_station_event(drv, tb);
2755                 break;
2756         case NL80211_CMD_DEL_STATION:
2757                 nl80211_del_station_event(drv, tb);
2758                 break;
2759         case NL80211_CMD_SET_REKEY_OFFLOAD:
2760                 nl80211_rekey_offload_event(drv, tb);
2761                 break;
2762         case NL80211_CMD_PMKSA_CANDIDATE:
2763                 nl80211_pmksa_candidate_event(drv, tb);
2764                 break;
2765         case NL80211_CMD_PROBE_CLIENT:
2766                 nl80211_client_probe_event(drv, tb);
2767                 break;
2768         case NL80211_CMD_TDLS_OPER:
2769                 nl80211_tdls_oper_event(drv, tb);
2770                 break;
2771         case NL80211_CMD_CONN_FAILED:
2772                 nl80211_connect_failed_event(drv, tb);
2773                 break;
2774         case NL80211_CMD_FT_EVENT:
2775                 mlme_event_ft_event(drv, tb);
2776                 break;
2777         case NL80211_CMD_RADAR_DETECT:
2778                 nl80211_radar_event(drv, tb);
2779                 break;
2780         case NL80211_CMD_STOP_AP:
2781                 nl80211_stop_ap(drv, tb);
2782                 break;
2783         default:
2784                 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Ignored unknown event "
2785                         "(cmd=%d)", cmd);
2786                 break;
2787         }
2788 }
2789
2790
2791 static int process_drv_event(struct nl_msg *msg, void *arg)
2792 {
2793         struct wpa_driver_nl80211_data *drv = arg;
2794         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2795         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2796         struct i802_bss *bss;
2797         int ifidx = -1;
2798
2799         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2800                   genlmsg_attrlen(gnlh, 0), NULL);
2801
2802         if (tb[NL80211_ATTR_IFINDEX]) {
2803                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2804
2805                 for (bss = drv->first_bss; bss; bss = bss->next)
2806                         if (ifidx == -1 || ifidx == bss->ifindex) {
2807                                 do_process_drv_event(bss, gnlh->cmd, tb);
2808                                 return NL_SKIP;
2809                         }
2810                 wpa_printf(MSG_DEBUG,
2811                            "nl80211: Ignored event (cmd=%d) for foreign interface (ifindex %d)",
2812                            gnlh->cmd, ifidx);
2813         } else if (tb[NL80211_ATTR_WDEV]) {
2814                 u64 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
2815                 wpa_printf(MSG_DEBUG, "nl80211: Process event on P2P device");
2816                 for (bss = drv->first_bss; bss; bss = bss->next) {
2817                         if (bss->wdev_id_set && wdev_id == bss->wdev_id) {
2818                                 do_process_drv_event(bss, gnlh->cmd, tb);
2819                                 return NL_SKIP;
2820                         }
2821                 }
2822                 wpa_printf(MSG_DEBUG,
2823                            "nl80211: Ignored event (cmd=%d) for foreign interface (wdev 0x%llx)",
2824                            gnlh->cmd, (long long unsigned int) wdev_id);
2825         }
2826
2827         return NL_SKIP;
2828 }
2829
2830
2831 static int process_global_event(struct nl_msg *msg, void *arg)
2832 {
2833         struct nl80211_global *global = arg;
2834         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2835         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2836         struct wpa_driver_nl80211_data *drv, *tmp;
2837         int ifidx = -1;
2838         struct i802_bss *bss;
2839         u64 wdev_id = 0;
2840         int wdev_id_set = 0;
2841
2842         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2843                   genlmsg_attrlen(gnlh, 0), NULL);
2844
2845         if (tb[NL80211_ATTR_IFINDEX])
2846                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2847         else if (tb[NL80211_ATTR_WDEV]) {
2848                 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
2849                 wdev_id_set = 1;
2850         }
2851
2852         dl_list_for_each_safe(drv, tmp, &global->interfaces,
2853                               struct wpa_driver_nl80211_data, list) {
2854                 for (bss = drv->first_bss; bss; bss = bss->next) {
2855                         if ((ifidx == -1 && !wdev_id_set) ||
2856                             ifidx == bss->ifindex ||
2857                             (wdev_id_set && bss->wdev_id_set &&
2858                              wdev_id == bss->wdev_id)) {
2859                                 do_process_drv_event(bss, gnlh->cmd, tb);
2860                                 return NL_SKIP;
2861                         }
2862                 }
2863         }
2864
2865         return NL_SKIP;
2866 }
2867
2868
2869 static int process_bss_event(struct nl_msg *msg, void *arg)
2870 {
2871         struct i802_bss *bss = arg;
2872         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2873         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2874
2875         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2876                   genlmsg_attrlen(gnlh, 0), NULL);
2877
2878         wpa_printf(MSG_DEBUG, "nl80211: BSS Event %d (%s) received for %s",
2879                    gnlh->cmd, nl80211_command_to_string(gnlh->cmd),
2880                    bss->ifname);
2881
2882         switch (gnlh->cmd) {
2883         case NL80211_CMD_FRAME:
2884         case NL80211_CMD_FRAME_TX_STATUS:
2885                 mlme_event(bss, gnlh->cmd, tb[NL80211_ATTR_FRAME],
2886                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2887                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2888                            tb[NL80211_ATTR_COOKIE],
2889                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2890                 break;
2891         case NL80211_CMD_UNEXPECTED_FRAME:
2892                 nl80211_spurious_frame(bss, tb, 0);
2893                 break;
2894         case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
2895                 nl80211_spurious_frame(bss, tb, 1);
2896                 break;
2897         default:
2898                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
2899                            "(cmd=%d)", gnlh->cmd);
2900                 break;
2901         }
2902
2903         return NL_SKIP;
2904 }
2905
2906
2907 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
2908                                              void *handle)
2909 {
2910         struct nl_cb *cb = eloop_ctx;
2911         int res;
2912
2913         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
2914
2915         res = nl_recvmsgs(handle, cb);
2916         if (res) {
2917                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
2918                            __func__, res);
2919         }
2920 }
2921
2922
2923 /**
2924  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
2925  * @priv: driver_nl80211 private data
2926  * @alpha2_arg: country to which to switch to
2927  * Returns: 0 on success, -1 on failure
2928  *
2929  * This asks nl80211 to set the regulatory domain for given
2930  * country ISO / IEC alpha2.
2931  */
2932 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
2933 {
2934         struct i802_bss *bss = priv;
2935         struct wpa_driver_nl80211_data *drv = bss->drv;
2936         char alpha2[3];
2937         struct nl_msg *msg;
2938
2939         msg = nlmsg_alloc();
2940         if (!msg)
2941                 return -ENOMEM;
2942
2943         alpha2[0] = alpha2_arg[0];
2944         alpha2[1] = alpha2_arg[1];
2945         alpha2[2] = '\0';
2946
2947         nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
2948
2949         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
2950         if (send_and_recv_msgs(drv, msg, NULL, NULL))
2951                 return -EINVAL;
2952         return 0;
2953 nla_put_failure:
2954         nlmsg_free(msg);
2955         return -EINVAL;
2956 }
2957
2958
2959 static int nl80211_get_country(struct nl_msg *msg, void *arg)
2960 {
2961         char *alpha2 = arg;
2962         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
2963         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2964
2965         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2966                   genlmsg_attrlen(gnlh, 0), NULL);
2967         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
2968                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
2969                 return NL_SKIP;
2970         }
2971         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
2972         return NL_SKIP;
2973 }
2974
2975
2976 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
2977 {
2978         struct i802_bss *bss = priv;
2979         struct wpa_driver_nl80211_data *drv = bss->drv;
2980         struct nl_msg *msg;
2981         int ret;
2982
2983         msg = nlmsg_alloc();
2984         if (!msg)
2985                 return -ENOMEM;
2986
2987         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
2988         alpha2[0] = '\0';
2989         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
2990         if (!alpha2[0])
2991                 ret = -1;
2992
2993         return ret;
2994 }
2995
2996
2997 static int protocol_feature_handler(struct nl_msg *msg, void *arg)
2998 {
2999         u32 *feat = arg;
3000         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
3001         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3002
3003         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3004                   genlmsg_attrlen(gnlh, 0), NULL);
3005
3006         if (tb_msg[NL80211_ATTR_PROTOCOL_FEATURES])
3007                 *feat = nla_get_u32(tb_msg[NL80211_ATTR_PROTOCOL_FEATURES]);
3008
3009         return NL_SKIP;
3010 }
3011
3012
3013 static u32 get_nl80211_protocol_features(struct wpa_driver_nl80211_data *drv)
3014 {
3015         u32 feat = 0;
3016         struct nl_msg *msg;
3017
3018         msg = nlmsg_alloc();
3019         if (!msg)
3020                 goto nla_put_failure;
3021
3022         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_PROTOCOL_FEATURES);
3023         if (send_and_recv_msgs(drv, msg, protocol_feature_handler, &feat) == 0)
3024                 return feat;
3025
3026         msg = NULL;
3027 nla_put_failure:
3028         nlmsg_free(msg);
3029         return 0;
3030 }
3031
3032
3033 struct wiphy_info_data {
3034         struct wpa_driver_nl80211_data *drv;
3035         struct wpa_driver_capa *capa;
3036
3037         unsigned int num_multichan_concurrent;
3038
3039         unsigned int error:1;
3040         unsigned int device_ap_sme:1;
3041         unsigned int poll_command_supported:1;
3042         unsigned int data_tx_status:1;
3043         unsigned int monitor_supported:1;
3044         unsigned int auth_supported:1;
3045         unsigned int connect_supported:1;
3046         unsigned int p2p_go_supported:1;
3047         unsigned int p2p_client_supported:1;
3048         unsigned int p2p_concurrent:1;
3049         unsigned int channel_switch_supported:1;
3050 };
3051
3052
3053 static unsigned int probe_resp_offload_support(int supp_protocols)
3054 {
3055         unsigned int prot = 0;
3056
3057         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS)
3058                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS;
3059         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2)
3060                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2;
3061         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P)
3062                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P;
3063         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U)
3064                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING;
3065
3066         return prot;
3067 }
3068
3069
3070 static void wiphy_info_supported_iftypes(struct wiphy_info_data *info,
3071                                          struct nlattr *tb)
3072 {
3073         struct nlattr *nl_mode;
3074         int i;
3075
3076         if (tb == NULL)
3077                 return;
3078
3079         nla_for_each_nested(nl_mode, tb, i) {
3080                 switch (nla_type(nl_mode)) {
3081                 case NL80211_IFTYPE_AP:
3082                         info->capa->flags |= WPA_DRIVER_FLAGS_AP;
3083                         break;
3084                 case NL80211_IFTYPE_ADHOC:
3085                         info->capa->flags |= WPA_DRIVER_FLAGS_IBSS;
3086                         break;
3087                 case NL80211_IFTYPE_P2P_DEVICE:
3088                         info->capa->flags |=
3089                                 WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE;
3090                         break;
3091                 case NL80211_IFTYPE_P2P_GO:
3092                         info->p2p_go_supported = 1;
3093                         break;
3094                 case NL80211_IFTYPE_P2P_CLIENT:
3095                         info->p2p_client_supported = 1;
3096                         break;
3097                 case NL80211_IFTYPE_MONITOR:
3098                         info->monitor_supported = 1;
3099                         break;
3100                 }
3101         }
3102 }
3103
3104
3105 static int wiphy_info_iface_comb_process(struct wiphy_info_data *info,
3106                                          struct nlattr *nl_combi)
3107 {
3108         struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
3109         struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
3110         struct nlattr *nl_limit, *nl_mode;
3111         int err, rem_limit, rem_mode;
3112         int combination_has_p2p = 0, combination_has_mgd = 0;
3113         static struct nla_policy
3114         iface_combination_policy[NUM_NL80211_IFACE_COMB] = {
3115                 [NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
3116                 [NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
3117                 [NL80211_IFACE_COMB_STA_AP_BI_MATCH] = { .type = NLA_FLAG },
3118                 [NL80211_IFACE_COMB_NUM_CHANNELS] = { .type = NLA_U32 },
3119                 [NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS] = { .type = NLA_U32 },
3120         },
3121         iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
3122                 [NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
3123                 [NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
3124         };
3125
3126         err = nla_parse_nested(tb_comb, MAX_NL80211_IFACE_COMB,
3127                                nl_combi, iface_combination_policy);
3128         if (err || !tb_comb[NL80211_IFACE_COMB_LIMITS] ||
3129             !tb_comb[NL80211_IFACE_COMB_MAXNUM] ||
3130             !tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS])
3131                 return 0; /* broken combination */
3132
3133         if (tb_comb[NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS])
3134                 info->capa->flags |= WPA_DRIVER_FLAGS_RADAR;
3135
3136         nla_for_each_nested(nl_limit, tb_comb[NL80211_IFACE_COMB_LIMITS],
3137                             rem_limit) {
3138                 err = nla_parse_nested(tb_limit, MAX_NL80211_IFACE_LIMIT,
3139                                        nl_limit, iface_limit_policy);
3140                 if (err || !tb_limit[NL80211_IFACE_LIMIT_TYPES])
3141                         return 0; /* broken combination */
3142
3143                 nla_for_each_nested(nl_mode,
3144                                     tb_limit[NL80211_IFACE_LIMIT_TYPES],
3145                                     rem_mode) {
3146                         int ift = nla_type(nl_mode);
3147                         if (ift == NL80211_IFTYPE_P2P_GO ||
3148                             ift == NL80211_IFTYPE_P2P_CLIENT)
3149                                 combination_has_p2p = 1;
3150                         if (ift == NL80211_IFTYPE_STATION)
3151                                 combination_has_mgd = 1;
3152                 }
3153                 if (combination_has_p2p && combination_has_mgd)
3154                         break;
3155         }
3156
3157         if (combination_has_p2p && combination_has_mgd) {
3158                 info->p2p_concurrent = 1;
3159                 info->num_multichan_concurrent =
3160                         nla_get_u32(tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS]);
3161                 return 1;
3162         }
3163
3164         return 0;
3165 }
3166
3167
3168 static void wiphy_info_iface_comb(struct wiphy_info_data *info,
3169                                   struct nlattr *tb)
3170 {
3171         struct nlattr *nl_combi;
3172         int rem_combi;
3173
3174         if (tb == NULL)
3175                 return;
3176
3177         nla_for_each_nested(nl_combi, tb, rem_combi) {
3178                 if (wiphy_info_iface_comb_process(info, nl_combi) > 0)
3179                         break;
3180         }
3181 }
3182
3183
3184 static void wiphy_info_supp_cmds(struct wiphy_info_data *info,
3185                                  struct nlattr *tb)
3186 {
3187         struct nlattr *nl_cmd;
3188         int i;
3189
3190         if (tb == NULL)
3191                 return;
3192
3193         nla_for_each_nested(nl_cmd, tb, i) {
3194                 switch (nla_get_u32(nl_cmd)) {
3195                 case NL80211_CMD_AUTHENTICATE:
3196                         info->auth_supported = 1;
3197                         break;
3198                 case NL80211_CMD_CONNECT:
3199                         info->connect_supported = 1;
3200                         break;
3201                 case NL80211_CMD_START_SCHED_SCAN:
3202                         info->capa->sched_scan_supported = 1;
3203                         break;
3204                 case NL80211_CMD_PROBE_CLIENT:
3205                         info->poll_command_supported = 1;
3206                         break;
3207                 case NL80211_CMD_CHANNEL_SWITCH:
3208                         info->channel_switch_supported = 1;
3209                         break;
3210                 }
3211         }
3212 }
3213
3214
3215 static void wiphy_info_max_roc(struct wpa_driver_capa *capa,
3216                                struct nlattr *tb)
3217 {
3218         if (tb)
3219                 capa->max_remain_on_chan = nla_get_u32(tb);
3220 }
3221
3222
3223 static void wiphy_info_tdls(struct wpa_driver_capa *capa, struct nlattr *tdls,
3224                             struct nlattr *ext_setup)
3225 {
3226         if (tdls == NULL)
3227                 return;
3228
3229         wpa_printf(MSG_DEBUG, "nl80211: TDLS supported");
3230         capa->flags |= WPA_DRIVER_FLAGS_TDLS_SUPPORT;
3231
3232         if (ext_setup) {
3233                 wpa_printf(MSG_DEBUG, "nl80211: TDLS external setup");
3234                 capa->flags |= WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP;
3235         }
3236 }
3237
3238
3239 static void wiphy_info_feature_flags(struct wiphy_info_data *info,
3240                                      struct nlattr *tb)
3241 {
3242         u32 flags;
3243         struct wpa_driver_capa *capa = info->capa;
3244
3245         if (tb == NULL)
3246                 return;
3247
3248         flags = nla_get_u32(tb);
3249
3250         if (flags & NL80211_FEATURE_SK_TX_STATUS)
3251                 info->data_tx_status = 1;
3252
3253         if (flags & NL80211_FEATURE_INACTIVITY_TIMER)
3254                 capa->flags |= WPA_DRIVER_FLAGS_INACTIVITY_TIMER;
3255
3256         if (flags & NL80211_FEATURE_SAE)
3257                 capa->flags |= WPA_DRIVER_FLAGS_SAE;
3258
3259         if (flags & NL80211_FEATURE_NEED_OBSS_SCAN)
3260                 capa->flags |= WPA_DRIVER_FLAGS_OBSS_SCAN;
3261 }
3262
3263
3264 static void wiphy_info_probe_resp_offload(struct wpa_driver_capa *capa,
3265                                           struct nlattr *tb)
3266 {
3267         u32 protocols;
3268
3269         if (tb == NULL)
3270                 return;
3271
3272         protocols = nla_get_u32(tb);
3273         wpa_printf(MSG_DEBUG, "nl80211: Supports Probe Response offload in AP "
3274                    "mode");
3275         capa->flags |= WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD;
3276         capa->probe_resp_offloads = probe_resp_offload_support(protocols);
3277 }
3278
3279
3280 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
3281 {
3282         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3283         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3284         struct wiphy_info_data *info = arg;
3285         struct wpa_driver_capa *capa = info->capa;
3286         struct wpa_driver_nl80211_data *drv = info->drv;
3287
3288         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3289                   genlmsg_attrlen(gnlh, 0), NULL);
3290
3291         if (tb[NL80211_ATTR_WIPHY_NAME])
3292                 os_strlcpy(drv->phyname,
3293                            nla_get_string(tb[NL80211_ATTR_WIPHY_NAME]),
3294                            sizeof(drv->phyname));
3295         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
3296                 capa->max_scan_ssids =
3297                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
3298
3299         if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS])
3300                 capa->max_sched_scan_ssids =
3301                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS]);
3302
3303         if (tb[NL80211_ATTR_MAX_MATCH_SETS])
3304                 capa->max_match_sets =
3305                         nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
3306
3307         if (tb[NL80211_ATTR_MAC_ACL_MAX])
3308                 capa->max_acl_mac_addrs =
3309                         nla_get_u8(tb[NL80211_ATTR_MAC_ACL_MAX]);
3310
3311         wiphy_info_supported_iftypes(info, tb[NL80211_ATTR_SUPPORTED_IFTYPES]);
3312         wiphy_info_iface_comb(info, tb[NL80211_ATTR_INTERFACE_COMBINATIONS]);
3313         wiphy_info_supp_cmds(info, tb[NL80211_ATTR_SUPPORTED_COMMANDS]);
3314
3315         if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) {
3316                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
3317                            "off-channel TX");
3318                 capa->flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
3319         }
3320
3321         if (tb[NL80211_ATTR_ROAM_SUPPORT]) {
3322                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based roaming");
3323                 capa->flags |= WPA_DRIVER_FLAGS_BSS_SELECTION;
3324         }
3325
3326         wiphy_info_max_roc(capa,
3327                            tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
3328
3329         if (tb[NL80211_ATTR_SUPPORT_AP_UAPSD])
3330                 capa->flags |= WPA_DRIVER_FLAGS_AP_UAPSD;
3331
3332         wiphy_info_tdls(capa, tb[NL80211_ATTR_TDLS_SUPPORT],
3333                         tb[NL80211_ATTR_TDLS_EXTERNAL_SETUP]);
3334
3335         if (tb[NL80211_ATTR_DEVICE_AP_SME])
3336                 info->device_ap_sme = 1;
3337
3338         wiphy_info_feature_flags(info, tb[NL80211_ATTR_FEATURE_FLAGS]);
3339         wiphy_info_probe_resp_offload(capa,
3340                                       tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]);
3341
3342         if (tb[NL80211_ATTR_EXT_CAPA] && tb[NL80211_ATTR_EXT_CAPA_MASK] &&
3343             drv->extended_capa == NULL) {
3344                 drv->extended_capa =
3345                         os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3346                 if (drv->extended_capa) {
3347                         os_memcpy(drv->extended_capa,
3348                                   nla_data(tb[NL80211_ATTR_EXT_CAPA]),
3349                                   nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3350                         drv->extended_capa_len =
3351                                 nla_len(tb[NL80211_ATTR_EXT_CAPA]);
3352                 }
3353                 drv->extended_capa_mask =
3354                         os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3355                 if (drv->extended_capa_mask) {
3356                         os_memcpy(drv->extended_capa_mask,
3357                                   nla_data(tb[NL80211_ATTR_EXT_CAPA]),
3358                                   nla_len(tb[NL80211_ATTR_EXT_CAPA]));
3359                 } else {
3360                         os_free(drv->extended_capa);
3361                         drv->extended_capa = NULL;
3362                         drv->extended_capa_len = 0;
3363                 }
3364         }
3365
3366         return NL_SKIP;
3367 }
3368
3369
3370 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
3371                                        struct wiphy_info_data *info)
3372 {
3373         u32 feat;
3374         struct nl_msg *msg;
3375
3376         os_memset(info, 0, sizeof(*info));
3377         info->capa = &drv->capa;
3378         info->drv = drv;
3379
3380         msg = nlmsg_alloc();
3381         if (!msg)
3382                 return -1;
3383
3384         feat = get_nl80211_protocol_features(drv);
3385         if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
3386                 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
3387         else
3388                 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
3389
3390         NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
3391         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
3392                 goto nla_put_failure;
3393
3394         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info))
3395                 return -1;
3396
3397         if (info->auth_supported)
3398                 drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
3399         else if (!info->connect_supported) {
3400                 wpa_printf(MSG_INFO, "nl80211: Driver does not support "
3401                            "authentication/association or connect commands");
3402                 info->error = 1;
3403         }
3404
3405         if (info->p2p_go_supported && info->p2p_client_supported)
3406                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
3407         if (info->p2p_concurrent) {
3408                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
3409                            "interface (driver advertised support)");
3410                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
3411                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
3412         }
3413         if (info->num_multichan_concurrent > 1) {
3414                 wpa_printf(MSG_DEBUG, "nl80211: Enable multi-channel "
3415                            "concurrent (driver advertised support)");
3416                 drv->capa.num_multichan_concurrent =
3417                         info->num_multichan_concurrent;
3418         }
3419
3420         /* default to 5000 since early versions of mac80211 don't set it */
3421         if (!drv->capa.max_remain_on_chan)
3422                 drv->capa.max_remain_on_chan = 5000;
3423
3424         return 0;
3425 nla_put_failure:
3426         nlmsg_free(msg);
3427         return -1;
3428 }
3429
3430
3431 static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
3432 {
3433         struct wiphy_info_data info;
3434         if (wpa_driver_nl80211_get_info(drv, &info))
3435                 return -1;
3436
3437         if (info.error)
3438                 return -1;
3439
3440         drv->has_capability = 1;
3441         /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
3442         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3443                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3444                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
3445                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
3446         drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
3447                 WPA_DRIVER_CAPA_ENC_WEP104 |
3448                 WPA_DRIVER_CAPA_ENC_TKIP |
3449                 WPA_DRIVER_CAPA_ENC_CCMP;
3450         drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
3451                 WPA_DRIVER_AUTH_SHARED |
3452                 WPA_DRIVER_AUTH_LEAP;
3453
3454         drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES;
3455         drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
3456         drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3457
3458         if (!info.device_ap_sme) {
3459                 drv->capa.flags |= WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS;
3460
3461                 /*
3462                  * No AP SME is currently assumed to also indicate no AP MLME
3463                  * in the driver/firmware.
3464                  */
3465                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_MLME;
3466         }
3467
3468         drv->device_ap_sme = info.device_ap_sme;
3469         drv->poll_command_supported = info.poll_command_supported;
3470         drv->data_tx_status = info.data_tx_status;
3471         drv->channel_switch_supported = info.channel_switch_supported;
3472
3473         /*
3474          * If poll command and tx status are supported, mac80211 is new enough
3475          * to have everything we need to not need monitor interfaces.
3476          */
3477         drv->use_monitor = !info.poll_command_supported || !info.data_tx_status;
3478
3479         if (drv->device_ap_sme && drv->use_monitor) {
3480                 /*
3481                  * Non-mac80211 drivers may not support monitor interface.
3482                  * Make sure we do not get stuck with incorrect capability here
3483                  * by explicitly testing this.
3484                  */
3485                 if (!info.monitor_supported) {
3486                         wpa_printf(MSG_DEBUG, "nl80211: Disable use_monitor "
3487                                    "with device_ap_sme since no monitor mode "
3488                                    "support detected");
3489                         drv->use_monitor = 0;
3490                 }
3491         }
3492
3493         /*
3494          * If we aren't going to use monitor interfaces, but the
3495          * driver doesn't support data TX status, we won't get TX
3496          * status for EAPOL frames.
3497          */
3498         if (!drv->use_monitor && !info.data_tx_status)
3499                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3500
3501         return 0;
3502 }
3503
3504
3505 #ifdef ANDROID
3506 static int android_genl_ctrl_resolve(struct nl_handle *handle,
3507                                      const char *name)
3508 {
3509         /*
3510          * Android ICS has very minimal genl_ctrl_resolve() implementation, so
3511          * need to work around that.
3512          */
3513         struct nl_cache *cache = NULL;
3514         struct genl_family *nl80211 = NULL;
3515         int id = -1;
3516
3517         if (genl_ctrl_alloc_cache(handle, &cache) < 0) {
3518                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
3519                            "netlink cache");
3520                 goto fail;
3521         }
3522
3523         nl80211 = genl_ctrl_search_by_name(cache, name);
3524         if (nl80211 == NULL)
3525                 goto fail;
3526
3527         id = genl_family_get_id(nl80211);
3528
3529 fail:
3530         if (nl80211)
3531                 genl_family_put(nl80211);
3532         if (cache)
3533                 nl_cache_free(cache);
3534
3535         return id;
3536 }
3537 #define genl_ctrl_resolve android_genl_ctrl_resolve
3538 #endif /* ANDROID */
3539
3540
3541 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
3542 {
3543         int ret;
3544
3545         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
3546         if (global->nl_cb == NULL) {
3547                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
3548                            "callbacks");
3549                 return -1;
3550         }
3551
3552         global->nl = nl_create_handle(global->nl_cb, "nl");
3553         if (global->nl == NULL)
3554                 goto err;
3555
3556         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
3557         if (global->nl80211_id < 0) {
3558                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
3559                            "found");
3560                 goto err;
3561         }
3562
3563         global->nl_event = nl_create_handle(global->nl_cb, "event");
3564         if (global->nl_event == NULL)
3565                 goto err;
3566
3567         ret = nl_get_multicast_id(global, "nl80211", "scan");
3568         if (ret >= 0)
3569                 ret = nl_socket_add_membership(global->nl_event, ret);
3570         if (ret < 0) {
3571                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
3572                            "membership for scan events: %d (%s)",
3573                            ret, strerror(-ret));
3574                 goto err;
3575         }
3576
3577         ret = nl_get_multicast_id(global, "nl80211", "mlme");
3578         if (ret >= 0)
3579                 ret = nl_socket_add_membership(global->nl_event, ret);
3580         if (ret < 0) {
3581                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
3582                            "membership for mlme events: %d (%s)",
3583                            ret, strerror(-ret));
3584                 goto err;
3585         }
3586
3587         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
3588         if (ret >= 0)
3589                 ret = nl_socket_add_membership(global->nl_event, ret);
3590         if (ret < 0) {
3591                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
3592                            "membership for regulatory events: %d (%s)",
3593                            ret, strerror(-ret));
3594                 /* Continue without regulatory events */
3595         }
3596
3597         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
3598                   no_seq_check, NULL);
3599         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
3600                   process_global_event, global);
3601
3602         nl80211_register_eloop_read(&global->nl_event,
3603                                     wpa_driver_nl80211_event_receive,
3604                                     global->nl_cb);
3605
3606         return 0;
3607
3608 err:
3609         nl_destroy_handles(&global->nl_event);
3610         nl_destroy_handles(&global->nl);
3611         nl_cb_put(global->nl_cb);
3612         global->nl_cb = NULL;
3613         return -1;
3614 }
3615
3616
3617 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
3618 {
3619         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
3620         if (!drv->nl_cb) {
3621                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
3622                 return -1;
3623         }
3624
3625         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
3626                   no_seq_check, NULL);
3627         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
3628                   process_drv_event, drv);
3629
3630         return 0;
3631 }
3632
3633
3634 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
3635 {
3636         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
3637         /*
3638          * This may be for any interface; use ifdown event to disable
3639          * interface.
3640          */
3641 }
3642
3643
3644 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
3645 {
3646         struct wpa_driver_nl80211_data *drv = ctx;
3647         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
3648         if (i802_set_iface_flags(drv->first_bss, 1)) {
3649                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
3650                            "after rfkill unblock");
3651                 return;
3652         }
3653         /* rtnetlink ifup handler will report interface as enabled */
3654 }
3655
3656
3657 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
3658                                                       void *eloop_ctx,
3659                                                       void *handle)
3660 {
3661         struct wpa_driver_nl80211_data *drv = eloop_ctx;
3662         u8 data[2048];
3663         struct msghdr msg;
3664         struct iovec entry;
3665         u8 control[512];
3666         struct cmsghdr *cmsg;
3667         int res, found_ee = 0, found_wifi = 0, acked = 0;
3668         union wpa_event_data event;
3669
3670         memset(&msg, 0, sizeof(msg));
3671         msg.msg_iov = &entry;
3672         msg.msg_iovlen = 1;
3673         entry.iov_base = data;
3674         entry.iov_len = sizeof(data);
3675         msg.msg_control = &control;
3676         msg.msg_controllen = sizeof(control);
3677
3678         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
3679         /* if error or not fitting 802.3 header, return */
3680         if (res < 14)
3681                 return;
3682
3683         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
3684         {
3685                 if (cmsg->cmsg_level == SOL_SOCKET &&
3686                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
3687                         int *ack;
3688
3689                         found_wifi = 1;
3690                         ack = (void *)CMSG_DATA(cmsg);
3691                         acked = *ack;
3692                 }
3693
3694                 if (cmsg->cmsg_level == SOL_PACKET &&
3695                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
3696                         struct sock_extended_err *err =
3697                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
3698
3699                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
3700                                 found_ee = 1;
3701                 }
3702         }
3703
3704         if (!found_ee || !found_wifi)
3705                 return;
3706
3707         memset(&event, 0, sizeof(event));
3708         event.eapol_tx_status.dst = data;
3709         event.eapol_tx_status.data = data + 14;
3710         event.eapol_tx_status.data_len = res - 14;
3711         event.eapol_tx_status.ack = acked;
3712         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
3713 }
3714
3715
3716 static int nl80211_init_bss(struct i802_bss *bss)
3717 {
3718         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
3719         if (!bss->nl_cb)
3720                 return -1;
3721
3722         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
3723                   no_seq_check, NULL);
3724         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
3725                   process_bss_event, bss);
3726
3727         return 0;
3728 }
3729
3730
3731 static void nl80211_destroy_bss(struct i802_bss *bss)
3732 {
3733         nl_cb_put(bss->nl_cb);
3734         bss->nl_cb = NULL;
3735 }
3736
3737
3738 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
3739                                           void *global_priv, int hostapd,
3740                                           const u8 *set_addr)
3741 {
3742         struct wpa_driver_nl80211_data *drv;
3743         struct rfkill_config *rcfg;
3744         struct i802_bss *bss;
3745
3746         if (global_priv == NULL)
3747                 return NULL;
3748         drv = os_zalloc(sizeof(*drv));
3749         if (drv == NULL)
3750                 return NULL;
3751         drv->global = global_priv;
3752         drv->ctx = ctx;
3753         drv->hostapd = !!hostapd;
3754         drv->eapol_sock = -1;
3755         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
3756         drv->if_indices = drv->default_if_indices;
3757
3758         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
3759         if (!drv->first_bss) {
3760                 os_free(drv);
3761                 return NULL;
3762         }
3763         bss = drv->first_bss;
3764         bss->drv = drv;
3765         bss->ctx = ctx;
3766
3767         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
3768         drv->monitor_ifidx = -1;
3769         drv->monitor_sock = -1;
3770         drv->eapol_tx_sock = -1;
3771         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
3772
3773         if (wpa_driver_nl80211_init_nl(drv)) {
3774                 os_free(drv);
3775                 return NULL;
3776         }
3777
3778         if (nl80211_init_bss(bss))
3779                 goto failed;
3780
3781         rcfg = os_zalloc(sizeof(*rcfg));
3782         if (rcfg == NULL)
3783                 goto failed;
3784         rcfg->ctx = drv;
3785         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
3786         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
3787         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
3788         drv->rfkill = rfkill_init(rcfg);
3789         if (drv->rfkill == NULL) {
3790                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
3791                 os_free(rcfg);
3792         }
3793
3794         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
3795                 drv->start_iface_up = 1;
3796
3797         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1))
3798                 goto failed;
3799
3800         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
3801         if (drv->eapol_tx_sock < 0)
3802                 goto failed;
3803
3804         if (drv->data_tx_status) {
3805                 int enabled = 1;
3806
3807                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
3808                                &enabled, sizeof(enabled)) < 0) {
3809                         wpa_printf(MSG_DEBUG,
3810                                 "nl80211: wifi status sockopt failed\n");
3811                         drv->data_tx_status = 0;
3812                         if (!drv->use_monitor)
3813                                 drv->capa.flags &=
3814                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3815                 } else {
3816                         eloop_register_read_sock(drv->eapol_tx_sock,
3817                                 wpa_driver_nl80211_handle_eapol_tx_status,
3818                                 drv, NULL);
3819                 }
3820         }
3821
3822         if (drv->global) {
3823                 dl_list_add(&drv->global->interfaces, &drv->list);
3824                 drv->in_interface_list = 1;
3825         }
3826
3827         return bss;
3828
3829 failed:
3830         wpa_driver_nl80211_deinit(bss);
3831         return NULL;
3832 }
3833
3834
3835 /**
3836  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
3837  * @ctx: context to be used when calling wpa_supplicant functions,
3838  * e.g., wpa_supplicant_event()
3839  * @ifname: interface name, e.g., wlan0
3840  * @global_priv: private driver global data from global_init()
3841  * Returns: Pointer to private data, %NULL on failure
3842  */
3843 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
3844                                       void *global_priv)
3845 {
3846         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL);
3847 }
3848
3849
3850 static int nl80211_register_frame(struct i802_bss *bss,
3851                                   struct nl_handle *nl_handle,
3852                                   u16 type, const u8 *match, size_t match_len)
3853 {
3854         struct wpa_driver_nl80211_data *drv = bss->drv;
3855         struct nl_msg *msg;
3856         int ret = -1;
3857
3858         msg = nlmsg_alloc();
3859         if (!msg)
3860                 return -1;
3861
3862         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x nl_handle=%p",
3863                    type, nl_handle);
3864         wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3865                     match, match_len);
3866
3867         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
3868
3869         if (nl80211_set_iface_id(msg, bss) < 0)
3870                 goto nla_put_failure;
3871
3872         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
3873         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
3874
3875         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
3876         msg = NULL;
3877         if (ret) {
3878                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
3879                            "failed (type=%u): ret=%d (%s)",
3880                            type, ret, strerror(-ret));
3881                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3882                             match, match_len);
3883                 goto nla_put_failure;
3884         }
3885         ret = 0;
3886 nla_put_failure:
3887         nlmsg_free(msg);
3888         return ret;
3889 }
3890
3891
3892 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
3893 {
3894         struct wpa_driver_nl80211_data *drv = bss->drv;
3895
3896         if (bss->nl_mgmt) {
3897                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
3898                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
3899                 return -1;
3900         }
3901
3902         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
3903         if (bss->nl_mgmt == NULL)
3904                 return -1;
3905
3906         return 0;
3907 }
3908
3909
3910 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
3911 {
3912         nl80211_register_eloop_read(&bss->nl_mgmt,
3913                                     wpa_driver_nl80211_event_receive,
3914                                     bss->nl_cb);
3915 }
3916
3917
3918 static int nl80211_register_action_frame(struct i802_bss *bss,
3919                                          const u8 *match, size_t match_len)
3920 {
3921         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
3922         return nl80211_register_frame(bss, bss->nl_mgmt,
3923                                       type, match, match_len);
3924 }
3925
3926
3927 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
3928 {
3929         struct wpa_driver_nl80211_data *drv = bss->drv;
3930
3931         if (nl80211_alloc_mgmt_handle(bss))
3932                 return -1;
3933         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
3934                    "handle %p", bss->nl_mgmt);
3935
3936         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
3937                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
3938
3939                 /* register for any AUTH message */
3940                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
3941         }
3942
3943 #ifdef CONFIG_INTERWORKING
3944         /* QoS Map Configure */
3945         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
3946                 return -1;
3947 #endif /* CONFIG_INTERWORKING */
3948 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
3949         /* GAS Initial Request */
3950         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
3951                 return -1;
3952         /* GAS Initial Response */
3953         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
3954                 return -1;
3955         /* GAS Comeback Request */
3956         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
3957                 return -1;
3958         /* GAS Comeback Response */
3959         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
3960                 return -1;
3961 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
3962 #ifdef CONFIG_P2P
3963         /* P2P Public Action */
3964         if (nl80211_register_action_frame(bss,
3965                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
3966                                           6) < 0)
3967                 return -1;
3968         /* P2P Action */
3969         if (nl80211_register_action_frame(bss,
3970                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
3971                                           5) < 0)
3972                 return -1;
3973 #endif /* CONFIG_P2P */
3974 #ifdef CONFIG_IEEE80211W
3975         /* SA Query Response */
3976         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
3977                 return -1;
3978 #endif /* CONFIG_IEEE80211W */
3979 #ifdef CONFIG_TDLS
3980         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
3981                 /* TDLS Discovery Response */
3982                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
3983                     0)
3984                         return -1;
3985         }
3986 #endif /* CONFIG_TDLS */
3987
3988         /* FT Action frames */
3989         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
3990                 return -1;
3991         else
3992                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
3993                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
3994
3995         /* WNM - BSS Transition Management Request */
3996         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
3997                 return -1;
3998         /* WNM-Sleep Mode Response */
3999         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
4000                 return -1;
4001
4002         nl80211_mgmt_handle_register_eloop(bss);
4003
4004         return 0;
4005 }
4006
4007
4008 static int nl80211_register_spurious_class3(struct i802_bss *bss)
4009 {
4010         struct wpa_driver_nl80211_data *drv = bss->drv;
4011         struct nl_msg *msg;
4012         int ret = -1;
4013
4014         msg = nlmsg_alloc();
4015         if (!msg)
4016                 return -1;
4017
4018         nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
4019
4020         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
4021
4022         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
4023         msg = NULL;
4024         if (ret) {
4025                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
4026                            "failed: ret=%d (%s)",
4027                            ret, strerror(-ret));
4028                 goto nla_put_failure;
4029         }
4030         ret = 0;
4031 nla_put_failure:
4032         nlmsg_free(msg);
4033         return ret;
4034 }
4035
4036
4037 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
4038 {
4039         static const int stypes[] = {
4040                 WLAN_FC_STYPE_AUTH,
4041                 WLAN_FC_STYPE_ASSOC_REQ,
4042                 WLAN_FC_STYPE_REASSOC_REQ,
4043                 WLAN_FC_STYPE_DISASSOC,
4044                 WLAN_FC_STYPE_DEAUTH,
4045                 WLAN_FC_STYPE_ACTION,
4046                 WLAN_FC_STYPE_PROBE_REQ,
4047 /* Beacon doesn't work as mac80211 doesn't currently allow
4048  * it, but it wouldn't really be the right thing anyway as
4049  * it isn't per interface ... maybe just dump the scan
4050  * results periodically for OLBC?
4051  */
4052 //              WLAN_FC_STYPE_BEACON,
4053         };
4054         unsigned int i;
4055
4056         if (nl80211_alloc_mgmt_handle(bss))
4057                 return -1;
4058         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
4059                    "handle %p", bss->nl_mgmt);
4060
4061         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
4062                 if (nl80211_register_frame(bss, bss->nl_mgmt,
4063                                            (WLAN_FC_TYPE_MGMT << 2) |
4064                                            (stypes[i] << 4),
4065                                            NULL, 0) < 0) {
4066                         goto out_err;
4067                 }
4068         }
4069
4070         if (nl80211_register_spurious_class3(bss))
4071                 goto out_err;
4072
4073         if (nl80211_get_wiphy_data_ap(bss) == NULL)
4074                 goto out_err;
4075
4076         nl80211_mgmt_handle_register_eloop(bss);
4077         return 0;
4078
4079 out_err:
4080         nl_destroy_handles(&bss->nl_mgmt);
4081         return -1;
4082 }
4083
4084
4085 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
4086 {
4087         if (nl80211_alloc_mgmt_handle(bss))
4088                 return -1;
4089         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
4090                    "handle %p (device SME)", bss->nl_mgmt);
4091
4092         if (nl80211_register_frame(bss, bss->nl_mgmt,
4093                                    (WLAN_FC_TYPE_MGMT << 2) |
4094                                    (WLAN_FC_STYPE_ACTION << 4),
4095                                    NULL, 0) < 0)
4096                 goto out_err;
4097
4098         nl80211_mgmt_handle_register_eloop(bss);
4099         return 0;
4100
4101 out_err:
4102         nl_destroy_handles(&bss->nl_mgmt);
4103         return -1;
4104 }
4105
4106
4107 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
4108 {
4109         if (bss->nl_mgmt == NULL)
4110                 return;
4111         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
4112                    "(%s)", bss->nl_mgmt, reason);
4113         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
4114
4115         nl80211_put_wiphy_data_ap(bss);
4116 }
4117
4118
4119 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
4120 {
4121         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
4122 }
4123
4124
4125 static void nl80211_del_p2pdev(struct i802_bss *bss)
4126 {
4127         struct wpa_driver_nl80211_data *drv = bss->drv;
4128         struct nl_msg *msg;
4129         int ret;
4130
4131         msg = nlmsg_alloc();
4132         if (!msg)
4133                 return;
4134
4135         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
4136         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
4137
4138         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4139         msg = NULL;
4140
4141         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
4142                    bss->ifname, (long long unsigned int) bss->wdev_id,
4143                    strerror(-ret));
4144
4145 nla_put_failure:
4146         nlmsg_free(msg);
4147 }
4148
4149
4150 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
4151 {
4152         struct wpa_driver_nl80211_data *drv = bss->drv;
4153         struct nl_msg *msg;
4154         int ret = -1;
4155
4156         msg = nlmsg_alloc();
4157         if (!msg)
4158                 return -1;
4159
4160         if (start)
4161                 nl80211_cmd(drv, msg, 0, NL80211_CMD_START_P2P_DEVICE);
4162         else
4163                 nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_P2P_DEVICE);
4164
4165         NLA_PUT_U64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
4166
4167         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4168         msg = NULL;
4169
4170         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
4171                    start ? "Start" : "Stop",
4172                    bss->ifname, (long long unsigned int) bss->wdev_id,
4173                    strerror(-ret));
4174
4175 nla_put_failure:
4176         nlmsg_free(msg);
4177         return ret;
4178 }
4179
4180
4181 static int i802_set_iface_flags(struct i802_bss *bss, int up)
4182 {
4183         enum nl80211_iftype nlmode;
4184
4185         nlmode = nl80211_get_ifmode(bss);
4186         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
4187                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
4188                                              bss->ifname, up);
4189         }
4190
4191         /* P2P Device has start/stop which is equivalent */
4192         return nl80211_set_p2pdev(bss, up);
4193 }
4194
4195
4196 static int
4197 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
4198                                    const u8 *set_addr, int first)
4199 {
4200         struct i802_bss *bss = drv->first_bss;
4201         int send_rfkill_event = 0;
4202         enum nl80211_iftype nlmode;
4203
4204         drv->ifindex = if_nametoindex(bss->ifname);
4205         bss->ifindex = drv->ifindex;
4206         bss->wdev_id = drv->global->if_add_wdevid;
4207         bss->wdev_id_set = drv->global->if_add_wdevid_set;
4208
4209         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
4210         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
4211         drv->global->if_add_wdevid_set = 0;
4212
4213         if (wpa_driver_nl80211_capa(drv))
4214                 return -1;
4215
4216         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
4217                    bss->ifname, drv->phyname);
4218
4219         if (set_addr &&
4220             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
4221              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
4222                                 set_addr)))
4223                 return -1;
4224
4225         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
4226                 drv->start_mode_ap = 1;
4227
4228         if (drv->hostapd)
4229                 nlmode = NL80211_IFTYPE_AP;
4230         else if (bss->if_dynamic)
4231                 nlmode = nl80211_get_ifmode(bss);
4232         else
4233                 nlmode = NL80211_IFTYPE_STATION;
4234
4235         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
4236                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
4237                 return -1;
4238         }
4239
4240         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
4241                 int ret = nl80211_set_p2pdev(bss, 1);
4242                 if (ret < 0)
4243                         wpa_printf(MSG_ERROR, "nl80211: Could not start P2P device");
4244                 nl80211_get_macaddr(bss);
4245                 return ret;
4246         }
4247
4248         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
4249                 if (rfkill_is_blocked(drv->rfkill)) {
4250                         wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
4251                                    "interface '%s' due to rfkill",
4252                                    bss->ifname);
4253                         drv->if_disabled = 1;
4254                         send_rfkill_event = 1;
4255                 } else {
4256                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
4257                                    "interface '%s' UP", bss->ifname);
4258                         return -1;
4259                 }
4260         }
4261
4262         if (!drv->hostapd)
4263                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
4264                                        1, IF_OPER_DORMANT);
4265
4266         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
4267                                bss->addr))
4268                 return -1;
4269
4270         if (send_rfkill_event) {
4271                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
4272                                        drv, drv->ctx);
4273         }
4274
4275         return 0;
4276 }
4277
4278
4279 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
4280 {
4281         struct nl_msg *msg;
4282
4283         msg = nlmsg_alloc();
4284         if (!msg)
4285                 return -ENOMEM;
4286
4287         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
4288                    drv->ifindex);
4289         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
4290         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4291
4292         return send_and_recv_msgs(drv, msg, NULL, NULL);
4293  nla_put_failure:
4294         nlmsg_free(msg);
4295         return -ENOBUFS;
4296 }
4297
4298
4299 /**
4300  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
4301  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
4302  *
4303  * Shut down driver interface and processing of driver events. Free
4304  * private data buffer if one was allocated in wpa_driver_nl80211_init().
4305  */
4306 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
4307 {
4308         struct wpa_driver_nl80211_data *drv = bss->drv;
4309
4310         bss->in_deinit = 1;
4311         if (drv->data_tx_status)
4312                 eloop_unregister_read_sock(drv->eapol_tx_sock);
4313         if (drv->eapol_tx_sock >= 0)
4314                 close(drv->eapol_tx_sock);
4315
4316         if (bss->nl_preq)
4317                 wpa_driver_nl80211_probe_req_report(bss, 0);
4318         if (bss->added_if_into_bridge) {
4319                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
4320                                     bss->ifname) < 0)
4321                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
4322                                    "interface %s from bridge %s: %s",
4323                                    bss->ifname, bss->brname, strerror(errno));
4324         }
4325         if (bss->added_bridge) {
4326                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
4327                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
4328                                    "bridge %s: %s",
4329                                    bss->brname, strerror(errno));
4330         }
4331
4332         nl80211_remove_monitor_interface(drv);
4333
4334         if (is_ap_interface(drv->nlmode))
4335                 wpa_driver_nl80211_del_beacon(drv);
4336
4337         if (drv->eapol_sock >= 0) {
4338                 eloop_unregister_read_sock(drv->eapol_sock);
4339                 close(drv->eapol_sock);
4340         }
4341
4342         if (drv->if_indices != drv->default_if_indices)
4343                 os_free(drv->if_indices);
4344
4345         if (drv->disabled_11b_rates)
4346                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
4347
4348         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
4349                                IF_OPER_UP);
4350         rfkill_deinit(drv->rfkill);
4351
4352         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
4353
4354         if (!drv->start_iface_up)
4355                 (void) i802_set_iface_flags(bss, 0);
4356         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
4357                 if (!drv->hostapd || !drv->start_mode_ap)
4358                         wpa_driver_nl80211_set_mode(bss,
4359                                                     NL80211_IFTYPE_STATION);
4360                 nl80211_mgmt_unsubscribe(bss, "deinit");
4361         } else {
4362                 nl80211_mgmt_unsubscribe(bss, "deinit");
4363                 nl80211_del_p2pdev(bss);
4364         }
4365         nl_cb_put(drv->nl_cb);
4366
4367         nl80211_destroy_bss(drv->first_bss);
4368
4369         os_free(drv->filter_ssids);
4370
4371         os_free(drv->auth_ie);
4372
4373         if (drv->in_interface_list)
4374                 dl_list_del(&drv->list);
4375
4376         os_free(drv->extended_capa);
4377         os_free(drv->extended_capa_mask);
4378         os_free(drv->first_bss);
4379         os_free(drv);
4380 }
4381
4382
4383 /**
4384  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
4385  * @eloop_ctx: Driver private data
4386  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
4387  *
4388  * This function can be used as registered timeout when starting a scan to
4389  * generate a scan completed event if the driver does not report this.
4390  */
4391 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
4392 {
4393         struct wpa_driver_nl80211_data *drv = eloop_ctx;
4394         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
4395                 wpa_driver_nl80211_set_mode(drv->first_bss,
4396                                             drv->ap_scan_as_station);
4397                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
4398         }
4399         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
4400         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
4401 }
4402
4403
4404 static struct nl_msg *
4405 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
4406                     struct wpa_driver_scan_params *params, u64 *wdev_id)
4407 {
4408         struct nl_msg *msg;
4409         size_t i;
4410
4411         msg = nlmsg_alloc();
4412         if (!msg)
4413                 return NULL;
4414
4415         nl80211_cmd(drv, msg, 0, cmd);
4416
4417         if (!wdev_id)
4418                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4419         else
4420                 NLA_PUT_U64(msg, NL80211_ATTR_WDEV, *wdev_id);
4421
4422         if (params->num_ssids) {
4423                 struct nlattr *ssids;
4424
4425                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4426                 if (ssids == NULL)
4427                         goto fail;
4428                 for (i = 0; i < params->num_ssids; i++) {
4429                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
4430                                           params->ssids[i].ssid,
4431                                           params->ssids[i].ssid_len);
4432                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
4433                                     params->ssids[i].ssid) < 0)
4434                                 goto fail;
4435                 }
4436                 nla_nest_end(msg, ssids);
4437         }
4438
4439         if (params->extra_ies) {
4440                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
4441                             params->extra_ies, params->extra_ies_len);
4442                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
4443                             params->extra_ies) < 0)
4444                         goto fail;
4445         }
4446
4447         if (params->freqs) {
4448                 struct nlattr *freqs;
4449                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4450                 if (freqs == NULL)
4451                         goto fail;
4452                 for (i = 0; params->freqs[i]; i++) {
4453                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
4454                                    "MHz", params->freqs[i]);
4455                         if (nla_put_u32(msg, i + 1, params->freqs[i]) < 0)
4456                                 goto fail;
4457                 }
4458                 nla_nest_end(msg, freqs);
4459         }
4460
4461         os_free(drv->filter_ssids);
4462         drv->filter_ssids = params->filter_ssids;
4463         params->filter_ssids = NULL;
4464         drv->num_filter_ssids = params->num_filter_ssids;
4465
4466         return msg;
4467
4468 fail:
4469 nla_put_failure:
4470         nlmsg_free(msg);
4471         return NULL;
4472 }
4473
4474
4475 /**
4476  * wpa_driver_nl80211_scan - Request the driver to initiate scan
4477  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
4478  * @params: Scan parameters
4479  * Returns: 0 on success, -1 on failure
4480  */
4481 static int wpa_driver_nl80211_scan(struct i802_bss *bss,
4482                                    struct wpa_driver_scan_params *params)
4483 {
4484         struct wpa_driver_nl80211_data *drv = bss->drv;
4485         int ret = -1, timeout;
4486         struct nl_msg *msg = NULL;
4487
4488         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
4489         drv->scan_for_auth = 0;
4490
4491         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params,
4492                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
4493         if (!msg)
4494                 return -1;
4495
4496         if (params->p2p_probe) {
4497                 struct nlattr *rates;
4498
4499                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
4500
4501                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
4502                 if (rates == NULL)
4503                         goto nla_put_failure;
4504
4505                 /*
4506                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
4507                  * by masking out everything else apart from the OFDM rates 6,
4508                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
4509                  * rates are left enabled.
4510                  */
4511                 NLA_PUT(msg, NL80211_BAND_2GHZ, 8,
4512                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
4513                 nla_nest_end(msg, rates);
4514
4515                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
4516         }
4517
4518         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4519         msg = NULL;
4520         if (ret) {
4521                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
4522                            "(%s)", ret, strerror(-ret));
4523                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
4524                         /*
4525                          * mac80211 does not allow scan requests in AP mode, so
4526                          * try to do this in station mode.
4527                          */
4528                         if (wpa_driver_nl80211_set_mode(
4529                                     bss, NL80211_IFTYPE_STATION))
4530                                 goto nla_put_failure;
4531
4532                         if (wpa_driver_nl80211_scan(bss, params)) {
4533                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
4534                                 goto nla_put_failure;
4535                         }
4536
4537                         /* Restore AP mode when processing scan results */
4538                         drv->ap_scan_as_station = drv->nlmode;
4539                         ret = 0;
4540                 } else
4541                         goto nla_put_failure;
4542         }
4543
4544         drv->scan_state = SCAN_REQUESTED;
4545         /* Not all drivers generate "scan completed" wireless event, so try to
4546          * read results after a timeout. */
4547         timeout = 10;
4548         if (drv->scan_complete_events) {
4549                 /*
4550                  * The driver seems to deliver events to notify when scan is
4551                  * complete, so use longer timeout to avoid race conditions
4552                  * with scanning and following association request.
4553                  */
4554                 timeout = 30;
4555         }
4556         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
4557                    "seconds", ret, timeout);
4558         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
4559         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
4560                                drv, drv->ctx);
4561
4562 nla_put_failure:
4563         nlmsg_free(msg);
4564         return ret;
4565 }
4566
4567
4568 /**
4569  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
4570  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
4571  * @params: Scan parameters
4572  * @interval: Interval between scan cycles in milliseconds
4573  * Returns: 0 on success, -1 on failure or if not supported
4574  */
4575 static int wpa_driver_nl80211_sched_scan(void *priv,
4576                                          struct wpa_driver_scan_params *params,
4577                                          u32 interval)
4578 {
4579         struct i802_bss *bss = priv;
4580         struct wpa_driver_nl80211_data *drv = bss->drv;
4581         int ret = -1;
4582         struct nl_msg *msg;
4583         size_t i;
4584
4585         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
4586
4587 #ifdef ANDROID
4588         if (!drv->capa.sched_scan_supported)
4589                 return android_pno_start(bss, params);
4590 #endif /* ANDROID */
4591
4592         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params,
4593                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
4594         if (!msg)
4595                 goto nla_put_failure;
4596
4597         NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
4598
4599         if ((drv->num_filter_ssids &&
4600             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
4601             params->filter_rssi) {
4602                 struct nlattr *match_sets;
4603                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
4604                 if (match_sets == NULL)
4605                         goto nla_put_failure;
4606
4607                 for (i = 0; i < drv->num_filter_ssids; i++) {
4608                         struct nlattr *match_set_ssid;
4609                         wpa_hexdump_ascii(MSG_MSGDUMP,
4610                                           "nl80211: Sched scan filter SSID",
4611                                           drv->filter_ssids[i].ssid,
4612                                           drv->filter_ssids[i].ssid_len);
4613
4614                         match_set_ssid = nla_nest_start(msg, i + 1);
4615                         if (match_set_ssid == NULL)
4616                                 goto nla_put_failure;
4617                         NLA_PUT(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
4618                                 drv->filter_ssids[i].ssid_len,
4619                                 drv->filter_ssids[i].ssid);
4620
4621                         nla_nest_end(msg, match_set_ssid);
4622                 }
4623
4624                 if (params->filter_rssi) {
4625                         struct nlattr *match_set_rssi;
4626                         match_set_rssi = nla_nest_start(msg, 0);
4627                         if (match_set_rssi == NULL)
4628                                 goto nla_put_failure;
4629                         NLA_PUT_U32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
4630                                     params->filter_rssi);
4631                         wpa_printf(MSG_MSGDUMP,
4632                                    "nl80211: Sched scan RSSI filter %d dBm",
4633                                    params->filter_rssi);
4634                         nla_nest_end(msg, match_set_rssi);
4635                 }
4636
4637                 nla_nest_end(msg, match_sets);
4638         }
4639
4640         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4641
4642         /* TODO: if we get an error here, we should fall back to normal scan */
4643
4644         msg = NULL;
4645         if (ret) {
4646                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
4647                            "ret=%d (%s)", ret, strerror(-ret));
4648                 goto nla_put_failure;
4649         }
4650
4651         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
4652                    "scan interval %d msec", ret, interval);
4653
4654 nla_put_failure:
4655         nlmsg_free(msg);
4656         return ret;
4657 }
4658
4659
4660 /**
4661  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
4662  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
4663  * Returns: 0 on success, -1 on failure or if not supported
4664  */
4665 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
4666 {
4667         struct i802_bss *bss = priv;
4668         struct wpa_driver_nl80211_data *drv = bss->drv;
4669         int ret = 0;
4670         struct nl_msg *msg;
4671
4672 #ifdef ANDROID
4673         if (!drv->capa.sched_scan_supported)
4674                 return android_pno_stop(bss);
4675 #endif /* ANDROID */
4676
4677         msg = nlmsg_alloc();
4678         if (!msg)
4679                 return -1;
4680
4681         nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
4682
4683         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4684
4685         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4686         msg = NULL;
4687         if (ret) {
4688                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
4689                            "ret=%d (%s)", ret, strerror(-ret));
4690                 goto nla_put_failure;
4691         }
4692
4693         wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
4694
4695 nla_put_failure:
4696         nlmsg_free(msg);
4697         return ret;
4698 }
4699
4700
4701 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
4702 {
4703         const u8 *end, *pos;
4704
4705         if (ies == NULL)
4706                 return NULL;
4707
4708         pos = ies;
4709         end = ies + ies_len;
4710
4711         while (pos + 1 < end) {
4712                 if (pos + 2 + pos[1] > end)
4713                         break;
4714                 if (pos[0] == ie)
4715                         return pos;
4716                 pos += 2 + pos[1];
4717         }
4718
4719         return NULL;
4720 }
4721
4722
4723 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
4724                                  const u8 *ie, size_t ie_len)
4725 {
4726         const u8 *ssid;
4727         size_t i;
4728
4729         if (drv->filter_ssids == NULL)
4730                 return 0;
4731
4732         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
4733         if (ssid == NULL)
4734                 return 1;
4735
4736         for (i = 0; i < drv->num_filter_ssids; i++) {
4737                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
4738                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
4739                     0)
4740                         return 0;
4741         }
4742
4743         return 1;
4744 }
4745
4746
4747 static int bss_info_handler(struct nl_msg *msg, void *arg)
4748 {
4749         struct nlattr *tb[NL80211_ATTR_MAX + 1];
4750         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4751         struct nlattr *bss[NL80211_BSS_MAX + 1];
4752         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
4753                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
4754                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
4755                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
4756                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
4757                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
4758                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
4759                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
4760                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
4761                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
4762                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
4763                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
4764         };
4765         struct nl80211_bss_info_arg *_arg = arg;
4766         struct wpa_scan_results *res = _arg->res;
4767         struct wpa_scan_res **tmp;
4768         struct wpa_scan_res *r;
4769         const u8 *ie, *beacon_ie;
4770         size_t ie_len, beacon_ie_len;
4771         u8 *pos;
4772         size_t i;
4773
4774         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4775                   genlmsg_attrlen(gnlh, 0), NULL);
4776         if (!tb[NL80211_ATTR_BSS])
4777                 return NL_SKIP;
4778         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
4779                              bss_policy))
4780                 return NL_SKIP;
4781         if (bss[NL80211_BSS_STATUS]) {
4782                 enum nl80211_bss_status status;
4783                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
4784                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
4785                     bss[NL80211_BSS_FREQUENCY]) {
4786                         _arg->assoc_freq =
4787                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
4788                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
4789                                    _arg->assoc_freq);
4790                 }
4791                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
4792                     bss[NL80211_BSS_BSSID]) {
4793                         os_memcpy(_arg->assoc_bssid,
4794                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
4795                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
4796                                    MACSTR, MAC2STR(_arg->assoc_bssid));
4797                 }
4798         }
4799         if (!res)
4800                 return NL_SKIP;
4801         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
4802                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
4803                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
4804         } else {
4805                 ie = NULL;
4806                 ie_len = 0;
4807         }
4808         if (bss[NL80211_BSS_BEACON_IES]) {
4809                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
4810                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
4811         } else {
4812                 beacon_ie = NULL;
4813                 beacon_ie_len = 0;
4814         }
4815
4816         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
4817                                   ie ? ie_len : beacon_ie_len))
4818                 return NL_SKIP;
4819
4820         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
4821         if (r == NULL)
4822                 return NL_SKIP;
4823         if (bss[NL80211_BSS_BSSID])
4824                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
4825                           ETH_ALEN);
4826         if (bss[NL80211_BSS_FREQUENCY])
4827                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
4828         if (bss[NL80211_BSS_BEACON_INTERVAL])
4829                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
4830         if (bss[NL80211_BSS_CAPABILITY])
4831                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
4832         r->flags |= WPA_SCAN_NOISE_INVALID;
4833         if (bss[NL80211_BSS_SIGNAL_MBM]) {
4834                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
4835                 r->level /= 100; /* mBm to dBm */
4836                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
4837         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
4838                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
4839                 r->flags |= WPA_SCAN_QUAL_INVALID;
4840         } else
4841                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
4842         if (bss[NL80211_BSS_TSF])
4843                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
4844         if (bss[NL80211_BSS_SEEN_MS_AGO])
4845                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
4846         r->ie_len = ie_len;
4847         pos = (u8 *) (r + 1);
4848         if (ie) {
4849                 os_memcpy(pos, ie, ie_len);
4850                 pos += ie_len;
4851         }
4852         r->beacon_ie_len = beacon_ie_len;
4853         if (beacon_ie)
4854                 os_memcpy(pos, beacon_ie, beacon_ie_len);
4855
4856         if (bss[NL80211_BSS_STATUS]) {
4857                 enum nl80211_bss_status status;
4858                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
4859                 switch (status) {
4860                 case NL80211_BSS_STATUS_AUTHENTICATED:
4861                         r->flags |= WPA_SCAN_AUTHENTICATED;
4862                         break;
4863                 case NL80211_BSS_STATUS_ASSOCIATED:
4864                         r->flags |= WPA_SCAN_ASSOCIATED;
4865                         break;
4866                 default:
4867                         break;
4868                 }
4869         }
4870
4871         /*
4872          * cfg80211 maintains separate BSS table entries for APs if the same
4873          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
4874          * not use frequency as a separate key in the BSS table, so filter out
4875          * duplicated entries. Prefer associated BSS entry in such a case in
4876          * order to get the correct frequency into the BSS table.
4877          */
4878         for (i = 0; i < res->num; i++) {
4879                 const u8 *s1, *s2;
4880                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
4881                         continue;
4882
4883                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
4884                                     res->res[i]->ie_len, WLAN_EID_SSID);
4885                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
4886                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
4887                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
4888                         continue;
4889
4890                 /* Same BSSID,SSID was already included in scan results */
4891                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
4892                            "for " MACSTR, MAC2STR(r->bssid));
4893
4894                 if ((r->flags & WPA_SCAN_ASSOCIATED) &&
4895                     !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) {
4896                         os_free(res->res[i]);
4897                         res->res[i] = r;
4898                 } else
4899                         os_free(r);
4900                 return NL_SKIP;
4901         }
4902
4903         tmp = os_realloc_array(res->res, res->num + 1,
4904                                sizeof(struct wpa_scan_res *));
4905         if (tmp == NULL) {
4906                 os_free(r);
4907                 return NL_SKIP;
4908         }
4909         tmp[res->num++] = r;
4910         res->res = tmp;
4911
4912         return NL_SKIP;
4913 }
4914
4915
4916 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
4917                                  const u8 *addr)
4918 {
4919         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
4920                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
4921                            "mismatch (" MACSTR ")", MAC2STR(addr));
4922                 wpa_driver_nl80211_mlme(drv, addr,
4923                                         NL80211_CMD_DEAUTHENTICATE,
4924                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
4925         }
4926 }
4927
4928
4929 static void wpa_driver_nl80211_check_bss_status(
4930         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
4931 {
4932         size_t i;
4933
4934         for (i = 0; i < res->num; i++) {
4935                 struct wpa_scan_res *r = res->res[i];
4936                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
4937                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4938                                    "indicates BSS status with " MACSTR
4939                                    " as authenticated",
4940                                    MAC2STR(r->bssid));
4941                         if (is_sta_interface(drv->nlmode) &&
4942                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
4943                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
4944                             0) {
4945                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
4946                                            " in local state (auth=" MACSTR
4947                                            " assoc=" MACSTR ")",
4948                                            MAC2STR(drv->auth_bssid),
4949                                            MAC2STR(drv->bssid));
4950                                 clear_state_mismatch(drv, r->bssid);
4951                         }
4952                 }
4953
4954                 if (r->flags & WPA_SCAN_ASSOCIATED) {
4955                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4956                                    "indicate BSS status with " MACSTR
4957                                    " as associated",
4958                                    MAC2STR(r->bssid));
4959                         if (is_sta_interface(drv->nlmode) &&
4960                             !drv->associated) {
4961                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4962                                            "(not associated) does not match "
4963                                            "with BSS state");
4964                                 clear_state_mismatch(drv, r->bssid);
4965                         } else if (is_sta_interface(drv->nlmode) &&
4966                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
4967                                    0) {
4968                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4969                                            "(associated with " MACSTR ") does "
4970                                            "not match with BSS state",
4971                                            MAC2STR(drv->bssid));
4972                                 clear_state_mismatch(drv, r->bssid);
4973                                 clear_state_mismatch(drv, drv->bssid);
4974                         }
4975                 }
4976         }
4977 }
4978
4979
4980 static struct wpa_scan_results *
4981 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
4982 {
4983         struct nl_msg *msg;
4984         struct wpa_scan_results *res;
4985         int ret;
4986         struct nl80211_bss_info_arg arg;
4987
4988         res = os_zalloc(sizeof(*res));
4989         if (res == NULL)
4990                 return NULL;
4991         msg = nlmsg_alloc();
4992         if (!msg)
4993                 goto nla_put_failure;
4994
4995         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
4996         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
4997                 goto nla_put_failure;
4998
4999         arg.drv = drv;
5000         arg.res = res;
5001         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
5002         msg = NULL;
5003         if (ret == 0) {
5004                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
5005                            "BSSes)", (unsigned long) res->num);
5006                 nl80211_get_noise_for_scan_results(drv, res);
5007                 return res;
5008         }
5009         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
5010                    "(%s)", ret, strerror(-ret));
5011 nla_put_failure:
5012         nlmsg_free(msg);
5013         wpa_scan_results_free(res);
5014         return NULL;
5015 }
5016
5017
5018 /**
5019  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
5020  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
5021  * Returns: Scan results on success, -1 on failure
5022  */
5023 static struct wpa_scan_results *
5024 wpa_driver_nl80211_get_scan_results(void *priv)
5025 {
5026         struct i802_bss *bss = priv;
5027         struct wpa_driver_nl80211_data *drv = bss->drv;
5028         struct wpa_scan_results *res;
5029
5030         res = nl80211_get_scan_results(drv);
5031         if (res)
5032                 wpa_driver_nl80211_check_bss_status(drv, res);
5033         return res;
5034 }
5035
5036
5037 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
5038 {
5039         struct wpa_scan_results *res;
5040         size_t i;
5041
5042         res = nl80211_get_scan_results(drv);
5043         if (res == NULL) {
5044                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
5045                 return;
5046         }
5047
5048         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
5049         for (i = 0; i < res->num; i++) {
5050                 struct wpa_scan_res *r = res->res[i];
5051                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
5052                            (int) i, (int) res->num, MAC2STR(r->bssid),
5053                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
5054                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
5055         }
5056
5057         wpa_scan_results_free(res);
5058 }
5059
5060
5061 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
5062                                       enum wpa_alg alg, const u8 *addr,
5063                                       int key_idx, int set_tx,
5064                                       const u8 *seq, size_t seq_len,
5065                                       const u8 *key, size_t key_len)
5066 {
5067         struct wpa_driver_nl80211_data *drv = bss->drv;
5068         int ifindex;
5069         struct nl_msg *msg;
5070         int ret;
5071         int tdls = 0;
5072
5073         /* Ignore for P2P Device */
5074         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
5075                 return 0;
5076
5077         ifindex = if_nametoindex(ifname);
5078         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
5079                    "set_tx=%d seq_len=%lu key_len=%lu",
5080                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
5081                    (unsigned long) seq_len, (unsigned long) key_len);
5082 #ifdef CONFIG_TDLS
5083         if (key_idx == -1) {
5084                 key_idx = 0;
5085                 tdls = 1;
5086         }
5087 #endif /* CONFIG_TDLS */
5088
5089         msg = nlmsg_alloc();
5090         if (!msg)
5091                 return -ENOMEM;
5092
5093         if (alg == WPA_ALG_NONE) {
5094                 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
5095         } else {
5096                 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
5097                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
5098                 switch (alg) {
5099                 case WPA_ALG_WEP:
5100                         if (key_len == 5)
5101                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5102                                             WLAN_CIPHER_SUITE_WEP40);
5103                         else
5104                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5105                                             WLAN_CIPHER_SUITE_WEP104);
5106                         break;
5107                 case WPA_ALG_TKIP:
5108                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5109                                     WLAN_CIPHER_SUITE_TKIP);
5110                         break;
5111                 case WPA_ALG_CCMP:
5112                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5113                                     WLAN_CIPHER_SUITE_CCMP);
5114                         break;
5115                 case WPA_ALG_GCMP:
5116                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5117                                     WLAN_CIPHER_SUITE_GCMP);
5118                         break;
5119                 case WPA_ALG_IGTK:
5120                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5121                                     WLAN_CIPHER_SUITE_AES_CMAC);
5122                         break;
5123                 case WPA_ALG_SMS4:
5124                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5125                                     WLAN_CIPHER_SUITE_SMS4);
5126                         break;
5127                 case WPA_ALG_KRK:
5128                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
5129                                     WLAN_CIPHER_SUITE_KRK);
5130                         break;
5131                 default:
5132                         wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
5133                                    "algorithm %d", __func__, alg);
5134                         nlmsg_free(msg);
5135                         return -1;
5136                 }
5137         }
5138
5139         if (seq && seq_len)
5140                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
5141
5142         if (addr && !is_broadcast_ether_addr(addr)) {
5143                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
5144                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5145
5146                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
5147                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
5148                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
5149                                     NL80211_KEYTYPE_GROUP);
5150                 }
5151         } else if (addr && is_broadcast_ether_addr(addr)) {
5152                 struct nlattr *types;
5153
5154                 wpa_printf(MSG_DEBUG, "   broadcast key");
5155
5156                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5157                 if (!types)
5158                         goto nla_put_failure;
5159                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
5160                 nla_nest_end(msg, types);
5161         }
5162         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
5163         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5164
5165         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5166         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
5167                 ret = 0;
5168         if (ret)
5169                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
5170                            ret, strerror(-ret));
5171
5172         /*
5173          * If we failed or don't need to set the default TX key (below),
5174          * we're done here.
5175          */
5176         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
5177                 return ret;
5178         if (is_ap_interface(drv->nlmode) && addr &&
5179             !is_broadcast_ether_addr(addr))
5180                 return ret;
5181
5182         msg = nlmsg_alloc();
5183         if (!msg)
5184                 return -ENOMEM;
5185
5186         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
5187         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
5188         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5189         if (alg == WPA_ALG_IGTK)
5190                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
5191         else
5192                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
5193         if (addr && is_broadcast_ether_addr(addr)) {
5194                 struct nlattr *types;
5195
5196                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5197                 if (!types)
5198                         goto nla_put_failure;
5199                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
5200                 nla_nest_end(msg, types);
5201         } else if (addr) {
5202                 struct nlattr *types;
5203
5204                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
5205                 if (!types)
5206                         goto nla_put_failure;
5207                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST);
5208                 nla_nest_end(msg, types);
5209         }
5210
5211         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5212         if (ret == -ENOENT)
5213                 ret = 0;
5214         if (ret)
5215                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
5216                            "err=%d %s)", ret, strerror(-ret));
5217         return ret;
5218
5219 nla_put_failure:
5220         nlmsg_free(msg);
5221         return -ENOBUFS;
5222 }
5223
5224
5225 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
5226                       int key_idx, int defkey,
5227                       const u8 *seq, size_t seq_len,
5228                       const u8 *key, size_t key_len)
5229 {
5230         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
5231         if (!key_attr)
5232                 return -1;
5233
5234         if (defkey && alg == WPA_ALG_IGTK)
5235                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
5236         else if (defkey)
5237                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
5238
5239         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
5240
5241         switch (alg) {
5242         case WPA_ALG_WEP:
5243                 if (key_len == 5)
5244                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5245                                     WLAN_CIPHER_SUITE_WEP40);
5246                 else
5247                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5248                                     WLAN_CIPHER_SUITE_WEP104);
5249                 break;
5250         case WPA_ALG_TKIP:
5251                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP);
5252                 break;
5253         case WPA_ALG_CCMP:
5254                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP);
5255                 break;
5256         case WPA_ALG_GCMP:
5257                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_GCMP);
5258                 break;
5259         case WPA_ALG_IGTK:
5260                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5261                             WLAN_CIPHER_SUITE_AES_CMAC);
5262                 break;
5263         default:
5264                 wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
5265                            "algorithm %d", __func__, alg);
5266                 return -1;
5267         }
5268
5269         if (seq && seq_len)
5270                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
5271
5272         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
5273
5274         nla_nest_end(msg, key_attr);
5275
5276         return 0;
5277  nla_put_failure:
5278         return -1;
5279 }
5280
5281
5282 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
5283                                  struct nl_msg *msg)
5284 {
5285         int i, privacy = 0;
5286         struct nlattr *nl_keys, *nl_key;
5287
5288         for (i = 0; i < 4; i++) {
5289                 if (!params->wep_key[i])
5290                         continue;
5291                 privacy = 1;
5292                 break;
5293         }
5294         if (params->wps == WPS_MODE_PRIVACY)
5295                 privacy = 1;
5296         if (params->pairwise_suite &&
5297             params->pairwise_suite != WPA_CIPHER_NONE)
5298                 privacy = 1;
5299
5300         if (!privacy)
5301                 return 0;
5302
5303         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
5304
5305         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
5306         if (!nl_keys)
5307                 goto nla_put_failure;
5308
5309         for (i = 0; i < 4; i++) {
5310                 if (!params->wep_key[i])
5311                         continue;
5312
5313                 nl_key = nla_nest_start(msg, i);
5314                 if (!nl_key)
5315                         goto nla_put_failure;
5316
5317                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
5318                         params->wep_key[i]);
5319                 if (params->wep_key_len[i] == 5)
5320                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5321                                     WLAN_CIPHER_SUITE_WEP40);
5322                 else
5323                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
5324                                     WLAN_CIPHER_SUITE_WEP104);
5325
5326                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
5327
5328                 if (i == params->wep_tx_keyidx)
5329                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
5330
5331                 nla_nest_end(msg, nl_key);
5332         }
5333         nla_nest_end(msg, nl_keys);
5334
5335         return 0;
5336
5337 nla_put_failure:
5338         return -ENOBUFS;
5339 }
5340
5341
5342 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
5343                                    const u8 *addr, int cmd, u16 reason_code,
5344                                    int local_state_change)
5345 {
5346         int ret = -1;
5347         struct nl_msg *msg;
5348
5349         msg = nlmsg_alloc();
5350         if (!msg)
5351                 return -1;
5352
5353         nl80211_cmd(drv, msg, 0, cmd);
5354
5355         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5356         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
5357         if (addr)
5358                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5359         if (local_state_change)
5360                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
5361
5362         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5363         msg = NULL;
5364         if (ret) {
5365                 wpa_dbg(drv->ctx, MSG_DEBUG,
5366                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
5367                         reason_code, ret, strerror(-ret));
5368                 goto nla_put_failure;
5369         }
5370         ret = 0;
5371
5372 nla_put_failure:
5373         nlmsg_free(msg);
5374         return ret;
5375 }
5376
5377
5378 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
5379                                          int reason_code)
5380 {
5381         int ret;
5382
5383         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
5384         nl80211_mark_disconnected(drv);
5385         /* Disconnect command doesn't need BSSID - it uses cached value */
5386         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
5387                                       reason_code, 0);
5388         /*
5389          * For locally generated disconnect, supplicant already generates a
5390          * DEAUTH event, so ignore the event from NL80211.
5391          */
5392         drv->ignore_next_local_disconnect = ret == 0;
5393
5394         return ret;
5395 }
5396
5397
5398 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
5399                                              const u8 *addr, int reason_code)
5400 {
5401         struct wpa_driver_nl80211_data *drv = bss->drv;
5402         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
5403                 return wpa_driver_nl80211_disconnect(drv, reason_code);
5404         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
5405                    __func__, MAC2STR(addr), reason_code);
5406         nl80211_mark_disconnected(drv);
5407         if (drv->nlmode == NL80211_IFTYPE_ADHOC)
5408                 return nl80211_leave_ibss(drv);
5409         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
5410                                        reason_code, 0);
5411 }
5412
5413
5414 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
5415                                      struct wpa_driver_auth_params *params)
5416 {
5417         int i;
5418
5419         drv->auth_freq = params->freq;
5420         drv->auth_alg = params->auth_alg;
5421         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
5422         drv->auth_local_state_change = params->local_state_change;
5423         drv->auth_p2p = params->p2p;
5424
5425         if (params->bssid)
5426                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
5427         else
5428                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
5429
5430         if (params->ssid) {
5431                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
5432                 drv->auth_ssid_len = params->ssid_len;
5433         } else
5434                 drv->auth_ssid_len = 0;
5435
5436
5437         os_free(drv->auth_ie);
5438         drv->auth_ie = NULL;
5439         drv->auth_ie_len = 0;
5440         if (params->ie) {
5441                 drv->auth_ie = os_malloc(params->ie_len);
5442                 if (drv->auth_ie) {
5443                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
5444                         drv->auth_ie_len = params->ie_len;
5445                 }
5446         }
5447
5448         for (i = 0; i < 4; i++) {
5449                 if (params->wep_key[i] && params->wep_key_len[i] &&
5450                     params->wep_key_len[i] <= 16) {
5451                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
5452                                   params->wep_key_len[i]);
5453                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
5454                 } else
5455                         drv->auth_wep_key_len[i] = 0;
5456         }
5457 }
5458
5459
5460 static int wpa_driver_nl80211_authenticate(
5461         struct i802_bss *bss, struct wpa_driver_auth_params *params)
5462 {
5463         struct wpa_driver_nl80211_data *drv = bss->drv;
5464         int ret = -1, i;
5465         struct nl_msg *msg;
5466         enum nl80211_auth_type type;
5467         enum nl80211_iftype nlmode;
5468         int count = 0;
5469         int is_retry;
5470
5471         is_retry = drv->retry_auth;
5472         drv->retry_auth = 0;
5473
5474         nl80211_mark_disconnected(drv);
5475         os_memset(drv->auth_bssid, 0, ETH_ALEN);
5476         if (params->bssid)
5477                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
5478         else
5479                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
5480         /* FIX: IBSS mode */
5481         nlmode = params->p2p ?
5482                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
5483         if (drv->nlmode != nlmode &&
5484             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
5485                 return -1;
5486
5487 retry:
5488         msg = nlmsg_alloc();
5489         if (!msg)
5490                 return -1;
5491
5492         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
5493                    drv->ifindex);
5494
5495         nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
5496
5497         for (i = 0; i < 4; i++) {
5498                 if (!params->wep_key[i])
5499                         continue;
5500                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
5501                                            NULL, i,
5502                                            i == params->wep_tx_keyidx, NULL, 0,
5503                                            params->wep_key[i],
5504                                            params->wep_key_len[i]);
5505                 if (params->wep_tx_keyidx != i)
5506                         continue;
5507                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
5508                                params->wep_key[i], params->wep_key_len[i])) {
5509                         nlmsg_free(msg);
5510                         return -1;
5511                 }
5512         }
5513
5514         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5515         if (params->bssid) {
5516                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
5517                            MAC2STR(params->bssid));
5518                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
5519         }
5520         if (params->freq) {
5521                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
5522                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
5523         }
5524         if (params->ssid) {
5525                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
5526                                   params->ssid, params->ssid_len);
5527                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5528                         params->ssid);
5529         }
5530         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
5531         if (params->ie)
5532                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
5533         if (params->sae_data) {
5534                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
5535                             params->sae_data_len);
5536                 NLA_PUT(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
5537                         params->sae_data);
5538         }
5539         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5540                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
5541         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5542                 type = NL80211_AUTHTYPE_SHARED_KEY;
5543         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5544                 type = NL80211_AUTHTYPE_NETWORK_EAP;
5545         else if (params->auth_alg & WPA_AUTH_ALG_FT)
5546                 type = NL80211_AUTHTYPE_FT;
5547         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
5548                 type = NL80211_AUTHTYPE_SAE;
5549         else
5550                 goto nla_put_failure;
5551         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
5552         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
5553         if (params->local_state_change) {
5554                 wpa_printf(MSG_DEBUG, "  * Local state change only");
5555                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
5556         }
5557
5558         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5559         msg = NULL;
5560         if (ret) {
5561                 wpa_dbg(drv->ctx, MSG_DEBUG,
5562                         "nl80211: MLME command failed (auth): ret=%d (%s)",
5563                         ret, strerror(-ret));
5564                 count++;
5565                 if (ret == -EALREADY && count == 1 && params->bssid &&
5566                     !params->local_state_change) {
5567                         /*
5568                          * mac80211 does not currently accept new
5569                          * authentication if we are already authenticated. As a
5570                          * workaround, force deauthentication and try again.
5571                          */
5572                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
5573                                    "after forced deauthentication");
5574                         wpa_driver_nl80211_deauthenticate(
5575                                 bss, params->bssid,
5576                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
5577                         nlmsg_free(msg);
5578                         goto retry;
5579                 }
5580
5581                 if (ret == -ENOENT && params->freq && !is_retry) {
5582                         /*
5583                          * cfg80211 has likely expired the BSS entry even
5584                          * though it was previously available in our internal
5585                          * BSS table. To recover quickly, start a single
5586                          * channel scan on the specified channel.
5587                          */
5588                         struct wpa_driver_scan_params scan;
5589                         int freqs[2];
5590
5591                         os_memset(&scan, 0, sizeof(scan));
5592                         scan.num_ssids = 1;
5593                         if (params->ssid) {
5594                                 scan.ssids[0].ssid = params->ssid;
5595                                 scan.ssids[0].ssid_len = params->ssid_len;
5596                         }
5597                         freqs[0] = params->freq;
5598                         freqs[1] = 0;
5599                         scan.freqs = freqs;
5600                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
5601                                    "channel scan to refresh cfg80211 BSS "
5602                                    "entry");
5603                         ret = wpa_driver_nl80211_scan(bss, &scan);
5604                         if (ret == 0) {
5605                                 nl80211_copy_auth_params(drv, params);
5606                                 drv->scan_for_auth = 1;
5607                         }
5608                 } else if (is_retry) {
5609                         /*
5610                          * Need to indicate this with an event since the return
5611                          * value from the retry is not delivered to core code.
5612                          */
5613                         union wpa_event_data event;
5614                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
5615                                    "failed");
5616                         os_memset(&event, 0, sizeof(event));
5617                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
5618                                   ETH_ALEN);
5619                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
5620                                              &event);
5621                 }
5622
5623                 goto nla_put_failure;
5624         }
5625         ret = 0;
5626         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
5627                    "successfully");
5628
5629 nla_put_failure:
5630         nlmsg_free(msg);
5631         return ret;
5632 }
5633
5634
5635 static int wpa_driver_nl80211_authenticate_retry(
5636         struct wpa_driver_nl80211_data *drv)
5637 {
5638         struct wpa_driver_auth_params params;
5639         struct i802_bss *bss = drv->first_bss;
5640         int i;
5641
5642         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
5643
5644         os_memset(&params, 0, sizeof(params));
5645         params.freq = drv->auth_freq;
5646         params.auth_alg = drv->auth_alg;
5647         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
5648         params.local_state_change = drv->auth_local_state_change;
5649         params.p2p = drv->auth_p2p;
5650
5651         if (!is_zero_ether_addr(drv->auth_bssid_))
5652                 params.bssid = drv->auth_bssid_;
5653
5654         if (drv->auth_ssid_len) {
5655                 params.ssid = drv->auth_ssid;
5656                 params.ssid_len = drv->auth_ssid_len;
5657         }
5658
5659         params.ie = drv->auth_ie;
5660         params.ie_len = drv->auth_ie_len;
5661
5662         for (i = 0; i < 4; i++) {
5663                 if (drv->auth_wep_key_len[i]) {
5664                         params.wep_key[i] = drv->auth_wep_key[i];
5665                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
5666                 }
5667         }
5668
5669         drv->retry_auth = 1;
5670         return wpa_driver_nl80211_authenticate(bss, &params);
5671 }
5672
5673
5674 struct phy_info_arg {
5675         u16 *num_modes;
5676         struct hostapd_hw_modes *modes;
5677         int last_mode, last_chan_idx;
5678 };
5679
5680 static void phy_info_ht_capa(struct hostapd_hw_modes *mode, struct nlattr *capa,
5681                              struct nlattr *ampdu_factor,
5682                              struct nlattr *ampdu_density,
5683                              struct nlattr *mcs_set)
5684 {
5685         if (capa)
5686                 mode->ht_capab = nla_get_u16(capa);
5687
5688         if (ampdu_factor)
5689                 mode->a_mpdu_params |= nla_get_u8(ampdu_factor) & 0x03;
5690
5691         if (ampdu_density)
5692                 mode->a_mpdu_params |= nla_get_u8(ampdu_density) << 2;
5693
5694         if (mcs_set && nla_len(mcs_set) >= 16) {
5695                 u8 *mcs;
5696                 mcs = nla_data(mcs_set);
5697                 os_memcpy(mode->mcs_set, mcs, 16);
5698         }
5699 }
5700
5701
5702 static void phy_info_vht_capa(struct hostapd_hw_modes *mode,
5703                               struct nlattr *capa,
5704                               struct nlattr *mcs_set)
5705 {
5706         if (capa)
5707                 mode->vht_capab = nla_get_u32(capa);
5708
5709         if (mcs_set && nla_len(mcs_set) >= 8) {
5710                 u8 *mcs;
5711                 mcs = nla_data(mcs_set);
5712                 os_memcpy(mode->vht_mcs_set, mcs, 8);
5713         }
5714 }
5715
5716
5717 static void phy_info_freq(struct hostapd_hw_modes *mode,
5718                           struct hostapd_channel_data *chan,
5719                           struct nlattr *tb_freq[])
5720 {
5721         u8 channel;
5722         chan->freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
5723         chan->flag = 0;
5724         if (ieee80211_freq_to_chan(chan->freq, &channel) != NUM_HOSTAPD_MODES)
5725                 chan->chan = channel;
5726
5727         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
5728                 chan->flag |= HOSTAPD_CHAN_DISABLED;
5729         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
5730                 chan->flag |= HOSTAPD_CHAN_PASSIVE_SCAN;
5731         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
5732                 chan->flag |= HOSTAPD_CHAN_NO_IBSS;
5733         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
5734                 chan->flag |= HOSTAPD_CHAN_RADAR;
5735
5736         if (tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]) {
5737                 enum nl80211_dfs_state state =
5738                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]);
5739
5740                 switch (state) {
5741                 case NL80211_DFS_USABLE:
5742                         chan->flag |= HOSTAPD_CHAN_DFS_USABLE;
5743                         break;
5744                 case NL80211_DFS_AVAILABLE:
5745                         chan->flag |= HOSTAPD_CHAN_DFS_AVAILABLE;
5746                         break;
5747                 case NL80211_DFS_UNAVAILABLE:
5748                         chan->flag |= HOSTAPD_CHAN_DFS_UNAVAILABLE;
5749                         break;
5750                 }
5751         }
5752 }
5753
5754
5755 static int phy_info_freqs(struct phy_info_arg *phy_info,
5756                           struct hostapd_hw_modes *mode, struct nlattr *tb)
5757 {
5758         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
5759                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
5760                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
5761                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
5762                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
5763                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
5764                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
5765                 [NL80211_FREQUENCY_ATTR_DFS_STATE] = { .type = NLA_U32 },
5766         };
5767         int new_channels = 0;
5768         struct hostapd_channel_data *channel;
5769         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
5770         struct nlattr *nl_freq;
5771         int rem_freq, idx;
5772
5773         if (tb == NULL)
5774                 return NL_OK;
5775
5776         nla_for_each_nested(nl_freq, tb, rem_freq) {
5777                 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
5778                           nla_data(nl_freq), nla_len(nl_freq), freq_policy);
5779                 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
5780                         continue;
5781                 new_channels++;
5782         }
5783
5784         channel = os_realloc_array(mode->channels,
5785                                    mode->num_channels + new_channels,
5786                                    sizeof(struct hostapd_channel_data));
5787         if (!channel)
5788                 return NL_SKIP;
5789
5790         mode->channels = channel;
5791         mode->num_channels += new_channels;
5792
5793         idx = phy_info->last_chan_idx;
5794
5795         nla_for_each_nested(nl_freq, tb, rem_freq) {
5796                 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
5797                           nla_data(nl_freq), nla_len(nl_freq), freq_policy);
5798                 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
5799                         continue;
5800                 phy_info_freq(mode, &mode->channels[idx], tb_freq);
5801                 idx++;
5802         }
5803         phy_info->last_chan_idx = idx;
5804
5805         return NL_OK;
5806 }
5807
5808
5809 static int phy_info_rates(struct hostapd_hw_modes *mode, struct nlattr *tb)
5810 {
5811         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
5812                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
5813                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] =
5814                 { .type = NLA_FLAG },
5815         };
5816         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
5817         struct nlattr *nl_rate;
5818         int rem_rate, idx;
5819
5820         if (tb == NULL)
5821                 return NL_OK;
5822
5823         nla_for_each_nested(nl_rate, tb, rem_rate) {
5824                 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
5825                           nla_data(nl_rate), nla_len(nl_rate),
5826                           rate_policy);
5827                 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
5828                         continue;
5829                 mode->num_rates++;
5830         }
5831
5832         mode->rates = os_calloc(mode->num_rates, sizeof(int));
5833         if (!mode->rates)
5834                 return NL_SKIP;
5835
5836         idx = 0;
5837
5838         nla_for_each_nested(nl_rate, tb, rem_rate) {
5839                 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
5840                           nla_data(nl_rate), nla_len(nl_rate),
5841                           rate_policy);
5842                 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
5843                         continue;
5844                 mode->rates[idx] = nla_get_u32(
5845                         tb_rate[NL80211_BITRATE_ATTR_RATE]);
5846                 idx++;
5847         }
5848
5849         return NL_OK;
5850 }
5851
5852
5853 static int phy_info_band(struct phy_info_arg *phy_info, struct nlattr *nl_band)
5854 {
5855         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
5856         struct hostapd_hw_modes *mode;
5857         int ret;
5858
5859         if (phy_info->last_mode != nl_band->nla_type) {
5860                 mode = os_realloc_array(phy_info->modes,
5861                                         *phy_info->num_modes + 1,
5862                                         sizeof(*mode));
5863                 if (!mode)
5864                         return NL_SKIP;
5865                 phy_info->modes = mode;
5866
5867                 mode = &phy_info->modes[*(phy_info->num_modes)];
5868                 os_memset(mode, 0, sizeof(*mode));
5869                 mode->mode = NUM_HOSTAPD_MODES;
5870                 mode->flags = HOSTAPD_MODE_FLAG_HT_INFO_KNOWN |
5871                         HOSTAPD_MODE_FLAG_VHT_INFO_KNOWN;
5872
5873                 /*
5874                  * Unsupported VHT MCS stream is defined as value 3, so the VHT
5875                  * MCS RX/TX map must be initialized with 0xffff to mark all 8
5876                  * possible streams as unsupported. This will be overridden if
5877                  * driver advertises VHT support.
5878                  */
5879                 mode->vht_mcs_set[0] = 0xff;
5880                 mode->vht_mcs_set[1] = 0xff;
5881                 mode->vht_mcs_set[4] = 0xff;
5882                 mode->vht_mcs_set[5] = 0xff;
5883
5884                 *(phy_info->num_modes) += 1;
5885                 phy_info->last_mode = nl_band->nla_type;
5886                 phy_info->last_chan_idx = 0;
5887         } else
5888                 mode = &phy_info->modes[*(phy_info->num_modes) - 1];
5889
5890         nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
5891                   nla_len(nl_band), NULL);
5892
5893         phy_info_ht_capa(mode, tb_band[NL80211_BAND_ATTR_HT_CAPA],
5894                          tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR],
5895                          tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY],
5896                          tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
5897         phy_info_vht_capa(mode, tb_band[NL80211_BAND_ATTR_VHT_CAPA],
5898                           tb_band[NL80211_BAND_ATTR_VHT_MCS_SET]);
5899         ret = phy_info_freqs(phy_info, mode, tb_band[NL80211_BAND_ATTR_FREQS]);
5900         if (ret != NL_OK)
5901                 return ret;
5902         ret = phy_info_rates(mode, tb_band[NL80211_BAND_ATTR_RATES]);
5903         if (ret != NL_OK)
5904                 return ret;
5905
5906         return NL_OK;
5907 }
5908
5909
5910 static int phy_info_handler(struct nl_msg *msg, void *arg)
5911 {
5912         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
5913         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5914         struct phy_info_arg *phy_info = arg;
5915         struct nlattr *nl_band;
5916         int rem_band;
5917
5918         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5919                   genlmsg_attrlen(gnlh, 0), NULL);
5920
5921         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
5922                 return NL_SKIP;
5923
5924         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band)
5925         {
5926                 int res = phy_info_band(phy_info, nl_band);
5927                 if (res != NL_OK)
5928                         return res;
5929         }
5930
5931         return NL_SKIP;
5932 }
5933
5934
5935 static struct hostapd_hw_modes *
5936 wpa_driver_nl80211_postprocess_modes(struct hostapd_hw_modes *modes,
5937                                      u16 *num_modes)
5938 {
5939         u16 m;
5940         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
5941         int i, mode11g_idx = -1;
5942
5943         /* heuristic to set up modes */
5944         for (m = 0; m < *num_modes; m++) {
5945                 if (!modes[m].num_channels)
5946                         continue;
5947                 if (modes[m].channels[0].freq < 4000) {
5948                         modes[m].mode = HOSTAPD_MODE_IEEE80211B;
5949                         for (i = 0; i < modes[m].num_rates; i++) {
5950                                 if (modes[m].rates[i] > 200) {
5951                                         modes[m].mode = HOSTAPD_MODE_IEEE80211G;
5952                                         break;
5953                                 }
5954                         }
5955                 } else if (modes[m].channels[0].freq > 50000)
5956                         modes[m].mode = HOSTAPD_MODE_IEEE80211AD;
5957                 else
5958                         modes[m].mode = HOSTAPD_MODE_IEEE80211A;
5959         }
5960
5961         /* If only 802.11g mode is included, use it to construct matching
5962          * 802.11b mode data. */
5963
5964         for (m = 0; m < *num_modes; m++) {
5965                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
5966                         return modes; /* 802.11b already included */
5967                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
5968                         mode11g_idx = m;
5969         }
5970
5971         if (mode11g_idx < 0)
5972                 return modes; /* 2.4 GHz band not supported at all */
5973
5974         nmodes = os_realloc_array(modes, *num_modes + 1, sizeof(*nmodes));
5975         if (nmodes == NULL)
5976                 return modes; /* Could not add 802.11b mode */
5977
5978         mode = &nmodes[*num_modes];
5979         os_memset(mode, 0, sizeof(*mode));
5980         (*num_modes)++;
5981         modes = nmodes;
5982
5983         mode->mode = HOSTAPD_MODE_IEEE80211B;
5984
5985         mode11g = &modes[mode11g_idx];
5986         mode->num_channels = mode11g->num_channels;
5987         mode->channels = os_malloc(mode11g->num_channels *
5988                                    sizeof(struct hostapd_channel_data));
5989         if (mode->channels == NULL) {
5990                 (*num_modes)--;
5991                 return modes; /* Could not add 802.11b mode */
5992         }
5993         os_memcpy(mode->channels, mode11g->channels,
5994                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
5995
5996         mode->num_rates = 0;
5997         mode->rates = os_malloc(4 * sizeof(int));
5998         if (mode->rates == NULL) {
5999                 os_free(mode->channels);
6000                 (*num_modes)--;
6001                 return modes; /* Could not add 802.11b mode */
6002         }
6003
6004         for (i = 0; i < mode11g->num_rates; i++) {
6005                 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
6006                     mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
6007                         continue;
6008                 mode->rates[mode->num_rates] = mode11g->rates[i];
6009                 mode->num_rates++;
6010                 if (mode->num_rates == 4)
6011                         break;
6012         }
6013
6014         if (mode->num_rates == 0) {
6015                 os_free(mode->channels);
6016                 os_free(mode->rates);
6017                 (*num_modes)--;
6018                 return modes; /* No 802.11b rates */
6019         }
6020
6021         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
6022                    "information");
6023
6024         return modes;
6025 }
6026
6027
6028 static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
6029                                   int end)
6030 {
6031         int c;
6032
6033         for (c = 0; c < mode->num_channels; c++) {
6034                 struct hostapd_channel_data *chan = &mode->channels[c];
6035                 if (chan->freq - 10 >= start && chan->freq + 10 <= end)
6036                         chan->flag |= HOSTAPD_CHAN_HT40;
6037         }
6038 }
6039
6040
6041 static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
6042                                       int end)
6043 {
6044         int c;
6045
6046         for (c = 0; c < mode->num_channels; c++) {
6047                 struct hostapd_channel_data *chan = &mode->channels[c];
6048                 if (!(chan->flag & HOSTAPD_CHAN_HT40))
6049                         continue;
6050                 if (chan->freq - 30 >= start && chan->freq - 10 <= end)
6051                         chan->flag |= HOSTAPD_CHAN_HT40MINUS;
6052                 if (chan->freq + 10 >= start && chan->freq + 30 <= end)
6053                         chan->flag |= HOSTAPD_CHAN_HT40PLUS;
6054         }
6055 }
6056
6057
6058 static void nl80211_reg_rule_max_eirp(struct nlattr *tb[],
6059                                       struct phy_info_arg *results)
6060 {
6061         u32 start, end, max_eirp;
6062         u16 m;
6063
6064         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6065             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6066             tb[NL80211_ATTR_POWER_RULE_MAX_EIRP] == NULL)
6067                 return;
6068
6069         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6070         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6071         max_eirp = nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) / 100;
6072
6073         wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u mBm",
6074                    start, end, max_eirp);
6075
6076         for (m = 0; m < *results->num_modes; m++) {
6077                 int c;
6078                 struct hostapd_hw_modes *mode = &results->modes[m];
6079
6080                 for (c = 0; c < mode->num_channels; c++) {
6081                         struct hostapd_channel_data *chan = &mode->channels[c];
6082                         if ((u32) chan->freq - 10 >= start &&
6083                             (u32) chan->freq + 10 <= end)
6084                                 chan->max_tx_power = max_eirp;
6085                 }
6086         }
6087 }
6088
6089
6090 static void nl80211_reg_rule_ht40(struct nlattr *tb[],
6091                                   struct phy_info_arg *results)
6092 {
6093         u32 start, end, max_bw;
6094         u16 m;
6095
6096         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6097             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6098             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
6099                 return;
6100
6101         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6102         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6103         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6104
6105         wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz",
6106                    start, end, max_bw);
6107         if (max_bw < 40)
6108                 return;
6109
6110         for (m = 0; m < *results->num_modes; m++) {
6111                 if (!(results->modes[m].ht_capab &
6112                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6113                         continue;
6114                 nl80211_set_ht40_mode(&results->modes[m], start, end);
6115         }
6116 }
6117
6118
6119 static void nl80211_reg_rule_sec(struct nlattr *tb[],
6120                                  struct phy_info_arg *results)
6121 {
6122         u32 start, end, max_bw;
6123         u16 m;
6124
6125         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6126             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6127             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
6128                 return;
6129
6130         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6131         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6132         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6133
6134         if (max_bw < 20)
6135                 return;
6136
6137         for (m = 0; m < *results->num_modes; m++) {
6138                 if (!(results->modes[m].ht_capab &
6139                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6140                         continue;
6141                 nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
6142         }
6143 }
6144
6145
6146 static void nl80211_set_vht_mode(struct hostapd_hw_modes *mode, int start,
6147                                  int end)
6148 {
6149         int c;
6150
6151         for (c = 0; c < mode->num_channels; c++) {
6152                 struct hostapd_channel_data *chan = &mode->channels[c];
6153                 if (chan->freq - 10 >= start && chan->freq + 70 <= end)
6154                         chan->flag |= HOSTAPD_CHAN_VHT_10_70;
6155
6156                 if (chan->freq - 30 >= start && chan->freq + 50 <= end)
6157                         chan->flag |= HOSTAPD_CHAN_VHT_30_50;
6158
6159                 if (chan->freq - 50 >= start && chan->freq + 30 <= end)
6160                         chan->flag |= HOSTAPD_CHAN_VHT_50_30;
6161
6162                 if (chan->freq - 70 >= start && chan->freq + 10 <= end)
6163                         chan->flag |= HOSTAPD_CHAN_VHT_70_10;
6164         }
6165 }
6166
6167
6168 static void nl80211_reg_rule_vht(struct nlattr *tb[],
6169                                  struct phy_info_arg *results)
6170 {
6171         u32 start, end, max_bw;
6172         u16 m;
6173
6174         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
6175             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
6176             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
6177                 return;
6178
6179         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
6180         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
6181         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
6182
6183         if (max_bw < 80)
6184                 return;
6185
6186         for (m = 0; m < *results->num_modes; m++) {
6187                 if (!(results->modes[m].ht_capab &
6188                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
6189                         continue;
6190                 /* TODO: use a real VHT support indication */
6191                 if (!results->modes[m].vht_capab)
6192                         continue;
6193
6194                 nl80211_set_vht_mode(&results->modes[m], start, end);
6195         }
6196 }
6197
6198
6199 static int nl80211_get_reg(struct nl_msg *msg, void *arg)
6200 {
6201         struct phy_info_arg *results = arg;
6202         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
6203         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6204         struct nlattr *nl_rule;
6205         struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
6206         int rem_rule;
6207         static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
6208                 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
6209                 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
6210                 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
6211                 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
6212                 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
6213                 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
6214         };
6215
6216         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6217                   genlmsg_attrlen(gnlh, 0), NULL);
6218         if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
6219             !tb_msg[NL80211_ATTR_REG_RULES]) {
6220                 wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
6221                            "available");
6222                 return NL_SKIP;
6223         }
6224
6225         wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
6226                    (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
6227
6228         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6229         {
6230                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6231                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6232                 nl80211_reg_rule_ht40(tb_rule, results);
6233                 nl80211_reg_rule_max_eirp(tb_rule, results);
6234         }
6235
6236         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6237         {
6238                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6239                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6240                 nl80211_reg_rule_sec(tb_rule, results);
6241         }
6242
6243         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
6244         {
6245                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
6246                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
6247                 nl80211_reg_rule_vht(tb_rule, results);
6248         }
6249
6250         return NL_SKIP;
6251 }
6252
6253
6254 static int nl80211_set_regulatory_flags(struct wpa_driver_nl80211_data *drv,
6255                                         struct phy_info_arg *results)
6256 {
6257         struct nl_msg *msg;
6258
6259         msg = nlmsg_alloc();
6260         if (!msg)
6261                 return -ENOMEM;
6262
6263         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
6264         return send_and_recv_msgs(drv, msg, nl80211_get_reg, results);
6265 }
6266
6267
6268 static struct hostapd_hw_modes *
6269 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
6270 {
6271         u32 feat;
6272         struct i802_bss *bss = priv;
6273         struct wpa_driver_nl80211_data *drv = bss->drv;
6274         struct nl_msg *msg;
6275         struct phy_info_arg result = {
6276                 .num_modes = num_modes,
6277                 .modes = NULL,
6278                 .last_mode = -1,
6279         };
6280
6281         *num_modes = 0;
6282         *flags = 0;
6283
6284         msg = nlmsg_alloc();
6285         if (!msg)
6286                 return NULL;
6287
6288         feat = get_nl80211_protocol_features(drv);
6289         if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
6290                 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
6291         else
6292                 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
6293
6294         NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
6295         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6296
6297         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) {
6298                 nl80211_set_regulatory_flags(drv, &result);
6299                 return wpa_driver_nl80211_postprocess_modes(result.modes,
6300                                                             num_modes);
6301         }
6302         msg = NULL;
6303  nla_put_failure:
6304         nlmsg_free(msg);
6305         return NULL;
6306 }
6307
6308
6309 static int wpa_driver_nl80211_send_mntr(struct wpa_driver_nl80211_data *drv,
6310                                         const void *data, size_t len,
6311                                         int encrypt, int noack)
6312 {
6313         __u8 rtap_hdr[] = {
6314                 0x00, 0x00, /* radiotap version */
6315                 0x0e, 0x00, /* radiotap length */
6316                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
6317                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
6318                 0x00,       /* padding */
6319                 0x00, 0x00, /* RX and TX flags to indicate that */
6320                 0x00, 0x00, /* this is the injected frame directly */
6321         };
6322         struct iovec iov[2] = {
6323                 {
6324                         .iov_base = &rtap_hdr,
6325                         .iov_len = sizeof(rtap_hdr),
6326                 },
6327                 {
6328                         .iov_base = (void *) data,
6329                         .iov_len = len,
6330                 }
6331         };
6332         struct msghdr msg = {
6333                 .msg_name = NULL,
6334                 .msg_namelen = 0,
6335                 .msg_iov = iov,
6336                 .msg_iovlen = 2,
6337                 .msg_control = NULL,
6338                 .msg_controllen = 0,
6339                 .msg_flags = 0,
6340         };
6341         int res;
6342         u16 txflags = 0;
6343
6344         if (encrypt)
6345                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
6346
6347         if (drv->monitor_sock < 0) {
6348                 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
6349                            "for %s", __func__);
6350                 return -1;
6351         }
6352
6353         if (noack)
6354                 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
6355         WPA_PUT_LE16(&rtap_hdr[12], txflags);
6356
6357         res = sendmsg(drv->monitor_sock, &msg, 0);
6358         if (res < 0) {
6359                 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
6360                 return -1;
6361         }
6362         return 0;
6363 }
6364
6365
6366 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
6367                                          const void *data, size_t len,
6368                                          int encrypt, int noack,
6369                                          unsigned int freq, int no_cck,
6370                                          int offchanok, unsigned int wait_time)
6371 {
6372         struct wpa_driver_nl80211_data *drv = bss->drv;
6373         u64 cookie;
6374         int res;
6375
6376         if (freq == 0) {
6377                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
6378                            bss->freq);
6379                 freq = bss->freq;
6380         }
6381
6382         if (drv->use_monitor) {
6383                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_mntr",
6384                            freq, bss->freq);
6385                 return wpa_driver_nl80211_send_mntr(drv, data, len,
6386                                                     encrypt, noack);
6387         }
6388
6389         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
6390         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
6391                                      &cookie, no_cck, noack, offchanok);
6392         if (res == 0 && !noack) {
6393                 const struct ieee80211_mgmt *mgmt;
6394                 u16 fc;
6395
6396                 mgmt = (const struct ieee80211_mgmt *) data;
6397                 fc = le_to_host16(mgmt->frame_control);
6398                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
6399                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
6400                         wpa_printf(MSG_MSGDUMP,
6401                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
6402                                    (long long unsigned int)
6403                                    drv->send_action_cookie,
6404                                    (long long unsigned int) cookie);
6405                         drv->send_action_cookie = cookie;
6406                 }
6407         }
6408
6409         return res;
6410 }
6411
6412
6413 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
6414                                         size_t data_len, int noack,
6415                                         unsigned int freq, int no_cck,
6416                                         int offchanok,
6417                                         unsigned int wait_time)
6418 {
6419         struct wpa_driver_nl80211_data *drv = bss->drv;
6420         struct ieee80211_mgmt *mgmt;
6421         int encrypt = 1;
6422         u16 fc;
6423
6424         mgmt = (struct ieee80211_mgmt *) data;
6425         fc = le_to_host16(mgmt->frame_control);
6426         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x nlmode=%d",
6427                    noack, freq, no_cck, offchanok, wait_time, fc, drv->nlmode);
6428
6429         if ((is_sta_interface(drv->nlmode) ||
6430              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
6431             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
6432             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
6433                 /*
6434                  * The use of last_mgmt_freq is a bit of a hack,
6435                  * but it works due to the single-threaded nature
6436                  * of wpa_supplicant.
6437                  */
6438                 if (freq == 0) {
6439                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
6440                                    drv->last_mgmt_freq);
6441                         freq = drv->last_mgmt_freq;
6442                 }
6443                 return nl80211_send_frame_cmd(bss, freq, 0,
6444                                               data, data_len, NULL, 1, noack,
6445                                               1);
6446         }
6447
6448         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
6449                 if (freq == 0) {
6450                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
6451                                    bss->freq);
6452                         freq = bss->freq;
6453                 }
6454                 return nl80211_send_frame_cmd(bss, freq,
6455                                               (int) freq == bss->freq ? 0 :
6456                                               wait_time,
6457                                               data, data_len,
6458                                               &drv->send_action_cookie,
6459                                               no_cck, noack, offchanok);
6460         }
6461
6462         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
6463             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
6464                 /*
6465                  * Only one of the authentication frame types is encrypted.
6466                  * In order for static WEP encryption to work properly (i.e.,
6467                  * to not encrypt the frame), we need to tell mac80211 about
6468                  * the frames that must not be encrypted.
6469                  */
6470                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
6471                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
6472                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
6473                         encrypt = 0;
6474         }
6475
6476         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
6477         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
6478                                              noack, freq, no_cck, offchanok,
6479                                              wait_time);
6480 }
6481
6482
6483 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
6484                            int slot, int ht_opmode, int ap_isolate,
6485                            int *basic_rates)
6486 {
6487         struct wpa_driver_nl80211_data *drv = bss->drv;
6488         struct nl_msg *msg;
6489
6490         msg = nlmsg_alloc();
6491         if (!msg)
6492                 return -ENOMEM;
6493
6494         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
6495
6496         if (cts >= 0)
6497                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
6498         if (preamble >= 0)
6499                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
6500         if (slot >= 0)
6501                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
6502         if (ht_opmode >= 0)
6503                 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
6504         if (ap_isolate >= 0)
6505                 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
6506
6507         if (basic_rates) {
6508                 u8 rates[NL80211_MAX_SUPP_RATES];
6509                 u8 rates_len = 0;
6510                 int i;
6511
6512                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
6513                      i++)
6514                         rates[rates_len++] = basic_rates[i] / 5;
6515
6516                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
6517         }
6518
6519         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
6520
6521         return send_and_recv_msgs(drv, msg, NULL, NULL);
6522  nla_put_failure:
6523         nlmsg_free(msg);
6524         return -ENOBUFS;
6525 }
6526
6527
6528 static int wpa_driver_nl80211_set_acl(void *priv,
6529                                       struct hostapd_acl_params *params)
6530 {
6531         struct i802_bss *bss = priv;
6532         struct wpa_driver_nl80211_data *drv = bss->drv;
6533         struct nl_msg *msg;
6534         struct nlattr *acl;
6535         unsigned int i;
6536         int ret = 0;
6537
6538         if (!(drv->capa.max_acl_mac_addrs))
6539                 return -ENOTSUP;
6540
6541         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
6542                 return -ENOTSUP;
6543
6544         msg = nlmsg_alloc();
6545         if (!msg)
6546                 return -ENOMEM;
6547
6548         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
6549                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
6550
6551         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_MAC_ACL);
6552
6553         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6554
6555         NLA_PUT_U32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
6556                     NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
6557                     NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED);
6558
6559         acl = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
6560         if (acl == NULL)
6561                 goto nla_put_failure;
6562
6563         for (i = 0; i < params->num_mac_acl; i++)
6564                 NLA_PUT(msg, i + 1, ETH_ALEN, params->mac_acl[i].addr);
6565
6566         nla_nest_end(msg, acl);
6567
6568         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6569         msg = NULL;
6570         if (ret) {
6571                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
6572                            ret, strerror(-ret));
6573         }
6574
6575 nla_put_failure:
6576         nlmsg_free(msg);
6577
6578         return ret;
6579 }
6580
6581
6582 static int wpa_driver_nl80211_set_ap(void *priv,
6583                                      struct wpa_driver_ap_params *params)
6584 {
6585         struct i802_bss *bss = priv;
6586         struct wpa_driver_nl80211_data *drv = bss->drv;
6587         struct nl_msg *msg;
6588         u8 cmd = NL80211_CMD_NEW_BEACON;
6589         int ret;
6590         int beacon_set;
6591         int ifindex = if_nametoindex(bss->ifname);
6592         int num_suites;
6593         u32 suites[10];
6594         u32 ver;
6595
6596         beacon_set = bss->beacon_set;
6597
6598         msg = nlmsg_alloc();
6599         if (!msg)
6600                 return -ENOMEM;
6601
6602         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
6603                    beacon_set);
6604         if (beacon_set)
6605                 cmd = NL80211_CMD_SET_BEACON;
6606
6607         nl80211_cmd(drv, msg, 0, cmd);
6608         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
6609                     params->head, params->head_len);
6610         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
6611         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
6612                     params->tail, params->tail_len);
6613         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
6614         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", ifindex);
6615         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
6616         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
6617         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
6618         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
6619         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
6620         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
6621                           params->ssid, params->ssid_len);
6622         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6623                 params->ssid);
6624         if (params->proberesp && params->proberesp_len) {
6625                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
6626                             params->proberesp, params->proberesp_len);
6627                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
6628                         params->proberesp);
6629         }
6630         switch (params->hide_ssid) {
6631         case NO_SSID_HIDING:
6632                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
6633                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
6634                             NL80211_HIDDEN_SSID_NOT_IN_USE);
6635                 break;
6636         case HIDDEN_SSID_ZERO_LEN:
6637                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
6638                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
6639                             NL80211_HIDDEN_SSID_ZERO_LEN);
6640                 break;
6641         case HIDDEN_SSID_ZERO_CONTENTS:
6642                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
6643                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
6644                             NL80211_HIDDEN_SSID_ZERO_CONTENTS);
6645                 break;
6646         }
6647         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
6648         if (params->privacy)
6649                 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
6650         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
6651         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
6652             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
6653                 /* Leave out the attribute */
6654         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
6655                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
6656                             NL80211_AUTHTYPE_SHARED_KEY);
6657         else
6658                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
6659                             NL80211_AUTHTYPE_OPEN_SYSTEM);
6660
6661         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
6662         ver = 0;
6663         if (params->wpa_version & WPA_PROTO_WPA)
6664                 ver |= NL80211_WPA_VERSION_1;
6665         if (params->wpa_version & WPA_PROTO_RSN)
6666                 ver |= NL80211_WPA_VERSION_2;
6667         if (ver)
6668                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
6669
6670         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
6671                    params->key_mgmt_suites);
6672         num_suites = 0;
6673         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
6674                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
6675         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
6676                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
6677         if (num_suites) {
6678                 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
6679                         num_suites * sizeof(u32), suites);
6680         }
6681
6682         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
6683             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
6684                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
6685
6686         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
6687                    params->pairwise_ciphers);
6688         num_suites = 0;
6689         if (params->pairwise_ciphers & WPA_CIPHER_CCMP)
6690                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
6691         if (params->pairwise_ciphers & WPA_CIPHER_GCMP)
6692                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
6693         if (params->pairwise_ciphers & WPA_CIPHER_TKIP)
6694                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
6695         if (params->pairwise_ciphers & WPA_CIPHER_WEP104)
6696                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
6697         if (params->pairwise_ciphers & WPA_CIPHER_WEP40)
6698                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
6699         if (num_suites) {
6700                 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
6701                         num_suites * sizeof(u32), suites);
6702         }
6703
6704         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
6705                    params->group_cipher);
6706         switch (params->group_cipher) {
6707         case WPA_CIPHER_CCMP:
6708                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
6709                             WLAN_CIPHER_SUITE_CCMP);
6710                 break;
6711         case WPA_CIPHER_GCMP:
6712                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
6713                             WLAN_CIPHER_SUITE_GCMP);
6714                 break;
6715         case WPA_CIPHER_TKIP:
6716                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
6717                             WLAN_CIPHER_SUITE_TKIP);
6718                 break;
6719         case WPA_CIPHER_WEP104:
6720                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
6721                             WLAN_CIPHER_SUITE_WEP104);
6722                 break;
6723         case WPA_CIPHER_WEP40:
6724                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
6725                             WLAN_CIPHER_SUITE_WEP40);
6726                 break;
6727         }
6728
6729         if (params->beacon_ies) {
6730                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
6731                                 params->beacon_ies);
6732                 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
6733                         wpabuf_head(params->beacon_ies));
6734         }
6735         if (params->proberesp_ies) {
6736                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
6737                                 params->proberesp_ies);
6738                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
6739                         wpabuf_len(params->proberesp_ies),
6740                         wpabuf_head(params->proberesp_ies));
6741         }
6742         if (params->assocresp_ies) {
6743                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
6744                                 params->assocresp_ies);
6745                 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
6746                         wpabuf_len(params->assocresp_ies),
6747                         wpabuf_head(params->assocresp_ies));
6748         }
6749
6750         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
6751                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
6752                            params->ap_max_inactivity);
6753                 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
6754                             params->ap_max_inactivity);
6755         }
6756
6757         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6758         if (ret) {
6759                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
6760                            ret, strerror(-ret));
6761         } else {
6762                 bss->beacon_set = 1;
6763                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
6764                                 params->short_slot_time, params->ht_opmode,
6765                                 params->isolate, params->basic_rates);
6766         }
6767         return ret;
6768  nla_put_failure:
6769         nlmsg_free(msg);
6770         return -ENOBUFS;
6771 }
6772
6773
6774 static int nl80211_put_freq_params(struct nl_msg *msg,
6775                                    struct hostapd_freq_params *freq)
6776 {
6777         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
6778         if (freq->vht_enabled) {
6779                 switch (freq->bandwidth) {
6780                 case 20:
6781                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6782                                     NL80211_CHAN_WIDTH_20);
6783                         break;
6784                 case 40:
6785                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6786                                     NL80211_CHAN_WIDTH_40);
6787                         break;
6788                 case 80:
6789                         if (freq->center_freq2)
6790                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6791                                             NL80211_CHAN_WIDTH_80P80);
6792                         else
6793                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6794                                             NL80211_CHAN_WIDTH_80);
6795                         break;
6796                 case 160:
6797                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6798                                     NL80211_CHAN_WIDTH_160);
6799                         break;
6800                 default:
6801                         return -EINVAL;
6802                 }
6803                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
6804                 if (freq->center_freq2)
6805                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
6806                                     freq->center_freq2);
6807         } else if (freq->ht_enabled) {
6808                 switch (freq->sec_channel_offset) {
6809                 case -1:
6810                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
6811                                     NL80211_CHAN_HT40MINUS);
6812                         break;
6813                 case 1:
6814                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
6815                                     NL80211_CHAN_HT40PLUS);
6816                         break;
6817                 default:
6818                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
6819                                     NL80211_CHAN_HT20);
6820                         break;
6821                 }
6822         }
6823         return 0;
6824
6825 nla_put_failure:
6826         return -ENOBUFS;
6827 }
6828
6829
6830 static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
6831                                        struct hostapd_freq_params *freq)
6832 {
6833         struct wpa_driver_nl80211_data *drv = bss->drv;
6834         struct nl_msg *msg;
6835         int ret;
6836
6837         wpa_printf(MSG_DEBUG,
6838                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
6839                    freq->freq, freq->ht_enabled, freq->vht_enabled,
6840                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
6841         msg = nlmsg_alloc();
6842         if (!msg)
6843                 return -1;
6844
6845         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
6846
6847         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6848         if (nl80211_put_freq_params(msg, freq) < 0)
6849                 goto nla_put_failure;
6850
6851         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6852         msg = NULL;
6853         if (ret == 0) {
6854                 bss->freq = freq->freq;
6855                 return 0;
6856         }
6857         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
6858                    "%d (%s)", freq->freq, ret, strerror(-ret));
6859 nla_put_failure:
6860         nlmsg_free(msg);
6861         return -1;
6862 }
6863
6864
6865 static u32 sta_flags_nl80211(int flags)
6866 {
6867         u32 f = 0;
6868
6869         if (flags & WPA_STA_AUTHORIZED)
6870                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
6871         if (flags & WPA_STA_WMM)
6872                 f |= BIT(NL80211_STA_FLAG_WME);
6873         if (flags & WPA_STA_SHORT_PREAMBLE)
6874                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
6875         if (flags & WPA_STA_MFP)
6876                 f |= BIT(NL80211_STA_FLAG_MFP);
6877         if (flags & WPA_STA_TDLS_PEER)
6878                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
6879
6880         return f;
6881 }
6882
6883
6884 static int wpa_driver_nl80211_sta_add(void *priv,
6885                                       struct hostapd_sta_add_params *params)
6886 {
6887         struct i802_bss *bss = priv;
6888         struct wpa_driver_nl80211_data *drv = bss->drv;
6889         struct nl_msg *msg;
6890         struct nl80211_sta_flag_update upd;
6891         int ret = -ENOBUFS;
6892
6893         if ((params->flags & WPA_STA_TDLS_PEER) &&
6894             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
6895                 return -EOPNOTSUPP;
6896
6897         msg = nlmsg_alloc();
6898         if (!msg)
6899                 return -ENOMEM;
6900
6901         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
6902                    params->set ? "Set" : "Add", MAC2STR(params->addr));
6903         nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
6904                     NL80211_CMD_NEW_STATION);
6905
6906         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
6907         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
6908         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
6909                 params->supp_rates);
6910         wpa_hexdump(MSG_DEBUG, "  * supported rates", params->supp_rates,
6911                     params->supp_rates_len);
6912         if (!params->set) {
6913                 if (params->aid) {
6914                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
6915                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
6916                 } else {
6917                         /*
6918                          * cfg80211 validates that AID is non-zero, so we have
6919                          * to make this a non-zero value for the TDLS case where
6920                          * a dummy STA entry is used for now.
6921                          */
6922                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
6923                         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, 1);
6924                 }
6925                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
6926                            params->listen_interval);
6927                 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
6928                             params->listen_interval);
6929         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
6930                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
6931                 NLA_PUT_U16(msg, NL80211_ATTR_PEER_AID, params->aid);
6932         }
6933         if (params->ht_capabilities) {
6934                 wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
6935                             (u8 *) params->ht_capabilities,
6936                             sizeof(*params->ht_capabilities));
6937                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
6938                         sizeof(*params->ht_capabilities),
6939                         params->ht_capabilities);
6940         }
6941
6942         if (params->vht_capabilities) {
6943                 wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
6944                             (u8 *) params->vht_capabilities,
6945                             sizeof(*params->vht_capabilities));
6946                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY,
6947                         sizeof(*params->vht_capabilities),
6948                         params->vht_capabilities);
6949         }
6950
6951         wpa_printf(MSG_DEBUG, "  * capability=0x%x", params->capability);
6952         NLA_PUT_U16(msg, NL80211_ATTR_STA_CAPABILITY, params->capability);
6953
6954         if (params->ext_capab) {
6955                 wpa_hexdump(MSG_DEBUG, "  * ext_capab",
6956                             params->ext_capab, params->ext_capab_len);
6957                 NLA_PUT(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
6958                         params->ext_capab_len, params->ext_capab);
6959         }
6960
6961         os_memset(&upd, 0, sizeof(upd));
6962         upd.mask = sta_flags_nl80211(params->flags);
6963         upd.set = upd.mask;
6964         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
6965                    upd.set, upd.mask);
6966         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
6967
6968         if (params->flags & WPA_STA_WMM) {
6969                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
6970
6971                 if (!wme)
6972                         goto nla_put_failure;
6973
6974                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
6975                 NLA_PUT_U8(msg, NL80211_STA_WME_UAPSD_QUEUES,
6976                                 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
6977                 NLA_PUT_U8(msg, NL80211_STA_WME_MAX_SP,
6978                                 (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
6979                                 WMM_QOSINFO_STA_SP_MASK);
6980                 nla_nest_end(msg, wme);
6981         }
6982
6983         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6984         msg = NULL;
6985         if (ret)
6986                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
6987                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
6988                            strerror(-ret));
6989         if (ret == -EEXIST)
6990                 ret = 0;
6991  nla_put_failure:
6992         nlmsg_free(msg);
6993         return ret;
6994 }
6995
6996
6997 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr)
6998 {
6999         struct wpa_driver_nl80211_data *drv = bss->drv;
7000         struct nl_msg *msg;
7001         int ret;
7002
7003         msg = nlmsg_alloc();
7004         if (!msg)
7005                 return -ENOMEM;
7006
7007         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
7008
7009         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7010                     if_nametoindex(bss->ifname));
7011         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7012
7013         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7014         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
7015                    " --> %d (%s)",
7016                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
7017         if (ret == -ENOENT)
7018                 return 0;
7019         return ret;
7020  nla_put_failure:
7021         nlmsg_free(msg);
7022         return -ENOBUFS;
7023 }
7024
7025
7026 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
7027                                  int ifidx)
7028 {
7029         struct nl_msg *msg;
7030
7031         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
7032
7033         /* stop listening for EAPOL on this interface */
7034         del_ifidx(drv, ifidx);
7035
7036         msg = nlmsg_alloc();
7037         if (!msg)
7038                 goto nla_put_failure;
7039
7040         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
7041         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
7042
7043         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
7044                 return;
7045         msg = NULL;
7046  nla_put_failure:
7047         nlmsg_free(msg);
7048         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
7049 }
7050
7051
7052 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
7053 {
7054         switch (mode) {
7055         case NL80211_IFTYPE_ADHOC:
7056                 return "ADHOC";
7057         case NL80211_IFTYPE_STATION:
7058                 return "STATION";
7059         case NL80211_IFTYPE_AP:
7060                 return "AP";
7061         case NL80211_IFTYPE_AP_VLAN:
7062                 return "AP_VLAN";
7063         case NL80211_IFTYPE_WDS:
7064                 return "WDS";
7065         case NL80211_IFTYPE_MONITOR:
7066                 return "MONITOR";
7067         case NL80211_IFTYPE_MESH_POINT:
7068                 return "MESH_POINT";
7069         case NL80211_IFTYPE_P2P_CLIENT:
7070                 return "P2P_CLIENT";
7071         case NL80211_IFTYPE_P2P_GO:
7072                 return "P2P_GO";
7073         case NL80211_IFTYPE_P2P_DEVICE:
7074                 return "P2P_DEVICE";
7075         default:
7076                 return "unknown";
7077         }
7078 }
7079
7080
7081 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
7082                                      const char *ifname,
7083                                      enum nl80211_iftype iftype,
7084                                      const u8 *addr, int wds,
7085                                      int (*handler)(struct nl_msg *, void *),
7086                                      void *arg)
7087 {
7088         struct nl_msg *msg;
7089         int ifidx;
7090         int ret = -ENOBUFS;
7091
7092         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
7093                    iftype, nl80211_iftype_str(iftype));
7094
7095         msg = nlmsg_alloc();
7096         if (!msg)
7097                 return -1;
7098
7099         nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
7100         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
7101                 goto nla_put_failure;
7102         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
7103         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
7104
7105         if (iftype == NL80211_IFTYPE_MONITOR) {
7106                 struct nlattr *flags;
7107
7108                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
7109                 if (!flags)
7110                         goto nla_put_failure;
7111
7112                 NLA_PUT_FLAG(msg, NL80211_MNTR_FLAG_COOK_FRAMES);
7113
7114                 nla_nest_end(msg, flags);
7115         } else if (wds) {
7116                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
7117         }
7118
7119         ret = send_and_recv_msgs(drv, msg, handler, arg);
7120         msg = NULL;
7121         if (ret) {
7122  nla_put_failure:
7123                 nlmsg_free(msg);
7124                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
7125                            ifname, ret, strerror(-ret));
7126                 return ret;
7127         }
7128
7129         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
7130                 return 0;
7131
7132         ifidx = if_nametoindex(ifname);
7133         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
7134                    ifname, ifidx);
7135
7136         if (ifidx <= 0)
7137                 return -1;
7138
7139         /* start listening for EAPOL on this interface */
7140         add_ifidx(drv, ifidx);
7141
7142         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
7143             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
7144                 nl80211_remove_iface(drv, ifidx);
7145                 return -1;
7146         }
7147
7148         return ifidx;
7149 }
7150
7151
7152 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
7153                                 const char *ifname, enum nl80211_iftype iftype,
7154                                 const u8 *addr, int wds,
7155                                 int (*handler)(struct nl_msg *, void *),
7156                                 void *arg, int use_existing)
7157 {
7158         int ret;
7159
7160         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
7161                                         arg);
7162
7163         /* if error occurred and interface exists already */
7164         if (ret == -ENFILE && if_nametoindex(ifname)) {
7165                 if (use_existing) {
7166                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
7167                                    ifname);
7168                         return -ENFILE;
7169                 }
7170                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
7171
7172                 /* Try to remove the interface that was already there. */
7173                 nl80211_remove_iface(drv, if_nametoindex(ifname));
7174
7175                 /* Try to create the interface again */
7176                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
7177                                                 wds, handler, arg);
7178         }
7179
7180         if (ret >= 0 && is_p2p_net_interface(iftype))
7181                 nl80211_disable_11b_rates(drv, ret, 1);
7182
7183         return ret;
7184 }
7185
7186
7187 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
7188 {
7189         struct ieee80211_hdr *hdr;
7190         u16 fc;
7191         union wpa_event_data event;
7192
7193         hdr = (struct ieee80211_hdr *) buf;
7194         fc = le_to_host16(hdr->frame_control);
7195
7196         os_memset(&event, 0, sizeof(event));
7197         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
7198         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
7199         event.tx_status.dst = hdr->addr1;
7200         event.tx_status.data = buf;
7201         event.tx_status.data_len = len;
7202         event.tx_status.ack = ok;
7203         wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
7204 }
7205
7206
7207 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
7208                              u8 *buf, size_t len)
7209 {
7210         struct ieee80211_hdr *hdr = (void *)buf;
7211         u16 fc;
7212         union wpa_event_data event;
7213
7214         if (len < sizeof(*hdr))
7215                 return;
7216
7217         fc = le_to_host16(hdr->frame_control);
7218
7219         os_memset(&event, 0, sizeof(event));
7220         event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
7221         event.rx_from_unknown.addr = hdr->addr2;
7222         event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
7223                 (WLAN_FC_FROMDS | WLAN_FC_TODS);
7224         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
7225 }
7226
7227
7228 static void handle_frame(struct wpa_driver_nl80211_data *drv,
7229                          u8 *buf, size_t len, int datarate, int ssi_signal)
7230 {
7231         struct ieee80211_hdr *hdr;
7232         u16 fc;
7233         union wpa_event_data event;
7234
7235         hdr = (struct ieee80211_hdr *) buf;
7236         fc = le_to_host16(hdr->frame_control);
7237
7238         switch (WLAN_FC_GET_TYPE(fc)) {
7239         case WLAN_FC_TYPE_MGMT:
7240                 os_memset(&event, 0, sizeof(event));
7241                 event.rx_mgmt.frame = buf;
7242                 event.rx_mgmt.frame_len = len;
7243                 event.rx_mgmt.datarate = datarate;
7244                 event.rx_mgmt.ssi_signal = ssi_signal;
7245                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
7246                 break;
7247         case WLAN_FC_TYPE_CTRL:
7248                 /* can only get here with PS-Poll frames */
7249                 wpa_printf(MSG_DEBUG, "CTRL");
7250                 from_unknown_sta(drv, buf, len);
7251                 break;
7252         case WLAN_FC_TYPE_DATA:
7253                 from_unknown_sta(drv, buf, len);
7254                 break;
7255         }
7256 }
7257
7258
7259 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
7260 {
7261         struct wpa_driver_nl80211_data *drv = eloop_ctx;
7262         int len;
7263         unsigned char buf[3000];
7264         struct ieee80211_radiotap_iterator iter;
7265         int ret;
7266         int datarate = 0, ssi_signal = 0;
7267         int injected = 0, failed = 0, rxflags = 0;
7268
7269         len = recv(sock, buf, sizeof(buf), 0);
7270         if (len < 0) {
7271                 wpa_printf(MSG_ERROR, "nl80211: Monitor socket recv failed: %s",
7272                            strerror(errno));
7273                 return;
7274         }
7275
7276         if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
7277                 wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame");
7278                 return;
7279         }
7280
7281         while (1) {
7282                 ret = ieee80211_radiotap_iterator_next(&iter);
7283                 if (ret == -ENOENT)
7284                         break;
7285                 if (ret) {
7286                         wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame (%d)",
7287                                    ret);
7288                         return;
7289                 }
7290                 switch (iter.this_arg_index) {
7291                 case IEEE80211_RADIOTAP_FLAGS:
7292                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
7293                                 len -= 4;
7294                         break;
7295                 case IEEE80211_RADIOTAP_RX_FLAGS:
7296                         rxflags = 1;
7297                         break;
7298                 case IEEE80211_RADIOTAP_TX_FLAGS:
7299                         injected = 1;
7300                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
7301                                         IEEE80211_RADIOTAP_F_TX_FAIL;
7302                         break;
7303                 case IEEE80211_RADIOTAP_DATA_RETRIES:
7304                         break;
7305                 case IEEE80211_RADIOTAP_CHANNEL:
7306                         /* TODO: convert from freq/flags to channel number */
7307                         break;
7308                 case IEEE80211_RADIOTAP_RATE:
7309                         datarate = *iter.this_arg * 5;
7310                         break;
7311                 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
7312                         ssi_signal = (s8) *iter.this_arg;
7313                         break;
7314                 }
7315         }
7316
7317         if (rxflags && injected)
7318                 return;
7319
7320         if (!injected)
7321                 handle_frame(drv, buf + iter.max_length,
7322                              len - iter.max_length, datarate, ssi_signal);
7323         else
7324                 handle_tx_callback(drv->ctx, buf + iter.max_length,
7325                                    len - iter.max_length, !failed);
7326 }
7327
7328
7329 /*
7330  * we post-process the filter code later and rewrite
7331  * this to the offset to the last instruction
7332  */
7333 #define PASS    0xFF
7334 #define FAIL    0xFE
7335
7336 static struct sock_filter msock_filter_insns[] = {
7337         /*
7338          * do a little-endian load of the radiotap length field
7339          */
7340         /* load lower byte into A */
7341         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
7342         /* put it into X (== index register) */
7343         BPF_STMT(BPF_MISC| BPF_TAX, 0),
7344         /* load upper byte into A */
7345         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
7346         /* left-shift it by 8 */
7347         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
7348         /* or with X */
7349         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
7350         /* put result into X */
7351         BPF_STMT(BPF_MISC| BPF_TAX, 0),
7352
7353         /*
7354          * Allow management frames through, this also gives us those
7355          * management frames that we sent ourselves with status
7356          */
7357         /* load the lower byte of the IEEE 802.11 frame control field */
7358         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
7359         /* mask off frame type and version */
7360         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
7361         /* accept frame if it's both 0, fall through otherwise */
7362         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
7363
7364         /*
7365          * TODO: add a bit to radiotap RX flags that indicates
7366          * that the sending station is not associated, then
7367          * add a filter here that filters on our DA and that flag
7368          * to allow us to deauth frames to that bad station.
7369          *
7370          * For now allow all To DS data frames through.
7371          */
7372         /* load the IEEE 802.11 frame control field */
7373         BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
7374         /* mask off frame type, version and DS status */
7375         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
7376         /* accept frame if version 0, type 2 and To DS, fall through otherwise
7377          */
7378         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
7379
7380 #if 0
7381         /*
7382          * drop non-data frames
7383          */
7384         /* load the lower byte of the frame control field */
7385         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
7386         /* mask off QoS bit */
7387         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
7388         /* drop non-data frames */
7389         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
7390 #endif
7391         /* load the upper byte of the frame control field */
7392         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
7393         /* mask off toDS/fromDS */
7394         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
7395         /* accept WDS frames */
7396         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
7397
7398         /*
7399          * add header length to index
7400          */
7401         /* load the lower byte of the frame control field */
7402         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
7403         /* mask off QoS bit */
7404         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
7405         /* right shift it by 6 to give 0 or 2 */
7406         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
7407         /* add data frame header length */
7408         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
7409         /* add index, was start of 802.11 header */
7410         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
7411         /* move to index, now start of LL header */
7412         BPF_STMT(BPF_MISC | BPF_TAX, 0),
7413
7414         /*
7415          * Accept empty data frames, we use those for
7416          * polling activity.
7417          */
7418         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
7419         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
7420
7421         /*
7422          * Accept EAPOL frames
7423          */
7424         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
7425         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
7426         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
7427         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
7428
7429         /* keep these last two statements or change the code below */
7430         /* return 0 == "DROP" */
7431         BPF_STMT(BPF_RET | BPF_K, 0),
7432         /* return ~0 == "keep all" */
7433         BPF_STMT(BPF_RET | BPF_K, ~0),
7434 };
7435
7436 static struct sock_fprog msock_filter = {
7437         .len = ARRAY_SIZE(msock_filter_insns),
7438         .filter = msock_filter_insns,
7439 };
7440
7441
7442 static int add_monitor_filter(int s)
7443 {
7444         int idx;
7445
7446         /* rewrite all PASS/FAIL jump offsets */
7447         for (idx = 0; idx < msock_filter.len; idx++) {
7448                 struct sock_filter *insn = &msock_filter_insns[idx];
7449
7450                 if (BPF_CLASS(insn->code) == BPF_JMP) {
7451                         if (insn->code == (BPF_JMP|BPF_JA)) {
7452                                 if (insn->k == PASS)
7453                                         insn->k = msock_filter.len - idx - 2;
7454                                 else if (insn->k == FAIL)
7455                                         insn->k = msock_filter.len - idx - 3;
7456                         }
7457
7458                         if (insn->jt == PASS)
7459                                 insn->jt = msock_filter.len - idx - 2;
7460                         else if (insn->jt == FAIL)
7461                                 insn->jt = msock_filter.len - idx - 3;
7462
7463                         if (insn->jf == PASS)
7464                                 insn->jf = msock_filter.len - idx - 2;
7465                         else if (insn->jf == FAIL)
7466                                 insn->jf = msock_filter.len - idx - 3;
7467                 }
7468         }
7469
7470         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
7471                        &msock_filter, sizeof(msock_filter))) {
7472                 wpa_printf(MSG_ERROR, "nl80211: setsockopt(SO_ATTACH_FILTER) failed: %s",
7473                            strerror(errno));
7474                 return -1;
7475         }
7476
7477         return 0;
7478 }
7479
7480
7481 static void nl80211_remove_monitor_interface(
7482         struct wpa_driver_nl80211_data *drv)
7483 {
7484         if (drv->monitor_refcount > 0)
7485                 drv->monitor_refcount--;
7486         wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface: refcount=%d",
7487                    drv->monitor_refcount);
7488         if (drv->monitor_refcount > 0)
7489                 return;
7490
7491         if (drv->monitor_ifidx >= 0) {
7492                 nl80211_remove_iface(drv, drv->monitor_ifidx);
7493                 drv->monitor_ifidx = -1;
7494         }
7495         if (drv->monitor_sock >= 0) {
7496                 eloop_unregister_read_sock(drv->monitor_sock);
7497                 close(drv->monitor_sock);
7498                 drv->monitor_sock = -1;
7499         }
7500 }
7501
7502
7503 static int
7504 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
7505 {
7506         char buf[IFNAMSIZ];
7507         struct sockaddr_ll ll;
7508         int optval;
7509         socklen_t optlen;
7510
7511         if (drv->monitor_ifidx >= 0) {
7512                 drv->monitor_refcount++;
7513                 wpa_printf(MSG_DEBUG, "nl80211: Re-use existing monitor interface: refcount=%d",
7514                            drv->monitor_refcount);
7515                 return 0;
7516         }
7517
7518         if (os_strncmp(drv->first_bss->ifname, "p2p-", 4) == 0) {
7519                 /*
7520                  * P2P interface name is of the format p2p-%s-%d. For monitor
7521                  * interface name corresponding to P2P GO, replace "p2p-" with
7522                  * "mon-" to retain the same interface name length and to
7523                  * indicate that it is a monitor interface.
7524                  */
7525                 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss->ifname + 4);
7526         } else {
7527                 /* Non-P2P interface with AP functionality. */
7528                 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss->ifname);
7529         }
7530
7531         buf[IFNAMSIZ - 1] = '\0';
7532
7533         drv->monitor_ifidx =
7534                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
7535                                      0, NULL, NULL, 0);
7536
7537         if (drv->monitor_ifidx == -EOPNOTSUPP) {
7538                 /*
7539                  * This is backward compatibility for a few versions of
7540                  * the kernel only that didn't advertise the right
7541                  * attributes for the only driver that then supported
7542                  * AP mode w/o monitor -- ath6kl.
7543                  */
7544                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
7545                            "monitor interface type - try to run without it");
7546                 drv->device_ap_sme = 1;
7547         }
7548
7549         if (drv->monitor_ifidx < 0)
7550                 return -1;
7551
7552         if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
7553                 goto error;
7554
7555         memset(&ll, 0, sizeof(ll));
7556         ll.sll_family = AF_PACKET;
7557         ll.sll_ifindex = drv->monitor_ifidx;
7558         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
7559         if (drv->monitor_sock < 0) {
7560                 wpa_printf(MSG_ERROR, "nl80211: socket[PF_PACKET,SOCK_RAW] failed: %s",
7561                            strerror(errno));
7562                 goto error;
7563         }
7564
7565         if (add_monitor_filter(drv->monitor_sock)) {
7566                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
7567                            "interface; do filtering in user space");
7568                 /* This works, but will cost in performance. */
7569         }
7570
7571         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
7572                 wpa_printf(MSG_ERROR, "nl80211: monitor socket bind failed: %s",
7573                            strerror(errno));
7574                 goto error;
7575         }
7576
7577         optlen = sizeof(optval);
7578         optval = 20;
7579         if (setsockopt
7580             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
7581                 wpa_printf(MSG_ERROR, "nl80211: Failed to set socket priority: %s",
7582                            strerror(errno));
7583                 goto error;
7584         }
7585
7586         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
7587                                      drv, NULL)) {
7588                 wpa_printf(MSG_INFO, "nl80211: Could not register monitor read socket");
7589                 goto error;
7590         }
7591
7592         drv->monitor_refcount++;
7593         return 0;
7594  error:
7595         nl80211_remove_monitor_interface(drv);
7596         return -1;
7597 }
7598
7599
7600 static int nl80211_setup_ap(struct i802_bss *bss)
7601 {
7602         struct wpa_driver_nl80211_data *drv = bss->drv;
7603
7604         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
7605                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
7606
7607         /*
7608          * Disable Probe Request reporting unless we need it in this way for
7609          * devices that include the AP SME, in the other case (unless using
7610          * monitor iface) we'll get it through the nl_mgmt socket instead.
7611          */
7612         if (!drv->device_ap_sme)
7613                 wpa_driver_nl80211_probe_req_report(bss, 0);
7614
7615         if (!drv->device_ap_sme && !drv->use_monitor)
7616                 if (nl80211_mgmt_subscribe_ap(bss))
7617                         return -1;
7618
7619         if (drv->device_ap_sme && !drv->use_monitor)
7620                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
7621                         return -1;
7622
7623         if (!drv->device_ap_sme && drv->use_monitor &&
7624             nl80211_create_monitor_interface(drv) &&
7625             !drv->device_ap_sme)
7626                 return -1;
7627
7628         if (drv->device_ap_sme &&
7629             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
7630                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
7631                            "Probe Request frame reporting in AP mode");
7632                 /* Try to survive without this */
7633         }
7634
7635         return 0;
7636 }
7637
7638
7639 static void nl80211_teardown_ap(struct i802_bss *bss)
7640 {
7641         struct wpa_driver_nl80211_data *drv = bss->drv;
7642
7643         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
7644                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
7645         if (drv->device_ap_sme) {
7646                 wpa_driver_nl80211_probe_req_report(bss, 0);
7647                 if (!drv->use_monitor)
7648                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
7649         } else if (drv->use_monitor)
7650                 nl80211_remove_monitor_interface(drv);
7651         else
7652                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
7653
7654         bss->beacon_set = 0;
7655 }
7656
7657
7658 static int nl80211_send_eapol_data(struct i802_bss *bss,
7659                                    const u8 *addr, const u8 *data,
7660                                    size_t data_len)
7661 {
7662         struct sockaddr_ll ll;
7663         int ret;
7664
7665         if (bss->drv->eapol_tx_sock < 0) {
7666                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
7667                 return -1;
7668         }
7669
7670         os_memset(&ll, 0, sizeof(ll));
7671         ll.sll_family = AF_PACKET;
7672         ll.sll_ifindex = bss->ifindex;
7673         ll.sll_protocol = htons(ETH_P_PAE);
7674         ll.sll_halen = ETH_ALEN;
7675         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
7676         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
7677                      (struct sockaddr *) &ll, sizeof(ll));
7678         if (ret < 0)
7679                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
7680                            strerror(errno));
7681
7682         return ret;
7683 }
7684
7685
7686 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
7687
7688 static int wpa_driver_nl80211_hapd_send_eapol(
7689         void *priv, const u8 *addr, const u8 *data,
7690         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
7691 {
7692         struct i802_bss *bss = priv;
7693         struct wpa_driver_nl80211_data *drv = bss->drv;
7694         struct ieee80211_hdr *hdr;
7695         size_t len;
7696         u8 *pos;
7697         int res;
7698         int qos = flags & WPA_STA_WMM;
7699
7700         if (drv->device_ap_sme || !drv->use_monitor)
7701                 return nl80211_send_eapol_data(bss, addr, data, data_len);
7702
7703         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
7704                 data_len;
7705         hdr = os_zalloc(len);
7706         if (hdr == NULL) {
7707                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
7708                            (unsigned long) len);
7709                 return -1;
7710         }
7711
7712         hdr->frame_control =
7713                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
7714         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
7715         if (encrypt)
7716                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
7717         if (qos) {
7718                 hdr->frame_control |=
7719                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
7720         }
7721
7722         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
7723         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
7724         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
7725         pos = (u8 *) (hdr + 1);
7726
7727         if (qos) {
7728                 /* Set highest priority in QoS header */
7729                 pos[0] = 7;
7730                 pos[1] = 0;
7731                 pos += 2;
7732         }
7733
7734         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
7735         pos += sizeof(rfc1042_header);
7736         WPA_PUT_BE16(pos, ETH_P_PAE);
7737         pos += 2;
7738         memcpy(pos, data, data_len);
7739
7740         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
7741                                             0, 0, 0, 0);
7742         if (res < 0) {
7743                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
7744                            "failed: %d (%s)",
7745                            (unsigned long) len, errno, strerror(errno));
7746         }
7747         os_free(hdr);
7748
7749         return res;
7750 }
7751
7752
7753 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
7754                                             int total_flags,
7755                                             int flags_or, int flags_and)
7756 {
7757         struct i802_bss *bss = priv;
7758         struct wpa_driver_nl80211_data *drv = bss->drv;
7759         struct nl_msg *msg;
7760         struct nlattr *flags;
7761         struct nl80211_sta_flag_update upd;
7762
7763         msg = nlmsg_alloc();
7764         if (!msg)
7765                 return -ENOMEM;
7766
7767         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
7768
7769         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7770                     if_nametoindex(bss->ifname));
7771         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7772
7773         /*
7774          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
7775          * can be removed eventually.
7776          */
7777         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
7778         if (!flags)
7779                 goto nla_put_failure;
7780         if (total_flags & WPA_STA_AUTHORIZED)
7781                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_AUTHORIZED);
7782
7783         if (total_flags & WPA_STA_WMM)
7784                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_WME);
7785
7786         if (total_flags & WPA_STA_SHORT_PREAMBLE)
7787                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_SHORT_PREAMBLE);
7788
7789         if (total_flags & WPA_STA_MFP)
7790                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_MFP);
7791
7792         if (total_flags & WPA_STA_TDLS_PEER)
7793                 NLA_PUT_FLAG(msg, NL80211_STA_FLAG_TDLS_PEER);
7794
7795         nla_nest_end(msg, flags);
7796
7797         os_memset(&upd, 0, sizeof(upd));
7798         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
7799         upd.set = sta_flags_nl80211(flags_or);
7800         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
7801
7802         return send_and_recv_msgs(drv, msg, NULL, NULL);
7803  nla_put_failure:
7804         nlmsg_free(msg);
7805         return -ENOBUFS;
7806 }
7807
7808
7809 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
7810                                  struct wpa_driver_associate_params *params)
7811 {
7812         enum nl80211_iftype nlmode, old_mode;
7813         struct hostapd_freq_params freq = {
7814                 .freq = params->freq,
7815         };
7816
7817         if (params->p2p) {
7818                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
7819                            "group (GO)");
7820                 nlmode = NL80211_IFTYPE_P2P_GO;
7821         } else
7822                 nlmode = NL80211_IFTYPE_AP;
7823
7824         old_mode = drv->nlmode;
7825         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
7826                 nl80211_remove_monitor_interface(drv);
7827                 return -1;
7828         }
7829
7830         if (wpa_driver_nl80211_set_freq(drv->first_bss, &freq)) {
7831                 if (old_mode != nlmode)
7832                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
7833                 nl80211_remove_monitor_interface(drv);
7834                 return -1;
7835         }
7836
7837         return 0;
7838 }
7839
7840
7841 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
7842 {
7843         struct nl_msg *msg;
7844         int ret = -1;
7845
7846         msg = nlmsg_alloc();
7847         if (!msg)
7848                 return -1;
7849
7850         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
7851         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7852         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7853         msg = NULL;
7854         if (ret) {
7855                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
7856                            "(%s)", ret, strerror(-ret));
7857                 goto nla_put_failure;
7858         }
7859
7860         ret = 0;
7861         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
7862
7863 nla_put_failure:
7864         if (wpa_driver_nl80211_set_mode(drv->first_bss,
7865                                         NL80211_IFTYPE_STATION)) {
7866                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
7867                            "station mode");
7868         }
7869
7870         nlmsg_free(msg);
7871         return ret;
7872 }
7873
7874
7875 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
7876                                    struct wpa_driver_associate_params *params)
7877 {
7878         struct nl_msg *msg;
7879         int ret = -1;
7880         int count = 0;
7881
7882         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
7883
7884         if (wpa_driver_nl80211_set_mode(drv->first_bss,
7885                                         NL80211_IFTYPE_ADHOC)) {
7886                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
7887                            "IBSS mode");
7888                 return -1;
7889         }
7890
7891 retry:
7892         msg = nlmsg_alloc();
7893         if (!msg)
7894                 return -1;
7895
7896         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
7897         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7898
7899         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
7900                 goto nla_put_failure;
7901
7902         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
7903                           params->ssid, params->ssid_len);
7904         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
7905                 params->ssid);
7906         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
7907         drv->ssid_len = params->ssid_len;
7908
7909         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
7910         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
7911
7912         ret = nl80211_set_conn_keys(params, msg);
7913         if (ret)
7914                 goto nla_put_failure;
7915
7916         if (params->bssid && params->fixed_bssid) {
7917                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
7918                            MAC2STR(params->bssid));
7919                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
7920         }
7921
7922         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
7923             params->key_mgmt_suite == KEY_MGMT_PSK ||
7924             params->key_mgmt_suite == KEY_MGMT_802_1X_SHA256 ||
7925             params->key_mgmt_suite == KEY_MGMT_PSK_SHA256) {
7926                 wpa_printf(MSG_DEBUG, "  * control port");
7927                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
7928         }
7929
7930         if (params->wpa_ie) {
7931                 wpa_hexdump(MSG_DEBUG,
7932                             "  * Extra IEs for Beacon/Probe Response frames",
7933                             params->wpa_ie, params->wpa_ie_len);
7934                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
7935                         params->wpa_ie);
7936         }
7937
7938         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7939         msg = NULL;
7940         if (ret) {
7941                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
7942                            ret, strerror(-ret));
7943                 count++;
7944                 if (ret == -EALREADY && count == 1) {
7945                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
7946                                    "forced leave");
7947                         nl80211_leave_ibss(drv);
7948                         nlmsg_free(msg);
7949                         goto retry;
7950                 }
7951
7952                 goto nla_put_failure;
7953         }
7954         ret = 0;
7955         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
7956
7957 nla_put_failure:
7958         nlmsg_free(msg);
7959         return ret;
7960 }
7961
7962
7963 static int wpa_driver_nl80211_try_connect(
7964         struct wpa_driver_nl80211_data *drv,
7965         struct wpa_driver_associate_params *params)
7966 {
7967         struct nl_msg *msg;
7968         enum nl80211_auth_type type;
7969         int ret = 0;
7970         int algs;
7971
7972         msg = nlmsg_alloc();
7973         if (!msg)
7974                 return -1;
7975
7976         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
7977         nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
7978
7979         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7980         if (params->bssid) {
7981                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
7982                            MAC2STR(params->bssid));
7983                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
7984         }
7985         if (params->freq) {
7986                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
7987                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
7988                 drv->assoc_freq = params->freq;
7989         } else
7990                 drv->assoc_freq = 0;
7991         if (params->bg_scan_period >= 0) {
7992                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
7993                            params->bg_scan_period);
7994                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
7995                             params->bg_scan_period);
7996         }
7997         if (params->ssid) {
7998                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
7999                                   params->ssid, params->ssid_len);
8000                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
8001                         params->ssid);
8002                 if (params->ssid_len > sizeof(drv->ssid))
8003                         goto nla_put_failure;
8004                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
8005                 drv->ssid_len = params->ssid_len;
8006         }
8007         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
8008         if (params->wpa_ie)
8009                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
8010                         params->wpa_ie);
8011
8012         algs = 0;
8013         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
8014                 algs++;
8015         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
8016                 algs++;
8017         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
8018                 algs++;
8019         if (algs > 1) {
8020                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
8021                            "selection");
8022                 goto skip_auth_type;
8023         }
8024
8025         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
8026                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
8027         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
8028                 type = NL80211_AUTHTYPE_SHARED_KEY;
8029         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
8030                 type = NL80211_AUTHTYPE_NETWORK_EAP;
8031         else if (params->auth_alg & WPA_AUTH_ALG_FT)
8032                 type = NL80211_AUTHTYPE_FT;
8033         else
8034                 goto nla_put_failure;
8035
8036         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
8037         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
8038
8039 skip_auth_type:
8040         if (params->wpa_proto) {
8041                 enum nl80211_wpa_versions ver = 0;
8042
8043                 if (params->wpa_proto & WPA_PROTO_WPA)
8044                         ver |= NL80211_WPA_VERSION_1;
8045                 if (params->wpa_proto & WPA_PROTO_RSN)
8046                         ver |= NL80211_WPA_VERSION_2;
8047
8048                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
8049                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
8050         }
8051
8052         if (params->pairwise_suite != CIPHER_NONE) {
8053                 int cipher;
8054
8055                 switch (params->pairwise_suite) {
8056                 case CIPHER_SMS4:
8057                         cipher = WLAN_CIPHER_SUITE_SMS4;
8058                         break;
8059                 case CIPHER_WEP40:
8060                         cipher = WLAN_CIPHER_SUITE_WEP40;
8061                         break;
8062                 case CIPHER_WEP104:
8063                         cipher = WLAN_CIPHER_SUITE_WEP104;
8064                         break;
8065                 case CIPHER_CCMP:
8066                         cipher = WLAN_CIPHER_SUITE_CCMP;
8067                         break;
8068                 case CIPHER_GCMP:
8069                         cipher = WLAN_CIPHER_SUITE_GCMP;
8070                         break;
8071                 case CIPHER_TKIP:
8072                 default:
8073                         cipher = WLAN_CIPHER_SUITE_TKIP;
8074                         break;
8075                 }
8076                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
8077         }
8078
8079         if (params->group_suite != CIPHER_NONE) {
8080                 int cipher;
8081
8082                 switch (params->group_suite) {
8083                 case CIPHER_SMS4:
8084                         cipher = WLAN_CIPHER_SUITE_SMS4;
8085                         break;
8086                 case CIPHER_WEP40:
8087                         cipher = WLAN_CIPHER_SUITE_WEP40;
8088                         break;
8089                 case CIPHER_WEP104:
8090                         cipher = WLAN_CIPHER_SUITE_WEP104;
8091                         break;
8092                 case CIPHER_CCMP:
8093                         cipher = WLAN_CIPHER_SUITE_CCMP;
8094                         break;
8095                 case CIPHER_GCMP:
8096                         cipher = WLAN_CIPHER_SUITE_GCMP;
8097                         break;
8098                 case CIPHER_TKIP:
8099                 default:
8100                         cipher = WLAN_CIPHER_SUITE_TKIP;
8101                         break;
8102                 }
8103                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
8104         }
8105
8106         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
8107             params->key_mgmt_suite == KEY_MGMT_PSK ||
8108             params->key_mgmt_suite == KEY_MGMT_FT_802_1X ||
8109             params->key_mgmt_suite == KEY_MGMT_FT_PSK ||
8110             params->key_mgmt_suite == KEY_MGMT_CCKM) {
8111                 int mgmt = WLAN_AKM_SUITE_PSK;
8112
8113                 switch (params->key_mgmt_suite) {
8114                 case KEY_MGMT_CCKM:
8115                         mgmt = WLAN_AKM_SUITE_CCKM;
8116                         break;
8117                 case KEY_MGMT_802_1X:
8118                         mgmt = WLAN_AKM_SUITE_8021X;
8119                         break;
8120                 case KEY_MGMT_FT_802_1X:
8121                         mgmt = WLAN_AKM_SUITE_FT_8021X;
8122                         break;
8123                 case KEY_MGMT_FT_PSK:
8124                         mgmt = WLAN_AKM_SUITE_FT_PSK;
8125                         break;
8126                 case KEY_MGMT_PSK:
8127                 default:
8128                         mgmt = WLAN_AKM_SUITE_PSK;
8129                         break;
8130                 }
8131                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
8132         }
8133
8134 #ifdef CONFIG_IEEE80211W
8135         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
8136                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
8137 #endif /* CONFIG_IEEE80211W */
8138
8139         if (params->disable_ht)
8140                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
8141
8142         if (params->htcaps && params->htcaps_mask) {
8143                 int sz = sizeof(struct ieee80211_ht_capabilities);
8144                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
8145                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
8146                         params->htcaps_mask);
8147         }
8148
8149 #ifdef CONFIG_VHT_OVERRIDES
8150         if (params->disable_vht) {
8151                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
8152                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
8153         }
8154
8155         if (params->vhtcaps && params->vhtcaps_mask) {
8156                 int sz = sizeof(struct ieee80211_vht_capabilities);
8157                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
8158                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
8159                         params->vhtcaps_mask);
8160         }
8161 #endif /* CONFIG_VHT_OVERRIDES */
8162
8163         ret = nl80211_set_conn_keys(params, msg);
8164         if (ret)
8165                 goto nla_put_failure;
8166
8167         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8168         msg = NULL;
8169         if (ret) {
8170                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
8171                            "(%s)", ret, strerror(-ret));
8172                 goto nla_put_failure;
8173         }
8174         ret = 0;
8175         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
8176
8177 nla_put_failure:
8178         nlmsg_free(msg);
8179         return ret;
8180
8181 }
8182
8183
8184 static int wpa_driver_nl80211_connect(
8185         struct wpa_driver_nl80211_data *drv,
8186         struct wpa_driver_associate_params *params)
8187 {
8188         int ret = wpa_driver_nl80211_try_connect(drv, params);
8189         if (ret == -EALREADY) {
8190                 /*
8191                  * cfg80211 does not currently accept new connections if
8192                  * we are already connected. As a workaround, force
8193                  * disconnection and try again.
8194                  */
8195                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
8196                            "disconnecting before reassociation "
8197                            "attempt");
8198                 if (wpa_driver_nl80211_disconnect(
8199                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
8200                         return -1;
8201                 ret = wpa_driver_nl80211_try_connect(drv, params);
8202         }
8203         return ret;
8204 }
8205
8206
8207 static int wpa_driver_nl80211_associate(
8208         void *priv, struct wpa_driver_associate_params *params)
8209 {
8210         struct i802_bss *bss = priv;
8211         struct wpa_driver_nl80211_data *drv = bss->drv;
8212         int ret = -1;
8213         struct nl_msg *msg;
8214
8215         if (params->mode == IEEE80211_MODE_AP)
8216                 return wpa_driver_nl80211_ap(drv, params);
8217
8218         if (params->mode == IEEE80211_MODE_IBSS)
8219                 return wpa_driver_nl80211_ibss(drv, params);
8220
8221         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
8222                 enum nl80211_iftype nlmode = params->p2p ?
8223                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
8224
8225                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
8226                         return -1;
8227                 return wpa_driver_nl80211_connect(drv, params);
8228         }
8229
8230         nl80211_mark_disconnected(drv);
8231
8232         msg = nlmsg_alloc();
8233         if (!msg)
8234                 return -1;
8235
8236         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
8237                    drv->ifindex);
8238         nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
8239
8240         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8241         if (params->bssid) {
8242                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
8243                            MAC2STR(params->bssid));
8244                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
8245         }
8246         if (params->freq) {
8247                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8248                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
8249                 drv->assoc_freq = params->freq;
8250         } else
8251                 drv->assoc_freq = 0;
8252         if (params->bg_scan_period >= 0) {
8253                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
8254                            params->bg_scan_period);
8255                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
8256                             params->bg_scan_period);
8257         }
8258         if (params->ssid) {
8259                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8260                                   params->ssid, params->ssid_len);
8261                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
8262                         params->ssid);
8263                 if (params->ssid_len > sizeof(drv->ssid))
8264                         goto nla_put_failure;
8265                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
8266                 drv->ssid_len = params->ssid_len;
8267         }
8268         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
8269         if (params->wpa_ie)
8270                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
8271                         params->wpa_ie);
8272
8273         if (params->pairwise_suite != CIPHER_NONE) {
8274                 int cipher;
8275
8276                 switch (params->pairwise_suite) {
8277                 case CIPHER_WEP40:
8278                         cipher = WLAN_CIPHER_SUITE_WEP40;
8279                         break;
8280                 case CIPHER_WEP104:
8281                         cipher = WLAN_CIPHER_SUITE_WEP104;
8282                         break;
8283                 case CIPHER_CCMP:
8284                         cipher = WLAN_CIPHER_SUITE_CCMP;
8285                         break;
8286                 case CIPHER_GCMP:
8287                         cipher = WLAN_CIPHER_SUITE_GCMP;
8288                         break;
8289                 case CIPHER_TKIP:
8290                 default:
8291                         cipher = WLAN_CIPHER_SUITE_TKIP;
8292                         break;
8293                 }
8294                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
8295                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
8296         }
8297
8298         if (params->group_suite != CIPHER_NONE) {
8299                 int cipher;
8300
8301                 switch (params->group_suite) {
8302                 case CIPHER_WEP40:
8303                         cipher = WLAN_CIPHER_SUITE_WEP40;
8304                         break;
8305                 case CIPHER_WEP104:
8306                         cipher = WLAN_CIPHER_SUITE_WEP104;
8307                         break;
8308                 case CIPHER_CCMP:
8309                         cipher = WLAN_CIPHER_SUITE_CCMP;
8310                         break;
8311                 case CIPHER_GCMP:
8312                         cipher = WLAN_CIPHER_SUITE_GCMP;
8313                         break;
8314                 case CIPHER_TKIP:
8315                 default:
8316                         cipher = WLAN_CIPHER_SUITE_TKIP;
8317                         break;
8318                 }
8319                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
8320                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
8321         }
8322
8323 #ifdef CONFIG_IEEE80211W
8324         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
8325                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
8326 #endif /* CONFIG_IEEE80211W */
8327
8328         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
8329
8330         if (params->prev_bssid) {
8331                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
8332                            MAC2STR(params->prev_bssid));
8333                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
8334                         params->prev_bssid);
8335         }
8336
8337         if (params->disable_ht)
8338                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
8339
8340         if (params->htcaps && params->htcaps_mask) {
8341                 int sz = sizeof(struct ieee80211_ht_capabilities);
8342                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
8343                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
8344                         params->htcaps_mask);
8345         }
8346
8347 #ifdef CONFIG_VHT_OVERRIDES
8348         if (params->disable_vht) {
8349                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
8350                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
8351         }
8352
8353         if (params->vhtcaps && params->vhtcaps_mask) {
8354                 int sz = sizeof(struct ieee80211_vht_capabilities);
8355                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
8356                 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
8357                         params->vhtcaps_mask);
8358         }
8359 #endif /* CONFIG_VHT_OVERRIDES */
8360
8361         if (params->p2p)
8362                 wpa_printf(MSG_DEBUG, "  * P2P group");
8363
8364         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8365         msg = NULL;
8366         if (ret) {
8367                 wpa_dbg(drv->ctx, MSG_DEBUG,
8368                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
8369                         ret, strerror(-ret));
8370                 nl80211_dump_scan(drv);
8371                 goto nla_put_failure;
8372         }
8373         ret = 0;
8374         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
8375                    "successfully");
8376
8377 nla_put_failure:
8378         nlmsg_free(msg);
8379         return ret;
8380 }
8381
8382
8383 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
8384                             int ifindex, enum nl80211_iftype mode)
8385 {
8386         struct nl_msg *msg;
8387         int ret = -ENOBUFS;
8388
8389         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
8390                    ifindex, mode, nl80211_iftype_str(mode));
8391
8392         msg = nlmsg_alloc();
8393         if (!msg)
8394                 return -ENOMEM;
8395
8396         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
8397         if (nl80211_set_iface_id(msg, drv->first_bss) < 0)
8398                 goto nla_put_failure;
8399         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
8400
8401         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8402         msg = NULL;
8403         if (!ret)
8404                 return 0;
8405 nla_put_failure:
8406         nlmsg_free(msg);
8407         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
8408                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
8409         return ret;
8410 }
8411
8412
8413 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
8414                                        enum nl80211_iftype nlmode)
8415 {
8416         struct wpa_driver_nl80211_data *drv = bss->drv;
8417         int ret = -1;
8418         int i;
8419         int was_ap = is_ap_interface(drv->nlmode);
8420         int res;
8421
8422         res = nl80211_set_mode(drv, drv->ifindex, nlmode);
8423         if (res && nlmode == nl80211_get_ifmode(bss))
8424                 res = 0;
8425
8426         if (res == 0) {
8427                 drv->nlmode = nlmode;
8428                 ret = 0;
8429                 goto done;
8430         }
8431
8432         if (res == -ENODEV)
8433                 return -1;
8434
8435         if (nlmode == drv->nlmode) {
8436                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
8437                            "requested mode - ignore error");
8438                 ret = 0;
8439                 goto done; /* Already in the requested mode */
8440         }
8441
8442         /* mac80211 doesn't allow mode changes while the device is up, so
8443          * take the device down, try to set the mode again, and bring the
8444          * device back up.
8445          */
8446         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
8447                    "interface down");
8448         for (i = 0; i < 10; i++) {
8449                 res = i802_set_iface_flags(bss, 0);
8450                 if (res == -EACCES || res == -ENODEV)
8451                         break;
8452                 if (res == 0) {
8453                         /* Try to set the mode again while the interface is
8454                          * down */
8455                         ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
8456                         if (ret == -EACCES)
8457                                 break;
8458                         res = i802_set_iface_flags(bss, 1);
8459                         if (res && !ret)
8460                                 ret = -1;
8461                         else if (ret != -EBUSY)
8462                                 break;
8463                 } else
8464                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
8465                                    "interface down");
8466                 os_sleep(0, 100000);
8467         }
8468
8469         if (!ret) {
8470                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
8471                            "interface is down");
8472                 drv->nlmode = nlmode;
8473                 drv->ignore_if_down_event = 1;
8474         }
8475
8476 done:
8477         if (ret) {
8478                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
8479                            "from %d failed", nlmode, drv->nlmode);
8480                 return ret;
8481         }
8482
8483         if (is_p2p_net_interface(nlmode))
8484                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
8485         else if (drv->disabled_11b_rates)
8486                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
8487
8488         if (is_ap_interface(nlmode)) {
8489                 nl80211_mgmt_unsubscribe(bss, "start AP");
8490                 /* Setup additional AP mode functionality if needed */
8491                 if (nl80211_setup_ap(bss))
8492                         return -1;
8493         } else if (was_ap) {
8494                 /* Remove additional AP mode functionality */
8495                 nl80211_teardown_ap(bss);
8496         } else {
8497                 nl80211_mgmt_unsubscribe(bss, "mode change");
8498         }
8499
8500         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
8501             nl80211_mgmt_subscribe_non_ap(bss) < 0)
8502                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
8503                            "frame processing - ignore for now");
8504
8505         return 0;
8506 }
8507
8508
8509 static int wpa_driver_nl80211_get_capa(void *priv,
8510                                        struct wpa_driver_capa *capa)
8511 {
8512         struct i802_bss *bss = priv;
8513         struct wpa_driver_nl80211_data *drv = bss->drv;
8514         if (!drv->has_capability)
8515                 return -1;
8516         os_memcpy(capa, &drv->capa, sizeof(*capa));
8517         if (drv->extended_capa && drv->extended_capa_mask) {
8518                 capa->extended_capa = drv->extended_capa;
8519                 capa->extended_capa_mask = drv->extended_capa_mask;
8520                 capa->extended_capa_len = drv->extended_capa_len;
8521         }
8522
8523         if ((capa->flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
8524             !drv->allow_p2p_device) {
8525                 wpa_printf(MSG_DEBUG, "nl80211: Do not indicate P2P_DEVICE support (p2p_device=1 driver param not specified)");
8526                 capa->flags &= ~WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE;
8527         }
8528
8529         return 0;
8530 }
8531
8532
8533 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
8534 {
8535         struct i802_bss *bss = priv;
8536         struct wpa_driver_nl80211_data *drv = bss->drv;
8537
8538         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
8539                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
8540         drv->operstate = state;
8541         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
8542                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
8543 }
8544
8545
8546 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
8547 {
8548         struct i802_bss *bss = priv;
8549         struct wpa_driver_nl80211_data *drv = bss->drv;
8550         struct nl_msg *msg;
8551         struct nl80211_sta_flag_update upd;
8552
8553         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
8554                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
8555
8556         msg = nlmsg_alloc();
8557         if (!msg)
8558                 return -ENOMEM;
8559
8560         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
8561
8562         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
8563                     if_nametoindex(bss->ifname));
8564         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
8565
8566         os_memset(&upd, 0, sizeof(upd));
8567         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
8568         if (authorized)
8569                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
8570         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
8571
8572         return send_and_recv_msgs(drv, msg, NULL, NULL);
8573  nla_put_failure:
8574         nlmsg_free(msg);
8575         return -ENOBUFS;
8576 }
8577
8578
8579 /* Set kernel driver on given frequency (MHz) */
8580 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
8581 {
8582         struct i802_bss *bss = priv;
8583         return wpa_driver_nl80211_set_freq(bss, freq);
8584 }
8585
8586
8587 static inline int min_int(int a, int b)
8588 {
8589         if (a < b)
8590                 return a;
8591         return b;
8592 }
8593
8594
8595 static int get_key_handler(struct nl_msg *msg, void *arg)
8596 {
8597         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8598         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8599
8600         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8601                   genlmsg_attrlen(gnlh, 0), NULL);
8602
8603         /*
8604          * TODO: validate the key index and mac address!
8605          * Otherwise, there's a race condition as soon as
8606          * the kernel starts sending key notifications.
8607          */
8608
8609         if (tb[NL80211_ATTR_KEY_SEQ])
8610                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
8611                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
8612         return NL_SKIP;
8613 }
8614
8615
8616 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
8617                            int idx, u8 *seq)
8618 {
8619         struct i802_bss *bss = priv;
8620         struct wpa_driver_nl80211_data *drv = bss->drv;
8621         struct nl_msg *msg;
8622
8623         msg = nlmsg_alloc();
8624         if (!msg)
8625                 return -ENOMEM;
8626
8627         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
8628
8629         if (addr)
8630                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8631         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
8632         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
8633
8634         memset(seq, 0, 6);
8635
8636         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
8637  nla_put_failure:
8638         nlmsg_free(msg);
8639         return -ENOBUFS;
8640 }
8641
8642
8643 static int i802_set_rts(void *priv, int rts)
8644 {
8645         struct i802_bss *bss = priv;
8646         struct wpa_driver_nl80211_data *drv = bss->drv;
8647         struct nl_msg *msg;
8648         int ret = -ENOBUFS;
8649         u32 val;
8650
8651         msg = nlmsg_alloc();
8652         if (!msg)
8653                 return -ENOMEM;
8654
8655         if (rts >= 2347)
8656                 val = (u32) -1;
8657         else
8658                 val = rts;
8659
8660         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
8661         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8662         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
8663
8664         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8665         msg = NULL;
8666         if (!ret)
8667                 return 0;
8668 nla_put_failure:
8669         nlmsg_free(msg);
8670         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
8671                    "%d (%s)", rts, ret, strerror(-ret));
8672         return ret;
8673 }
8674
8675
8676 static int i802_set_frag(void *priv, int frag)
8677 {
8678         struct i802_bss *bss = priv;
8679         struct wpa_driver_nl80211_data *drv = bss->drv;
8680         struct nl_msg *msg;
8681         int ret = -ENOBUFS;
8682         u32 val;
8683
8684         msg = nlmsg_alloc();
8685         if (!msg)
8686                 return -ENOMEM;
8687
8688         if (frag >= 2346)
8689                 val = (u32) -1;
8690         else
8691                 val = frag;
8692
8693         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
8694         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8695         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
8696
8697         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8698         msg = NULL;
8699         if (!ret)
8700                 return 0;
8701 nla_put_failure:
8702         nlmsg_free(msg);
8703         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
8704                    "%d: %d (%s)", frag, ret, strerror(-ret));
8705         return ret;
8706 }
8707
8708
8709 static int i802_flush(void *priv)
8710 {
8711         struct i802_bss *bss = priv;
8712         struct wpa_driver_nl80211_data *drv = bss->drv;
8713         struct nl_msg *msg;
8714         int res;
8715
8716         msg = nlmsg_alloc();
8717         if (!msg)
8718                 return -1;
8719
8720         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
8721                    bss->ifname);
8722         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
8723
8724         /*
8725          * XXX: FIX! this needs to flush all VLANs too
8726          */
8727         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
8728                     if_nametoindex(bss->ifname));
8729
8730         res = send_and_recv_msgs(drv, msg, NULL, NULL);
8731         if (res) {
8732                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
8733                            "(%s)", res, strerror(-res));
8734         }
8735         return res;
8736  nla_put_failure:
8737         nlmsg_free(msg);
8738         return -ENOBUFS;
8739 }
8740
8741
8742 static int get_sta_handler(struct nl_msg *msg, void *arg)
8743 {
8744         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8745         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8746         struct hostap_sta_driver_data *data = arg;
8747         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
8748         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
8749                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
8750                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
8751                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
8752                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
8753                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
8754                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
8755         };
8756
8757         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8758                   genlmsg_attrlen(gnlh, 0), NULL);
8759
8760         /*
8761          * TODO: validate the interface and mac address!
8762          * Otherwise, there's a race condition as soon as
8763          * the kernel starts sending station notifications.
8764          */
8765
8766         if (!tb[NL80211_ATTR_STA_INFO]) {
8767                 wpa_printf(MSG_DEBUG, "sta stats missing!");
8768                 return NL_SKIP;
8769         }
8770         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
8771                              tb[NL80211_ATTR_STA_INFO],
8772                              stats_policy)) {
8773                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
8774                 return NL_SKIP;
8775         }
8776
8777         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
8778                 data->inactive_msec =
8779                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
8780         if (stats[NL80211_STA_INFO_RX_BYTES])
8781                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
8782         if (stats[NL80211_STA_INFO_TX_BYTES])
8783                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
8784         if (stats[NL80211_STA_INFO_RX_PACKETS])
8785                 data->rx_packets =
8786                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
8787         if (stats[NL80211_STA_INFO_TX_PACKETS])
8788                 data->tx_packets =
8789                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
8790         if (stats[NL80211_STA_INFO_TX_FAILED])
8791                 data->tx_retry_failed =
8792                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
8793
8794         return NL_SKIP;
8795 }
8796
8797 static int i802_read_sta_data(struct i802_bss *bss,
8798                               struct hostap_sta_driver_data *data,
8799                               const u8 *addr)
8800 {
8801         struct wpa_driver_nl80211_data *drv = bss->drv;
8802         struct nl_msg *msg;
8803
8804         os_memset(data, 0, sizeof(*data));
8805         msg = nlmsg_alloc();
8806         if (!msg)
8807                 return -ENOMEM;
8808
8809         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
8810
8811         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8812         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
8813
8814         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
8815  nla_put_failure:
8816         nlmsg_free(msg);
8817         return -ENOBUFS;
8818 }
8819
8820
8821 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
8822                                     int cw_min, int cw_max, int burst_time)
8823 {
8824         struct i802_bss *bss = priv;
8825         struct wpa_driver_nl80211_data *drv = bss->drv;
8826         struct nl_msg *msg;
8827         struct nlattr *txq, *params;
8828
8829         msg = nlmsg_alloc();
8830         if (!msg)
8831                 return -1;
8832
8833         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
8834
8835         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
8836
8837         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
8838         if (!txq)
8839                 goto nla_put_failure;
8840
8841         /* We are only sending parameters for a single TXQ at a time */
8842         params = nla_nest_start(msg, 1);
8843         if (!params)
8844                 goto nla_put_failure;
8845
8846         switch (queue) {
8847         case 0:
8848                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
8849                 break;
8850         case 1:
8851                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
8852                 break;
8853         case 2:
8854                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
8855                 break;
8856         case 3:
8857                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
8858                 break;
8859         }
8860         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
8861          * 32 usec, so need to convert the value here. */
8862         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
8863         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
8864         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
8865         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
8866
8867         nla_nest_end(msg, params);
8868
8869         nla_nest_end(msg, txq);
8870
8871         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
8872                 return 0;
8873         msg = NULL;
8874  nla_put_failure:
8875         nlmsg_free(msg);
8876         return -1;
8877 }
8878
8879
8880 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
8881                              const char *ifname, int vlan_id)
8882 {
8883         struct wpa_driver_nl80211_data *drv = bss->drv;
8884         struct nl_msg *msg;
8885         int ret = -ENOBUFS;
8886
8887         msg = nlmsg_alloc();
8888         if (!msg)
8889                 return -ENOMEM;
8890
8891         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
8892                    ", ifname=%s[%d], vlan_id=%d)",
8893                    bss->ifname, if_nametoindex(bss->ifname),
8894                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
8895         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
8896
8897         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
8898                     if_nametoindex(bss->ifname));
8899         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8900         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
8901                     if_nametoindex(ifname));
8902
8903         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8904         msg = NULL;
8905         if (ret < 0) {
8906                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
8907                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
8908                            MAC2STR(addr), ifname, vlan_id, ret,
8909                            strerror(-ret));
8910         }
8911  nla_put_failure:
8912         nlmsg_free(msg);
8913         return ret;
8914 }
8915
8916
8917 static int i802_get_inact_sec(void *priv, const u8 *addr)
8918 {
8919         struct hostap_sta_driver_data data;
8920         int ret;
8921
8922         data.inactive_msec = (unsigned long) -1;
8923         ret = i802_read_sta_data(priv, &data, addr);
8924         if (ret || data.inactive_msec == (unsigned long) -1)
8925                 return -1;
8926         return data.inactive_msec / 1000;
8927 }
8928
8929
8930 static int i802_sta_clear_stats(void *priv, const u8 *addr)
8931 {
8932 #if 0
8933         /* TODO */
8934 #endif
8935         return 0;
8936 }
8937
8938
8939 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
8940                            int reason)
8941 {
8942         struct i802_bss *bss = priv;
8943         struct wpa_driver_nl80211_data *drv = bss->drv;
8944         struct ieee80211_mgmt mgmt;
8945
8946         if (drv->device_ap_sme)
8947                 return wpa_driver_nl80211_sta_remove(bss, addr);
8948
8949         memset(&mgmt, 0, sizeof(mgmt));
8950         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
8951                                           WLAN_FC_STYPE_DEAUTH);
8952         memcpy(mgmt.da, addr, ETH_ALEN);
8953         memcpy(mgmt.sa, own_addr, ETH_ALEN);
8954         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
8955         mgmt.u.deauth.reason_code = host_to_le16(reason);
8956         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
8957                                             IEEE80211_HDRLEN +
8958                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
8959                                             0);
8960 }
8961
8962
8963 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
8964                              int reason)
8965 {
8966         struct i802_bss *bss = priv;
8967         struct wpa_driver_nl80211_data *drv = bss->drv;
8968         struct ieee80211_mgmt mgmt;
8969
8970         if (drv->device_ap_sme)
8971                 return wpa_driver_nl80211_sta_remove(bss, addr);
8972
8973         memset(&mgmt, 0, sizeof(mgmt));
8974         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
8975                                           WLAN_FC_STYPE_DISASSOC);
8976         memcpy(mgmt.da, addr, ETH_ALEN);
8977         memcpy(mgmt.sa, own_addr, ETH_ALEN);
8978         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
8979         mgmt.u.disassoc.reason_code = host_to_le16(reason);
8980         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
8981                                             IEEE80211_HDRLEN +
8982                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
8983                                             0);
8984 }
8985
8986
8987 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
8988 {
8989         int i;
8990         int *old;
8991
8992         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
8993                    ifidx);
8994         for (i = 0; i < drv->num_if_indices; i++) {
8995                 if (drv->if_indices[i] == 0) {
8996                         drv->if_indices[i] = ifidx;
8997                         return;
8998                 }
8999         }
9000
9001         if (drv->if_indices != drv->default_if_indices)
9002                 old = drv->if_indices;
9003         else
9004                 old = NULL;
9005
9006         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
9007                                            sizeof(int));
9008         if (!drv->if_indices) {
9009                 if (!old)
9010                         drv->if_indices = drv->default_if_indices;
9011                 else
9012                         drv->if_indices = old;
9013                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
9014                            "interfaces");
9015                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
9016                 return;
9017         } else if (!old)
9018                 os_memcpy(drv->if_indices, drv->default_if_indices,
9019                           sizeof(drv->default_if_indices));
9020         drv->if_indices[drv->num_if_indices] = ifidx;
9021         drv->num_if_indices++;
9022 }
9023
9024
9025 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9026 {
9027         int i;
9028
9029         for (i = 0; i < drv->num_if_indices; i++) {
9030                 if (drv->if_indices[i] == ifidx) {
9031                         drv->if_indices[i] = 0;
9032                         break;
9033                 }
9034         }
9035 }
9036
9037
9038 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
9039 {
9040         int i;
9041
9042         for (i = 0; i < drv->num_if_indices; i++)
9043                 if (drv->if_indices[i] == ifidx)
9044                         return 1;
9045
9046         return 0;
9047 }
9048
9049
9050 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
9051                             const char *bridge_ifname, char *ifname_wds)
9052 {
9053         struct i802_bss *bss = priv;
9054         struct wpa_driver_nl80211_data *drv = bss->drv;
9055         char name[IFNAMSIZ + 1];
9056
9057         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
9058         if (ifname_wds)
9059                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
9060
9061         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
9062                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
9063         if (val) {
9064                 if (!if_nametoindex(name)) {
9065                         if (nl80211_create_iface(drv, name,
9066                                                  NL80211_IFTYPE_AP_VLAN,
9067                                                  bss->addr, 1, NULL, NULL, 0) <
9068                             0)
9069                                 return -1;
9070                         if (bridge_ifname &&
9071                             linux_br_add_if(drv->global->ioctl_sock,
9072                                             bridge_ifname, name) < 0)
9073                                 return -1;
9074                 }
9075                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
9076                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
9077                                    "interface %s up", name);
9078                 }
9079                 return i802_set_sta_vlan(priv, addr, name, 0);
9080         } else {
9081                 if (bridge_ifname)
9082                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
9083                                         name);
9084
9085                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
9086                 return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
9087                                                     name);
9088         }
9089 }
9090
9091
9092 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
9093 {
9094         struct wpa_driver_nl80211_data *drv = eloop_ctx;
9095         struct sockaddr_ll lladdr;
9096         unsigned char buf[3000];
9097         int len;
9098         socklen_t fromlen = sizeof(lladdr);
9099
9100         len = recvfrom(sock, buf, sizeof(buf), 0,
9101                        (struct sockaddr *)&lladdr, &fromlen);
9102         if (len < 0) {
9103                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
9104                            strerror(errno));
9105                 return;
9106         }
9107
9108         if (have_ifidx(drv, lladdr.sll_ifindex))
9109                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
9110 }
9111
9112
9113 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
9114                              struct i802_bss *bss,
9115                              const char *brname, const char *ifname)
9116 {
9117         int ifindex;
9118         char in_br[IFNAMSIZ];
9119
9120         os_strlcpy(bss->brname, brname, IFNAMSIZ);
9121         ifindex = if_nametoindex(brname);
9122         if (ifindex == 0) {
9123                 /*
9124                  * Bridge was configured, but the bridge device does
9125                  * not exist. Try to add it now.
9126                  */
9127                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
9128                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
9129                                    "bridge interface %s: %s",
9130                                    brname, strerror(errno));
9131                         return -1;
9132                 }
9133                 bss->added_bridge = 1;
9134                 add_ifidx(drv, if_nametoindex(brname));
9135         }
9136
9137         if (linux_br_get(in_br, ifname) == 0) {
9138                 if (os_strcmp(in_br, brname) == 0)
9139                         return 0; /* already in the bridge */
9140
9141                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
9142                            "bridge %s", ifname, in_br);
9143                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
9144                     0) {
9145                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
9146                                    "remove interface %s from bridge "
9147                                    "%s: %s",
9148                                    ifname, brname, strerror(errno));
9149                         return -1;
9150                 }
9151         }
9152
9153         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
9154                    ifname, brname);
9155         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
9156                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
9157                            "into bridge %s: %s",
9158                            ifname, brname, strerror(errno));
9159                 return -1;
9160         }
9161         bss->added_if_into_bridge = 1;
9162
9163         return 0;
9164 }
9165
9166
9167 static void *i802_init(struct hostapd_data *hapd,
9168                        struct wpa_init_params *params)
9169 {
9170         struct wpa_driver_nl80211_data *drv;
9171         struct i802_bss *bss;
9172         size_t i;
9173         char brname[IFNAMSIZ];
9174         int ifindex, br_ifindex;
9175         int br_added = 0;
9176
9177         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
9178                                           params->global_priv, 1,
9179                                           params->bssid);
9180         if (bss == NULL)
9181                 return NULL;
9182
9183         drv = bss->drv;
9184
9185         if (linux_br_get(brname, params->ifname) == 0) {
9186                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
9187                            params->ifname, brname);
9188                 br_ifindex = if_nametoindex(brname);
9189         } else {
9190                 brname[0] = '\0';
9191                 br_ifindex = 0;
9192         }
9193
9194         for (i = 0; i < params->num_bridge; i++) {
9195                 if (params->bridge[i]) {
9196                         ifindex = if_nametoindex(params->bridge[i]);
9197                         if (ifindex)
9198                                 add_ifidx(drv, ifindex);
9199                         if (ifindex == br_ifindex)
9200                                 br_added = 1;
9201                 }
9202         }
9203         if (!br_added && br_ifindex &&
9204             (params->num_bridge == 0 || !params->bridge[0]))
9205                 add_ifidx(drv, br_ifindex);
9206
9207         /* start listening for EAPOL on the default AP interface */
9208         add_ifidx(drv, drv->ifindex);
9209
9210         if (params->num_bridge && params->bridge[0] &&
9211             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
9212                 goto failed;
9213
9214         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
9215         if (drv->eapol_sock < 0) {
9216                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
9217                            strerror(errno));
9218                 goto failed;
9219         }
9220
9221         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
9222         {
9223                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
9224                 goto failed;
9225         }
9226
9227         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
9228                                params->own_addr))
9229                 goto failed;
9230
9231         memcpy(bss->addr, params->own_addr, ETH_ALEN);
9232
9233         return bss;
9234
9235 failed:
9236         wpa_driver_nl80211_deinit(bss);
9237         return NULL;
9238 }
9239
9240
9241 static void i802_deinit(void *priv)
9242 {
9243         struct i802_bss *bss = priv;
9244         wpa_driver_nl80211_deinit(bss);
9245 }
9246
9247
9248 static enum nl80211_iftype wpa_driver_nl80211_if_type(
9249         enum wpa_driver_if_type type)
9250 {
9251         switch (type) {
9252         case WPA_IF_STATION:
9253                 return NL80211_IFTYPE_STATION;
9254         case WPA_IF_P2P_CLIENT:
9255         case WPA_IF_P2P_GROUP:
9256                 return NL80211_IFTYPE_P2P_CLIENT;
9257         case WPA_IF_AP_VLAN:
9258                 return NL80211_IFTYPE_AP_VLAN;
9259         case WPA_IF_AP_BSS:
9260                 return NL80211_IFTYPE_AP;
9261         case WPA_IF_P2P_GO:
9262                 return NL80211_IFTYPE_P2P_GO;
9263         case WPA_IF_P2P_DEVICE:
9264                 return NL80211_IFTYPE_P2P_DEVICE;
9265         }
9266         return -1;
9267 }
9268
9269
9270 #ifdef CONFIG_P2P
9271
9272 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
9273 {
9274         struct wpa_driver_nl80211_data *drv;
9275         dl_list_for_each(drv, &global->interfaces,
9276                          struct wpa_driver_nl80211_data, list) {
9277                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
9278                         return 1;
9279         }
9280         return 0;
9281 }
9282
9283
9284 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
9285                                       u8 *new_addr)
9286 {
9287         unsigned int idx;
9288
9289         if (!drv->global)
9290                 return -1;
9291
9292         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
9293         for (idx = 0; idx < 64; idx++) {
9294                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
9295                 new_addr[0] ^= idx << 2;
9296                 if (!nl80211_addr_in_use(drv->global, new_addr))
9297                         break;
9298         }
9299         if (idx == 64)
9300                 return -1;
9301
9302         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
9303                    MACSTR, MAC2STR(new_addr));
9304
9305         return 0;
9306 }
9307
9308 #endif /* CONFIG_P2P */
9309
9310
9311 struct wdev_info {
9312         u64 wdev_id;
9313         int wdev_id_set;
9314         u8 macaddr[ETH_ALEN];
9315 };
9316
9317 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
9318 {
9319         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9320         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9321         struct wdev_info *wi = arg;
9322
9323         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9324                   genlmsg_attrlen(gnlh, 0), NULL);
9325         if (tb[NL80211_ATTR_WDEV]) {
9326                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
9327                 wi->wdev_id_set = 1;
9328         }
9329
9330         if (tb[NL80211_ATTR_MAC])
9331                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
9332                           ETH_ALEN);
9333
9334         return NL_SKIP;
9335 }
9336
9337
9338 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
9339                                      const char *ifname, const u8 *addr,
9340                                      void *bss_ctx, void **drv_priv,
9341                                      char *force_ifname, u8 *if_addr,
9342                                      const char *bridge, int use_existing)
9343 {
9344         enum nl80211_iftype nlmode;
9345         struct i802_bss *bss = priv;
9346         struct wpa_driver_nl80211_data *drv = bss->drv;
9347         int ifidx;
9348         int added = 1;
9349
9350         if (addr)
9351                 os_memcpy(if_addr, addr, ETH_ALEN);
9352         nlmode = wpa_driver_nl80211_if_type(type);
9353         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
9354                 struct wdev_info p2pdev_info;
9355
9356                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
9357                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
9358                                              0, nl80211_wdev_handler,
9359                                              &p2pdev_info, use_existing);
9360                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
9361                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
9362                                    ifname);
9363                         return -1;
9364                 }
9365
9366                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
9367                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
9368                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
9369                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
9370                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
9371                            ifname,
9372                            (long long unsigned int) p2pdev_info.wdev_id);
9373         } else {
9374                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
9375                                              0, NULL, NULL, use_existing);
9376                 if (use_existing && ifidx == -ENFILE) {
9377                         added = 0;
9378                         ifidx = if_nametoindex(ifname);
9379                 } else if (ifidx < 0) {
9380                         return -1;
9381                 }
9382         }
9383
9384         if (!addr) {
9385                 if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
9386                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
9387                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
9388                                             bss->ifname, if_addr) < 0) {
9389                         if (added)
9390                                 nl80211_remove_iface(drv, ifidx);
9391                         return -1;
9392                 }
9393         }
9394
9395 #ifdef CONFIG_P2P
9396         if (!addr &&
9397             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
9398              type == WPA_IF_P2P_GO)) {
9399                 /* Enforce unique P2P Interface Address */
9400                 u8 new_addr[ETH_ALEN];
9401
9402                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
9403                                        new_addr) < 0) {
9404                         nl80211_remove_iface(drv, ifidx);
9405                         return -1;
9406                 }
9407                 if (nl80211_addr_in_use(drv->global, new_addr)) {
9408                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
9409                                    "for P2P group interface");
9410                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
9411                                 nl80211_remove_iface(drv, ifidx);
9412                                 return -1;
9413                         }
9414                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
9415                                                new_addr) < 0) {
9416                                 nl80211_remove_iface(drv, ifidx);
9417                                 return -1;
9418                         }
9419                 }
9420                 os_memcpy(if_addr, new_addr, ETH_ALEN);
9421         }
9422 #endif /* CONFIG_P2P */
9423
9424         if (type == WPA_IF_AP_BSS) {
9425                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
9426                 if (new_bss == NULL) {
9427                         if (added)
9428                                 nl80211_remove_iface(drv, ifidx);
9429                         return -1;
9430                 }
9431
9432                 if (bridge &&
9433                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
9434                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
9435                                    "interface %s to a bridge %s",
9436                                    ifname, bridge);
9437                         if (added)
9438                                 nl80211_remove_iface(drv, ifidx);
9439                         os_free(new_bss);
9440                         return -1;
9441                 }
9442
9443                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
9444                 {
9445                         nl80211_remove_iface(drv, ifidx);
9446                         os_free(new_bss);
9447                         return -1;
9448                 }
9449                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
9450                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
9451                 new_bss->ifindex = ifidx;
9452                 new_bss->drv = drv;
9453                 new_bss->next = drv->first_bss->next;
9454                 new_bss->freq = drv->first_bss->freq;
9455                 new_bss->ctx = bss_ctx;
9456                 new_bss->added_if = added;
9457                 drv->first_bss->next = new_bss;
9458                 if (drv_priv)
9459                         *drv_priv = new_bss;
9460                 nl80211_init_bss(new_bss);
9461
9462                 /* Subscribe management frames for this WPA_IF_AP_BSS */
9463                 if (nl80211_setup_ap(new_bss))
9464                         return -1;
9465         }
9466
9467         if (drv->global)
9468                 drv->global->if_add_ifindex = ifidx;
9469
9470         return 0;
9471 }
9472
9473
9474 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
9475                                         enum wpa_driver_if_type type,
9476                                         const char *ifname)
9477 {
9478         struct wpa_driver_nl80211_data *drv = bss->drv;
9479         int ifindex = if_nametoindex(ifname);
9480
9481         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
9482                    __func__, type, ifname, ifindex, bss->added_if);
9483         if (ifindex > 0 && bss->added_if)
9484                 nl80211_remove_iface(drv, ifindex);
9485
9486         if (type != WPA_IF_AP_BSS)
9487                 return 0;
9488
9489         if (bss->added_if_into_bridge) {
9490                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
9491                                     bss->ifname) < 0)
9492                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
9493                                    "interface %s from bridge %s: %s",
9494                                    bss->ifname, bss->brname, strerror(errno));
9495         }
9496         if (bss->added_bridge) {
9497                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
9498                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
9499                                    "bridge %s: %s",
9500                                    bss->brname, strerror(errno));
9501         }
9502
9503         if (bss != drv->first_bss) {
9504                 struct i802_bss *tbss;
9505
9506                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
9507                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
9508                         if (tbss->next == bss) {
9509                                 tbss->next = bss->next;
9510                                 /* Unsubscribe management frames */
9511                                 nl80211_teardown_ap(bss);
9512                                 nl80211_destroy_bss(bss);
9513                                 os_free(bss);
9514                                 bss = NULL;
9515                                 break;
9516                         }
9517                 }
9518                 if (bss)
9519                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
9520                                    "BSS %p in the list", __func__, bss);
9521         } else {
9522                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
9523                 nl80211_teardown_ap(bss);
9524                 if (!bss->added_if && !drv->first_bss->next)
9525                         wpa_driver_nl80211_del_beacon(drv);
9526                 nl80211_destroy_bss(bss);
9527                 if (!bss->added_if)
9528                         i802_set_iface_flags(bss, 0);
9529                 if (drv->first_bss->next) {
9530                         drv->first_bss = drv->first_bss->next;
9531                         drv->ctx = drv->first_bss->ctx;
9532                         os_free(bss);
9533                 } else {
9534                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
9535                 }
9536         }
9537
9538         return 0;
9539 }
9540
9541
9542 static int cookie_handler(struct nl_msg *msg, void *arg)
9543 {
9544         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9545         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9546         u64 *cookie = arg;
9547         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9548                   genlmsg_attrlen(gnlh, 0), NULL);
9549         if (tb[NL80211_ATTR_COOKIE])
9550                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
9551         return NL_SKIP;
9552 }
9553
9554
9555 static int nl80211_send_frame_cmd(struct i802_bss *bss,
9556                                   unsigned int freq, unsigned int wait,
9557                                   const u8 *buf, size_t buf_len,
9558                                   u64 *cookie_out, int no_cck, int no_ack,
9559                                   int offchanok)
9560 {
9561         struct wpa_driver_nl80211_data *drv = bss->drv;
9562         struct nl_msg *msg;
9563         u64 cookie;
9564         int ret = -1;
9565
9566         msg = nlmsg_alloc();
9567         if (!msg)
9568                 return -1;
9569
9570         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
9571                    "no_ack=%d offchanok=%d",
9572                    freq, wait, no_cck, no_ack, offchanok);
9573         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
9574         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
9575
9576         if (nl80211_set_iface_id(msg, bss) < 0)
9577                 goto nla_put_failure;
9578         if (freq)
9579                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
9580         if (wait)
9581                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
9582         if (offchanok && (drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX))
9583                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
9584         if (no_cck)
9585                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
9586         if (no_ack)
9587                 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
9588
9589         NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
9590
9591         cookie = 0;
9592         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
9593         msg = NULL;
9594         if (ret) {
9595                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
9596                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
9597                            freq, wait);
9598                 goto nla_put_failure;
9599         }
9600         wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
9601                    "cookie 0x%llx", no_ack ? " (no ACK)" : "",
9602                    (long long unsigned int) cookie);
9603
9604         if (cookie_out)
9605                 *cookie_out = no_ack ? (u64) -1 : cookie;
9606
9607 nla_put_failure:
9608         nlmsg_free(msg);
9609         return ret;
9610 }
9611
9612
9613 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
9614                                           unsigned int freq,
9615                                           unsigned int wait_time,
9616                                           const u8 *dst, const u8 *src,
9617                                           const u8 *bssid,
9618                                           const u8 *data, size_t data_len,
9619                                           int no_cck)
9620 {
9621         struct wpa_driver_nl80211_data *drv = bss->drv;
9622         int ret = -1;
9623         u8 *buf;
9624         struct ieee80211_hdr *hdr;
9625
9626         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
9627                    "freq=%u MHz wait=%d ms no_cck=%d)",
9628                    drv->ifindex, freq, wait_time, no_cck);
9629
9630         buf = os_zalloc(24 + data_len);
9631         if (buf == NULL)
9632                 return ret;
9633         os_memcpy(buf + 24, data, data_len);
9634         hdr = (struct ieee80211_hdr *) buf;
9635         hdr->frame_control =
9636                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
9637         os_memcpy(hdr->addr1, dst, ETH_ALEN);
9638         os_memcpy(hdr->addr2, src, ETH_ALEN);
9639         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
9640
9641         if (is_ap_interface(drv->nlmode) &&
9642             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
9643              (int) freq == bss->freq || drv->device_ap_sme ||
9644              !drv->use_monitor))
9645                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
9646                                                    0, freq, no_cck, 1,
9647                                                    wait_time);
9648         else
9649                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
9650                                              24 + data_len,
9651                                              &drv->send_action_cookie,
9652                                              no_cck, 0, 1);
9653
9654         os_free(buf);
9655         return ret;
9656 }
9657
9658
9659 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
9660 {
9661         struct i802_bss *bss = priv;
9662         struct wpa_driver_nl80211_data *drv = bss->drv;
9663         struct nl_msg *msg;
9664         int ret;
9665
9666         msg = nlmsg_alloc();
9667         if (!msg)
9668                 return;
9669
9670         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
9671                    (long long unsigned int) drv->send_action_cookie);
9672         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
9673
9674         if (nl80211_set_iface_id(msg, bss) < 0)
9675                 goto nla_put_failure;
9676         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
9677
9678         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9679         msg = NULL;
9680         if (ret)
9681                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
9682                            "(%s)", ret, strerror(-ret));
9683
9684  nla_put_failure:
9685         nlmsg_free(msg);
9686 }
9687
9688
9689 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
9690                                                 unsigned int duration)
9691 {
9692         struct i802_bss *bss = priv;
9693         struct wpa_driver_nl80211_data *drv = bss->drv;
9694         struct nl_msg *msg;
9695         int ret;
9696         u64 cookie;
9697
9698         msg = nlmsg_alloc();
9699         if (!msg)
9700                 return -1;
9701
9702         nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
9703
9704         if (nl80211_set_iface_id(msg, bss) < 0)
9705                 goto nla_put_failure;
9706
9707         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
9708         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
9709
9710         cookie = 0;
9711         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
9712         msg = NULL;
9713         if (ret == 0) {
9714                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
9715                            "0x%llx for freq=%u MHz duration=%u",
9716                            (long long unsigned int) cookie, freq, duration);
9717                 drv->remain_on_chan_cookie = cookie;
9718                 drv->pending_remain_on_chan = 1;
9719                 return 0;
9720         }
9721         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
9722                    "(freq=%d duration=%u): %d (%s)",
9723                    freq, duration, ret, strerror(-ret));
9724 nla_put_failure:
9725         nlmsg_free(msg);
9726         return -1;
9727 }
9728
9729
9730 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
9731 {
9732         struct i802_bss *bss = priv;
9733         struct wpa_driver_nl80211_data *drv = bss->drv;
9734         struct nl_msg *msg;
9735         int ret;
9736
9737         if (!drv->pending_remain_on_chan) {
9738                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
9739                            "to cancel");
9740                 return -1;
9741         }
9742
9743         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
9744                    "0x%llx",
9745                    (long long unsigned int) drv->remain_on_chan_cookie);
9746
9747         msg = nlmsg_alloc();
9748         if (!msg)
9749                 return -1;
9750
9751         nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
9752
9753         if (nl80211_set_iface_id(msg, bss) < 0)
9754                 goto nla_put_failure;
9755
9756         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
9757
9758         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9759         msg = NULL;
9760         if (ret == 0)
9761                 return 0;
9762         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
9763                    "%d (%s)", ret, strerror(-ret));
9764 nla_put_failure:
9765         nlmsg_free(msg);
9766         return -1;
9767 }
9768
9769
9770 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
9771 {
9772         struct wpa_driver_nl80211_data *drv = bss->drv;
9773
9774         if (!report) {
9775                 if (bss->nl_preq && drv->device_ap_sme &&
9776                     is_ap_interface(drv->nlmode)) {
9777                         /*
9778                          * Do not disable Probe Request reporting that was
9779                          * enabled in nl80211_setup_ap().
9780                          */
9781                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
9782                                    "Probe Request reporting nl_preq=%p while "
9783                                    "in AP mode", bss->nl_preq);
9784                 } else if (bss->nl_preq) {
9785                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
9786                                    "reporting nl_preq=%p", bss->nl_preq);
9787                         nl80211_destroy_eloop_handle(&bss->nl_preq);
9788                 }
9789                 return 0;
9790         }
9791
9792         if (bss->nl_preq) {
9793                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
9794                            "already on! nl_preq=%p", bss->nl_preq);
9795                 return 0;
9796         }
9797
9798         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
9799         if (bss->nl_preq == NULL)
9800                 return -1;
9801         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
9802                    "reporting nl_preq=%p", bss->nl_preq);
9803
9804         if (nl80211_register_frame(bss, bss->nl_preq,
9805                                    (WLAN_FC_TYPE_MGMT << 2) |
9806                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
9807                                    NULL, 0) < 0)
9808                 goto out_err;
9809
9810         nl80211_register_eloop_read(&bss->nl_preq,
9811                                     wpa_driver_nl80211_event_receive,
9812                                     bss->nl_cb);
9813
9814         return 0;
9815
9816  out_err:
9817         nl_destroy_handles(&bss->nl_preq);
9818         return -1;
9819 }
9820
9821
9822 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
9823                                      int ifindex, int disabled)
9824 {
9825         struct nl_msg *msg;
9826         struct nlattr *bands, *band;
9827         int ret;
9828
9829         msg = nlmsg_alloc();
9830         if (!msg)
9831                 return -1;
9832
9833         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
9834         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
9835
9836         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
9837         if (!bands)
9838                 goto nla_put_failure;
9839
9840         /*
9841          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
9842          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
9843          * rates. All 5 GHz rates are left enabled.
9844          */
9845         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
9846         if (!band)
9847                 goto nla_put_failure;
9848         if (disabled) {
9849                 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
9850                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
9851         }
9852         nla_nest_end(msg, band);
9853
9854         nla_nest_end(msg, bands);
9855
9856         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9857         msg = NULL;
9858         if (ret) {
9859                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
9860                            "(%s)", ret, strerror(-ret));
9861         } else
9862                 drv->disabled_11b_rates = disabled;
9863
9864         return ret;
9865
9866 nla_put_failure:
9867         nlmsg_free(msg);
9868         return -1;
9869 }
9870
9871
9872 static int wpa_driver_nl80211_deinit_ap(void *priv)
9873 {
9874         struct i802_bss *bss = priv;
9875         struct wpa_driver_nl80211_data *drv = bss->drv;
9876         if (!is_ap_interface(drv->nlmode))
9877                 return -1;
9878         wpa_driver_nl80211_del_beacon(drv);
9879
9880         /*
9881          * If the P2P GO interface was dynamically added, then it is
9882          * possible that the interface change to station is not possible.
9883          */
9884         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
9885                 return 0;
9886
9887         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
9888 }
9889
9890
9891 static int wpa_driver_nl80211_stop_ap(void *priv)
9892 {
9893         struct i802_bss *bss = priv;
9894         struct wpa_driver_nl80211_data *drv = bss->drv;
9895         if (!is_ap_interface(drv->nlmode))
9896                 return -1;
9897         wpa_driver_nl80211_del_beacon(drv);
9898         bss->beacon_set = 0;
9899         return 0;
9900 }
9901
9902
9903 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
9904 {
9905         struct i802_bss *bss = priv;
9906         struct wpa_driver_nl80211_data *drv = bss->drv;
9907         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
9908                 return -1;
9909
9910         /*
9911          * If the P2P Client interface was dynamically added, then it is
9912          * possible that the interface change to station is not possible.
9913          */
9914         if (bss->if_dynamic)
9915                 return 0;
9916
9917         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
9918 }
9919
9920
9921 static void wpa_driver_nl80211_resume(void *priv)
9922 {
9923         struct i802_bss *bss = priv;
9924
9925         if (i802_set_iface_flags(bss, 1))
9926                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
9927 }
9928
9929
9930 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
9931                                   const u8 *ies, size_t ies_len)
9932 {
9933         struct i802_bss *bss = priv;
9934         struct wpa_driver_nl80211_data *drv = bss->drv;
9935         int ret;
9936         u8 *data, *pos;
9937         size_t data_len;
9938         const u8 *own_addr = bss->addr;
9939
9940         if (action != 1) {
9941                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
9942                            "action %d", action);
9943                 return -1;
9944         }
9945
9946         /*
9947          * Action frame payload:
9948          * Category[1] = 6 (Fast BSS Transition)
9949          * Action[1] = 1 (Fast BSS Transition Request)
9950          * STA Address
9951          * Target AP Address
9952          * FT IEs
9953          */
9954
9955         data_len = 2 + 2 * ETH_ALEN + ies_len;
9956         data = os_malloc(data_len);
9957         if (data == NULL)
9958                 return -1;
9959         pos = data;
9960         *pos++ = 0x06; /* FT Action category */
9961         *pos++ = action;
9962         os_memcpy(pos, own_addr, ETH_ALEN);
9963         pos += ETH_ALEN;
9964         os_memcpy(pos, target_ap, ETH_ALEN);
9965         pos += ETH_ALEN;
9966         os_memcpy(pos, ies, ies_len);
9967
9968         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
9969                                              drv->bssid, own_addr, drv->bssid,
9970                                              data, data_len, 0);
9971         os_free(data);
9972
9973         return ret;
9974 }
9975
9976
9977 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
9978 {
9979         struct i802_bss *bss = priv;
9980         struct wpa_driver_nl80211_data *drv = bss->drv;
9981         struct nl_msg *msg;
9982         struct nlattr *cqm;
9983         int ret = -1;
9984
9985         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
9986                    "hysteresis=%d", threshold, hysteresis);
9987
9988         msg = nlmsg_alloc();
9989         if (!msg)
9990                 return -1;
9991
9992         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
9993
9994         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
9995
9996         cqm = nla_nest_start(msg, NL80211_ATTR_CQM);
9997         if (cqm == NULL)
9998                 goto nla_put_failure;
9999
10000         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
10001         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
10002         nla_nest_end(msg, cqm);
10003
10004         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10005         msg = NULL;
10006
10007 nla_put_failure:
10008         nlmsg_free(msg);
10009         return ret;
10010 }
10011
10012
10013 /* Converts nl80211_chan_width to a common format */
10014 static enum chan_width convert2width(int width)
10015 {
10016         switch (width) {
10017         case NL80211_CHAN_WIDTH_20_NOHT:
10018                 return CHAN_WIDTH_20_NOHT;
10019         case NL80211_CHAN_WIDTH_20:
10020                 return CHAN_WIDTH_20;
10021         case NL80211_CHAN_WIDTH_40:
10022                 return CHAN_WIDTH_40;
10023         case NL80211_CHAN_WIDTH_80:
10024                 return CHAN_WIDTH_80;
10025         case NL80211_CHAN_WIDTH_80P80:
10026                 return CHAN_WIDTH_80P80;
10027         case NL80211_CHAN_WIDTH_160:
10028                 return CHAN_WIDTH_160;
10029         }
10030         return CHAN_WIDTH_UNKNOWN;
10031 }
10032
10033
10034 static int get_channel_width(struct nl_msg *msg, void *arg)
10035 {
10036         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10037         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10038         struct wpa_signal_info *sig_change = arg;
10039
10040         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10041                   genlmsg_attrlen(gnlh, 0), NULL);
10042
10043         sig_change->center_frq1 = -1;
10044         sig_change->center_frq2 = -1;
10045         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
10046
10047         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
10048                 sig_change->chanwidth = convert2width(
10049                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
10050                 if (tb[NL80211_ATTR_CENTER_FREQ1])
10051                         sig_change->center_frq1 =
10052                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
10053                 if (tb[NL80211_ATTR_CENTER_FREQ2])
10054                         sig_change->center_frq2 =
10055                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
10056         }
10057
10058         return NL_SKIP;
10059 }
10060
10061
10062 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
10063                                      struct wpa_signal_info *sig)
10064 {
10065         struct nl_msg *msg;
10066
10067         msg = nlmsg_alloc();
10068         if (!msg)
10069                 return -ENOMEM;
10070
10071         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_INTERFACE);
10072         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
10073
10074         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
10075
10076 nla_put_failure:
10077         nlmsg_free(msg);
10078         return -ENOBUFS;
10079 }
10080
10081
10082 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
10083 {
10084         struct i802_bss *bss = priv;
10085         struct wpa_driver_nl80211_data *drv = bss->drv;
10086         int res;
10087
10088         os_memset(si, 0, sizeof(*si));
10089         res = nl80211_get_link_signal(drv, si);
10090         if (res != 0)
10091                 return res;
10092
10093         res = nl80211_get_channel_width(drv, si);
10094         if (res != 0)
10095                 return res;
10096
10097         return nl80211_get_link_noise(drv, si);
10098 }
10099
10100
10101 static int wpa_driver_nl80211_shared_freq(void *priv)
10102 {
10103         struct i802_bss *bss = priv;
10104         struct wpa_driver_nl80211_data *drv = bss->drv;
10105         struct wpa_driver_nl80211_data *driver;
10106         int freq = 0;
10107
10108         /*
10109          * If the same PHY is in connected state with some other interface,
10110          * then retrieve the assoc freq.
10111          */
10112         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
10113                    drv->phyname);
10114
10115         dl_list_for_each(driver, &drv->global->interfaces,
10116                          struct wpa_driver_nl80211_data, list) {
10117                 if (drv == driver ||
10118                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
10119                     !driver->associated)
10120                         continue;
10121
10122                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
10123                            MACSTR,
10124                            driver->phyname, driver->first_bss->ifname,
10125                            MAC2STR(driver->first_bss->addr));
10126                 if (is_ap_interface(driver->nlmode))
10127                         freq = driver->first_bss->freq;
10128                 else
10129                         freq = nl80211_get_assoc_freq(driver);
10130                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
10131                            drv->phyname, freq);
10132         }
10133
10134         if (!freq)
10135                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
10136                            "PHY (%s) in associated state", drv->phyname);
10137
10138         return freq;
10139 }
10140
10141
10142 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
10143                               int encrypt)
10144 {
10145         struct i802_bss *bss = priv;
10146         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
10147                                              0, 0, 0, 0);
10148 }
10149
10150
10151 static int nl80211_set_param(void *priv, const char *param)
10152 {
10153         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
10154         if (param == NULL)
10155                 return 0;
10156
10157 #ifdef CONFIG_P2P
10158         if (os_strstr(param, "use_p2p_group_interface=1")) {
10159                 struct i802_bss *bss = priv;
10160                 struct wpa_driver_nl80211_data *drv = bss->drv;
10161
10162                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
10163                            "interface");
10164                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
10165                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
10166         }
10167
10168         if (os_strstr(param, "p2p_device=1")) {
10169                 struct i802_bss *bss = priv;
10170                 struct wpa_driver_nl80211_data *drv = bss->drv;
10171                 drv->allow_p2p_device = 1;
10172         }
10173 #endif /* CONFIG_P2P */
10174
10175         return 0;
10176 }
10177
10178
10179 static void * nl80211_global_init(void)
10180 {
10181         struct nl80211_global *global;
10182         struct netlink_config *cfg;
10183
10184         global = os_zalloc(sizeof(*global));
10185         if (global == NULL)
10186                 return NULL;
10187         global->ioctl_sock = -1;
10188         dl_list_init(&global->interfaces);
10189         global->if_add_ifindex = -1;
10190
10191         cfg = os_zalloc(sizeof(*cfg));
10192         if (cfg == NULL)
10193                 goto err;
10194
10195         cfg->ctx = global;
10196         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
10197         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
10198         global->netlink = netlink_init(cfg);
10199         if (global->netlink == NULL) {
10200                 os_free(cfg);
10201                 goto err;
10202         }
10203
10204         if (wpa_driver_nl80211_init_nl_global(global) < 0)
10205                 goto err;
10206
10207         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
10208         if (global->ioctl_sock < 0) {
10209                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
10210                            strerror(errno));
10211                 goto err;
10212         }
10213
10214         return global;
10215
10216 err:
10217         nl80211_global_deinit(global);
10218         return NULL;
10219 }
10220
10221
10222 static void nl80211_global_deinit(void *priv)
10223 {
10224         struct nl80211_global *global = priv;
10225         if (global == NULL)
10226                 return;
10227         if (!dl_list_empty(&global->interfaces)) {
10228                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
10229                            "nl80211_global_deinit",
10230                            dl_list_len(&global->interfaces));
10231         }
10232
10233         if (global->netlink)
10234                 netlink_deinit(global->netlink);
10235
10236         nl_destroy_handles(&global->nl);
10237
10238         if (global->nl_event)
10239                 nl80211_destroy_eloop_handle(&global->nl_event);
10240
10241         nl_cb_put(global->nl_cb);
10242
10243         if (global->ioctl_sock >= 0)
10244                 close(global->ioctl_sock);
10245
10246         os_free(global);
10247 }
10248
10249
10250 static const char * nl80211_get_radio_name(void *priv)
10251 {
10252         struct i802_bss *bss = priv;
10253         struct wpa_driver_nl80211_data *drv = bss->drv;
10254         return drv->phyname;
10255 }
10256
10257
10258 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
10259                          const u8 *pmkid)
10260 {
10261         struct nl_msg *msg;
10262
10263         msg = nlmsg_alloc();
10264         if (!msg)
10265                 return -ENOMEM;
10266
10267         nl80211_cmd(bss->drv, msg, 0, cmd);
10268
10269         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
10270         if (pmkid)
10271                 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
10272         if (bssid)
10273                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
10274
10275         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
10276  nla_put_failure:
10277         nlmsg_free(msg);
10278         return -ENOBUFS;
10279 }
10280
10281
10282 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
10283 {
10284         struct i802_bss *bss = priv;
10285         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
10286         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
10287 }
10288
10289
10290 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
10291 {
10292         struct i802_bss *bss = priv;
10293         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
10294                    MAC2STR(bssid));
10295         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
10296 }
10297
10298
10299 static int nl80211_flush_pmkid(void *priv)
10300 {
10301         struct i802_bss *bss = priv;
10302         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
10303         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
10304 }
10305
10306
10307 static void clean_survey_results(struct survey_results *survey_results)
10308 {
10309         struct freq_survey *survey, *tmp;
10310
10311         if (dl_list_empty(&survey_results->survey_list))
10312                 return;
10313
10314         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
10315                               struct freq_survey, list) {
10316                 dl_list_del(&survey->list);
10317                 os_free(survey);
10318         }
10319 }
10320
10321
10322 static void add_survey(struct nlattr **sinfo, u32 ifidx,
10323                        struct dl_list *survey_list)
10324 {
10325         struct freq_survey *survey;
10326
10327         survey = os_zalloc(sizeof(struct freq_survey));
10328         if  (!survey)
10329                 return;
10330
10331         survey->ifidx = ifidx;
10332         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
10333         survey->filled = 0;
10334
10335         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
10336                 survey->nf = (int8_t)
10337                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
10338                 survey->filled |= SURVEY_HAS_NF;
10339         }
10340
10341         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
10342                 survey->channel_time =
10343                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
10344                 survey->filled |= SURVEY_HAS_CHAN_TIME;
10345         }
10346
10347         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
10348                 survey->channel_time_busy =
10349                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
10350                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
10351         }
10352
10353         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
10354                 survey->channel_time_rx =
10355                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
10356                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
10357         }
10358
10359         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
10360                 survey->channel_time_tx =
10361                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
10362                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
10363         }
10364
10365         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
10366                    survey->freq,
10367                    survey->nf,
10368                    (unsigned long int) survey->channel_time,
10369                    (unsigned long int) survey->channel_time_busy,
10370                    (unsigned long int) survey->channel_time_tx,
10371                    (unsigned long int) survey->channel_time_rx,
10372                    survey->filled);
10373
10374         dl_list_add_tail(survey_list, &survey->list);
10375 }
10376
10377
10378 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
10379                            unsigned int freq_filter)
10380 {
10381         if (!freq_filter)
10382                 return 1;
10383
10384         return freq_filter == surveyed_freq;
10385 }
10386
10387
10388 static int survey_handler(struct nl_msg *msg, void *arg)
10389 {
10390         struct nlattr *tb[NL80211_ATTR_MAX + 1];
10391         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
10392         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
10393         struct survey_results *survey_results;
10394         u32 surveyed_freq = 0;
10395         u32 ifidx;
10396
10397         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
10398                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
10399                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
10400         };
10401
10402         survey_results = (struct survey_results *) arg;
10403
10404         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
10405                   genlmsg_attrlen(gnlh, 0), NULL);
10406
10407         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
10408
10409         if (!tb[NL80211_ATTR_SURVEY_INFO])
10410                 return NL_SKIP;
10411
10412         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
10413                              tb[NL80211_ATTR_SURVEY_INFO],
10414                              survey_policy))
10415                 return NL_SKIP;
10416
10417         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
10418                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
10419                 return NL_SKIP;
10420         }
10421
10422         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
10423
10424         if (!check_survey_ok(sinfo, surveyed_freq,
10425                              survey_results->freq_filter))
10426                 return NL_SKIP;
10427
10428         if (survey_results->freq_filter &&
10429             survey_results->freq_filter != surveyed_freq) {
10430                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
10431                            surveyed_freq);
10432                 return NL_SKIP;
10433         }
10434
10435         add_survey(sinfo, ifidx, &survey_results->survey_list);
10436
10437         return NL_SKIP;
10438 }
10439
10440
10441 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
10442 {
10443         struct i802_bss *bss = priv;
10444         struct wpa_driver_nl80211_data *drv = bss->drv;
10445         struct nl_msg *msg;
10446         int err = -ENOBUFS;
10447         union wpa_event_data data;
10448         struct survey_results *survey_results;
10449
10450         os_memset(&data, 0, sizeof(data));
10451         survey_results = &data.survey_results;
10452
10453         dl_list_init(&survey_results->survey_list);
10454
10455         msg = nlmsg_alloc();
10456         if (!msg)
10457                 goto nla_put_failure;
10458
10459         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
10460
10461         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
10462
10463         if (freq)
10464                 data.survey_results.freq_filter = freq;
10465
10466         do {
10467                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
10468                 err = send_and_recv_msgs(drv, msg, survey_handler,
10469                                          survey_results);
10470         } while (err > 0);
10471
10472         if (err) {
10473                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
10474                 goto out_clean;
10475         }
10476
10477         wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
10478
10479 out_clean:
10480         clean_survey_results(survey_results);
10481 nla_put_failure:
10482         return err;
10483 }
10484
10485
10486 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
10487                                    const u8 *replay_ctr)
10488 {
10489         struct i802_bss *bss = priv;
10490         struct wpa_driver_nl80211_data *drv = bss->drv;
10491         struct nlattr *replay_nested;
10492         struct nl_msg *msg;
10493
10494         msg = nlmsg_alloc();
10495         if (!msg)
10496                 return;
10497
10498         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10499
10500         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
10501
10502         replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10503         if (!replay_nested)
10504                 goto nla_put_failure;
10505
10506         NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
10507         NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
10508         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
10509                 replay_ctr);
10510
10511         nla_nest_end(msg, replay_nested);
10512
10513         send_and_recv_msgs(drv, msg, NULL, NULL);
10514         return;
10515  nla_put_failure:
10516         nlmsg_free(msg);
10517 }
10518
10519
10520 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
10521                                     const u8 *addr, int qos)
10522 {
10523         /* send data frame to poll STA and check whether
10524          * this frame is ACKed */
10525         struct {
10526                 struct ieee80211_hdr hdr;
10527                 u16 qos_ctl;
10528         } STRUCT_PACKED nulldata;
10529         size_t size;
10530
10531         /* Send data frame to poll STA and check whether this frame is ACKed */
10532
10533         os_memset(&nulldata, 0, sizeof(nulldata));
10534
10535         if (qos) {
10536                 nulldata.hdr.frame_control =
10537                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
10538                                      WLAN_FC_STYPE_QOS_NULL);
10539                 size = sizeof(nulldata);
10540         } else {
10541                 nulldata.hdr.frame_control =
10542                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
10543                                      WLAN_FC_STYPE_NULLFUNC);
10544                 size = sizeof(struct ieee80211_hdr);
10545         }
10546
10547         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
10548         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
10549         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
10550         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
10551
10552         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
10553                                          0, 0) < 0)
10554                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
10555                            "send poll frame");
10556 }
10557
10558 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
10559                                 int qos)
10560 {
10561         struct i802_bss *bss = priv;
10562         struct wpa_driver_nl80211_data *drv = bss->drv;
10563         struct nl_msg *msg;
10564
10565         if (!drv->poll_command_supported) {
10566                 nl80211_send_null_frame(bss, own_addr, addr, qos);
10567                 return;
10568         }
10569
10570         msg = nlmsg_alloc();
10571         if (!msg)
10572                 return;
10573
10574         nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
10575
10576         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
10577         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
10578
10579         send_and_recv_msgs(drv, msg, NULL, NULL);
10580         return;
10581  nla_put_failure:
10582         nlmsg_free(msg);
10583 }
10584
10585
10586 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
10587 {
10588         struct nl_msg *msg;
10589
10590         msg = nlmsg_alloc();
10591         if (!msg)
10592                 return -ENOMEM;
10593
10594         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
10595         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
10596         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
10597                     enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
10598         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
10599 nla_put_failure:
10600         nlmsg_free(msg);
10601         return -ENOBUFS;
10602 }
10603
10604
10605 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
10606                                      int ctwindow)
10607 {
10608         struct i802_bss *bss = priv;
10609
10610         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
10611                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
10612
10613         if (opp_ps != -1 || ctwindow != -1)
10614                 return -1; /* Not yet supported */
10615
10616         if (legacy_ps == -1)
10617                 return 0;
10618         if (legacy_ps != 0 && legacy_ps != 1)
10619                 return -1; /* Not yet supported */
10620
10621         return nl80211_set_power_save(bss, legacy_ps);
10622 }
10623
10624
10625 static int nl80211_start_radar_detection(void *priv,
10626                                          struct hostapd_freq_params *freq)
10627 {
10628         struct i802_bss *bss = priv;
10629         struct wpa_driver_nl80211_data *drv = bss->drv;
10630         struct nl_msg *msg;
10631         int ret;
10632
10633         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
10634                    freq->freq, freq->ht_enabled, freq->vht_enabled,
10635                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
10636
10637         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
10638                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
10639                            "detection");
10640                 return -1;
10641         }
10642
10643         msg = nlmsg_alloc();
10644         if (!msg)
10645                 return -1;
10646
10647         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_RADAR_DETECT);
10648         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
10649         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
10650
10651         if (freq->vht_enabled) {
10652                 switch (freq->bandwidth) {
10653                 case 20:
10654                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
10655                                     NL80211_CHAN_WIDTH_20);
10656                         break;
10657                 case 40:
10658                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
10659                                     NL80211_CHAN_WIDTH_40);
10660                         break;
10661                 case 80:
10662                         if (freq->center_freq2)
10663                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
10664                                             NL80211_CHAN_WIDTH_80P80);
10665                         else
10666                                 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
10667                                             NL80211_CHAN_WIDTH_80);
10668                         break;
10669                 case 160:
10670                         NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
10671                                     NL80211_CHAN_WIDTH_160);
10672                         break;
10673                 default:
10674                         return -1;
10675                 }
10676                 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
10677                 if (freq->center_freq2)
10678                         NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
10679                                     freq->center_freq2);
10680         } else if (freq->ht_enabled) {
10681                 switch (freq->sec_channel_offset) {
10682                 case -1:
10683                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10684                                     NL80211_CHAN_HT40MINUS);
10685                         break;
10686                 case 1:
10687                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10688                                     NL80211_CHAN_HT40PLUS);
10689                         break;
10690                 default:
10691                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10692                                     NL80211_CHAN_HT20);
10693                         break;
10694                 }
10695         }
10696
10697         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
10698         if (ret == 0)
10699                 return 0;
10700         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
10701                    "%d (%s)", ret, strerror(-ret));
10702 nla_put_failure:
10703         return -1;
10704 }
10705
10706 #ifdef CONFIG_TDLS
10707
10708 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
10709                                   u8 dialog_token, u16 status_code,
10710                                   const u8 *buf, size_t len)
10711 {
10712         struct i802_bss *bss = priv;
10713         struct wpa_driver_nl80211_data *drv = bss->drv;
10714         struct nl_msg *msg;
10715
10716         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
10717                 return -EOPNOTSUPP;
10718
10719         if (!dst)
10720                 return -EINVAL;
10721
10722         msg = nlmsg_alloc();
10723         if (!msg)
10724                 return -ENOMEM;
10725
10726         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
10727         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
10728         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
10729         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
10730         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
10731         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
10732         NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
10733
10734         return send_and_recv_msgs(drv, msg, NULL, NULL);
10735
10736 nla_put_failure:
10737         nlmsg_free(msg);
10738         return -ENOBUFS;
10739 }
10740
10741
10742 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
10743 {
10744         struct i802_bss *bss = priv;
10745         struct wpa_driver_nl80211_data *drv = bss->drv;
10746         struct nl_msg *msg;
10747         enum nl80211_tdls_operation nl80211_oper;
10748
10749         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
10750                 return -EOPNOTSUPP;
10751
10752         switch (oper) {
10753         case TDLS_DISCOVERY_REQ:
10754                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
10755                 break;
10756         case TDLS_SETUP:
10757                 nl80211_oper = NL80211_TDLS_SETUP;
10758                 break;
10759         case TDLS_TEARDOWN:
10760                 nl80211_oper = NL80211_TDLS_TEARDOWN;
10761                 break;
10762         case TDLS_ENABLE_LINK:
10763                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
10764                 break;
10765         case TDLS_DISABLE_LINK:
10766                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
10767                 break;
10768         case TDLS_ENABLE:
10769                 return 0;
10770         case TDLS_DISABLE:
10771                 return 0;
10772         default:
10773                 return -EINVAL;
10774         }
10775
10776         msg = nlmsg_alloc();
10777         if (!msg)
10778                 return -ENOMEM;
10779
10780         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
10781         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
10782         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
10783         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
10784
10785         return send_and_recv_msgs(drv, msg, NULL, NULL);
10786
10787 nla_put_failure:
10788         nlmsg_free(msg);
10789         return -ENOBUFS;
10790 }
10791
10792 #endif /* CONFIG TDLS */
10793
10794
10795 #ifdef ANDROID
10796
10797 typedef struct android_wifi_priv_cmd {
10798         char *buf;
10799         int used_len;
10800         int total_len;
10801 } android_wifi_priv_cmd;
10802
10803 static int drv_errors = 0;
10804
10805 static void wpa_driver_send_hang_msg(struct wpa_driver_nl80211_data *drv)
10806 {
10807         drv_errors++;
10808         if (drv_errors > DRV_NUMBER_SEQUENTIAL_ERRORS) {
10809                 drv_errors = 0;
10810                 wpa_msg(drv->ctx, MSG_INFO, WPA_EVENT_DRIVER_STATE "HANGED");
10811         }
10812 }
10813
10814
10815 static int android_priv_cmd(struct i802_bss *bss, const char *cmd)
10816 {
10817         struct wpa_driver_nl80211_data *drv = bss->drv;
10818         struct ifreq ifr;
10819         android_wifi_priv_cmd priv_cmd;
10820         char buf[MAX_DRV_CMD_SIZE];
10821         int ret;
10822
10823         os_memset(&ifr, 0, sizeof(ifr));
10824         os_memset(&priv_cmd, 0, sizeof(priv_cmd));
10825         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
10826
10827         os_memset(buf, 0, sizeof(buf));
10828         os_strlcpy(buf, cmd, sizeof(buf));
10829
10830         priv_cmd.buf = buf;
10831         priv_cmd.used_len = sizeof(buf);
10832         priv_cmd.total_len = sizeof(buf);
10833         ifr.ifr_data = &priv_cmd;
10834
10835         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
10836         if (ret < 0) {
10837                 wpa_printf(MSG_ERROR, "%s: failed to issue private commands",
10838                            __func__);
10839                 wpa_driver_send_hang_msg(drv);
10840                 return ret;
10841         }
10842
10843         drv_errors = 0;
10844         return 0;
10845 }
10846
10847
10848 static int android_pno_start(struct i802_bss *bss,
10849                              struct wpa_driver_scan_params *params)
10850 {
10851         struct wpa_driver_nl80211_data *drv = bss->drv;
10852         struct ifreq ifr;
10853         android_wifi_priv_cmd priv_cmd;
10854         int ret = 0, i = 0, bp;
10855         char buf[WEXT_PNO_MAX_COMMAND_SIZE];
10856
10857         bp = WEXT_PNOSETUP_HEADER_SIZE;
10858         os_memcpy(buf, WEXT_PNOSETUP_HEADER, bp);
10859         buf[bp++] = WEXT_PNO_TLV_PREFIX;
10860         buf[bp++] = WEXT_PNO_TLV_VERSION;
10861         buf[bp++] = WEXT_PNO_TLV_SUBVERSION;
10862         buf[bp++] = WEXT_PNO_TLV_RESERVED;
10863
10864         while (i < WEXT_PNO_AMOUNT && (size_t) i < params->num_ssids) {
10865                 /* Check that there is enough space needed for 1 more SSID, the
10866                  * other sections and null termination */
10867                 if ((bp + WEXT_PNO_SSID_HEADER_SIZE + MAX_SSID_LEN +
10868                      WEXT_PNO_NONSSID_SECTIONS_SIZE + 1) >= (int) sizeof(buf))
10869                         break;
10870                 wpa_hexdump_ascii(MSG_DEBUG, "For PNO Scan",
10871                                   params->ssids[i].ssid,
10872                                   params->ssids[i].ssid_len);
10873                 buf[bp++] = WEXT_PNO_SSID_SECTION;
10874                 buf[bp++] = params->ssids[i].ssid_len;
10875                 os_memcpy(&buf[bp], params->ssids[i].ssid,
10876                           params->ssids[i].ssid_len);
10877                 bp += params->ssids[i].ssid_len;
10878                 i++;
10879         }
10880
10881         buf[bp++] = WEXT_PNO_SCAN_INTERVAL_SECTION;
10882         os_snprintf(&buf[bp], WEXT_PNO_SCAN_INTERVAL_LENGTH + 1, "%x",
10883                     WEXT_PNO_SCAN_INTERVAL);
10884         bp += WEXT_PNO_SCAN_INTERVAL_LENGTH;
10885
10886         buf[bp++] = WEXT_PNO_REPEAT_SECTION;
10887         os_snprintf(&buf[bp], WEXT_PNO_REPEAT_LENGTH + 1, "%x",
10888                     WEXT_PNO_REPEAT);
10889         bp += WEXT_PNO_REPEAT_LENGTH;
10890
10891         buf[bp++] = WEXT_PNO_MAX_REPEAT_SECTION;
10892         os_snprintf(&buf[bp], WEXT_PNO_MAX_REPEAT_LENGTH + 1, "%x",
10893                     WEXT_PNO_MAX_REPEAT);
10894         bp += WEXT_PNO_MAX_REPEAT_LENGTH + 1;
10895
10896         memset(&ifr, 0, sizeof(ifr));
10897         memset(&priv_cmd, 0, sizeof(priv_cmd));
10898         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
10899
10900         priv_cmd.buf = buf;
10901         priv_cmd.used_len = bp;
10902         priv_cmd.total_len = bp;
10903         ifr.ifr_data = &priv_cmd;
10904
10905         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
10906
10907         if (ret < 0) {
10908                 wpa_printf(MSG_ERROR, "ioctl[SIOCSIWPRIV] (pnosetup): %d",
10909                            ret);
10910                 wpa_driver_send_hang_msg(drv);
10911                 return ret;
10912         }
10913
10914         drv_errors = 0;
10915
10916         return android_priv_cmd(bss, "PNOFORCE 1");
10917 }
10918
10919
10920 static int android_pno_stop(struct i802_bss *bss)
10921 {
10922         return android_priv_cmd(bss, "PNOFORCE 0");
10923 }
10924
10925 #endif /* ANDROID */
10926
10927
10928 static int driver_nl80211_set_key(const char *ifname, void *priv,
10929                                   enum wpa_alg alg, const u8 *addr,
10930                                   int key_idx, int set_tx,
10931                                   const u8 *seq, size_t seq_len,
10932                                   const u8 *key, size_t key_len)
10933 {
10934         struct i802_bss *bss = priv;
10935         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
10936                                           set_tx, seq, seq_len, key, key_len);
10937 }
10938
10939
10940 static int driver_nl80211_scan2(void *priv,
10941                                 struct wpa_driver_scan_params *params)
10942 {
10943         struct i802_bss *bss = priv;
10944         return wpa_driver_nl80211_scan(bss, params);
10945 }
10946
10947
10948 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
10949                                          int reason_code)
10950 {
10951         struct i802_bss *bss = priv;
10952         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
10953 }
10954
10955
10956 static int driver_nl80211_authenticate(void *priv,
10957                                        struct wpa_driver_auth_params *params)
10958 {
10959         struct i802_bss *bss = priv;
10960         return wpa_driver_nl80211_authenticate(bss, params);
10961 }
10962
10963
10964 static void driver_nl80211_deinit(void *priv)
10965 {
10966         struct i802_bss *bss = priv;
10967         wpa_driver_nl80211_deinit(bss);
10968 }
10969
10970
10971 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
10972                                     const char *ifname)
10973 {
10974         struct i802_bss *bss = priv;
10975         return wpa_driver_nl80211_if_remove(bss, type, ifname);
10976 }
10977
10978
10979 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
10980                                     size_t data_len, int noack)
10981 {
10982         struct i802_bss *bss = priv;
10983         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
10984                                             0, 0, 0, 0);
10985 }
10986
10987
10988 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
10989 {
10990         struct i802_bss *bss = priv;
10991         return wpa_driver_nl80211_sta_remove(bss, addr);
10992 }
10993
10994
10995 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
10996                                        const char *ifname, int vlan_id)
10997 {
10998         struct i802_bss *bss = priv;
10999         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
11000 }
11001
11002
11003 static int driver_nl80211_read_sta_data(void *priv,
11004                                         struct hostap_sta_driver_data *data,
11005                                         const u8 *addr)
11006 {
11007         struct i802_bss *bss = priv;
11008         return i802_read_sta_data(bss, data, addr);
11009 }
11010
11011
11012 static int driver_nl80211_send_action(void *priv, unsigned int freq,
11013                                       unsigned int wait_time,
11014                                       const u8 *dst, const u8 *src,
11015                                       const u8 *bssid,
11016                                       const u8 *data, size_t data_len,
11017                                       int no_cck)
11018 {
11019         struct i802_bss *bss = priv;
11020         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
11021                                               bssid, data, data_len, no_cck);
11022 }
11023
11024
11025 static int driver_nl80211_probe_req_report(void *priv, int report)
11026 {
11027         struct i802_bss *bss = priv;
11028         return wpa_driver_nl80211_probe_req_report(bss, report);
11029 }
11030
11031
11032 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
11033                                             const u8 *ies, size_t ies_len)
11034 {
11035         int ret;
11036         struct nl_msg *msg;
11037         struct i802_bss *bss = priv;
11038         struct wpa_driver_nl80211_data *drv = bss->drv;
11039         u16 mdid = WPA_GET_LE16(md);
11040
11041         msg = nlmsg_alloc();
11042         if (!msg)
11043                 return -ENOMEM;
11044
11045         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
11046         nl80211_cmd(drv, msg, 0, NL80211_CMD_UPDATE_FT_IES);
11047         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11048         NLA_PUT(msg, NL80211_ATTR_IE, ies_len, ies);
11049         NLA_PUT_U16(msg, NL80211_ATTR_MDID, mdid);
11050
11051         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
11052         if (ret) {
11053                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
11054                            "err=%d (%s)", ret, strerror(-ret));
11055         }
11056
11057         return ret;
11058
11059 nla_put_failure:
11060         nlmsg_free(msg);
11061         return -ENOBUFS;
11062 }
11063
11064
11065 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
11066 {
11067         struct i802_bss *bss = priv;
11068         struct wpa_driver_nl80211_data *drv = bss->drv;
11069
11070         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
11071                 return NULL;
11072
11073         return bss->addr;
11074 }
11075
11076
11077 static const char * scan_state_str(enum scan_states scan_state)
11078 {
11079         switch (scan_state) {
11080         case NO_SCAN:
11081                 return "NO_SCAN";
11082         case SCAN_REQUESTED:
11083                 return "SCAN_REQUESTED";
11084         case SCAN_STARTED:
11085                 return "SCAN_STARTED";
11086         case SCAN_COMPLETED:
11087                 return "SCAN_COMPLETED";
11088         case SCAN_ABORTED:
11089                 return "SCAN_ABORTED";
11090         case SCHED_SCAN_STARTED:
11091                 return "SCHED_SCAN_STARTED";
11092         case SCHED_SCAN_STOPPED:
11093                 return "SCHED_SCAN_STOPPED";
11094         case SCHED_SCAN_RESULTS:
11095                 return "SCHED_SCAN_RESULTS";
11096         }
11097
11098         return "??";
11099 }
11100
11101
11102 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
11103 {
11104         struct i802_bss *bss = priv;
11105         struct wpa_driver_nl80211_data *drv = bss->drv;
11106         int res;
11107         char *pos, *end;
11108
11109         pos = buf;
11110         end = buf + buflen;
11111
11112         res = os_snprintf(pos, end - pos,
11113                           "ifindex=%d\n"
11114                           "ifname=%s\n"
11115                           "brname=%s\n"
11116                           "addr=" MACSTR "\n"
11117                           "freq=%d\n"
11118                           "%s%s%s%s%s",
11119                           bss->ifindex,
11120                           bss->ifname,
11121                           bss->brname,
11122                           MAC2STR(bss->addr),
11123                           bss->freq,
11124                           bss->beacon_set ? "beacon_set=1\n" : "",
11125                           bss->added_if_into_bridge ?
11126                           "added_if_into_bridge=1\n" : "",
11127                           bss->added_bridge ? "added_bridge=1\n" : "",
11128                           bss->in_deinit ? "in_deinit=1\n" : "",
11129                           bss->if_dynamic ? "if_dynamic=1\n" : "");
11130         if (res < 0 || res >= end - pos)
11131                 return pos - buf;
11132         pos += res;
11133
11134         if (bss->wdev_id_set) {
11135                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
11136                                   (unsigned long long) bss->wdev_id);
11137                 if (res < 0 || res >= end - pos)
11138                         return pos - buf;
11139                 pos += res;
11140         }
11141
11142         res = os_snprintf(pos, end - pos,
11143                           "phyname=%s\n"
11144                           "drv_ifindex=%d\n"
11145                           "operstate=%d\n"
11146                           "scan_state=%s\n"
11147                           "auth_bssid=" MACSTR "\n"
11148                           "auth_attempt_bssid=" MACSTR "\n"
11149                           "bssid=" MACSTR "\n"
11150                           "prev_bssid=" MACSTR "\n"
11151                           "associated=%d\n"
11152                           "assoc_freq=%u\n"
11153                           "monitor_sock=%d\n"
11154                           "monitor_ifidx=%d\n"
11155                           "monitor_refcount=%d\n"
11156                           "last_mgmt_freq=%u\n"
11157                           "eapol_tx_sock=%d\n"
11158                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
11159                           drv->phyname,
11160                           drv->ifindex,
11161                           drv->operstate,
11162                           scan_state_str(drv->scan_state),
11163                           MAC2STR(drv->auth_bssid),
11164                           MAC2STR(drv->auth_attempt_bssid),
11165                           MAC2STR(drv->bssid),
11166                           MAC2STR(drv->prev_bssid),
11167                           drv->associated,
11168                           drv->assoc_freq,
11169                           drv->monitor_sock,
11170                           drv->monitor_ifidx,
11171                           drv->monitor_refcount,
11172                           drv->last_mgmt_freq,
11173                           drv->eapol_tx_sock,
11174                           drv->ignore_if_down_event ?
11175                           "ignore_if_down_event=1\n" : "",
11176                           drv->scan_complete_events ?
11177                           "scan_complete_events=1\n" : "",
11178                           drv->disabled_11b_rates ?
11179                           "disabled_11b_rates=1\n" : "",
11180                           drv->pending_remain_on_chan ?
11181                           "pending_remain_on_chan=1\n" : "",
11182                           drv->in_interface_list ? "in_interface_list=1\n" : "",
11183                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
11184                           drv->poll_command_supported ?
11185                           "poll_command_supported=1\n" : "",
11186                           drv->data_tx_status ? "data_tx_status=1\n" : "",
11187                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
11188                           drv->retry_auth ? "retry_auth=1\n" : "",
11189                           drv->use_monitor ? "use_monitor=1\n" : "",
11190                           drv->ignore_next_local_disconnect ?
11191                           "ignore_next_local_disconnect=1\n" : "",
11192                           drv->allow_p2p_device ? "allow_p2p_device=1\n" : "");
11193         if (res < 0 || res >= end - pos)
11194                 return pos - buf;
11195         pos += res;
11196
11197         if (drv->has_capability) {
11198                 res = os_snprintf(pos, end - pos,
11199                                   "capa.key_mgmt=0x%x\n"
11200                                   "capa.enc=0x%x\n"
11201                                   "capa.auth=0x%x\n"
11202                                   "capa.flags=0x%x\n"
11203                                   "capa.max_scan_ssids=%d\n"
11204                                   "capa.max_sched_scan_ssids=%d\n"
11205                                   "capa.sched_scan_supported=%d\n"
11206                                   "capa.max_match_sets=%d\n"
11207                                   "capa.max_remain_on_chan=%u\n"
11208                                   "capa.max_stations=%u\n"
11209                                   "capa.probe_resp_offloads=0x%x\n"
11210                                   "capa.max_acl_mac_addrs=%u\n"
11211                                   "capa.num_multichan_concurrent=%u\n",
11212                                   drv->capa.key_mgmt,
11213                                   drv->capa.enc,
11214                                   drv->capa.auth,
11215                                   drv->capa.flags,
11216                                   drv->capa.max_scan_ssids,
11217                                   drv->capa.max_sched_scan_ssids,
11218                                   drv->capa.sched_scan_supported,
11219                                   drv->capa.max_match_sets,
11220                                   drv->capa.max_remain_on_chan,
11221                                   drv->capa.max_stations,
11222                                   drv->capa.probe_resp_offloads,
11223                                   drv->capa.max_acl_mac_addrs,
11224                                   drv->capa.num_multichan_concurrent);
11225                 if (res < 0 || res >= end - pos)
11226                         return pos - buf;
11227                 pos += res;
11228         }
11229
11230         return pos - buf;
11231 }
11232
11233
11234 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
11235 {
11236         if (settings->head)
11237                 NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD,
11238                         settings->head_len, settings->head);
11239
11240         if (settings->tail)
11241                 NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL,
11242                         settings->tail_len, settings->tail);
11243
11244         if (settings->beacon_ies)
11245                 NLA_PUT(msg, NL80211_ATTR_IE,
11246                         settings->beacon_ies_len, settings->beacon_ies);
11247
11248         if (settings->proberesp_ies)
11249                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
11250                         settings->proberesp_ies_len, settings->proberesp_ies);
11251
11252         if (settings->assocresp_ies)
11253                 NLA_PUT(msg,
11254                         NL80211_ATTR_IE_ASSOC_RESP,
11255                         settings->assocresp_ies_len, settings->assocresp_ies);
11256
11257         if (settings->probe_resp)
11258                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP,
11259                         settings->probe_resp_len, settings->probe_resp);
11260
11261         return 0;
11262
11263 nla_put_failure:
11264         return -ENOBUFS;
11265 }
11266
11267
11268 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
11269 {
11270         struct nl_msg *msg;
11271         struct i802_bss *bss = priv;
11272         struct wpa_driver_nl80211_data *drv = bss->drv;
11273         struct nlattr *beacon_csa;
11274         int ret = -ENOBUFS;
11275
11276         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d)",
11277                    settings->cs_count, settings->block_tx,
11278                    settings->freq_params.freq);
11279
11280         if (!drv->channel_switch_supported) {
11281                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
11282                 return -EOPNOTSUPP;
11283         }
11284
11285         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
11286             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
11287                 return -EOPNOTSUPP;
11288
11289         /* check settings validity */
11290         if (!settings->beacon_csa.tail ||
11291             ((settings->beacon_csa.tail_len <=
11292               settings->counter_offset_beacon) ||
11293              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
11294               settings->cs_count)))
11295                 return -EINVAL;
11296
11297         if (settings->beacon_csa.probe_resp &&
11298             ((settings->beacon_csa.probe_resp_len <=
11299               settings->counter_offset_presp) ||
11300              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
11301               settings->cs_count)))
11302                 return -EINVAL;
11303
11304         msg = nlmsg_alloc();
11305         if (!msg)
11306                 return -ENOMEM;
11307
11308         nl80211_cmd(drv, msg, 0, NL80211_CMD_CHANNEL_SWITCH);
11309         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
11310         NLA_PUT_U32(msg, NL80211_ATTR_CH_SWITCH_COUNT, settings->cs_count);
11311         ret = nl80211_put_freq_params(msg, &settings->freq_params);
11312         if (ret)
11313                 goto error;
11314
11315         if (settings->block_tx)
11316                 NLA_PUT_FLAG(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX);
11317
11318         /* beacon_after params */
11319         ret = set_beacon_data(msg, &settings->beacon_after);
11320         if (ret)
11321                 goto error;
11322
11323         /* beacon_csa params */
11324         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
11325         if (!beacon_csa)
11326                 goto nla_put_failure;
11327
11328         ret = set_beacon_data(msg, &settings->beacon_csa);
11329         if (ret)
11330                 goto error;
11331
11332         NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
11333                     settings->counter_offset_beacon);
11334
11335         if (settings->beacon_csa.probe_resp)
11336                 NLA_PUT_U16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
11337                             settings->counter_offset_presp);
11338
11339         nla_nest_end(msg, beacon_csa);
11340         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
11341         if (ret) {
11342                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
11343                            ret, strerror(-ret));
11344         }
11345         return ret;
11346
11347 nla_put_failure:
11348         ret = -ENOBUFS;
11349 error:
11350         nlmsg_free(msg);
11351         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
11352         return ret;
11353 }
11354
11355
11356 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
11357         .name = "nl80211",
11358         .desc = "Linux nl80211/cfg80211",
11359         .get_bssid = wpa_driver_nl80211_get_bssid,
11360         .get_ssid = wpa_driver_nl80211_get_ssid,
11361         .set_key = driver_nl80211_set_key,
11362         .scan2 = driver_nl80211_scan2,
11363         .sched_scan = wpa_driver_nl80211_sched_scan,
11364         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
11365         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
11366         .deauthenticate = driver_nl80211_deauthenticate,
11367         .authenticate = driver_nl80211_authenticate,
11368         .associate = wpa_driver_nl80211_associate,
11369         .global_init = nl80211_global_init,
11370         .global_deinit = nl80211_global_deinit,
11371         .init2 = wpa_driver_nl80211_init,
11372         .deinit = driver_nl80211_deinit,
11373         .get_capa = wpa_driver_nl80211_get_capa,
11374         .set_operstate = wpa_driver_nl80211_set_operstate,
11375         .set_supp_port = wpa_driver_nl80211_set_supp_port,
11376         .set_country = wpa_driver_nl80211_set_country,
11377         .get_country = wpa_driver_nl80211_get_country,
11378         .set_ap = wpa_driver_nl80211_set_ap,
11379         .set_acl = wpa_driver_nl80211_set_acl,
11380         .if_add = wpa_driver_nl80211_if_add,
11381         .if_remove = driver_nl80211_if_remove,
11382         .send_mlme = driver_nl80211_send_mlme,
11383         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
11384         .sta_add = wpa_driver_nl80211_sta_add,
11385         .sta_remove = driver_nl80211_sta_remove,
11386         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
11387         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
11388         .hapd_init = i802_init,
11389         .hapd_deinit = i802_deinit,
11390         .set_wds_sta = i802_set_wds_sta,
11391         .get_seqnum = i802_get_seqnum,
11392         .flush = i802_flush,
11393         .get_inact_sec = i802_get_inact_sec,
11394         .sta_clear_stats = i802_sta_clear_stats,
11395         .set_rts = i802_set_rts,
11396         .set_frag = i802_set_frag,
11397         .set_tx_queue_params = i802_set_tx_queue_params,
11398         .set_sta_vlan = driver_nl80211_set_sta_vlan,
11399         .sta_deauth = i802_sta_deauth,
11400         .sta_disassoc = i802_sta_disassoc,
11401         .read_sta_data = driver_nl80211_read_sta_data,
11402         .set_freq = i802_set_freq,
11403         .send_action = driver_nl80211_send_action,
11404         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
11405         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
11406         .cancel_remain_on_channel =
11407         wpa_driver_nl80211_cancel_remain_on_channel,
11408         .probe_req_report = driver_nl80211_probe_req_report,
11409         .deinit_ap = wpa_driver_nl80211_deinit_ap,
11410         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
11411         .resume = wpa_driver_nl80211_resume,
11412         .send_ft_action = nl80211_send_ft_action,
11413         .signal_monitor = nl80211_signal_monitor,
11414         .signal_poll = nl80211_signal_poll,
11415         .send_frame = nl80211_send_frame,
11416         .shared_freq = wpa_driver_nl80211_shared_freq,
11417         .set_param = nl80211_set_param,
11418         .get_radio_name = nl80211_get_radio_name,
11419         .add_pmkid = nl80211_add_pmkid,
11420         .remove_pmkid = nl80211_remove_pmkid,
11421         .flush_pmkid = nl80211_flush_pmkid,
11422         .set_rekey_info = nl80211_set_rekey_info,
11423         .poll_client = nl80211_poll_client,
11424         .set_p2p_powersave = nl80211_set_p2p_powersave,
11425         .start_dfs_cac = nl80211_start_radar_detection,
11426         .stop_ap = wpa_driver_nl80211_stop_ap,
11427 #ifdef CONFIG_TDLS
11428         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
11429         .tdls_oper = nl80211_tdls_oper,
11430 #endif /* CONFIG_TDLS */
11431         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
11432         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
11433         .get_survey = wpa_driver_nl80211_get_survey,
11434         .status = wpa_driver_nl80211_status,
11435         .switch_channel = nl80211_switch_channel,
11436 };